TCP/IP & OSI Model
Understand how the OSI and TCP/IP models layer network functions, how data travels from app to wire.
Learning Objectives
- → Name and describe all 7 OSI layers
- → Map TCP/IP 4-layer model to OSI equivalents
- → Explain the TCP 3-way handshake
- → Identify key protocols and port numbers at each layer
The OSI Model
The OSI (Open Systems Interconnection) model is a conceptual framework dividing network communication into 7 layers. Each layer has a specific job and communicates with the layers above and below it.
Layer 7 — Application → HTTP, DNS, FTP, SMTP
Layer 6 — Presentation → TLS/SSL, JPEG, ASCII
Layer 5 — Session → NetBIOS, RPC
Layer 4 — Transport → TCP, UDP
Layer 3 — Network → IP, ICMP, ARP
Layer 2 — Data Link → Ethernet, WiFi (802.11)
Layer 1 — Physical → Cables, radio waves, bits
Mnemonic: "All People Seem To Need Data Processing"
Layer Details
Layer 7 — Application
The interface between the user/app and the network. Protocols: HTTP/S (web), DNS (name resolution), FTP (file transfer), SMTP/IMAP (email).
Layer 4 — Transport
Provides end-to-end communication between processes using port numbers.
| Feature | TCP | UDP |
|---|---|---|
| Connection | Yes (3-way handshake) | No |
| Reliability | Guaranteed delivery, retransmit | Best-effort |
| Order | Sequenced | Not sequenced |
| Speed | Slower | Faster |
| Use case | HTTP, SSH, FTP | DNS, VoIP, gaming, video |
TCP 3-Way Handshake:
Client → SYN → Server
Client ← SYN-ACK ← Server
Client → ACK → Server
[Connection established]
Layer 3 — Network
Routes packets across multiple networks using IP addresses. Key protocols: IP, ICMP (ping/traceroute), OSPF, BGP.
Layer 2 — Data Link
Transfers frames within a single network segment using MAC addresses. Ethernet uses CSMA/CD. WiFi uses CSMA/CA.
TCP/IP Model (4 Layers)
OSI TCP/IP
──────────────────── ──────────────
Application (7) ┐
Presentation (6) │ → Application
Session (5) ┘
Transport (4) → Transport
Network (3) → Internet
Data Link (2) ┐
Physical (1) ┘ → Network Access
Encapsulation
As data moves down the stack, each layer adds a header (and sometimes a trailer):
App data
→ [TCP header] + data (segment)
→ [IP header] + segment (packet)
→ [Eth header] + packet + [FCS] (frame)
→ bits on the wire
At the receiving end, each layer strips its header (de-encapsulation).
Common Port Numbers
| Port | Protocol | Service |
|---|---|---|
| 20/21 | TCP | FTP |
| 22 | TCP | SSH |
| 23 | TCP | Telnet |
| 25 | TCP | SMTP |
| 53 | UDP/TCP | DNS |
| 80 | TCP | HTTP |
| 443 | TCP | HTTPS |
| 3389 | TCP | RDP |
The OSI (Open Systems Interconnection) model is a conceptual framework dividing network communication into 7 layers. Each layer has a specific job and only talks to adjacent layers.
At which OSI layer does TCP operate?
A 'packet' is the PDU (Protocol Data Unit) at which OSI layer?
Two core Transport layer protocols — TCP (reliable) and UDP (fast). Choosing the right one depends on the application's needs.
🔵 TCP — Transmission Control
- Connection-oriented (3-way handshake)
- Guaranteed delivery — retransmits lost packets
- In-order delivery
- Flow control and congestion control
- Slower but reliable
🟡 UDP — User Datagram Protocol
- Connectionless — no handshake
- Best-effort delivery (may drop packets)
- No ordering guarantee
- No flow control
- Faster, lower overhead
Which protocol uses a 3-way handshake before sending data?
DNS typically uses which transport protocol?
Before TCP transfers data, it establishes a connection using a 3-way handshake. This ensures both sides are ready and agrees on sequence numbers.
Client sends a SYN (synchronise) packet with a random sequence number (ISN). "I want to connect, my starting seq is 1000."
Server replies with SYN-ACK: acknowledges client's seq (1001) and sends its own ISN. "Got it! My starting seq is 5000."
Client acknowledges server's seq (5001). Connection is now open. Data can flow.
What is the first packet sent in a TCP 3-way handshake?
After the handshake completes, the connection state is:
Port numbers identify the specific service/application a packet is destined for. Ports 0–1023 are well-known, reserved for standard services.
| Port | Protocol | Service | Encrypted? |
|---|---|---|---|
| 20/21 | TCP | FTP (File Transfer) | No (use SFTP) |
| 22 | TCP | SSH (Secure Shell) | Yes ✓ |
| 23 | TCP | Telnet | No ⚠ |
| 25 | TCP | SMTP (Email send) | No (use 587/465) |
| 53 | UDP/TCP | DNS | No (use DoH/DoT) |
| 80 | TCP | HTTP (Web) | No ⚠ |
| 443 | TCP | HTTPS (Web) | Yes ✓ |
| 3389 | TCP | RDP (Remote Desktop) | Yes (TLS) |
Which port does HTTPS use?
Port 22 is used by which service?
Why should you avoid using Telnet (port 23)?
💪 Exercises & Challenges
Packet Capture with tcpdump
## Task: Observe TCP Handshake Use `tcpdump` to capture and observe a real TCP 3-way handshake. ### Steps **Step 1 — Start capture:** ```bash sudo tcpdump -i any -n tcp port 80 -c 20 ``` **Step 2
Protocol Identification
Analyse this packet header excerpt: ``` Src IP: 10.0.0.5 Dst IP: 10.0.0.1 Proto: 6 Src Port: 54231 Dst Port: 22 Flags: [S] Seq: 1000 ``` **Question**: What service is being connected to, a