TCP/IP Stack and Protocols
TCP/IP Stack and Protocols
The TCP/IP model is the practical framework underpinning the internet. Understanding its layers, key protocols, and how data moves through the stack is essential for A-Level Computer Science.
The TCP/IP Model vs OSI Model
The TCP/IP model has 4 layers (compared to the OSI model's 7):
| TCP/IP Layer | OSI Equivalent | Function | Example Protocols |
|---|---|---|---|
| Application | Application + Presentation + Session | User-facing services, data formatting | HTTP, HTTPS, FTP, SMTP, DNS, SSH, IMAP |
| Transport | Transport | Reliable/unreliable delivery between processes | TCP, UDP |
| Internet | Network | Routing packets across networks | IP, ICMP, ARP |
| Network Access (Link) | Data Link + Physical | Physical transmission on local network | Ethernet, Wi-Fi (802.11), PPP |
How Data Moves Through the Stack
Sending (encapsulation):
1. Application layer creates the data (e.g., an HTTP request)
2. Transport layer wraps it in a segment (TCP) or datagram (UDP), adding port numbers
3. Internet layer wraps it in a packet, adding source and destination IP addresses
4. Network access layer wraps it in a frame, adding MAC addresses
Each layer adds a header — this process is called encapsulation.
Receiving (de-encapsulation): The reverse — each layer strips its header and passes the data up.
TCP vs UDP
| Feature | TCP | UDP |
|---|---|---|
| Full name | Transmission Control Protocol | User Datagram Protocol |
| Connection | Connection-oriented (handshake first) | Connectionless (no handshake) |
| Reliability | ✓ Guaranteed delivery (ACKs, retransmission) | ✗ No guarantee |
| Ordering | ✓ Data arrives in order (sequence numbers) | ✗ May arrive out of order |
| Error checking | ✓ Checksums + retransmission | ✓ Checksums only |
| Speed | Slower (overhead) | Faster (minimal overhead) |
| Flow control | ✓ (sliding window) | ✗ |
| Use cases | Web (HTTP), email, file transfer | Streaming, gaming, VoIP, DNS lookups |
TCP Three-Way Handshake
Before data transfer, TCP establishes a connection:
1. SYN → Client sends a synchronise request to the server
2. SYN-ACK ← Server acknowledges and sends its own synchronise
3. ACK → Client acknowledges the server's synchronise
Connection is now established — data can flow in both directions.
Termination uses a similar process: FIN → ACK, FIN → ACK (four-way handshake).
IP (Internet Protocol)
IPv4: 32-bit addresses (e.g., 192.168.1.1) — approximately 4.3 billion addresses (exhausted).
IPv6: 128-bit addresses (e.g., 2001:0db8:85a3::8a2e:0370:7334) — effectively unlimited addresses.
| Feature | IPv4 | IPv6 |
|---|---|---|
| Address size | 32 bits | 128 bits |
| Notation | Dotted decimal (192.168.0.1) | Hex colon (2001:db8::1) |
| Addresses | ~4.3 × 10⁹ | ~3.4 × 10³⁸ |
| Header | Variable length | Fixed 40 bytes |
| NAT needed? | Yes (address shortage) | No |
Subnetting: Dividing a network into smaller sub-networks. A subnet mask (e.g., 255.255.255.0 or /24) determines which part of the IP address is the network ID and which is the host ID.
Key Application-Layer Protocols
| Protocol | Port | Purpose |
|---|---|---|
| HTTP | 80 | Web pages (unencrypted) |
| HTTPS | 443 | Web pages (encrypted with TLS) |
| FTP | 20/21 | File transfer |
| SMTP | 25/587 | Sending email |
| IMAP | 143/993 | Retrieving email (server-side storage) |
| POP3 | 110/995 | Retrieving email (downloads to client) |
| DNS | 53 | Domain name → IP address resolution |
| SSH | 22 | Secure remote shell access |
| DHCP | 67/68 | Automatic IP address assignment |
DNS (Domain Name System)
DNS translates domain names (www.example.com) to IP addresses (93.184.216.34).
Resolution process:
1. Browser checks its local cache
2. Query sent to recursive DNS resolver (usually ISP's)
3. Resolver queries root name server → told to ask .com TLD server
4. Queries .com TLD server → told to ask example.com's authoritative server
5. Queries authoritative name server → returns the IP address
6. Result cached at each level for future lookups
DNS record types: A (IPv4), AAAA (IPv6), CNAME (alias), MX (mail server), TXT (text data).
Port Numbers
Ports identify specific processes/services on a host (0–65535):
| Range | Name | Use |
|---|---|---|
| 0–1023 | Well-known | Standard services (HTTP=80, HTTPS=443) |
| 1024–49151 | Registered | Assigned to specific applications |
| 49152–65535 | Dynamic/ephemeral | Temporary client-side ports |
A socket = IP address + port number (e.g., 192.168.1.1:443). It uniquely identifies a connection endpoint.
Packet Structure
An IP packet contains:
- Header: Source IP, destination IP, TTL (time to live), protocol (TCP/UDP), header checksum, version
- Payload: The data (or the TCP/UDP segment)
A TCP segment contains:
- Header: Source port, destination port, sequence number, acknowledgement number, flags (SYN/ACK/FIN), window size, checksum
- Data: The application-layer data
Exam Tips
- Know the four TCP/IP layers and what each does — don't confuse with the 7-layer OSI model
- Be able to explain encapsulation step by step: data → segment → packet → frame
- TCP vs UDP is a favourite exam question — learn the comparison table and give appropriate use cases for each
- The three-way handshake (SYN, SYN-ACK, ACK) is frequently asked — draw the diagram
- Know common port numbers (at least HTTP 80, HTTPS 443, FTP 21, SMTP 25, DNS 53, SSH 22)
- DNS resolution is a multi-step process — be ready to describe each step in order
- IPv6 was developed because IPv4 addresses ran out — explain why 128 bits provides enough addresses