The Internet protocol suite is the set of protocols that implement the protocol stack on which the Internet runs. It is sometimes called the TCP/IP protocol suite, after two of the many protocols that make up the suite: the Transmission Control Protocol (TCP) and the Internet Protocol (IP), which were the first two defined. The authoritative reference on this subject is RFC 1122.
The Internet protocol suite can be described by analogy with the OSI model, which describes the layers of a protocol stack, not all of which correspond well with Internet practice. In a protocol stack, each layer solves a set of problems involving the transmission of data, and provides a well-defined service to the higher layers. Higher layers are logically closer to the user and deal with more abstract data, relying on lower layers to translate data into forms that can eventually be physically manipulated.
The Internet model was produced as the solution to a practical engineering problem. The OSI model, on the other hand, was a more theoretical approach, and was also produced at an earlier stage in the evolution of networks. Therefore, the OSI model is easier to understand, but the TCP/IP model is the one in actual use. It is helpful to have an understanding of the OSI model before learning TCP/IP, as the same principles apply, but are easier to understand in the OSI model.
In addition, the OSI model is not really rich enough at the lower layers to capture the true layering; there needs to be an extra layer (the Internetworking layer) between the Transport and Network layers. Protocols specific to a particular network type, but which are run on top of the basic hardware framing, ought to be at the Network layer. Examples of such protocols are ARP, and the Spanning Tree Protocol (used to keep redundant bridges idle until they are needed). However, they are local protocols, and operate beneath the internetwork functionality; to place both groups (not to mention also protocols which run on top of the internetwork protocol, such as ICMP) all at the same layer can be confusing.
The following diagram attempts to show where various TCP/IP and other protocols would reside in the original OSI model:
Layers in the TCP/IP Stack
There is some discussion about where the distinctions between layers are drawn. Since the TCP/IP and OSI protocol suites do not match precisely, there is no one correct answer.
| 7 | Application | e.g. HTTP, SMTP, SNMP, FTP, Telnet, NFS |
| 6 | Presentation | e.g. XDR, ASN.1, SMB, AFP |
| 5 | Session | e.g. ISO 8327 / CCITT X.225, RPC, NetBIOS, ASP |
| 4 | Transport | e.g. TCP, UDP, RTP, SPX, ATP |
| 3 | Network | e.g. IP, ICMP, IGMP, X.25, CLNP, ARP, OSPF, RIP, IPX, DDP |
| 2 | Data Link | e.g. Ethernet, Token ring, PPP, HDLC, Frame relay, ISDN, ATM |
| 1 | Physical | e.g. electricity, radio, laser |
Commonly, the top three layers of the OSI model (Application, Presentation and Session) are considered as a single Application Layer in the TCP/IP suite. Because the TCP/IP suite has no unified session layer on which higher layers are built, these functions are typically carried out (or ignored) by individual applications. A simplified TCP/IP interpretation of the stack is shown below:
| Application "layer 7" | e.g. HTTP, FTP, DNS (routing protocols like RIP, which for oscure reasons run over UDP, may also be considered part of the network layer) | |
| 4 | Transport | e.g. TCP, UDP, RTP (routing protocols like OSPF, which run over IP, may also be considered part of the Network layer) |
| 3 | Network | For TCP/IP this is the Internet Protocol (IP) (required protocols like ICMP and IGMP run over IP, but may still be considered part of the network layer; ARP does not run over IP) |
| 2 | Data Link | e.g. Ethernet, Token ring, etc. |
| 1 | Physical | e.g. physical media, and encoding techniques |
The Physical Layer
The Physical layer describes the physical characteristics of the communication, such as conventions about the nature of the medium used for communication (such as wires, fiber optic links or radio links), and all related details such as connectors, channel codes and modulation, signal strengths, wavelengths, low-level sychronization and timing and maximum distances.
The Data-Link Layer
The Data link layer specifies how packets are transported over the physical layer, including the framing (i.e. the special bit patterns which mark the start and end of packets). Ethernet, for example, includes fields in the packet header which specify which machine or machines on the network a packet is destined for. Examples of Data-link layer protocols are Ethernet, Wireless Ethernet, SLIP, Token Ring and ATM.
PPP is a little more complex, as it was originally specified as a separate protocol which ran on top of another data link layer, HDLC/SDLC.
This layer is sometimes further subdivided into Logical Link Control and Media Access Control.
The Network Layer
As originally defined, the Network layer solved the problem of getting packets across a single network. Examples of such protocols are X.25, and the ARPANET's Initial Connection Protocol.
With the advent of the concept of internetworking, additional functionality was added to this layer, namely getting data from the source network to the destination network. This generally involves routing the packet across a network of networks, known as an Internet. In the Internet protocol suite, IP performs the basic task of getting packets of data from source to destination, and also supports other protocols, such as ICMP (used to transmit diagnostic information about IP transmission) and IGMP (used to manage multicast data). ICMP and IGMP are layered on top of IP but perform network layer functions, illustrating an incompatibility between the Internet and OSI models.
The Network Layer Internet Protocol (IP) can carry data for a number of different higher level protocols. These protocols are each identified by a unique IP Protocol Number. ICMP and IGMP are protocols 1 and 2, respectively.
The Transport Layer
The protocols at the Transport layer can solve problems like reliability ("did the data reach the destination?") and ensure that data arrives in the correct order. In the TCP/IP protocol suite, transport protocols also determine which application any given data is intended for.
The dynamic routing protocols which technically fit at this layer in the TCP/IP Protocol Suite (since they run over IP) are generally considered to be part of the Network layer; an example is OSPF (IP protocol number 89).
TCP (IP protocol number 6) is a "reliable", connection-oriented transport mechanism providing a reliable byte stream, which makes sure data arrives undamaged and in order, is re-transmitted if lost, and eliminates duplicate copies. It also handles "emergency" content which must be processed out of order (although technically it is not sent out-of-band). TCP will attempt to deliver all data correctly in the specified sequence - this is its purpose and main advantage over UDP, but it can be a disadvantage in real-time streaming or routing applications with high layer 3 loss rates.
UDP (IP protocol number 17) is a lower-overhead, connectionless protocol. It is known as an "unreliable" protocol - not because it is particularly unreliable, but because it does not verify that packets have reached their destination, and gives no guarantee that they will arrive in order. If an Application requires these guarantees, it must provide them itself, or use TCP.
UDP is typically used for applications such as streaming media (audio and video, etc) where the time TCP requires for retransmission and re-ordering might not be available, or for simple query/response applications like DNS lookups, where the overhead of setting up a reliable connection is disproportionately large.
Both TCP and UDP are used to carry a number of higher-level applications. The applications at any given network address are distinguished by their TCP or UDP Port Number. By convention certain well known ports are associated with specific applications.
RTP is an attempt to provide a compromise between TCP and raw UDP. Although it uses the UDP packet format as a basis, it provides a function that is at the same protocol layer.
The Application Layer
The Application layer is where most common network programs reside.
These programs and their corresponding protocols include HTTP (The World Wide Web), FTP (File transport), SMTP (Email), SSH (Secure remote login), DNS (Name <--> IP Address lookups) and many others.
Applications most commonly run on TCP or UDP, and are often associated with a Well Known Port number. Some examples are:
- HTTP on TCP port 80 or 8080.
- SSH on TCP port 22,
- DNS lookups on UDP (or sometimes TCP) port 53,
- RIP routing updates on UDP port 520.
Feel free to add to this list: Echo, QOTD, Telnet, NTP, DHCP (Kind-of), Finger, IMAP, SNMP, IRC, POP3, IMAPS, HTTPS, POPS, RTSP, NNTP, Gopher.
