TCP/IP Explained: Layers, Handshake and Ports

The four layers of TCP/IP

If you have studied the seven OSI layers, the TCP/IP application layer covers OSI Layers 5 to 7 and the link layer covers Layers 1 and 2. The middle two layers line up directly.

IP: addressing, routing and delivery

IP gives every interface an address and puts the source and destination addresses in each packet header. Routers read the destination and forward the packet towards it. IP itself does not promise delivery: packets can be lost, duplicated or arrive out of order. The header also carries a TTL (time to live, called hop limit in IPv6) that each router decrements, so a packet caught in a loop is eventually discarded.

ICMP carries control and error messages for IP. ping uses ICMP echo requests and replies, and traceroute relies on ICMP "time exceeded" messages to reveal each router along a path.

TCP versus UDP

QUIC, the transport behind HTTP/3, runs over UDP but adds its own reliability and encryption. That is why modern browsers send much of their traffic to UDP port 443 as well as TCP port 443.

The TCP three-way handshake

Before any data flows, TCP opens a connection with three messages. Each side picks a random initial sequence number (ISN) so that both ends can track which bytes have been received.

1. SYN: the client sends a segment with the SYN flag set and its ISN, say 1000, to the server port, for example 443.
2. SYN-ACK: the server replies with SYN and ACK set, its own ISN, say 5000, and an acknowledgement number of 1001.
3. ACK: the client acknowledges with acknowledgement number 5001. The connection is now established and data can flow both ways.

Client                          Server
  | ---- SYN  seq=1000 ---------->  |
  | <--- SYN-ACK seq=5000 ack=1001  |
  | ---- ACK  ack=5001 ---------->  |
  |        connection open          |

Closing a connection normally uses FIN and ACK messages from each side, while a RST flag aborts it immediately. In Wireshark, the display filter tcp.flags.syn == 1 on a capture of your own traffic shows each handshake clearly.

Common port numbers to know

A port number identifies a service on a host, while an IP address identifies the host itself. Together, the source IP, source port, destination IP, destination port and protocol form a five-tuple that uniquely identifies each connection. Firewalls, NAT devices and load balancers all track traffic using this five-tuple, which is why port knowledge matters as much for security work as for troubleshooting.

Ports 0 to 1023 are well-known ports, 1024 to 49151 are registered ports, and higher numbers are dynamic ports that clients pick for their side of a connection.

Inspecting TCP/IP on Linux

A few commands show what your own machine is doing. Run them on a lab VM or your laptop.

ip a                 # interfaces and IP addresses
ip route             # routing table and default gateway
ss -tulpn            # listening TCP and UDP sockets with process names
ss -tn state established
dig example.com      # DNS lookup over UDP 53

For a fuller tour of these tools, see the Linux for networking guide. If you prefer a guided route, the online networking and security course from SkillNewton builds on these fundamentals through project-based work.

Common mistakes

• Assuming UDP is unreliable in a bad sense, when it is simply the right choice for real-time traffic.
• Forgetting that DNS uses TCP as well as UDP, which matters when writing firewall rules.
• Reading a timeout as "the server is down" without checking whether a firewall is dropping SYN packets.
• Leaving legacy plain-text services such as Telnet or FTP enabled on production devices.
• Learning port numbers by rote without matching them to traffic in a real capture.

Frequently asked questions