TCP/IP Model: Layers and Responsibilities

Choosing Our Map: The 5-Layer TCP/IP Model

As we briefly touched on last time, you'll encounter different versions of the TCP/IP model. The original model had four layers, but modern networking education and many real-world tools often use a five-layer "hybrid" model. This model is more descriptive because it splits the bottom layer into two, aligning more closely with the physical hardware. For our practical purposes, this five-layer model is the most useful.

Let's start with a video that clarifies this distinction and introduces the model we'll be using.

To summarize the video's key point: while several models exist, we will focus on this five-layer TCP/IP model as our primary framework.

The Five Layers and Their Responsibilities

Now, let's get a formal definition for each layer. The following reading provides a concise, high-level overview of each layer's main job.

This gives us our roadmap. Now, let's explore each of these layers in more detail, connecting them to the data they handle. A fantastic way to do this is to see how a tool like Wireshark—which you'll use extensively later—organizes captured data according to these layers.

The following reading explains how to interpret a captured packet by looking at the information added by each layer.

Building on those readings, let's walk through the layers from bottom to top, synthesizing what we've learned.

Layer 1: The Physical Layer

• Core Responsibility: Transmitting raw bits (1s and 0s) as physical signals.
• What it does: This layer is all about the physics of communication. It defines the characteristics of the hardware that carries the signal. It answers questions like:
  • Is the medium copper wire, fiber optic cable, or air?
  • If it's a wire, what voltage represents a 1 and what represents a 0?
  • If it's fiber, what wavelength of light is used?
  • If it's wireless, what radio frequency is used?
• In Wireshark: The "Frame" section shows details like the arrival time and total size of the bitstream that was received over the physical medium.
• Examples: Ethernet cables, Wi-Fi radio transceivers, fiber optic cables, specifications for connectors like RJ45.

Layer 2: The Data Link Layer

• Core Responsibility: Transferring data between devices on the same local network.
• What it does: This layer manages communication on a single network segment (like all the devices connected to your home Wi-Fi router). Its main jobs are:
  1. Framing: It takes packets from the Network Layer and wraps them in a "frame."
  2. Physical Addressing: It uses MAC addresses (Media Access Control addresses)—unique hardware identifiers burned into every network interface card (NIC)—to specify the source and destination devices on the local network.
  3. Error Checking: It often includes a checksum (called a Frame Check Sequence) to detect if the data was corrupted during physical transmission.
• In Wireshark: The "Ethernet II" section shows the source and destination MAC addresses.
• Key Idea: The Data Link layer is concerned with the next hop. If you're sending data to a server on the internet, the Layer 2 destination is not the final server, but your local router.

Layer 3: The Network Layer (or Internet Layer)

• Core Responsibility: Transferring data between different networks; i.e., routing.
• What it does: This is the layer that makes the internet work. It's responsible for moving packets across potentially vast and complex networks.
  1. Logical Addressing: It uses IP addresses (Internet Protocol addresses) to identify the original source and final destination hosts anywhere in the world. Unlike MAC addresses, IP addresses are logical and can change depending on which network you're connected to.
  2. Routing: It determines the best path for a packet to take to get from its source to its destination. This is the primary job of routers.
• In Wireshark: The "Internet Protocol" section shows the source and destination IP addresses.
• Key Idea: This layer provides a global addressing scheme that allows any device on the internet to send a packet to any other device, regardless of the local network technologies used along the way.

Layer 4: The Transport Layer

• Core Responsibility: Providing end-to-end communication between processes on hosts.
• What it does: While the Network Layer gets data from host A to host B, the Transport Layer gets data from a specific application on host A (like your web browser) to a specific application on host B (like the web server software).
  1. Process Identification: It uses port numbers to direct data to the correct application on a host. For example, web traffic (HTTP) usually goes to port 80, while secure web traffic (HTTPS) goes to port 443.
  2. Choice of Service: It offers two main protocols:
     • TCP (Transmission Control Protocol): A reliable, connection-oriented protocol. It's like a phone call: it establishes a connection, ensures all data arrives in the correct order, and re-sends anything that gets lost. Used for web browsing, email, and file transfers.
     • UDP (User Datagram Protocol): An unreliable, connectionless protocol. It's like sending a postcard: it sends the data and hopes for the best, with no guarantees of delivery or order. Used for DNS, video streaming, and online gaming where speed is more critical than perfect reliability.
• In Wireshark: The "Transmission Control Protocol" or "User Datagram Protocol" section shows the source and destination port numbers, as well as protocol-specific details like TCP sequence numbers.

Layer 5: The Application Layer

• Core Responsibility: Providing network services directly to user applications.
• What it does: This is the layer you interact with most directly. It contains the protocols that applications use to communicate over the network. It defines the rules and formats for specific tasks.
• In Wireshark: The "Hypertext Transfer Protocol" or "Domain Name System" section shows the actual application data, like an HTTP GET request for a webpage or a DNS query for an IP address.
• Examples:
  • HTTP/HTTPS: For the World Wide Web.
  • DNS: For translating domain names (like google.com) into IP addresses.
  • SMTP: For sending email.
  • SSH: For secure remote login.

Where Do the Layers Live? A Computer Science Perspective

Given your background in operating systems and C programming, it's useful to map these abstract layers to where they are actually implemented in a typical computer system. This will be highly relevant when we get to socket programming.

This mapping is crucial:

• Application Layer: Runs in user space. This is where your C programs will run. They use the socket API to talk to the kernel.
• Transport & Network Layers: Implemented inside the operating system kernel. The kernel handles TCP/UDP and IP logic, providing services to user-space applications. This ensures that network functionality is managed centrally and securely by the OS.
• Data Link & Physical Layers: A mix of OS (device drivers) and hardware (Network Interface Card - NIC). The NIC firmware and hardware handle the low-level tasks of creating frames and sending signals.

This division of labor is a classic OS design pattern, separating user-level processes from privileged kernel operations and hardware interaction.

Conclusion

We've now put names and responsibilities to the layers of the internet's core architecture. This framework is not just academic; it's the mental model every network professional uses to build, manage, and troubleshoot networks.

Key Takeaways:

• We use a 5-layer TCP/IP model: Physical, Data Link, Network, Transport, and Application.
• Physical Layer (L1): Transmits bits as signals over a medium.
• Data Link Layer (L2): Handles local delivery on the same network using MAC addresses.
• Network Layer (L3): Handles global delivery between networks using IP addresses and routing.
• Transport Layer (L4): Manages process-to-process communication using port numbers and provides either reliability (TCP) or speed (UDP).
• Application Layer (L5): Defines protocols (like HTTP, DNS) for user applications.
• These layers are implemented across user space, the OS kernel, and hardware NICs.

Preview of the Next Lesson:

Now that we know what the layers are, the next logical question is: how does data actually move between them? In the next lesson, we will explore data encapsulation, the process of how each layer adds its own header to the data as it travels down the stack, preparing it for transmission across the network.