TCP/IP Model: Layers, Protocols and OSI vs TCP/IP

The TCP/IP model describes the protocol suite that runs the internet. It grew out of ARPANET research funded by the US Department of Defense, which is why older books call it the DoD model, and ARPANET switched over to TCP/IP on 1 January 1983. Unlike OSI, which was designed on paper first, TCP/IP was written down after the protocols already worked: RFC 1122 (1989) describes the layers that hosts implement. Interviewers ask about it mostly in comparison with the OSI model, so this note keeps both in view.

The four layers

Application layer

Everything an application needs from the network lives here: the protocol's message format (an HTTP request, a DNS query), and any encryption, compression or session handling, which OSI would put in layers 5 and 6. TLS sits between this layer and TCP, and HTTPS is simply HTTP carried inside TLS.

Transport layer

TCP gives a reliable, ordered, connection-oriented byte stream with flow control and congestion control. UDP gives connectionless, best-effort datagrams with almost no overhead. Both use 16-bit port numbers to deliver data to the right program. QUIC, which HTTP/3 uses, builds reliability on top of UDP. The details are in TCP and UDP.

Internet layer

IP gives every interface an address and moves packets hop by hop towards the destination network. IP is connectionless and best effort: it does not promise delivery, order or freedom from duplicates; those are left to the transport layer. ICMP carries IP's error and diagnostic messages, such as "destination unreachable" and the echo request and reply that ping uses.

Link layer

The link (or network access) layer moves a frame across one physical network to the next hop, using hardware addresses (MAC addresses on Ethernet and Wi-Fi). TCP/IP deliberately says little about it: IP runs over whatever link exists. ARP, which finds the MAC address for an IP address on the local network, is usually placed here.

How TCP/IP maps to OSI

Many Indian university syllabi and popular textbooks teach a five-layer hybrid, because it keeps the useful split between framing and signalling. If an interviewer asks "how many layers?", answer "four in the RFC, five in the textbook hybrid" and name them.

Worked example: how each layer knows what is inside

A receiving host has to hand each unit to the right protocol above it. Every header carries a field that names its payload, so the host can demultiplex a frame step by step.

1. A browser's request, 37 bytes of text, wrapped three times: a 20-byte TCP header makes a 57-byte segment, a 20-byte IP header a 77-byte packet, and Ethernet's 14-byte header and 4-byte FCS a 95-byte frame.
2. The link layer checks the FCS and reads the EtherType, 0x0800: the payload is an IPv4 packet, so it strips the header and trailer and hands the 77 bytes to IP.
3. IP sees its own address as the destination and reads the Protocol field, 6: the payload is a TCP segment, so the 57 bytes go to TCP.
4. TCP reads the destination port, 80, and finds the socket of the process listening there, the web server.
5. The server reads the 37-byte request. Three header fields, one per layer, named what each payload was; 58 of the frame's 95 bytes were headers and trailer.

In IPv6 the Protocol field's job is done by the Next Header field.

Where the tricky protocols sit

Some protocols do a lower layer's job but are carried as application data. Interviewers use them to check that you know the difference between a protocol's purpose and its position.

OSI vs TCP/IP

The two service rows follow Tanenbaum's comparison and are a frequent written-exam question: OSI offers both kinds of service at the network layer but only connection-oriented service at the transport layer; TCP/IP is the other way round.

Common mistakes

• Saying TCP/IP has exactly five layers without qualification: the RFC model has four; five is the textbook hybrid.
• Calling the TCP/IP internet layer "the network layer of TCP/IP" and then putting ARP in it: ARP is usually a link-layer protocol.
• Forgetting that session and presentation duties still exist in TCP/IP: they are done by the application or by TLS.
• Saying IP is reliable: IP is best effort; reliability comes from TCP or from the application.
• Classifying RIP and BGP by purpose rather than position: both are routing protocols carried as application data (UDP and TCP).
• Thinking HTTP/3 means "no transport layer": it runs over QUIC, which runs over UDP.

Interview questions

What are the layers of the TCP/IP model and what does each do? Application (protocols programs use, such as HTTP and DNS), Transport (process-to-process delivery with TCP or UDP), Internet (addressing and routing packets with IP) and Link (moving frames across the local network, such as Ethernet or Wi-Fi). Mention the five-layer variant if the interviewer seems to expect it.

How is the TCP/IP model different from the OSI model? TCP/IP has four layers and was written to describe working protocols; OSI has seven and was designed before its protocols. TCP/IP merges session and presentation into the application layer, offers only connectionless service at the internet layer and both kinds at the transport layer, and is the model the internet actually uses.

Why did TCP/IP win over the OSI protocols? It was already running on ARPANET and was freely included in widely used operating systems such as BSD Unix, while the OSI protocols arrived later and were complex to implement. A working, free, good-enough implementation won adoption first.

Is IP connection-oriented? What does "best effort" mean? No. IP is connectionless: every packet is routed independently with no setup. Best effort means IP tries to deliver each packet but promises nothing about delivery, order, delay or duplication; TCP adds those guarantees where an application needs them.

At which layer does ICMP work, given that it is carried inside IP? At the internet layer. ICMP messages are encapsulated in IP packets (protocol number 1), but ICMP exists only to serve IP, reporting errors such as unreachable destinations and expired TTLs, so it is treated as part of the internet layer.

How does a host know which protocol to hand a received packet to? Each header names its payload: Ethernet's EtherType (0x0800 for IPv4), IP's Protocol field (6 for TCP, 17 for UDP) and the transport header's destination port (443 for HTTPS). The host demultiplexes upwards using these fields.

Where does DNS sit, and which transport does it use? DNS is an application-layer protocol. It normally uses UDP port 53 for queries, and TCP port 53 for zone transfers and for answers too large for UDP. See DNS.

Next, read IP addressing and subnetting, and test yourself with the Computer Networks (Basic) skill test.