The TCP/IP Model

In The OSI Model, you learned about seven layers. OSI is a useful way to talk aboutnetworking, but it is not what your laptop actually runs. Your laptop, your phone, every web server and the whole internet run the TCP/IP protocol suite, which is described by a simpler model with just four layers. By the end of this lesson, you should be able to:

• Name the four TCP/IP layers and say what each one does.
• Place common protocols (HTTP, DNS, TCP, UDP, IP, Ethernet, Wi-Fi) in the right layer.
• Map each TCP/IP layer to the OSI layers it covers.
• Explain why TCP/IP, not OSI, is what really runs on networks.

💡 In simple terms: TCP/IP works like a postal service with four departments. One writes the letter (Application), one makes sure it reaches the right person in the house (Transport), one gets it to the right town and street (Internet), and one drives the van along each road (Network Access).

What is the TCP/IP model?

The TCP/IP model is a way of grouping the protocols of the internet into four layers. A protocol is a set of rules that two devices agree to follow, such as “ask for a web page like this” or “number each byte like this”. Each layer has one job and uses the services of the layer below it:

A PDU (protocol data unit) is the name for a piece of data at a given layer. Different books use different names for the bottom layer: Link (the name used in the internet's own standard, RFC 1122), Network Access or Network Interface. They all mean the same thing.

Notice the shape. There are many applications at the top and many types of link at the bottom, but only one protocol in the middle that everyone shares: IP. That narrow middle is the key to TCP/IP's success, as you will see below.

Why TCP/IP exists

In the late 1960s and 1970s, the US Department of Defense funded a research network called the ARPANET. Researchers wanted to connect many different networks (radio, satellite, leased lines), each built in its own way, into one larger network. That raised some difficult problems:

Vint Cerf and Bob Kahn designed the first version of TCP and IP in 1974. On 1 January 1983, the ARPANET switched over to TCP/IP, and that day is often called the birthday of the internet. The layers were later documented in RFC 1122 (1989). You may also see it called the DoD model, after the Department of Defense.

The four layers in detail

Each card below shows the layer's job, its PDU, the address it uses, its main protocols, the devices that work at that layer, and what the layer does when you open https://routelearn.net.

Application layer: more than one OSI layer

In OSI, the Session (5), Presentation (6) and Application (7) layers are separate. TCP/IP combines all three into one Application layer, because in practice the same program does all three jobs. For example, a web browser formats the request (presentation), encrypts it with TLS (presentation and session) and sends it using HTTP (application), all by itself. There is no separate "session header" in the packet. HTTPS and DNS are two important application protocols to study next.

Learn more: HTTPS and TLS · DNS

Transport layer: TCP or UDP

The application chooses which transport protocol to use. Both TCP and UDP use port numbers. The difference is how much care they take with delivery:

Learn more: TCP vs. UDP Compared · Port Numbers and Sockets

Internet layer: the narrow waist

IP is the one protocol that every device on the internet must use. It gives every interface an IP address and moves packets hop by hop through routers. IP itself is best effort: it does its best to deliver each packet, but it does not guarantee delivery or order, and it does not prevent duplicates. Reliability is the job of TCP at the Transport layer. ICMP also works at this layer. It carries error and test messages, such as the replies to ping.

Network Access layer: one hop at a time

This layer only ever deals with one link: the cable or radio connection between two neighbouring devices. On Ethernet and Wi-Fi, it uses MAC addresses, and ARP finds the MAC address that belongs to a neighbour's IP address. Each router removes the frame and builds a new one, while the IP packet inside travels end to end. That idea is at the centre of the next lesson.

Learn more: Encapsulation and De-encapsulation

TCP/IP and OSI side by side

Both models describe the same journey, divided into a different number of layers. Use the toggle to switch between the four-layer model and the five-layer version that many courses use:

Where the two models differ

Engineers mix the two models all the time. They say "layer 3" for IP and "layer 4" for TCP and UDP (OSI numbers), even when they are talking about TCP/IP protocols. When someone says "layer 7", they mean the application. You will rarely hear "TCP/IP layer 2".

Why TCP/IP is what really runs

In the 1980s, many people expected OSI's own protocols to replace TCP/IP. The opposite happened. Here's why:

1. It already worked. TCP/IP was running on real networks while OSI protocols were still being designed on paper.
2. It was free and open. Anyone could read the standards (the RFCs) for free, and a free implementation shipped with BSD Unix in 1983, so universities and companies could start using it immediately.
3. It runs over any link. IP only asks the link below to "carry this packet to the next device", so TCP/IP runs over Ethernet, Wi-Fi, fibre, DSL, cable and mobile networks. New link types simply plug in at the bottom.
4. Applications can change without changing the network. New applications (the web in 1991, video streaming, online games) only had to use TCP or UDP. The routers in the middle did not need to change at all.
5. Simple core, smart edges. Routers only forward packets; the two end hosts handle reliability. This kept routers cheap and fast, so the network could grow.

💡 Today, every device on the internet runs a TCP/IP stack: the part of the operating system that implements IP, TCP, UDP and related protocols. Windows, macOS, Linux, Android and iOS all include one.

How the four layers work together

When you send data, it goes down the four layers on your device. Each layer adds its own information (a header) in front of the data from the layer above. This wrapping is called encapsulation. The receiver takes the data up through the same four layers, removing one header at each step.

Each layer only reads the header written by the same layer on the other side. TCP on your laptop communicates with TCP on the server; it never looks at MAC addresses. This is called peer-layer communication, and it is why a change at one layer (for example, moving from Wi-Fi to a cable) does not break the others.

Which layers each device uses

Hosts use all four layers. Devices in the middle only go as far up the stack as they need to make their forwarding decision:

A real example: a DNS lookup through the layers

Your laptop (192.168.1.20) wants the IP address of routelearn.net. It asks a DNS server at 198.51.100.53. Here's what each layer adds to that one small question:

The destination MAC address is the home router's, not the DNS server's, because the server is on another network. The frame only has to reach the default gateway; the IP header carries the final destination. Your home router also replaces the private source address with its public address (NAT) on the way out.

Learn more: Why NAT Exists

What happens when a layer fails

Each layer depends on the layer below it. If a lower layer fails, everything above it fails too. This is why the symptoms often look like an application problem, even when the cause is a cable.

Troubleshooting with the TCP/IP layers

A simple method is to test from the bottom up: prove that the Network Access layer works, then the Internet layer, then the Transport layer, and finally the Application layer. These commands work on most Linux systems, and the table also shows the Windows equivalents:

$ ip -br link
lo               UNKNOWN        00:00:00:00:00:00 <LOOPBACK,UP,LOWER_UP>
wlan0            UP             02:00:00:00:00:aa <BROADCAST,MULTICAST,UP,LOWER_UP>

$ ip route
default via 192.168.1.1 dev wlan0 proto dhcp src 192.168.1.20 metric 600
192.168.1.0/24 dev wlan0 proto kernel scope link src 192.168.1.20 metric 600

$ ss -tn
State   Recv-Q   Send-Q     Local Address:Port        Peer Address:Port   Process
ESTAB   0        0           192.168.1.20:51524       203.0.113.20:443
ESTAB   0        0           192.168.1.20:40312      198.51.100.25:22

Learn more: Essential Linux Network Commands · Essential Windows Network Commands · Bottom-Up, Top-Down, Divide and Conquer

Common mistakes

• Thinking TCP/IP means only TCP and IP. It is a whole suite of protocols: UDP, ICMP, ARP, DNS, DHCP and HTTP are all part of it.
• Mixing up the layer names. TCP/IP's "Internet" layer is OSI's "Network" layer. TCP/IP's "Network Access" layer is OSI layers 1 and 2, not OSI layer 3.
• Using TCP/IP layer numbers when people expect OSI numbers. "Layer 3" almost always means IP (OSI numbering), not the TCP/IP Transport layer.
• Putting DNS or DHCP at the Transport layer. They use UDP (and DNS also uses TCP), but they are Application-layer protocols.
• Thinking IP guarantees delivery. IP is best effort. Reliability comes from TCP, or from the application when it uses UDP.
• Forgetting that the bottom layer changes at every hop. Each router builds a new frame with new MAC addresses; the IP packet inside travels end to end.

Knowledge check

Where to go next

Next, watch every header being added and removed, with real addresses and ports. To study each layer in more detail, start with Ethernet (Network Access), IP addressing (Internet), the transport layer (Transport) and HTTP (Application).

Learn more: Encapsulation and De-encapsulation · Ethernet Fundamentals · What Is an IP Address? · What the Transport Layer Does · HTTP: How the Web Talks