TCP/IP Model and Core Protocols

The TCP/IP model

TCP/IP layer	Closest OSI layers	Examples
Application	7, 6 and 5	HTTP, DNS, SSH, SMTP, DHCP
Transport	4	TCP, UDP
Internet	3	IPv4, IPv6, ICMP
Link / Network Access	2 and 1	Ethernet, Wi-Fi, ARP/ND, physical media

The TCP/IP model is implementation-focused. It groups several OSI functions together rather than preserving seven strict layers.

TCP versus UDP

Feature	TCP	UDP
Connection	Connection-oriented	Connectionless
Reliability	Acknowledgements, retransmission and sequencing	No built-in delivery guarantee
Overhead	Higher	Lower
Typical uses	HTTPS, SSH, email, many database sessions	DNS queries, voice/video, telemetry, real-time applications
Important caution	A successful handshake does not prove the application works.	Applications must add reliability if they need it.

TCP connection establishment

SYN

SYN-ACK

ACK

Application data

The three-way handshake synchronises initial sequence information and confirms two-way reachability. Connection close normally uses FIN/ACK exchanges, while RST aborts a connection immediately.

Core protocols and functions

Protocol	Function
IP	Moves packets between addressed networks without guaranteeing delivery.
ARP	Resolves an IPv4 address to a local-link MAC address.
ICMP	Carries control and diagnostic messages such as echo and unreachable indications.
DNS	Maps names to records such as A, AAAA, CNAME and MX.
DHCP	Automatically supplies address, mask, gateway and other options.
TCP/UDP ports	Identify the application endpoint on a host.

Common ports to remember

Service	Transport / port
HTTP	TCP 80
HTTPS	TCP 443
DNS	UDP 53 commonly; TCP 53 also used
SSH	TCP 22
SMTP	TCP 25
DHCPv4	UDP 67/68
NTP	UDP 123
BGP	TCP 179

Practical troubleshooting

Cross-platform checks

ping 192.0.2.10
tracert 192.0.2.10        # Windows
traceroute 192.0.2.10     # Linux
nslookup example.com
curl -Iv https://example.com
netstat -ano              # Windows
ss -lntup                 # Linux

Interpret each test carefully. Ping can be blocked, traceroute can be incomplete, and a listening port does not guarantee a healthy application response.

Quick self-check

1. Which protocol provides ordered reliable byte-stream delivery?

Answer: TCP.

2. Which transport protocol is usually used for a normal DNS query?

Answer: UDP, although DNS also uses TCP in several cases.

3. What is the purpose of ARP?

Answer: Resolve a local IPv4 address to a MAC address.

4. What does a TCP RST indicate?

Answer: The connection was reset or refused/aborted rather than gracefully closed.

5. Which TCP/IP layer performs routing?

Answer: The Internet layer.

Frequently asked questions

1. Does UDP mean packets are always lost?

Answer: No. It means UDP itself does not provide acknowledgement, retransmission or ordering. The network may still deliver every datagram.

2. Can DNS use TCP?

Answer: Yes. TCP is used for zone transfers and when response size, truncation or protocol features require it.

3. Does ping test TCP?

Answer: No. Ping normally uses ICMP echo messages.

Standards and further reading

Editorial note: Vendor commands and best-path tie-breakers can differ by platform and software release. Always verify production configuration against the device vendor documentation.