TCP/IP Complete Guide: From Basics to Application Layer

Overview

Introduction to the fundamental protocol suite that powers the internet and most private networks.

TCP/IP (Transmission Control Protocol / Internet Protocol) is the fundamental communication protocol suite of the internet and most private networks. It defines how data is packaged, addressed, transmitted, routed, and received across networks.

This single comprehensive tutorial covers all 9 topics — TCP/IP Introduction, Network Interface Layer, Internet Layer, Transport Layer, TCP, UDP, Ports, Sockets, and the Application Layer.

Table of Contents

• TCP/IP Introduction
  • What is TCP/IP?
  • A Brief History
  • The 4-Layer TCP/IP Stack
  • Encapsulation — How Data Flows
  • TCP/IP vs OSI Model
  • IPv4 vs IPv6 — Quick Look
• Network Interface Layer
  • What is the Network Interface Layer?
    • Key Responsibilities
  • Physical Layer — Transmission Media
  • Data Link Layer — MAC Addresses & Ethernet Frames
    • MAC Addresses
    • Ethernet Frame Structure
    • CSMA/CD
  • Common Network Technologies
  • ARP — Address Resolution Protocol
    • How ARP Works
    • ARP Table
  • MTU and Fragmentation
• Internet Layer
  • What is the Internet Layer?
    • Key Responsibilities
  • IPv4 Header Structure
  • IPv4 Addressing
    • Private IP Address Ranges
  • Subnetting & CIDR
  • IPv6 — The Future
  • Routing — How Packets Travel
    • Direct vs Indirect Delivery
    • Routing Table
    • Hop-by-Hop Routing
  • ICMP — Ping & Traceroute
  • NAT — Network Address Translation
• Transport Layer — Ports & Sockets
  • What is the Transport Layer?
    • Two Protocols
    • Key Responsibilities
  • Port Numbers
    • Port Ranges
    • Common Well-Known Ports
    • How Ports Work in Practice
    • Checking Ports on Your System
  • Understanding Sockets
    • Socket Tuple
    • Socket Types
    • Socket Programming Flow
  • The Client-Server Model
  • Port Forwarding & NAT Traversal
• TCP — Transmission Control Protocol
  • TCP Segment Structure
  • The Three-Way Handshake
  • Connection Termination
  • Reliable Data Delivery
    • Sequence Numbers & Acknowledgments
    • Retransmission (RTO)
    • Fast Retransmit
  • Flow Control — Sliding Window
  • Congestion Control
    • Slow Start
    • Congestion Avoidance
    • Fast Recovery
    • Modern Congestion Algorithms
• UDP — User Datagram Protocol
  • UDP Segment Structure
  • How UDP Works
  • Where UDP is Used
    • Example: DNS over UDP
    • Example: VoIP over UDP
  • TCP vs UDP — Complete Comparison
    • When to Choose Which
  • Building Reliability on Top of UDP
• Application Layer
  • What is the Application Layer?
    • How It Works
  • HTTP & HTTPS
    • HTTP Request-Response
    • HTTP Methods
    • HTTP Status Codes
    • HTTPS — HTTP Over TLS
    • HTTP/2 and HTTP/3
  • DNS — Domain Name System
    • Resolution Process
    • DNS Record Types
    • DNS Hierarchy
  • DHCP — Dynamic Host Configuration Protocol
    • DORA Process
  • Email Protocols — SMTP, POP3, IMAP
    • How Email Flows
    • SMTP — Sending Email
    • POP3 vs IMAP
  • SSH & Remote Access
  • FTP & File Transfer
  • Other Important Application Protocols
  • Application Layer Security
• Final Summary
• Practical Exercises
  • Exercise 1: Identify the Layer
  • Exercise 2: Read an Ethernet Frame & Routing Table
  • Exercise 3: Analyze a TCP Handshake
  • Exercise 4: TCP or UDP?
  • Exercise 5: Identify the Protocol
  • Exercise 6: HTTP Status Codes

TCP/IP Introduction

Introduction to the TCP/IP protocol suite — its definition, history, 4-layer stack, and how data flows through it.

What is TCP/IP?

Defines the core protocol suite that powers all internet communication.

TCP/IP is a suite of communication protocols used to interconnect network devices. It is named after its two most important protocols:

A Brief History

Timeline of TCP/IP's evolution from ARPANET to the global internet standard.

Why was TCP/IP created? The U.S. Department of Defense needed a robust, decentralized network that could survive partial outages — if one route was destroyed, packets would automatically find another path.

The 4-Layer TCP/IP Stack

Explains the four layers (Network Interface, Internet, Transport, Application) that organize network communication.

TCP/IP is organized into 4 layers, each with a specific job:

 ┌─────────────────────────────────────────────┐
 │            Application Layer                │  ← HTTP, DNS, SMTP, FTP, SSH
 ├─────────────────────────────────────────────┤
 │             Transport Layer                 │  ← TCP, UDP
 ├─────────────────────────────────────────────┤
 │              Internet Layer                 │  ← IP, ICMP, ARP
 ├─────────────────────────────────────────────┤
 │         Network Interface Layer             │  ← Ethernet, Wi-Fi, Fiber
 └─────────────────────────────────────────────┘

Encapsulation — How Data Flows

Shows how each layer adds its own header as data travels down the protocol stack.

When an application sends data, it travels down the stack, and each layer adds its own header:

[Application]                     Data (e.g., HTTP request)
       │
       ▼
[Transport]    +─────────+──────────────────────────────+
               | TCP hdr |          Data                |
               +─────────+──────────────────────────────+
       │
       ▼
[Internet]     +──+─────────+──────────────────────────────+
               |IP| TCP hdr |          Data                |
               +──+─────────+──────────────────────────────+
       │
       ▼
[Network]      +──+──+─────────+──────────────────────────────+
               |Eth|IP| TCP hdr |          Data               |
               +──+──+─────────+──────────────────────────────+
       │
       ▼      Physical bits on the wire/air

At the receiving end, each layer strips its header and passes the payload up (decapsulation).

TCP/IP vs OSI Model

Compares the 4-layer TCP/IP model with the 7-layer OSI reference model.

Key difference: TCP/IP combines OSI's top 3 layers into Application Layer, and bottom 2 into Network Interface Layer.

IPv4 vs IPv6 — Quick Look

Compares the two IP versions — address size, format, and features.

Network Interface Layer

The lowest layer handling physical data transmission, MAC addressing, Ethernet framing, and ARP resolution.

What is the Network Interface Layer?

The lowest TCP/IP layer responsible for physical data transmission and local network addressing.

The Network Interface Layer (Link Layer or Network Access Layer) is the lowest layer. It handles the physical transmission of data and local network addressing.

Analogy: If the Internet Layer is the postal service, the Network Interface Layer is the mail truck, the roads, and the wheels.

Key Responsibilities

Core functions of the Network Interface Layer — framing, MAC addressing, error detection, media access control.

Physical Layer — Transmission Media

The hardware medium (copper, fiber, radio) that carries raw bits as signals across the network.

Signaling: Electrical (voltage changes on copper), Optical (light on/off in fiber), Radio (modulated radio waves)

Data Link Layer — MAC Addresses & Ethernet Frames

Manages local addressing via MAC addresses and formats data into Ethernet frames.

MAC Addresses

Unique 48-bit hardware identifiers burned into each network interface card.

A MAC address is a 48-bit hardware address burned into every NIC:

Format:  XX:XX:XX:YY:YY:YY
Example: 00:1A:2B:3C:4D:5E

Ethernet Frame Structure

Format of data packets at the link layer — preamble, MAC addresses, EtherType, payload, and FCS.

 ┌────────┬────────┬──────────┬────────────┬───────────────┬──────────┬──────────┐
 │Preamble│ SFD    │Dest MAC  │Source MAC  │  EtherType    │  Payload │   FCS    │
 │ 7 bytes│ 1 byte │ 6 bytes  │ 6 bytes    │  2 bytes      │46-1500 B │ 4 bytes  │
 └────────┴────────┴──────────┴────────────┴───────────────┴──────────┴──────────┘

CSMA/CD

Legacy collision detection protocol used in classic shared Ethernet (hub-based) networks.

In classic Ethernet (hubs), CSMA/CD prevents collisions:

1. Carrier Sense — Listen before sending
2. Multiple Access — Many devices share the medium
3. Collision Detection — If collision occurs, both stop, wait random time, retry

Modern switched Ethernet does not use CSMA/CD — each device has a dedicated switch port.

Common Network Technologies

Popular Ethernet and Wi-Fi standards with their speeds, cable types, and generations.

Ethernet:

Wi-Fi (802.11):

ARP — Address Resolution Protocol

Protocol that maps IP addresses to MAC addresses on the same local network.

ARP maps IP addresses to MAC addresses on the same local network.

How ARP Works

Broadcast-request and unicast-reply process for resolving a device's MAC address from its IP address.

1. Device A wants to send to 192.168.1.10 on the same network
2. Device A checks its ARP cache — if no entry, it broadcasts an ARP request:
   • "Who has 192.168.1.10? Tell AA:AA:AA:AA:AA:AA" (broadcast to FF:FF:FF:FF:FF:FF)
3. Device B (192.168.1.10) responds with an ARP reply (unicast):
   • "I have 192.168.1.10. My MAC is BB:BB:BB:BB:BB:BB"
4. Device A stores the mapping and sends data

[Device A]         [Device B]
  │─── ARP Request (Broadcast) ──→│  "Who has 192.168.1.10?"
  │←── ARP Reply (Unicast) ──────│  "I do. MAC = BB:BB:BB:BB:BB:BB"
  │─── Data Frame ───────────────→│  With correct destination MAC

Security risk: ARP has no authentication — attackers can send fake replies (ARP Spoofing).

ARP Table

Local cache of resolved IP-to-MAC address mappings maintained by each host.

$ arp -a
Interface: 192.168.1.5
  Internet Address    Physical Address      Type
  192.168.1.1         00:14:22:ab:cd:01     dynamic
  192.168.1.10        bb:bb:bb:bb:bb:bb    dynamic

MTU and Fragmentation

Maximum frame payload size (MTU) and how larger packets are split into smaller pieces for transmission.

MTU (Maximum Transmission Unit) = maximum payload size per frame:

If an IP packet exceeds the link's MTU, it is fragmented into smaller pieces.

Internet Layer

The layer responsible for logical IP addressing, routing across networks, ICMP diagnostics, and NAT translation.

What is the Internet Layer?

The layer responsible for logical addressing (IP) and routing packets across multiple networks.

The Internet Layer is the heart of TCP/IP. It handles logical addressing and routing — getting packets from any source to any destination across multiple networks.

Analogy: The Internet Layer is the postal system. You write an address on an envelope (IP address), and routers figure out how to get it there.

Key Responsibilities

Core functions of the Internet Layer — IP addressing, routing, forwarding, fragmentation, and ICMP error reporting.

IPv4 Header Structure

The 20-60 byte header format showing all fields — version, TTL, protocol, source/destination IP, and more.

 0               1               2               3
├─────┬─────┬───────────┬──────┬──────────────────────────────────┤
│Vers │ IHL │   DSCP    │  TL  │       Total Length (16)          │
├─────┴─────┴───────────┴──────┴──────────────────────────────────┤
│          Identification (16)     │Flags│   Fragment Offset (13) │
├─────────────────────────────────┴─────┴─────────────────────────┤
│     Time to Live (8)    │   Protocol (8)    │   Header Checksum │
├─────────────────────────────────────────────────────────────────┤
│                    Source IP Address (32)                       │
├─────────────────────────────────────────────────────────────────┤
│                  Destination IP Address (32)                    │
└─────────────────────────────────────────────────────────────────┘

IPv4 Addressing

32-bit dotted-decimal addresses (e.g., 192.168.1.10) identifying hosts and their networks.

An IPv4 address is a 32-bit number in dotted decimal:

Binary:      11000000 10101000 00000001 00001010
Decimal:     192.168.1.10

Each address has two parts separated by the subnet mask:

Private IP Address Ranges

Reserved IP ranges for internal network use — not routable on the public internet.

Special addresses:

• 127.0.0.1 — Loopback (localhost)
• 0.0.0.0 — Default route / "any address"
• 169.254.x.x — APIPA (auto-config when DHCP fails)

Subnetting & CIDR

Method for dividing IP networks using prefix-length notation (e.g., /24) to calculate host capacity.

CIDR notation: IP/prefix_length (e.g., 192.168.1.0/24)

Available hosts: 2^(32 - prefix) - 2

IPv6 — The Future

128-bit addressing scheme replacing IPv4 with a simpler header and vastly more address space.

IPv6 uses 128-bit addresses and has a simpler header (40 bytes fixed, no checksum, no fragmentation by routers).

Full:     2001:0db8:85a3:0000:0000:8a2e:0370:7334
Short:    2001:db8:85a3::8a2e:370:7334
Loopback: ::1

Shortening rules:

1. Leading zeros in a group can be omitted: 0370 → 370
2. One or more consecutive all-zero groups replaced with :: (use only once)

IPv6 address types:

Routing — How Packets Travel

Process of forwarding packets across networks through routers using routing tables.

Direct vs Indirect Delivery

Same-network direct delivery vs cross-network delivery requiring a router.

Routing Table

A table in routers and hosts listing destination networks, gateways, and interfaces for packet forwarding.

Every router (and host) has a routing table:

Destination     Netmask          Gateway         Interface
0.0.0.0         0.0.0.0          192.168.1.1     eth0    (Default route)
192.168.1.0     255.255.255.0    0.0.0.0         eth0    (Local network)
10.0.0.0        255.255.255.0    192.168.1.10    eth0    (Via router)

• Default route (0.0.0.0/0): everything else goes to the gateway
• Local network: directly reachable
• Specific routes: forwarded to next-hop routers

Hop-by-Hop Routing

Each router forwards to the next hop without knowing the full path to the destination.

[Host A] ──── [Router 1] ──── [Router 2] ──── [Server B]
   │         192.168.1.1       10.0.0.1        198.51.100.1
192.168.1.50

Each router only knows the next hop, not the entire path.

ICMP — Ping & Traceroute

Protocol for error reporting and network diagnostics — used by ping and traceroute tools.

ICMP (Internet Control Message Protocol) is used for error reporting and diagnostics.

Ping tests reachability and measures round-trip time:

$ ping google.com
64 bytes from 142.250.80.4: icmp_seq=0 ttl=116 time=12.3 ms

--- google.com ping statistics ---
3 packets transmitted, 3 received, 0% packet loss

Traceroute maps the path by sending packets with increasing TTL:

$ traceroute google.com
 1  192.168.1.1       1.2 ms
 2  10.0.0.1          3.1 ms
 3  203.0.113.1       8.4 ms
 4  142.250.80.4     12.8 ms

NAT — Network Address Translation

Maps multiple private IP addresses to a single public IP address for internet access.

NAT allows multiple private devices to share a single public IP:

Internal: 192.168.1.10:55000
                 │
                 ▼
NAT Table: 192.168.1.10:55000 ↔ 100.50.25.10:32000
                 │
                 ▼
External: 100.50.25.10:32000 → Internet

NAT is used in virtually every home/office router. It also provides basic security by hiding internal IPs.

Transport Layer — Ports & Sockets

The layer providing end-to-end application communication via port numbers, sockets, and the client-server model.

What is the Transport Layer?

Provides end-to-end communication between applications on different hosts using TCP or UDP.

The Transport Layer provides end-to-end communication between application processes on different hosts. While the Internet Layer (IP) delivers data between hosts, the Transport Layer delivers it to specific applications.

 Host A                      Host B
┌─────────┐                 ┌─────────┐
│ Browser │                 │ Web Svr │  ← Applications
├─────────┤                 ├─────────┤
│  TCP    │──── Network ───→│  TCP    │  ← Transport Layer (app-to-app)
├─────────┤                 ├─────────┤
│   IP    │                 │   IP    │  ← Internet Layer (host-to-host)
└─────────┘                 └─────────┘

Two Protocols

Overview of TCP (reliable, connection-oriented) and UDP (fast, connectionless).

Key Responsibilities

Core transport functions — multiplexing, port addressing, segmentation, reassembly, and error detection.

Port Numbers

16-bit identifiers (0-65535) that distinguish different applications and services on a host.

A port is a 16-bit number (0–65535) that identifies a specific application on a host.

Analogy: IP address = building address. Port number = apartment door in that building.

Port Ranges

Three categories of ports — well-known (0-1023), registered (1024-49151), and ephemeral (49152-65535).

Common Well-Known Ports

Standard port assignments for popular network services like SSH, HTTP, DNS, and HTTPS.

How Ports Work in Practice

Real example of how source and destination ports identify a connection between a browser and a server.

Browser: 192.168.1.5:49152  ←──→  Google: 142.250.80.4:443
             ↑  ↑                      ↑   ↑
           IP  Port                  IP  Port
         (host) (app)             (host) (app)

The combination (Source IP, Source Port, Dest IP, Dest Port) uniquely identifies every connection on the internet.

Checking Ports on Your System

Commands to view listening services and active connections using netstat.

# Linux/macOS
$ netstat -tln
Proto Recv-Q Local Address    Foreign Address   State
tcp        0 0.0.0.0:22       0.0.0.0:*         LISTEN
tcp        0 0.0.0.0:80       0.0.0.0:*         LISTEN
tcp        0 0.0.0.0:443      0.0.0.0:*         LISTEN

# Windows
C:\> netstat -an
Proto  Local Address        Foreign Address      State
TCP    0.0.0.0:135          0.0.0.0:0            LISTENING
TCP    192.168.1.5:49152    93.184.216.34:80     ESTABLISHED

Ephemeral port ranges by OS: Linux (32768–60999), Windows/macOS (49152–65535)

Understanding Sockets

Software endpoints that applications use to send and receive data over a network.

A socket is a software endpoint for network communication — the programming interface that applications use to send and receive data.

Socket Tuple

The 5-element set (protocol, source IP, source port, destination IP, destination port) uniquely identifying each connection.

A connection is identified by a 5-tuple:

{ Protocol, Source IP, Source Port, Dest IP, Dest Port }
{ TCP,      192.168.1.5, 49152,     93.184.216.34, 80     }

Socket Types

Stream sockets for TCP, datagram sockets for UDP, and raw sockets for direct IP access.

Socket Programming Flow

API call sequence for establishing TCP and UDP communication between client and server.

TCP Server:                     TCP Client:
  socket()                        socket()
  bind(port=80)                   connect(server_ip, 80)
  listen()                        send()/recv()
  accept() → new_socket           close()
  send()/recv()
  close()

UDP Server:                     UDP Client:
  socket()                        socket()
  bind(port=5353)                 sendto(data, server_ip, port)
  recvfrom(buffer)                recvfrom(buffer)
  sendto(response, client)

The Client-Server Model

Architecture where clients (using ephemeral ports) request services from servers (listening on well-known ports).

Client                           Server
  │                                │
  │  Chooses ephemeral port       │  Binds to well-known port (e.g., 80)
  │  (e.g., 49152)                │  Listens for connections
  │                                │
  │──── Connection Request ──────→│
  │←── Connection Accepted ──────│
  │════════ Data Transfer ═══════│
  │──── Close ──────────────────→│

A server can handle many clients simultaneously via threads or async I/O:

Server
├── Port 80 (listening)
├── Client 1: 192.168.1.10:49152  (thread A)
├── Client 2: 10.0.0.5:53000      (thread B)
└── Client 3: 203.0.113.8:60001   (thread C)

Port Forwarding & NAT Traversal

Techniques for accessing services behind NAT — port forwarding, UPnP, STUN, TURN, and ICE.

Port Forwarding allows external access to internal servers behind NAT:

Internet → Router (100.50.25.10:8080) → Internal Server (192.168.1.100:80)

NAT Traversal techniques:

TCP — Transmission Control Protocol

Reliable, connection-oriented protocol that guarantees delivery, ordering, and data integrity.

TCP is a reliable, connection-oriented protocol that guarantees delivery, ordering, and data integrity.

TCP Segment Structure

The 20-60 byte TCP header format showing source/dest ports, sequence numbers, flags, and window size.

 0               1               2               3
├────────────────────────┬────────────────────────────────────────┤
│        Source Port (16)            │    Destination Port (16)   │
├───────────────────────────────────┴─────────────────────────────┤
│                      Sequence Number (32)                       │
├─────────────────────────────────────────────────────────────────┤
│                   Acknowledgment Number (32)                    │
├──────────┬────┬──────────┬──────────┬───────────────────────────┤
│ Data Off │Rsvd│ Flags (9)│         Window Size (16)             │
├──────────┴────┴──────────┴──────────┴───────────────────────────┤
│         TCP Checksum (16)          │      Urgent Pointer (16)   │
└─────────────────────────────────────────────────────────────────┘

TCP Flags:

The Three-Way Handshake

Three-step process (SYN, SYN-ACK, ACK) that establishes a TCP connection between client and server.

Before data transfer, a connection must be established:

Client                          Server
  │                               │
  │────── SYN (Seq=100) ────────→│  Step 1: Client requests connection
  │                               │
  │←── SYN-ACK (Seq=300, Ack=101)│  Step 2: Server responds & ACKs
  │                               │
  │────── ACK (Seq=101, Ack=301) ─→│  Step 3: Client ACKs
  │═══════════════════════════════│  Connection Established!
  │←────── Data Transfer ────────→│

Why three steps? To synchronize both sides' sequence numbers and confirm both parties are ready.

Connection Termination

Four-step graceful close (FIN, ACK, FIN, ACK) where each direction closes independently.

Client                          Server
  │────── FIN (Seq=X) ──────────→│  "I'm done sending"
  │←── ACK (Ack=X+1) ───────────│  "Got it"
  │←── FIN (Seq=Y) ─────────────│  "I'm done too"
  │────── ACK (Ack=Y+1) ────────→│  "Got it"
  │          Connection Closed    │

TCP connections are full-duplex — each direction closes independently.

Reliable Data Delivery

Mechanisms ensuring TCP data arrives intact, complete, and in the correct order.

Sequence Numbers & Acknowledgments

Byte tracking system where every byte has a sequence number and the receiver ACKs the next expected byte.

Every byte has a sequence number. The receiver acknowledges the next expected byte:

Client sends:   Seq=101, Data=500 bytes  →  Bytes 101-600
Server ACKs:    Ack=601                  →  "Received 101-600, expect 601 next"

Normal flow:
  Client                          Server
    │──── Seq=101 (500 bytes) ────→│
    │←── Ack=601 ─────────────────│
    │──── Seq=601 (500 bytes) ────→│
    │←── Ack=1101 ────────────────│

Retransmission (RTO)

Timer-based retransmission — if an ACK isn't received before the adaptive timeout (RTO), the segment is resent.

If an ACK isn't received before the timer expires:

Client                          Server
  │──── Seq=101 (500 bytes) ────→│  Packet LOST!
  │         ⏱ Timer expires      │
  │──── Seq=101 (500 bytes) ────→│  Retransmitted!
  │←── Ack=601 ─────────────────│  Received now

RTO is adaptive: RTO = RTT + 4 × RTT_variation (exponential backoff on repeated loss).

Fast Retransmit

Immediate retransmission triggered by three duplicate ACKs — no need to wait for timeout.

Instead of waiting for timeout, 3 duplicate ACKs trigger immediate retransmission:

Client                          Server
  │──── Seq=101 ────────────────→│
  │──── Seq=601 ────────────────→│  LOST!
  │──── Seq=1101 ───────────────→│
  │←── Ack=601 ─────────────────│  Duplicate (expecting 601)
  │←── Ack=601 ─────────────────│  Duplicate
  │←── Ack=601 ─────────────────│  Duplicate (3rd = FAST RETRANSMIT)
  │──── Seq=601 ────────────────→│  Sent immediately!
  │←── Ack=1601 ────────────────│  "Now I have everything"

Flow Control — Sliding Window

Receiver-driven mechanism where the window size field prevents buffer overflow by controlling how much data the sender can transmit.

The receiver advertises a Window Size — the amount of data it can accept:

Sender's perspective:
◀══════ Sent & ACKed ══════▶◀── Window (can send) ──▶◀── Can't send yet ──▶

As the receiver reads data from its buffer, the window opens, allowing more data:

Sender                      Receiver
  │──── Seq 101-1100 ────────→│  Window=10000
  │──── Seq 1101-2100 ───────→│  Window shrinks to 8000
  │                           │  Receiver reads data
  │←── Ack=3101, Window=10000─│  Window opens again

Zero Window: If the receiver's buffer fills up, Window=0. The sender probes periodically to check if space is available.

Congestion Control

Algorithms (slow start, congestion avoidance, fast recovery) that prevent TCP from overloading the network.

TCP prevents network overload with these algorithms:

Slow Start

Exponential increase of sending rate — begins with 1 segment and doubles each RTT until reaching the threshold.

Begin with 1 segment, double each RTT: 1 → 2 → 4 → 8 → 16 → ... (until threshold)

Congestion Avoidance

Linear window increase after reaching the slow start threshold — adds 1 segment per RTT.

After the slow start threshold (ssthresh), increase by 1 segment per RTT (linear growth).

Fast Recovery

When loss is detected via 3 duplicate ACKs, the congestion window is halved without returning to slow start.

When loss is detected (3 duplicate ACKs):

1. Halve the congestion window and ssthresh
2. Continue congestion avoidance from there (don't restart from 1)

This is AIMD (Additive Increase, Multiplicative Decrease) :

• Success: window +1 per RTT
• Loss: window ÷ 2

Modern Congestion Algorithms

CUBIC (default on Linux), BBR (Google's model-based), and Reno (classic AIMD) implementations.

UDP — User Datagram Protocol

Connectionless, unreliable protocol optimized for speed and low overhead.

UDP is a connectionless, unreliable protocol focused on speed and low overhead.

UDP Segment Structure

The 8-byte fixed header format with only four fields — source port, dest port, length, and checksum.

 0               1               2               3
├────────────────────────┬─────────────────────────────────────────┤
│        Source Port (16)            │    Destination Port (16)    │
├───────────────────────────────────┴──────────────────────────────┤
│            Length (16)              │         Checksum (16)      │
├──────────────────────────────────────────────────────────────────┤
│                          Data (payload)                          │
└──────────────────────────────────────────────────────────────────┘

Total UDP header: 8 bytes (vs TCP's minimum 20 bytes).

Maximum UDP payload: 65535 - 8 (UDP header) - 20 (IP header) = 65507 bytes, but typically limited by MTU (1500 bytes).

How UDP Works

Connectionless communication — no handshake, no ACKs, no retransmission, no flow or congestion control.

Connectionless: No handshake — send immediately:

Client                          Server
  │──── Data (no handshake!) ────→│  Immediate!
  │──── More data ───────────────→│  No setup needed

No ACKs, no retransmission, no flow control, no congestion control. UDP sends as fast as the application provides data.

Checksum: Optional in IPv4, mandatory in IPv6. Covers a pseudo-header (IP addresses) + UDP data.

Where UDP is Used

Real-world applications that benefit from UDP's speed and simplicity — DNS, DHCP, VoIP, gaming, streaming.

Example: DNS over UDP

Quick query-response exchange without handshake overhead — lost queries are retried by the application.

Client                          DNS Server
  │── UDP Query ─────────────────→│  "IP of google.com?"
  │←── UDP Response ─────────────│  "142.250.80.4"  (~20ms total)

If the query is lost, the application simply retries.

Example: VoIP over UDP

Real-time voice transmission where small packet losses are acceptable but low latency is critical.

Sender                          Receiver
  │── RTP (20ms audio) ──────────→│
  │── RTP (20ms audio) ──────────→│  LOST — tiny glitch, no retransmit
  │── RTP (20ms audio) ──────────→│

Retransmitting old audio doesn't help in a real-time call.

TCP vs UDP — Complete Comparison

Side-by-side comparison of features — connection, reliability, ordering, flow control, header size, and use cases.

When to Choose Which

Decision guide — TCP when reliability matters, UDP when speed is critical.

Building Reliability on Top of UDP

Modern protocols like QUIC (HTTP/3) that add reliability features on top of UDP for better performance.

Modern protocols often build reliability on top of UDP for better performance:

QUIC (Quick UDP Internet Connections) — the foundation of HTTP/3:

Other protocols that build on UDP: WebRTC, WireGuard VPN, DNS (with client retry), custom game server protocols.

Application Layer

The topmost layer providing network services to users — HTTP, DNS, DHCP, SMTP, SSH, and more.

What is the Application Layer?

The topmost TCP/IP layer providing network services directly to user applications.

The Application Layer is the topmost layer — where network protocols meet user applications. It provides services we interact with daily: web pages, email, file transfers, domain names, and remote access.

Analogy: Lower layers are the highway, GPS, and truck. The Application Layer is the actual cargo being delivered.

How It Works

Client-server model where clients request services from servers using text-based, binary, or structured message formats.

Most application protocols follow the client-server model:

Browser ── HTTP request ──→ Web Server
Email Client ── SMTP ─────→ Mail Server
SSH Client ── SSH ────────→ Remote Server
DNS Resolver ── DNS query ─→ DNS Server

Message formats:

• Text-based (HTTP, SMTP, FTP) — human-readable, easy to debug, more verbose
• Binary (DNS, DHCP, SNMP) — compact, fast to parse, not human-readable
• Structured (JSON APIs, gRPC, Protobuf) — self-describing, language-independent

HTTP & HTTPS

Foundation of web communication — a request-response protocol for transferring hypertext documents.

HTTP Request-Response

Client sends a request with method, URL, and headers; server returns a response with status code and content.

Client (Browser)                  Server
      │                                │
      │──── GET /index.html HTTP/1.1 ──→│
      │    Host: www.example.com        │
      │    User-Agent: Chrome/120.0     │
      │                                 │
      │←── HTTP/1.1 200 OK ─────────────│
      │    Content-Type: text/html      │
      │    Content-Length: 4500         │
      │    <html>...</html>             │

HTTP Methods

Verbs defining the action — GET (retrieve), POST (create), PUT (replace), DELETE (remove).

HTTP Status Codes

Three-digit codes indicating request outcomes — 2xx (success), 3xx (redirect), 4xx (client error), 5xx (server error).

HTTP Headers:

HTTPS — HTTP Over TLS

Encrypted HTTP using TLS certificates and session keys — protects data from eavesdropping and tampering.

HTTP:  All data in plaintext — anyone on the network can read it
HTTPS: All data encrypted — only client & server can read it

How TLS works (simplified):

1. Client connects on port 443
2. Server presents its TLS certificate (contains public key, signed by a Certificate Authority)
3. Client verifies the certificate against trusted CAs
4. Client & server negotiate a session key (symmetric encryption)
5. All subsequent data is encrypted with the session key

HTTP/2 and HTTP/3

Modern HTTP versions — HTTP/2 adds multiplexing over TCP, HTTP/3 uses QUIC over UDP for reduced latency.

DNS — Domain Name System

The "phonebook of the internet" — translates human-readable domain names (google.com) into IP addresses.

DNS translates human-readable domain names to IP addresses — the "phonebook of the internet."

Resolution Process

Step-by-step query from browser cache through recursive resolver, root, TLD, and authoritative DNS servers.

Browser: "www.example.com"
    │
    ▼
1. DNS Resolver checks local cache
2. Root Server → "Ask .com TLD server"
3. .com TLD Server → "Ask example.com's authoritative DNS"
4. Authoritative DNS Server → "93.184.216.34"
    │
    ▼
Browser connects to 93.184.216.34:80

DNS Record Types

Different record types — A (IPv4), AAAA (IPv6), CNAME (alias), MX (mail), NS (nameserver), TXT (text), SOA (authority).

DNS Hierarchy

Tree structure from root (.) to TLDs (.com, .org) to authoritative servers, with caching at every level.

Root (.)
├── .com        ├── .org       ├── .net       ├── .uk
│   ├── example │              │              │
│   │   ├── www → 93.184.216.34               │
│   │   └── mail → 192.0.2.10                 │
│   └── google                                │
└── ...

DNS is cached at every level: browser (seconds), OS (minutes), ISP (hours).

DHCP — Dynamic Host Configuration Protocol

Automatically assigns IP addresses, subnet masks, gateways, and DNS servers to devices on a network.

DHCP automatically assigns IP addresses to devices on a network.

DORA Process

Four-step exchange — Discover (client seeks server), Offer (server offers IP), Request (client accepts), Acknowledge (server confirms).

Client                          DHCP Server
  │── DHCP Discover (Broadcast) ──→│  "I need an IP address!"
  │←── DHCP Offer ────────────────│  "You can use 192.168.1.100"
  │── DHCP Request (Broadcast) ───→│  "I accept 192.168.1.100"
  │←── DHCP Acknowledgment ───────│  "Confirmed! Here's your config"
  ▼
Client now has: IP 192.168.1.100, Subnet 255.255.255.0,
                Gateway 192.168.1.1, DNS 8.8.8.8

DHCP provides: IP address, subnet mask, default gateway, DNS server(s), lease time. Uses UDP: Client port 68, Server port 67.

Email Protocols — SMTP, POP3, IMAP

Protocols for sending (SMTP) and receiving (POP3 for download, IMAP for server sync) email messages.

How Email Flows

Path from sender's client via SMTP to sender's server, then relayed via SMTP to receiver's server, where it's retrieved via POP3 or IMAP.

[Alice's Email Client]
        │
        │ SMTP (port 587)
        ▼
[Alice's Mail Server (smtp.gmail.com)]
        │
        │ SMTP (relay across internet)
        ▼
[Bob's Mail Server (mail.yahoo.com)]
        │
        ├── POP3 (port 110/995) → [Bob downloads email to one device]
        └── IMAP (port 143/993) → [Bob reads/ manages email on server, synced to all devices]

SMTP — Sending Email

Protocol for outgoing mail submission — uses HELO, MAIL FROM, RCPT TO, and DATA commands to deliver messages.

Client                          SMTP Server
  │──── HELO/EHLO ───────────────→│  Hello, I'm mail.example.com
  │←── 250 Hello ────────────────│
  │──── MAIL FROM:<alice@a.com> ─→│  Sender address
  │──── RCPT TO:<bob@b.com> ────→│  Recipient address
  │──── DATA ────────────────────→│  Email content follows
  │──── Subject: Hello!          │
  │──── Hi Bob, ...              │
  │──── . ──────────────────────→│  End of message
  │←── 250 OK ──────────────────│  Message accepted

SMTP ports: 25 (original, often blocked), 587 (authenticated submission — recommended), 465 (legacy SSL)

POP3 vs IMAP

Comparison — POP3 downloads and deletes from server (one device), IMAP keeps on server (synced across devices).

IMAP dominates today — it syncs seamlessly across phone, laptop, and webmail.

SSH & Remote Access

Secure encrypted remote administration protocol (port 22) — supports key authentication, tunneling, and proxying.

SSH (Secure Shell) — the standard for secure remote administration:

• Port 22, all traffic encrypted
• Key authentication (more secure than passwords — private/public key pair)
• Can tunnel traffic: ssh -L 8080:localhost:80 user@server
• Can proxy: ssh -D 1080 user@server (SOCKS proxy)
• Transfers files via SFTP or SCP

Telnet — same concept but no encryption:

Telnet Client: "password: hunter2" ──→ Server (IN PLAINTEXT!)

Never use Telnet on untrusted networks. Use SSH instead.

FTP & File Transfer

Protocols for transferring files — FTP (plaintext), FTPS (TLS), SFTP (SSH-based), and SCP.

SFTP is not FTP — it is a file transfer protocol built into SSH, despite the name.

FTP modes: Active (server connects back to client — fails through firewalls), Passive (client connects to server port — works through firewalls).

Other Important Application Protocols

Additional protocols — NTP (time sync), LDAP (directory), SNMP (monitoring), RDP (remote desktop), and more.

Application Layer Security

Common threats (SQL injection, XSS, DNS spoofing, MITM) and best practices (encryption, certificate validation, MFA).

Best practices: Use encrypted protocols (HTTPS, SSH, SFTP, IMAPS), validate TLS certificates, use strong authentication (SSH keys, multi-factor auth), keep software updated.

Final Summary

Recap of all seven parts — TCP/IP Introduction, Network Interface, Internet, Transport (Ports/Sockets, TCP, UDP), and Application Layer.

TCP/IP is the foundation of modern networking. Here is what each part of the protocol suite contributes:

Key takeaway: Data travels down the stack at the sender (each layer adds a header — encapsulation), across the network, and up the stack at the receiver (each layer strips its header — decapsulation). The layers work together to deliver data from one application to another across the global internet.

Practical Exercises

Hands-on tasks to test your understanding of all TCP/IP layers, protocols, and concepts.

Exercise 1: Identify the Layer

Test your knowledge of which TCP/IP layer handles each networking scenario.

Task: Which TCP/IP layer is primarily involved?

Exercise 2: Read an Ethernet Frame & Routing Table

Practice analyzing an Ethernet frame header and interpreting a routing table.

Part A — Ethernet Frame:

Dest MAC:  FF:FF:FF:FF:FF:FF
Src MAC:   00:1A:2B:3C:4D:5E
EtherType: 0x0806
Payload:   [ARP Request — Who has 192.168.1.1?]

1. Is this broadcast or unicast?
2. What protocol is in the payload?
3. Will all devices on the local network receive this?

Part B — Routing Table:

Destination     Netmask          Gateway         Interface
0.0.0.0         0.0.0.0          10.0.1.1        eth0
10.0.1.0        255.255.255.0    0.0.0.0         eth0
192.168.10.0    255.255.255.0    10.0.1.100      eth0

1. What is the default gateway?
2. Where does traffic to 8.8.8.8 go?
3. Where does traffic to 192.168.10.50 go?
4. Where does traffic to 10.0.1.50 go?

Exercise 3: Analyze a TCP Handshake

Practice filling in missing fields in a TCP three-way handshake capture.

Packet 1: Client → Server — Flags: SYN, Seq=1000
Packet 2: Server → Client — Flags: SYN, ACK, Seq=5000, Ack=_______
Packet 3: Client → Server — Flags: _______, Seq=1001, Ack=5001

1. Fill in the blanks for Packet 2's Ack and Packet 3's Flags.
2. After Packet 3, what state is the connection in?
3. What is the client's initial sequence number? The server's?

Exercise 4: TCP or UDP?

Decide which transport protocol is appropriate for each scenario and justify your choice.

Scenario: An IoT sensor sends temperature readings every second to a server. The sensor has limited battery and processing power. One lost reading is acceptable.

1. Would you use TCP or UDP?
2. What would be the downside of using TCP here?
3. If the sensor was controlling a medical device, would your answer change?

Exercise 5: Identify the Protocol

Identify which Application Layer protocol(s) are involved in each real-world scenario.

Task: Which Application Layer protocol(s) are involved?