Illustrated Guide to TCP/IP: Visualizing the Internet Protocol Suite

What is TCP/IP?

Many people assume TCP/IP only contains two protocols—TCP and IP—but it is actually an entire family of Internet protocols. TCP and IP are the most representative, so the whole suite is often referred to as TCP/IP.

TCP/IP Layered Model

Engineers use layering to avoid re‑implementing network transmission in every program.

OSI Seven‑Layer Model

Interviewers often ask which OSI layer TCP belongs to. OSI defines Physical, Data Link, Network, Transport, Session, Presentation, and Application layers.

Mapping TCP/IP to OSI

TCP/IP compresses the top three OSI layers into an Application layer, leaves the middle two layers unchanged, and merges the bottom two layers.

Application Layer

TCP/IP’s Application layer covers OSI’s Application, Presentation, and Session layers.

Transport Layer

TCP/IP’s Transport layer corresponds to OSI’s Transport layer. TCP and UDP use port numbers to deliver data to the correct process.

Network Layer

IP handles addressing and routing. A ping test demonstrates its function.

Link Layer

TCP/IP’s Link layer combines OSI’s Data Link and Physical layers; drivers already handle the physical signals.

Physical Layer: MAC Addresses

In the early 1980s, two computers were connected with a serial cable for point‑to‑point communication. Adding more computers required a hub that broadcast frames to all ports.

Hub

A hub operates at the Physical layer, simply copying incoming signals to every other port.

Switch

A switch works at the Data Link layer, maintaining a MAC address table that maps MAC addresses to ports. It learns the source MAC on each incoming frame and forwards frames only to the appropriate port, eliminating broadcast storms and improving efficiency.

End‑to‑End Transmission Process

Example: Computer A sends a packet to computer F through switches SW1, SW2 and routers R1, R2. The article details every step—IP and subnet calculations, default gateway MAC substitution, routing table lookup, MAC table learning, and final delivery.

TCP Segment Format

TCP provides a reliable, connection‑oriented byte‑stream service. The header consists of fixed fields (source port, destination port, sequence number, acknowledgment number, data offset, reserved bits, flags, window size, checksum, urgent pointer) and optional fields such as MSS.

Three‑Way Handshake

1) Client sends SYN with a random initial sequence number (ISN). 2) Server replies SYN+ACK, acknowledging the client’s ISN+1 and providing its own ISN. 3) Client sends ACK, completing the connection. The article includes state diagrams and C++ socket examples for both server (passive open) and client (active open).

Four‑Way Teardown

The termination requires four steps: FIN from the active closer, ACK from the passive side, FIN from the passive side, and final ACK from the active side, after which the active side enters TIME_WAIT for 2 MSL to ensure all stray packets expire.

Interview Questions

Why does connection termination need four handshakes while establishment uses three?

Can the three‑way handshake be reduced to two steps?

Why is the initial sequence number (ISN) random?

What is a SYN flood attack and how can it be mitigated?

Can data be carried in the first two handshake packets?

What causes many CLOSE_WAIT sockets and how to resolve them?

Difference between the SYN (half‑open) queue and the Accept (full‑open) queue.