Exercises — TCP - IP model — 4 layers, mapping to OSI

WHAT is being asked: two raw counts. (Reminder: the ==...== marks below just flag these numbers as key terms to memorise — read ==4== as the plain number 4.)

• TCP/IP model = 4 layers (Application, Transport, Internet, Network Access).
• OSI model = 7 layers (Application, Presentation, Session, Transport, Network, Data Link, Physical).

Answer: TCP/IP has 4, OSI has 7.

Top → bottom: Application → Transport → Internet → Network Access. Mnemonic from the parent note: "All The Internet Needs" → Application, Transport, Internet, Network access.

Reading top → bottom, each layer wraps the one above and gives the result a new name:

WHY the names change: each layer adds its own header, so the bundle is genuinely a different object at each level — a new name signals "new envelope wrapped around the old one."

Step 1 — WHAT are ports for? Ports let one host run many programs and still send each byte to the right program. This "deliver to the correct application" job is called demultiplexing. Why this step: it tells us which layer's job we are naming. Step 2 — WHICH layer demultiplexes? That is port handling, done by TCP/UDP → the Transport layer. Answer: Transport layer (OSI Layer 4).

Step 1: Recall the merge pattern 3 → 1 → 1 → 2. The "3" is OSI's top three: Application, Presentation, Session. Step 2: All three fold into TCP/IP Application — because in practice the app program handles session-keeping and data formatting itself. Answer: Application layer.

Step 1 — WHAT does the app want? Speed over perfect reliability; a late frame is useless, a missing one is fine. Step 2 — WHICH protocol fits? TCP vs UDP: TCP is reliable + ordered but adds delay (retransmits). UDP is fast, connectionless, no retransmit. Live video → UDP. Step 3 — WHICH layer? Both TCP and UDP live at the Transport layer. Answer: Use UDP, and it is a Transport-layer choice.

The pattern from top to bottom is 3 → 1 → 1 → 2:

• Top 3 OSI layers merge → TCP/IP Application.
• Transport stays 1→1 (OSI Transport ↔ TCP/IP Transport).
• Network stays 1→1 (OSI Network ↔ TCP/IP Internet, just renamed).
• Bottom 2 merge → TCP/IP Network Access.

WHY only the ends merge: OSI's extra top layers (Presentation/Session) describe how the app formats and keeps a conversation — real apps do this internally, so no separate box is shipped. OSI's bottom two (Data Link + Physical) are both "getting bits onto a medium," so real hardware treats them as one job. The middle two are genuinely distinct, universal jobs — "reliable delivery to a program" and "route to a host" — so nobody merges them. The over-merger's error: applying the "squish" idea to the middle, e.g. claiming Transport maps to 2 layers. It maps to exactly one.

Step 1 — classify each:

• ICMP — used for ping/error messages, carried inside IP packets → Internet layer.
• ARP — resolves an IP address into a MAC address on the local network segment. In the standard TCP/IP model ARP belongs to the Network Access (Link) layer, because its job is confined to one physical segment (finding the hardware address of the next hop), not routing across networks.
• SMTP — email protocol → Application layer.

Step 2 — odd one out. All three sit at three different layers (Internet, Network Access, Application). If forced to name the single most "different in kind," it is SMTP: it is the only user-facing application protocol, while ICMP and ARP are both low-level plumbing (error reporting / hardware-address resolution) that a user never invokes directly. Answer: SMTP is the odd one out — the only Application-layer protocol; ICMP is Internet-layer and ARP is Network-Access (Link) layer.

Step 1 — count and compare. The classic TCP/IP model has 4 layers; here the single Network Access layer has been split into Data Link + Physical (borrowed from OSI). That gives 5. Step 2 — verdict. This is the hybrid 5-layer teaching model, popular because splitting Network Access makes framing (Data Link) vs raw signalling (Physical) easier to teach. Step 3 — exam rule. If the question says "the TCP/IP model" with no qualifier, answer 4. The 5-layer version is a teaching hybrid, not the original. Answer: No — it's the 5-layer hybrid; the original TCP/IP model has 4 layers.

Follow the picture below as you read.

Figure 2 — Encapsulation going down the stack. Four layer boxes stacked top to bottom — Application (magenta), Transport (violet), Internet (orange), Network Access (navy) — each with a downward arrow to the next. Beside each box, the data unit it produces is labelled: Application → "message"; Transport → "segment (+TCP header, port 443)"; Internet → "packet (+IP header, addresses)"; Network Access → "frame → bits (+MAC header/trailer)". At the bottom a magenta caption reads "message → segment → packet → frame → bits". On the right, a nested-envelope icon shows a small "msg" box inside an orange box inside a white box, illustrating that each header wraps the whole thing above it.

Step 1 (Application): Browser builds an HTTP request message. Why: the App layer speaks HTTP; it produces the raw meaningful content. Step 2 (Transport): TCP adds a header carrying port 443 → now a segment. Why: to deliver reliably to the right service on the destination host. Step 3 (Internet): IP adds source + destination IP addresses → now a packet. Why: to route across networks to the correct host. Step 4 (Network Access): Ethernet/WiFi adds a MAC header + trailer → now a frame, then it becomes bits on the wire. Why: to physically reach the next hop.

Chain: $\text{message}\to \text{segment}\to \text{packet}\to \text{frame}\to \text{bits}$.

At the server (decapsulation — exact reverse): bits → strip the whole frame (both MAC header and trailer) → packet → strip IP header → segment → strip TCP header → message → handed to the web server app. ✅

Step 1 — list the wraps below Application: Transport (TCP header), Internet (IP header), Network Access (frame/MAC header). That is 3 headers added. Step 2 — the message itself: the Application message has no additional wrapping header from a lower layer at the App level, so we count only the three below it. Answer: 3 headers (TCP + IP + frame header). (Note: the Network Access frame also adds a trailer — e.g. Ethernet's checksum — but this exercise asked for headers only, so we deliberately exclude it. See L4.3, which does account for the trailer.) General rule: if there are $n$ layers below Application that each add one header, the message carries $n$ headers by the time it hits the wire. Here $n=3$.

Server encapsulates (down its stack): message → (add TCP header) segment → (add IP header) packet → (add MAC header + trailer) frame → bits. Your machine decapsulates (up your stack): bits → (strip the whole frame: MAC header and trailer) packet → (strip IP header) segment → (strip TCP header) message. WHY the trailer matters here: the Network Access layer wraps the payload with a header in front and a trailer behind (the trailer holds the frame-check checksum used to detect corruption). So "stripping the frame" means removing both the header and the trailer — not just the front. Skipping the trailer would leave stray bytes glued to the packet. Mirror check: encapsulation order = App, Transport, Internet, Net-Access (top→bottom). Decapsulation order = Net-Access, Internet, Transport, App (bottom→top). One list reversed is the other — that's the "last envelope on is the first envelope off" rule (like taking off a coat, then a jacket, in reverse of the order you put them on).

Step 1 — what does a router's job require? A router forwards packets between networks based on destination IP. That is a decision made at the Internet layer. Step 2 — how far up must it climb? To read the IP header it must decapsulate up to the Internet layer, but it does not need the ports (Transport) or the HTTP message (Application). Those stay sealed as opaque payload — separation of concerns. Step 3 — the bottom. Each hop is a fresh physical link, so the router strips the incoming frame (Network Access) and builds a new frame with the next hop's MAC address before sending on. Answer: The router processes Network Access (rebuilds the frame) and Internet (reads/routes on IP). It does not touch Transport or Application — those remain untouched payload. Edge insight: this is exactly why layering pays off — the router upgrades the link (new frame each hop) without ever understanding your web request.

Step 1 — map each capability to the layer whose header/data it must read:

• Block by IP address → it must read the IP header (source/destination address) → Internet layer.
• Block by port number → it must read the TCP/UDP header (which carries the port) → Transport layer.
• Inspect the HTTP path (e.g. block /admin) → it must read the application message itself → Application layer.

Step 2 — WHAT it means that one box touches all three. To filter on the HTTP path, the firewall cannot stop at the IP header; it must decapsulate all the way up the stack — strip the frame, strip the IP header, strip the TCP header, and finally read the application payload. Reading the payload like this is called deep packet inspection (DPI). Step 3 — contrast with the router (L5.1). A plain router only needed the Internet layer (destination IP) and then re-framed. This firewall goes two layers further up (Transport, then Application). So the deeper you filter, the more envelopes you must peel — and the more work per packet. Answer: IP filtering = Internet layer, port filtering = Transport layer, HTTP-path filtering = Application layer. One box touching all three means it performs full decapsulation up to the Application layer (deep packet inspection), doing far more per-packet work than a simple IP router.

Step 1 — Application: still builds a real message (e.g. an HTTP request to 127.0.0.1:8080). Step 2 — Transport: still uses ports to reach the right program — this is essential even locally, because that's how the OS knows which local process gets the bytes. Step 3 — Internet: IP is still used — the destination is the loopback address 127.0.0.1. Routing is trivial ("it's me"), but the IP layer is logically present. Step 4 — Network Access (the edge): there is no real Ethernet/WiFi hardware. The OS provides a virtual loopback interface: the frame never leaves the machine; the kernel simply hands the packet back up its own stack. So the layer exists logically but the "physical medium" is memory, not copper/radio. Answer: All 4 layers are logically involved; the Network Access layer is served by a virtual loopback — bits are copied in memory, no physical transmission occurs. This edge case proves the model is about logical responsibilities, not literal wires.

L1 done → you can name layers, counts, data units. L2 done → you can apply layer facts to fresh inputs (ports, TCP vs UDP). L3 done → you can analyse boundaries (why only ends merge; classify protocols by their true layer). L4 done → you can build a full encapsulation/decapsulation trace, count headers, and account for the frame trailer. L5 done → you can reason about routers, firewalls, and loopback edge cases. Mastery. ✅