TCP/IP Network Model

Distributed systems are easier to reason about once the layer a problem belongs to is clear. The TCP/IP model, defined in RFC 1122, uses four layers: link, internet, transport and application. The OSI model splits the same job into seven. The two are not aligned one-to-one, and the word “network” means different things in each, which is the usual source of confusion:

TCP/IP layer	Equivalent OSI layers	Addresses by
Application	Application, Presentation, Session	Resource path
Transport	Transport	Port
Internet	Network	IP address
Link	Data Link, Physical	MAC address

OSI numbers its layers from the bottom up, so “Layer 4” means transport and “Layer 7” means application. Those numbers are OSI’s, and they are what network hardware vendors mean — a “Layer 7 load balancer” is one that reads HTTP. The four TCP/IP layers are referred to by name, not by number, throughout this handbook.

A single URL exercises three of the four layers at once:

192.158.1.38	:8081	/path
Internet layer (IP)	Transport layer (TCP)	Application layer (HTTP)

Link layer

The link layer moves frames between network interfaces on the same physical segment, addressing them by MAC address. Ethernet is the usual protocol. Nothing at this layer knows about IP addresses or routing beyond the local segment.

Internet layer

The internet layer uses IP to route packets from the source IP address to the destination IP address, hop by hop, across networks it does not control. IP is best-effort: packets may be dropped, duplicated, or delivered out of order, and nothing at this layer reports that it happened. Every guarantee above that is added by the transport layer or the application.

Transport layer

The transport layer offers two protocols, and the choice between them is a choice about what to do when the network misbehaves.

UDP sends datagrams and does not track them. There is no handshake, no retransmission and no ordering, so there is also no delay waiting for a lost packet to be resent. That suits real-time video, voice, gaming and broadcast traffic, where a late packet is worth less than no packet. QUIC — and therefore HTTP/3 — is built on UDP, and implements its own reliability on top.

TCP establishes a connection between two endpoints before any data moves, then delivers a stream of bytes reliably and in order, retransmitting whatever is lost. It costs a round trip to set up and it will stall the whole stream while it recovers a lost segment.

Both identify the receiving process by port number. A connection is identified by the full tuple of source address, source port, destination address and destination port, so two clients reaching the same server port hold two distinct sockets — the server does not need a port per client.

Application layer

The application layer defines how a payload is framed inside the byte stream or datagram beneath it. Common protocols:

Protocol	Purpose
HTTP (Hypertext Transfer Protocol)	Transferring hypermedia and API payloads
DNS (Domain Name System)	Resolving host names to IP addresses
SMTP (Simple Mail Transfer Protocol)	Sending mail between servers
FTP / SFTP	Transferring files

See HTTP Protocol for how HTTP’s own versions differ in the way they use the transport beneath them.