What Is This Chapter About?
Before you write a single line of socket code, you need to understand how data actually travels across a network. This chapter explains the TCP/IP protocol suite — the foundation of all internet communication. Think of it as understanding the road rules before you drive a car.
TCP/IP is not a single protocol. It is a family (suite) of protocols arranged in layers. Each layer has a specific job, and they work together to move data from one computer to another — even across the world.
Imagine posting a letter. You write the message, put it in an envelope, add an address, hand it to the post office, they put it in a van, the van goes to a sorting center, and so on. Each step adds or removes “wrapping.” You don’t need to know how the van works — you just write the letter.
Networking works the same way. Layering means each layer does one job and hands off to the next. The sender adds headers layer by layer going down. The receiver strips them off going up. This separation makes it easy to replace one layer without breaking the others.
Two important models describe this layering:
- OSI Model — A theoretical 7-layer model used for teaching and standards.
- TCP/IP Model — The practical 4-layer model actually used on the Internet.
The OSI model has 7 layers. TCP/IP collapses some of them into 4 practical layers:
ℹ️ The TCP/IP model is what Linux and real systems implement. OSI is mostly used for learning and documentation.
Moves raw bits over a physical medium (cable, wifi, fiber). Handles MAC addresses. Examples: Ethernet frames, WiFi packets. Linux uses drivers here (e.g., eth0, wlan0).
Handles logical addressing (IP addresses) and routing. Takes data and wraps it into datagrams that can hop across routers. Does NOT guarantee delivery or order — that is not its job.
Provides end-to-end communication between processes on two machines. TCP gives reliability; UDP gives speed. Uses port numbers to identify which process gets the data.
Your program lives here. HTTP, FTP, DNS all run here. When you write a socket program in C, you are writing an application-layer program.
When you send data, each layer wraps the data with its own header (and sometimes a trailer). This wrapping is called encapsulation. At the receiver, the reverse happens — each layer strips off its header and passes the inner data up.
The unit of data at each layer has a special name:
| Layer | Data Unit (PDU) | What Gets Added | Example |
|---|---|---|---|
| Application | Message / Data | Application headers (HTTP headers) | “GET / HTTP/1.1” |
| Transport | Segment (TCP) / Datagram (UDP) | Source/dest port, sequence no., checksum | TCP segment |
| Network | Datagram / Packet | Source/dest IP address, TTL | IP packet |
| Link | Frame | MAC addresses, CRC checksum | Ethernet frame |
When your packet leaves your machine, it does not go directly to the destination. It hops through multiple routers. Each router looks at the IP destination address and decides the best next hop. This is called routing.
Routers only operate at the Network layer (Layer 3). They read the IP header, decrement the TTL (Time To Live), and forward the packet. If TTL reaches zero, the packet is dropped (prevents infinite loops).
Your PC
192.168.1.5
Home Router
192.168.1.1
ISP Router
Backbone Router
Web Server
93.184.216.34
Each hop may go through a different physical path. IP does not guarantee all packets take the same route! That is why TCP re-orders them at the destination.
You can observe the TCP/IP stack directly using standard Linux tools:
/* ---- Check your IP address (Network Layer) ---- */
$ ip addr show
$ ifconfig /* older systems */
/* Output example:
eth0: inet 192.168.1.100/24 <-- your IPv4 address
inet6 fe80::1/64 <-- your IPv6 link-local address
*/
/* ---- See routing table (how router decides next hop) ---- */
$ ip route show
/* Example:
default via 192.168.1.1 dev eth0 <-- default gateway
192.168.1.0/24 dev eth0 <-- local network
*/
/* ---- Trace the hops to a destination (TTL trick) ---- */
$ traceroute google.com
/*
1 192.168.1.1 (home router) 0.5 ms
2 10.x.x.x (ISP) 5.2 ms
3 ...
*/
/* ---- See active TCP connections (Transport Layer) ---- */
$ ss -tnp
$ netstat -tnp /* older systems */
A: OSI has 7 layers (Application, Presentation, Session, Transport, Network, Data Link, Physical). TCP/IP has 4 layers (Application, Transport, Internet, Link). OSI is a theoretical reference model; TCP/IP is the practical model used in real networks. OSI’s top 3 layers (Application, Presentation, Session) are merged into a single Application layer in TCP/IP.
A: Encapsulation is the process where each layer wraps the data from the layer above by adding its own header (and sometimes a trailer). On sending: Application → Transport adds TCP/UDP header → Network adds IP header → Link adds frame header+trailer. On receiving, headers are stripped in reverse order. The wrapped unit of data at each layer is called a PDU (Protocol Data Unit).
A: TTL is a field in the IP header that limits how many routers a packet can pass through. Each router decrements TTL by 1. If TTL reaches 0, the router drops the packet and sends an ICMP “Time Exceeded” message back to the sender. This prevents packets from looping forever in the network due to routing loops.
A: IP is connectionless — there is no setup phase before sending. Each IP datagram is independent. Datagrams from the same stream can take different routes, arrive out of order, be duplicated, or be lost entirely. IP simply forwards each packet as best it can (best-effort delivery). Reliability, ordering, and deduplication are the job of higher layers (TCP).
A: Network layer (IP) moves packets between hosts using IP addresses. Transport layer (TCP/UDP) provides communication between processes on those hosts using port numbers. Network layer is host-to-host; transport layer is process-to-process (also called end-to-end).
A: TCP/IP was developed before OSI and became the de facto internet standard. Linux implements the actual TCP/IP stack in its kernel. OSI is a conceptual model used for teaching; no real OS implements the 7-layer OSI stack directly. The Linux kernel network stack maps to the 4-layer TCP/IP model with: socket API (application), TCP/UDP (transport), IP (network), net device drivers (link).