Networking · Fundamentals
TCP/IP
The protocol suite that actually runs the internet and virtually every enterprise network, organised into link, internet, transport and application layers.
FoundationalUpdated 2026-09-01
Overview
TCP/IP is a family of protocols rather than two protocols. IP handles addressing and best effort delivery between networks; TCP and UDP handle end to end delivery to a specific process; ICMP carries control and error signalling; and a large set of application protocols sits on top.
The suite is defined by IETF RFCs and deliberately assumes an unreliable network. Reliability, ordering and congestion control are host responsibilities, which is why the model scales from a two device lab to the global internet.
How it works
- 01An application writes data to a socket identified by a protocol, local address and port, and a remote address and port.
- 02TCP segments the stream, numbers the bytes, and establishes a connection with a three way handshake (SYN, SYN ACK, ACK). Lost segments are retransmitted and congestion windows adapt to observed loss and delay.
- 03UDP adds only ports and a checksum: no handshake, no ordering, no retransmission. Applications that need those guarantees implement them themselves, as QUIC does.
- 04IP prepends source and destination addresses and a TTL, then the link layer frames the packet for the local medium. Routers rewrite link layer framing hop by hop while leaving IP addresses intact, except where NAT is applied.
Why it matters
- Almost every fault symptom, slow file transfers, half open sessions, MTU black holes, is explained by TCP or IP behaviour.
- Firewall and load balancer rules are written in TCP/IP terms: protocol, address, port, and connection state.
- Cloud networking (VPCs, virtual networks, security groups) is a software reimplementation of the same primitives.
Reference table
| Property | TCP | UDP |
|---|---|---|
| Connection | Connection oriented handshake | Connectionless |
| Delivery | Reliable, ordered, retransmitted | Best effort, unordered |
| Overhead | 20 byte minimum header, state per session | 8 byte header, no state |
| Congestion control | Yes | Application's responsibility |
| Typical use | HTTP/1.1 and 2, SMB, RDP, SQL, SSH | DNS, DHCP, NTP, SNMP, VoIP, QUIC/HTTP3 |
Where it is used
- Reading packet captures to prove whether a problem is network or application.
- Sizing MTU and MSS for VPN and overlay networks.
- Designing health checks and timeouts that match real transport behaviour.
Security considerations
- Source addresses can be spoofed; do not use IP address alone as an authentication mechanism.
- SYN floods exhaust connection state, mitigate with SYN cookies and upstream scrubbing.
- Plaintext application protocols over TCP are readable in transit; require TLS or an encrypted tunnel.
Common misconfigurations
- MTU mismatch on tunnels causing large transfers to hang while pings succeed.
- Asymmetric routing breaking stateful firewall inspection.
- Allowing ICMP to be blocked wholesale, which breaks path MTU discovery.