The TCP/IP Stack
Four layers, one idea: each layer solves exactly one problem and trusts the layer below.
Why Layers?
Sending bytes across the planet involves dozens of problems — signal encoding, addressing, routing, reliability, naming, encryption. No single protocol could own all of it. So the internet splits the work into layers: each layer offers a service to the one above and consumes a service from the one below. Swap WiFi for fiber and nothing above the link layer notices; swap HTTP for SMTP and nothing below the transport layer cares.
| Layer | Job | Protocols | Unit |
|---|---|---|---|
| Application | What to say | HTTP, DNS, SMTP, SSH | Message |
| Transport | Process-to-process delivery | TCP, UDP | Segment / Datagram |
| Internet | Host-to-host across networks | IP, ICMP | Packet |
| Link | Neighbour-to-neighbour on one medium | Ethernet, WiFi, ARP | Frame |
Encapsulation — Wrapping the Data
Each layer wraps the payload from above with its own header, like nested envelopes. Your HTTP request becomes the payload of a TCP segment, which becomes the payload of an IP packet, which rides inside an Ethernet frame. The receiver unwraps in reverse.
Headers carry the metadata each layer needs: TCP adds ports and sequence numbers, IP adds source/destination addresses, Ethernet adds MAC addresses and a checksum trailer.
Who Reads What
Not every device reads every header. A switch looks only at frames (L2). A router unwraps to the IP packet (L3), picks the next hop, and re-wraps in a fresh frame. Only the end hosts ever look at TCP and HTTP — the network core stays dumb, the intelligence lives at the edges.
- Ethernet frame — stripped & rebuilt per hop
- IP header — TTL decremented, checksum redone
- TCP ports & sequence numbers
- HTTP request itself
- TLS-encrypted payload
traceroute works: it sends packets with increasing TTL. Each router that decrements TTL to zero sends back an ICMP error — revealing itself.See the Stack in Action
# L3/L4: show the path packet takes (TTL trick) traceroute example.com # L4: see live TCP connections and their states ss -t # or netstat -t # L7 over L4 over L3: verbose curl shows DNS, TCP connect, TLS, HTTP curl -v https://example.com
curl -v is a one-command tour of the whole stack: name resolution (DNS), the TCP connect, the TLS handshake, then the HTTP request and response.
Interview Questions
Why is the internet built in layers?
Separation of concerns: each layer solves one problem behind a stable interface, so technologies can be swapped independently — WiFi for Ethernet, HTTP/3 for HTTP/1.1 — without rewriting the rest of the stack.
What is encapsulation?
Each layer prepends its own header to the payload from the layer above — HTTP inside TCP inside IP inside an Ethernet frame. The receiving host strips headers in reverse order.
Difference between a switch and a router?
A switch forwards frames within one network using MAC addresses (L2). A router connects networks, forwarding packets using IP addresses (L3), decrementing TTL each hop.
Map OSI to TCP/IP.
OSI application+presentation+session ≈ TCP/IP application layer; OSI transport = transport; OSI network = internet; OSI data-link+physical ≈ link layer.