Understanding TCP/IP: Layers, Handshakes, and Why They Matter

What is the TCP/IP protocol?

For computers and network devices to communicate, both sides must follow the same set of rules—how to discover each other, which side initiates communication, which language is used, and how the session ends. These rules constitute a protocol, and TCP/IP is the collective name for the family of Internet‑related protocols.

TCP/IP is organized into layers. The most common representation includes five layers: Physical, Data Link, Network, Transport, and Application (some models use four or seven layers). Layering allows changes to be made to one part of the system without replacing the entire stack.

Why use layers?

Layering isolates design concerns: a change in one layer does not require changes in others. Applications at the top layer can focus on their specific tasks without needing to know the details of lower‑level transmission, routing, or hardware.

Physical layer

This layer handles the transmission of raw bit streams between nodes, dealing with the physical medium and hardware connections.

Data Link layer

It controls communication between the Network and Physical layers, ensuring reliable data transfer by framing packets, adding source and destination addresses, and providing error‑control information.

Network layer

Responsible for routing data from the source to the destination, considering factors such as priority, congestion, quality of service, and cost.

Transport layer

Provides end‑to‑end communication between applications on two hosts. It includes two main protocols: TCP (a reliable, connection‑oriented protocol) and UDP (an unreliable, connectionless protocol).

Application layer

Defines the format of data exchanged by applications. Common protocols include HTTP, FTP, and Telnet.

TCP vs. UDP

Both operate at the transport layer but differ in reliability and usage scenarios. TCP offers reliable, ordered delivery, while UDP provides faster, unordered transmission.

Message‑oriented transmission (UDP)

Applications specify the size of each datagram; each UDP packet is sent as a single message.

Byte‑stream transmission (TCP)

TCP treats data as a continuous stream of bytes, segmenting it as needed for transmission.

TCP three‑way handshake

1. SYN: Client sends a SYN packet with sequence number x and enters SYN_SENT. 2. SYN‑ACK: Server replies with SYN‑ACK, acknowledging x+1 and sending its own sequence y, entering SYN_RECV. 3. ACK: Client acknowledges with ACK y+1, and both sides enter ESTABLISHED, completing the connection.

TCP four‑way termination

1. FIN: Client sends FIN, entering FIN_WAIT_1. 2. ACK: Server acknowledges the FIN. 3. FIN: Server sends its own FIN, entering LAST_ACK. 4. ACK: Client acknowledges, entering TIME_WAIT; after waiting for 2 MSL, the connection fully closes.

Because establishing and closing many connections incurs overhead, HTTP uses persistent (keep‑alive) connections to reuse an existing TCP link for multiple requests.

Common questions

1. Why three‑way handshake? It prevents stale connection requests from being mistakenly accepted, ensuring both sides agree the connection is valid before data transfer begins.

2. Why four‑way termination? TCP is full‑duplex; each side must independently close its sending direction while still receiving data, requiring separate FIN and ACK exchanges.

3. Why wait 2 MSL? Waiting twice the maximum segment lifetime guarantees that delayed duplicate packets from the closed connection are discarded, preventing them from interfering with future connections.