TCP/IP Model

TCP/IP (the Internet Protocol suite) grew from ARPANET research. It was designed to move packets across unlike networks that fail independently. The practical model used in operations has four layers: Network Access (also called Link), Internet, Transport, and Application. They are not a rejection of OSI. They are a coarser grouping of the same jobs.

Map them once and keep the map. Network Access ≈ OSI Layers 1–2: bits on the medium plus frames and MACs on the local hop (Ethernet, Wi-Fi). Internet = OSI Layer 3: IP addressing, routing, ICMP. Transport = OSI Layer 4: TCP or UDP, ports, reliability choices. Application ≈ OSI Layers 5–7: HTTP, DNS, SSH, TLS-as-used-by-apps, session cookies — everything above the transport header. When a vendor says "Layer 7 firewall," they mean they inspect TCP/IP Application data, not that OSI Layers 5 and 6 vanished.

Why did the real internet pick this shape? Because hosts on different physical networks still need one internet layer (IP) that does not care whether the last hop was Ethernet or a serial link, and one transport that apps can call without rewriting for every cable type. OSI's extra drawers (Session, Presentation) describe real concerns — encoding, encryption, dialogue — but those concerns were implemented inside application protocols and libraries, not as separate on-the-wire headers you always expand in Wireshark. The model is not a lie. The packet is not seven equal wrappers.

Headers are the proof. On the way out: application bytes → Transport header (ports, TCP flags or UDP length) → Internet header (IPv4 or IPv6 addresses, TTL) → Link header (MACs, EtherType). On the way in, each device that is not the final destination may strip and rebuild only the Link header (a router) while leaving the IP packet mostly intact. That is why "the MAC changes every hop, the IP destination usually does not" is a TCP/IP fact you will use in the next lesson on how data travels.

The Link header answers "who is the next hop on this wire?" It is local. A switch never needs your destination IP to forward inside one VLAN; it needs the destination MAC. Compromise at this layer (rogue AP, ARP cache poison) can steal or reroute traffic before a Layer-3 firewall ever sees the correct path. ip link on your own box is how you see this layer's addresses without touching anyone else's LAN.

The Internet header answers "which network is this packet trying to reach?" Source and destination IP, protocol number (6 = TCP, 17 = UDP, 1 = ICMP), and TTL. Spoofed sources, unexpected routes, and expired TTL are Internet-layer stories. The Transport header answers "which process?" Source port, destination port, and for TCP the flags and sequence state. A firewall allow for tcp/443 is a Transport match riding on Internet addresses. The Application payload answers "what are they saying?" — Host headers, DNS questions, SSH banners. Encryption can hide that payload; it does not delete the headers below.

TCP versus UDP is a Transport choice, not a religion. TCP sets up a conversation (you will walk the handshake in the next lesson), retransmits, and orders data — browsers and SSH want that. UDP sends datagrams with no session setup — DNS queries and many real-time streams want the lower delay. Neither is "more secure." Security controls must name the protocol: blocking UDP/53 blindly can break name resolution; allowing all TCP because "TCP is reliable" is not a policy.

You cannot dump a live internet packet without a sniffer (later module). You can still see Link vs Internet on your own host: MAC and iface state are Network Access; inet CIDR and routes are Internet. Stay on this machine.

ip link              # Network Access: iface, UP/DOWN, MAC (link/ether)
ip addr              # Internet: inet / inet6 on those ifaces
ip route             # Internet: how this host leaves its networks

Last lesson gave you seven named floors. You now know the internet's four-layer clothing and how headers nest without declaring OSI obsolete. Next up — How Data Travels in Networks — a single click walked hop by hop: DNS preview, TCP handshake idea, switch then router, TTL, and why traceroute lists devices you never typed.