Network Layers, TCP and UDP

Introduction

Networking is hard because many problems must be solved at once: electrical signals, addressing, routing, reliability, security, applications. The solution is layers. Each layer does one job and relies on the one below it, so each can change without breaking the rest.

The simple explanation

Posting a parcel: you wrap it (application), the post office adds an address label (internet), and trucks carry it (link). Each step only cares about its own job.

The TCP/IP layers

From top to bottom:

1. Application layer: the protocols your programs speak, such as HTTP, DNS and email.
2. Transport layer: delivers data between programs, using TCP or UDP and port numbers.
3. Internet layer: addresses and routes packets between networks, using IP.
4. Link layer: moves bits across one physical link, such as Wi-Fi or Ethernet.

You may also meet the seven-layer OSI model, which splits these further. It is a useful teaching and discussion tool.

As data travels down on the sender, each layer adds its own header, called encapsulation. On the receiver, each layer removes its header on the way up.

Ports

An IP address finds a computer. A port number (0 to 65535) finds the program on it. Well-known ports:

A connection is identified by the addresses and ports at both ends.

TCP: reliable delivery

TCP (Transmission Control Protocol) provides a reliable, ordered stream of bytes. It does this by:

• Connecting first with a three-way handshake: the client sends SYN, the server replies SYN-ACK, and the client answers ACK.
• Numbering the data, so the receiver can put it in order.
• Acknowledging what arrives, and resending anything lost.
• Flow control: the receiver tells the sender how much it can handle.
• Congestion control: the sender slows down when the network is crowded.

This makes TCP ideal for web pages, email, file transfers and anything where every byte must arrive correctly. The cost is extra delay.

UDP: fast and simple

UDP (User Datagram Protocol) sends independent messages with no connection, no retransmission and no ordering. If a packet is lost, it is gone, unless the application handles it.

It is ideal where speed matters more than perfection, or where old data is useless: live video calls, online games, DNS lookups and streaming. Newer protocols such as QUIC (used by HTTP/3) build their own reliability on top of UDP.

Choosing

• Need every byte, in order? TCP.
• Need low delay and can tolerate loss, or need to build your own rules? UDP.

Seeing it yourself

On your computer, you can list open connections with a command such as:

netstat -an

You will see local and remote addresses with ports, and states such as ESTABLISHED. Tools such as Wireshark show individual packets, which is a powerful way to learn. Only capture traffic on networks you own or have permission to monitor.

Try it yourself

Open a web page, then run netstat -an and find a connection to port 443. Explain which layer each of these belongs to: the port number, the IP address and the HTTP request.

Summary

• Layers split networking into application, transport, internet and link, each with one job.
• Ports identify programs, and TCP gives reliable ordered delivery with a handshake and retransmission.
• UDP is faster and simpler with no guarantees, so it suits real-time traffic.