Last updated · reviewed for accuracy
The TCP/IP stack
OSI is the vocabulary; TCP/IP is the machine. These four layers are what every packet you will ever capture actually decomposes into, and the TCP-or-UDP choice at layer three of them shapes how every application behaves.
What is the TCP/IP model?
The TCP/IP model is the four-layer protocol architecture the internet runs on: link (getting frames across one hop), internet (routing packets end to end), transport (delivering to the right application, reliably or not), and application (the protocols users touch, like HTTP and DNS).
It predates the OSI model and won by shipping working code. When you open a capture in Wireshark, the four rows of the protocol pane are these four layers: nothing theoretical about it.
How does it map to OSI?
TCP/IP’s link layer covers OSI layers 1–2, its internet layer is OSI layer 3, its transport layer is OSI layer 4, and its application layer absorbs OSI 5–7. Nothing is lost: OSI just splits the top and bottom more finely than practice ever needed.
| TCP/IP layer | OSI equivalent | Lives here |
|---|---|---|
| Application | 5–7 | HTTP, DNS, SMTP, SSH, TLS |
| Transport | 4 | TCP, UDP, QUIC, port numbers |
| Internet | 3 | IP, ICMP, routing |
| Link | 1–2 | Ethernet, Wi-Fi, ARP, MACs |
TCP or UDP: which, and when?
TCP guarantees ordered, complete delivery by acknowledging and retransmitting: right for web pages, file transfers and email, where correctness beats speed. UDP just sends, with no connection or recovery: right for DNS lookups, live video and games, where a late answer is worthless anyway.
| TCP | UDP | |
|---|---|---|
| Connection | Handshake first (SYN, SYN-ACK, ACK) | None: fire and forget |
| Ordering & loss | Reordered and retransmitted for you | Arrives as it arrives, or not |
| Overhead | Higher: state, ACKs, slow start | Minimal: 8-byte header |
| Used by | HTTP/1–2, email, SSH, file transfer | DNS, DHCP, VoIP, games, HTTP/3 (QUIC) |
The modern twist: HTTP/3 runs over QUIC, which rebuilds TCP’s reliability on top of UDP to escape decades of TCP’s accumulated constraints. The layers are a design space, not a law.
Why did TCP/IP win?
Because of the “narrow waist”: every application above speaks IP, every technology below carries IP. One universal middle layer let any new app run over any new link technology without either knowing about the other, which is why your doorbell and a supercomputer can share a network.
Draw the stack as an hourglass: dozens of application protocols on top, dozens of link technologies on the bottom, and a single protocol (IP) at the pinch point. Guard that mental image; half of network design decisions make sense only in its light.
Next stop: the addresses themselves
The internet layer runs on IP addresses: continue with IPv4 addressing, or revisit the vocabulary in The OSI Model.
Frequently asked questions
Where does ICMP fit in the stack?
ICMP lives at the internet layer alongside IP. It is IP’s control and diagnostics companion. When you run ping or receive a “destination unreachable”, that is ICMP. It is neither TCP nor UDP and has no port numbers, which is why firewall rules treat it separately.
Why does TCP/IP have 4 layers when OSI has 7?
TCP/IP was engineered pragmatically: separate layers only where real implementations needed a boundary. Sessions, presentation and application never justified separate machinery in practice, so they merged. OSI split finer for standards-committee completeness; the extra granularity survives as vocabulary, not code.
Is HTTP/3 still TCP?
No: HTTP/3 runs over QUIC, which is built on UDP. QUIC reimplements reliability, ordering and congestion control in user space and encrypts almost everything, cutting connection setup to a single round trip. In captures it appears as UDP on port 443.
Do I need to memorise port numbers?
A working handful, yes: 22 SSH, 53 DNS, 80 HTTP, 443 HTTPS, 25/587 mail, 67/68 DHCP. Beyond those, knowing how to look a port up beats memorising hundreds, but the handful above appears in tickets, filters and interviews constantly.