TCP/IP Protocol Suite

Learning Objectives

By the end of this reading, you will be able to:

• Understand the structure and components of the TCP/IP protocol suite
• Explain IP addressing, including IPv4 and IPv6
• Perform subnetting calculations and understand CIDR notation
• Compare and contrast TCP and UDP protocols
• Explain the TCP three-way handshake and connection termination
• Understand port numbers and well-known services
• Trace packet routing through a network

Introduction

The TCP/IP (Transmission Control Protocol/Internet Protocol) suite is the foundation of the modern Internet. While the OSI model provides a conceptual framework, TCP/IP is what actually powers network communication worldwide.

In this reading, we'll explore the protocols that make up the TCP/IP suite, with a focus on IP addressing, subnetting, and the transport layer protocols TCP and UDP.

The TCP/IP Model

The TCP/IP model consists of four layers that map to the OSI model:

┌─────────────────────────────────────────┐
│  Application Layer                      │ ← HTTP, DNS, SMTP, FTP
│  (OSI Layers 5-7)                       │
├─────────────────────────────────────────┤
│  Transport Layer                        │ ← TCP, UDP
│  (OSI Layer 4)                          │
├─────────────────────────────────────────┤
│  Internet Layer                         │ ← IP, ICMP, ARP
│  (OSI Layer 3)                          │
├─────────────────────────────────────────┤
│  Network Access Layer                   │ ← Ethernet, Wi-Fi
│  (OSI Layers 1-2)                       │
└─────────────────────────────────────────┘

Internet Protocol (IP)

IP is the primary protocol in the Internet layer, responsible for addressing and routing packets across networks.

IP Characteristics

• Connectionless: No connection setup required
• Best-effort delivery: No guarantee of delivery
• Unreliable: No error checking or correction (left to higher layers)
• Packet-switched: Data divided into independent packets

IPv4 Addressing

IPv4 uses 32-bit addresses, typically written in dotted decimal notation.

Format: Four octets separated by dots Example: 192.168.1.1

Binary:     11000000.10101000.00000001.00000001
Decimal:    192     .168     .1       .1

Address Space: 2^32 = 4,294,967,296 addresses

IPv4 Address Classes

Historically, IPv4 addresses were divided into classes:

Class A: 0.0.0.0     to 127.255.255.255
         [Network][  Host  ][  Host  ][  Host  ]
         Default Mask: 255.0.0.0 (/8)
         Use: Large organizations

Class B: 128.0.0.0   to 191.255.255.255
         [Network][Network][  Host  ][  Host  ]
         Default Mask: 255.255.0.0 (/16)
         Use: Medium organizations

Class C: 192.0.0.0   to 223.255.255.255
         [Network][Network][Network][  Host  ]
         Default Mask: 255.255.255.0 (/24)
         Use: Small networks

Class D: 224.0.0.0   to 239.255.255.255
         Use: Multicast

Class E: 240.0.0.0   to 255.255.255.255
         Use: Reserved/Experimental

Note: Classful addressing is largely obsolete, replaced by CIDR (Classless Inter-Domain Routing).

Special IPv4 Addresses

Subnet Masks

A subnet mask determines which portion of an IP address is the network and which is the host.

IP Address:    192.168.1.100
Subnet Mask:   255.255.255.0

Binary AND operation:
  11000000.10101000.00000001.01100100  (IP)
& 11111111.11111111.11111111.00000000  (Mask)
= 11000000.10101000.00000001.00000000  (Network)
  192.168.1.0

Network Address: 192.168.1.0 (all host bits = 0) Broadcast Address: 192.168.1.255 (all host bits = 1) Usable Hosts: 192.168.1.1 to 192.168.1.254

CIDR Notation

CIDR (Classless Inter-Domain Routing) uses a slash followed by the number of network bits.

192.168.1.0/24

/24 means 24 bits for network, 8 bits for hosts

Subnet Mask: 11111111.11111111.11111111.00000000
             255.255.255.0

Common CIDR Blocks:

Subnetting

Subnetting divides a network into smaller sub-networks.

Example: Subnet 192.168.1.0/24 into 4 equal subnets

1. Determine new prefix:

   • Need 4 subnets = 2^2, so borrow 2 bits
   • New prefix: /24 + 2 = /26

2. Calculate subnet mask:

   • /26 = 255.255.255.192

3. Determine subnet size:

   • Host bits: 32 - 26 = 6 bits
   • Hosts per subnet: 2^6 - 2 = 62

4. List subnets:

Subnet 1: 192.168.1.0/26
  Network:     192.168.1.0
  First Host:  192.168.1.1
  Last Host:   192.168.1.62
  Broadcast:   192.168.1.63

Subnet 2: 192.168.1.64/26
  Network:     192.168.1.64
  First Host:  192.168.1.65
  Last Host:   192.168.1.126
  Broadcast:   192.168.1.127

Subnet 3: 192.168.1.128/26
  Network:     192.168.1.128
  First Host:  192.168.1.129
  Last Host:   192.168.1.190
  Broadcast:   192.168.1.191

Subnet 4: 192.168.1.192/26
  Network:     192.168.1.192
  First Host:  192.168.1.193
  Last Host:   192.168.1.254
  Broadcast:   192.168.1.255

Subnetting Quick Reference

Formula: Number of subnets = 2^n (where n = borrowed bits) Formula: Hosts per subnet = 2^h - 2 (where h = host bits, -2 for network and broadcast)

IPv6 Addressing

IPv6 was developed to address IPv4 address exhaustion.

Key Features:

• 128-bit addresses
• Address space: 2^128 ≈ 340 undecillion addresses
• No need for NAT
• Built-in security (IPsec)
• Simplified header format
• Better support for mobile devices

Format: Eight groups of four hexadecimal digits separated by colons

Full IPv6:      2001:0db8:85a3:0000:0000:8a2e:0370:7334
Compressed:     2001:0db8:85a3::8a2e:0370:7334

Compression Rules:

• Leading zeros in each group can be omitted
• One sequence of consecutive zeros can be replaced with ::

IPv6 Address Types:

1. Unicast: Single interface

   • Global Unicast: 2000::/3 (Internet routable)
   • Link-Local: fe80::/10 (Not routable, local segment only)
   • Unique Local: fc00::/7 (Private networks)

2. Multicast: Multiple interfaces (ff00::/8)

3. Anycast: Nearest of multiple interfaces

Special Addresses:

• ::1 - Loopback (equivalent to 127.0.0.1)
• :: - Unspecified address
• ::ffff:192.168.1.1 - IPv4-mapped IPv6

IP Packet Structure (IPv4)

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|Version|  IHL  |Type of Service|          Total Length         |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|         Identification        |Flags|      Fragment Offset    |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|  Time to Live |    Protocol   |         Header Checksum       |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                       Source IP Address                       |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                    Destination IP Address                     |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                    Options                    |    Padding    |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Key Fields:

• Version: IP version (4)
• TTL (Time to Live): Prevents infinite loops, decremented at each hop
• Protocol: Upper layer protocol (6=TCP, 17=UDP)
• Source/Destination IP: Addresses

Transport Layer Protocols

The transport layer provides end-to-end communication services.

TCP (Transmission Control Protocol)

Characteristics:

• Connection-oriented: Establishes connection before data transfer
• Reliable: Guarantees delivery through acknowledgments
• Ordered: Data arrives in order sent
• Flow control: Prevents overwhelming receiver
• Error checking: Detects and retransmits corrupted data
• Full-duplex: Simultaneous two-way communication

Use Cases:

• Web browsing (HTTP/HTTPS)
• Email (SMTP, POP3, IMAP)
• File transfer (FTP, SFTP)
• Remote access (SSH, Telnet)

TCP Segment Structure

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|          Source Port          |       Destination Port        |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                        Sequence Number                        |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                    Acknowledgment Number                      |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|  Data |       |C|E|U|A|P|R|S|F|                               |
| Offset| Rsrvd |W|C|R|C|S|S|Y|I|            Window             |
|       |       |R|E|G|K|H|T|N|N|                               |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|           Checksum            |         Urgent Pointer        |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Key Fields:

• Sequence Number: Byte number of first data byte
• Acknowledgment Number: Next expected byte
• Flags: SYN, ACK, FIN, RST, PSH, URG
• Window: Flow control, receiver's buffer size

TCP Three-Way Handshake

The TCP connection establishment process:

Client                                Server
  |                                     |
  |  SYN (seq=100)                      |
  |------------------------------------>|
  |                                     |
  |            SYN-ACK (seq=300,        |
  |                    ack=101)         |
  |<------------------------------------|
  |                                     |
  |  ACK (seq=101, ack=301)             |
  |------------------------------------>|
  |                                     |
  |      Connection Established         |
  |<===================================>|

Step 1: SYN

• Client sends SYN packet with initial sequence number (e.g., 100)
• SYN flag set to 1

Step 2: SYN-ACK

• Server responds with SYN-ACK
• Acknowledges client's sequence number (ack=101)
• Sends its own sequence number (seq=300)
• SYN and ACK flags set to 1

Step 3: ACK

• Client sends ACK
• Acknowledges server's sequence number (ack=301)
• ACK flag set to 1
• Connection established, data transfer can begin

TCP Connection Termination (Four-Way Handshake)

Client                                Server
  |                                     |
  |  FIN (seq=500)                      |
  |------------------------------------>|
  |                                     |
  |            ACK (ack=501)            |
  |<------------------------------------|
  |                                     |
  |            FIN (seq=800)            |
  |<------------------------------------|
  |                                     |
  |  ACK (ack=801)                      |
  |------------------------------------>|
  |                                     |
  |      Connection Closed              |

Alternative: Sometimes combined into three steps if server sends FIN+ACK together.

TCP Flow Control: Sliding Window

TCP uses a sliding window for flow control:

Sender's Window:
┌─────────────────────────────────────┐
│ Sent & ACKed │ Sent, Not ACKed │ Can Send │ Cannot Send Yet │
└─────────────────────────────────────┘
               ↑                 ↑
               Window Start      Window End

Process:

1. Receiver advertises window size (available buffer space)
2. Sender can send data up to window size without waiting for ACK
3. As ACKs arrive, window slides forward
4. If receiver's buffer fills, window size = 0 (sender must wait)

UDP (User Datagram Protocol)

Characteristics:

• Connectionless: No connection setup
• Unreliable: No delivery guarantee
• Unordered: Packets may arrive out of order
• No flow control: Sends at any rate
• Lightweight: Minimal overhead (8-byte header)
• Fast: Lower latency than TCP

Use Cases:

• Video streaming
• VoIP (Voice over IP)
• Online gaming
• DNS queries
• DHCP
• Broadcasting/multicasting

UDP Datagram Structure

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|          Source Port          |       Destination Port        |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|            Length             |           Checksum            |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                          Data...                              |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Much simpler than TCP!

TCP vs UDP Comparison

Choosing Between TCP and UDP:

Need reliability? ──Yes──> TCP
       │
       No
       │
       ▼
Need speed? ──Yes──> UDP
       │
       No
       │
       ▼
    Probably TCP

Port Numbers

Ports identify specific applications or services on a device.

Port Number Ranges

Well-Known Ports (0-1023):
    Reserved for common services
    Requires administrative privileges

Registered Ports (1024-49151):
    Assigned to specific services by IANA
    Can be used by regular applications

Dynamic/Private Ports (49152-65535):
    Temporary ports for client connections
    Ephemeral ports

Common Well-Known Ports

Socket Addressing

A socket uniquely identifies a network endpoint:

Socket = IP Address + Port Number

Examples:
  192.168.1.100:80     (Web server)
  10.0.0.5:22          (SSH server)
  172.16.0.10:3306     (MySQL server)

A connection is defined by a 5-tuple:

1. Protocol (TCP/UDP)
2. Source IP
3. Source Port
4. Destination IP
5. Destination Port

Example: TCP 192.168.1.100:52000 → 93.184.216.34:443

ICMP (Internet Control Message Protocol)

ICMP is used for diagnostic and error reporting.

Common ICMP Messages:

Ping Example

Client                           Server (8.8.8.8)
  |                                   |
  | ICMP Echo Request (Type 8)        |
  |---------------------------------->|
  |                                   |
  | ICMP Echo Reply (Type 0)          |
  |<----------------------------------|
  |                                   |

Output:
64 bytes from 8.8.8.8: icmp_seq=1 ttl=116 time=15.4 ms

Traceroute Example

Traceroute uses TTL to discover route:

1st Packet: TTL=1
  → 1st router decrements to 0
  → Sends ICMP Time Exceeded
  → Client learns 1st hop

2nd Packet: TTL=2
  → Passes 1st router (TTL=1)
  → 2nd router decrements to 0
  → Sends ICMP Time Exceeded
  → Client learns 2nd hop

...continues until destination reached

ARP (Address Resolution Protocol)

ARP resolves IP addresses to MAC addresses on a local network.

ARP Process

Computer A wants to send to 192.168.1.5 but doesn't know its MAC:

1. Computer A broadcasts ARP Request:
   "Who has 192.168.1.5? Tell 192.168.1.2"

   [ARP Request - Broadcast]
   Src MAC: AA:BB:CC:DD:EE:01
   Dst MAC: FF:FF:FF:FF:FF:FF (broadcast)
   Src IP:  192.168.1.2
   Dst IP:  192.168.1.5

2. Computer with 192.168.1.5 replies:
   "192.168.1.5 is at 11:22:33:44:55:66"

   [ARP Reply - Unicast]
   Src MAC: 11:22:33:44:55:66
   Dst MAC: AA:BB:CC:DD:EE:01
   Src IP:  192.168.1.5
   Dst IP:  192.168.1.2

3. Computer A caches the MAC address in ARP table

ARP Table Example

IP Address        MAC Address         Type
192.168.1.1       00:0a:95:9d:68:16   dynamic
192.168.1.5       11:22:33:44:55:66   dynamic
192.168.1.10      aa:bb:cc:dd:ee:ff   static

NAT (Network Address Translation)

NAT allows multiple devices on a private network to share a single public IP.

NAT Translation Example

Private Network (192.168.1.0/24)
    |
    |  Computer 192.168.1.100:52000 → Internet
    |
  [NAT Router]
    |  Public IP: 203.0.113.5
    |  Translates to: 203.0.113.5:60000 → Internet
    |
  Internet

NAT Table:
┌──────────────────────┬─────────────────────┐
│ Private              │ Public              │
├──────────────────────┼─────────────────────┤
│ 192.168.1.100:52000  │ 203.0.113.5:60000   │
│ 192.168.1.101:52001  │ 203.0.113.5:60001   │
│ 192.168.1.102:52002  │ 203.0.113.5:60002   │
└──────────────────────┴─────────────────────┘

Benefits:

• IP address conservation
• Security (hides internal network)
• Flexibility (change ISP without renumbering)

Drawbacks:

• Breaks end-to-end connectivity
• Complicates peer-to-peer applications
• NAT traversal needed for some services

Routing

Routing is the process of selecting paths for data across networks.

Routing Table Example

Destination       Gateway         Genmask         Iface
0.0.0.0           192.168.1.1     0.0.0.0         eth0     (Default route)
192.168.1.0       0.0.0.0         255.255.255.0   eth0     (Direct)
10.0.0.0          192.168.1.50    255.0.0.0       eth0     (Static)
172.16.0.0        192.168.1.51    255.240.0.0     eth0     (Static)

Longest Prefix Match: Router chooses most specific route.

Example: Packet destined for 192.168.1.100

• Matches 192.168.1.0/24 (24 bits)
• Matches 0.0.0.0/0 (0 bits)
• Chooses 192.168.1.0/24 (longer prefix)

Exercises

Basic Exercises

1. IP Address Conversion: Convert the following:

   • a) 192.168.1.1 to binary
   • b) 11000000.10101000.00000001.00001010 to decimal
   • c) What class is 172.16.5.10?

2. Subnet Identification: For the IP address 10.50.100.25/16:

   • a) What is the subnet mask?
   • b) What is the network address?
   • c) What is the broadcast address?
   • d) How many usable hosts?

3. TCP vs UDP: For each application, choose TCP or UDP and explain why:

   • a) Video conferencing
   • b) File download
   • c) DNS query
   • d) Email sending

4. Port Identification: What service typically uses these ports?

   • a) 80
   • b) 443
   • c) 22
   • d) 3306

Intermediate Exercises

5. Subnetting Problem: You have network 172.16.0.0/16. Create 8 equal subnets.

   • a) What is the new subnet mask?
   • b) What is the CIDR notation?
   • c) List all 8 network addresses
   • d) How many hosts per subnet?

6. Three-Way Handshake: Draw and label a TCP three-way handshake where:

   • Client initial sequence number: 1000
   • Server initial sequence number: 5000
   • Show all flags and sequence/acknowledgment numbers

7. CIDR Calculation: How many /24 networks can fit in a /20 network? Show your work.

8. Private vs Public: Identify whether these addresses are public or private:

   • a) 192.168.5.10
   • b) 8.8.8.8
   • c) 172.20.10.5
   • d) 10.255.255.255
   • e) 172.32.1.1

Advanced Exercises

9. Complex Subnetting: Design a subnet scheme for a company with:

   • Building A: Needs 500 hosts
   • Building B: Needs 200 hosts
   • Building C: Needs 50 hosts
   • 3 point-to-point links between buildings (2 hosts each)
   • Starting with 192.168.0.0/16
   • Minimize address waste using VLSM (Variable Length Subnet Mask)

10. Routing Analysis: Given this routing table, determine the outgoing interface for each destination:

Network           Gateway       Interface
10.0.0.0/8        0.0.0.0       eth0
172.16.32.0/19    0.0.0.0       eth1
192.168.1.0/24    172.16.32.1   eth1
0.0.0.0/0         10.0.0.1      eth0

Destinations to route:
a) 10.5.10.50
b) 172.16.40.100
c) 192.168.1.50
d) 8.8.8.8
e) 172.16.20.5

11. TCP Sequence Numbers: A TCP connection has:

    • Client ISN: 1000
    • Server ISN: 5000
    • Client sends 500 bytes
    • Server sends 800 bytes
    • Client sends another 300 bytes

    Show the sequence and acknowledgment numbers for each segment.

12. IPv6 Address Manipulation:

    • a) Compress: 2001:0db8:0000:0000:0000:ff00:0042:8329
    • b) Expand: fe80::1
    • c) Identify the address type of: ff02::1

13. Network Design: Design a network addressing scheme for:

    • 4 departments, each needing their own subnet
    • Department sizes: 60, 30, 20, 10 hosts
    • Use 10.0.0.0/24
    • Minimize waste with VLSM
    • Include network, first host, last host, and broadcast for each subnet

Summary

In this reading, we explored the TCP/IP protocol suite in depth:

• IP Addressing: IPv4 uses 32-bit addresses in dotted decimal notation; IPv6 uses 128-bit addresses to solve address exhaustion
• Subnetting: Divides networks into smaller segments using subnet masks and CIDR notation
• TCP: Connection-oriented, reliable protocol with three-way handshake, flow control, and ordered delivery
• UDP: Connectionless, unreliable protocol with minimal overhead, ideal for speed-critical applications
• Port Numbers: Identify specific services (0-1023 well-known, 1024-49151 registered, 49152-65535 dynamic)
• ICMP: Diagnostic protocol used by ping and traceroute
• ARP: Resolves IP addresses to MAC addresses on local networks
• NAT: Allows multiple private IP addresses to share a single public IP
• Routing: Directs packets across networks using routing tables

The TCP/IP suite is the foundation of Internet communication, providing the protocols necessary for devices worldwide to exchange data reliably and efficiently.

Key Takeaways

1. IPv4 addresses are running out; IPv6 provides a massive address space
2. CIDR notation (/24, /16, etc.) is more flexible than classful addressing
3. TCP provides reliability at the cost of speed; UDP provides speed at the cost of reliability
4. The three-way handshake establishes TCP connections reliably
5. Port numbers allow multiple services to run on a single IP address
6. NAT enables IP address conservation but complicates some applications
7. Understanding subnetting is essential for network design and troubleshooting

Next Steps

Now that you understand the TCP/IP protocol suite, you're ready to explore application layer protocols. In the next reading, we'll cover:

• HTTP and HTTPS for web communication
• DNS for domain name resolution
• Email protocols (SMTP, POP3, IMAP)
• FTP for file transfer
• REST APIs and modern web services

Continue to: 03-application-layer.md

Additional Resources

• RFC 791: Internet Protocol (IPv4)
• RFC 793: Transmission Control Protocol
• RFC 768: User Datagram Protocol
• RFC 8200: Internet Protocol, Version 6 (IPv6)
• RFC 1918: Address Allocation for Private Internets
• Subnet calculator tools (online)
• Wireshark for packet analysis

This reading is part of Module 8: Networking