Protocols and the TCP/IP stack

Two computers made by different manufacturers, running different operating systems and connected through dozens of networks, can exchange a web page in a fraction of a second. That only works because every device follows the same protocols, and because the protocols are organised as a stack of layers, each with one job. Paper 3 asks you to explain why protocols are essential, to describe the four layers of the TCP/IP suite and what each does, and to describe what happens at each layer when a message is sent from one host to another across the internet.

What a protocol is and why it is essential

Think of a phone call between two people who share no language and have never agreed who speaks first. Each can make sounds, but nothing is communicated. Computers are in the same position: one sends a stream of bits, and the other can only make sense of them if both agree exactly what every bit means.

A protocol fixes, among other things:

• the format of messages: which bits are the header, which are the data, how long each field is
• addressing: how the sender and the receiver are identified
• timing and sequencing: who sends first, how long to wait for a reply, how to put pieces back in order
• error detection and correction: checksums, acknowledgements, what to do if data is lost or corrupted
• flow control: how to stop a fast sender overwhelming a slow receiver
• the transmission medium and signalling at the lowest level

Why protocols are arranged in a stack

Getting a file from one computer to another involves many separate problems: what the application wants, splitting it into pieces, finding a route across the internet, and physically sending bits along a cable or radio link. Rather than one huge protocol that does everything, the work is divided into layers. Each layer has its own protocols and its own function.

The layered approach has clear benefits:

• Each layer can be designed, understood and tested separately. A complex problem is decomposed into smaller ones.
• Layers are independent. A protocol at one layer can be changed or replaced without changing the others, as long as the interface between layers stays the same. Replacing Ethernet with Wi-Fi at the bottom layer does not require any change to a web browser.
• Different manufacturers can make products for different layers (network cards, routers, browsers) that work together.
• Each layer on the sender talks logically to the same layer on the receiver, so a programmer at one layer need not know the details of the others.

The four layers of TCP/IP

The internet uses the TCP/IP protocol suite, named after its two most important protocols, TCP and IP. It has four layers.

Application layer

The application layer is where programs that use the network (browsers, email clients, file-transfer programs) hand their data to the stack. Its protocols define what the messages mean: an HTTP request asks for a web page; an SMTP command sends an email. The application layer does not care how the data gets there. The individual protocols are covered in application-layer protocols.

Transport layer

The transport layer gets data from a process on one host to the correct process on the other. Two hosts may have many network programs running at once, so each is identified by a port number (for example 80 for HTTP, 443 for HTTPS, 25 for SMTP).

TCP (Transmission Control Protocol) provides reliable, connection-oriented delivery:

• it establishes a connection before data is sent (the three-way handshake: SYN, SYN-ACK, ACK)
• it splits the application's data into segments and gives each a sequence number
• the receiver sends acknowledgements; any segment that is not acknowledged in time is retransmitted
• a checksum in each segment lets the receiver detect corruption
• the receiver uses the sequence numbers to reassemble the data in the right order, whatever order the segments arrived in
• flow control stops the sender sending faster than the receiver can cope

UDP (User Datagram Protocol) is connectionless and unreliable: no handshake, no acknowledgements, no retransmission. It is faster and has less overhead, which suits live audio and video, online games and DNS look-ups, where a late packet is useless anyway.

	TCP	UDP
Connection	set up before data is sent	none
Reliability	acknowledgements and retransmission guarantee delivery	no guarantee of delivery
Order	reassembled in order using sequence numbers	may arrive out of order
Overhead	larger header, slower	small header, faster
Used for	web pages, email, file transfer	streaming, voice calls, games, DNS

Internet layer

The internet layer moves packets from the source host to the destination host, possibly across many networks. The Internet Protocol (IP) adds a header containing the source and destination IP addresses, and the resulting packet is passed from router to router until it reaches the destination network. Each router uses only the internet layer (and below): it reads the destination IP address and decides where to send the packet next. IP itself is a "best effort" protocol: it does not guarantee delivery or order. That is why TCP is needed above it.

Link layer

The link layer moves data across one physical link, such as the Ethernet cable from a computer to a switch, or the Wi-Fi connection from a laptop to an access point. It wraps the packet in a frame whose header contains the MAC addresses of the two devices at each end of that link, converts the bits into electrical, light or radio signals, and checks each frame for transmission errors. At every router the frame is removed and a new one is built for the next link, so MAC addresses change hop by hop while IP addresses stay the same end to end.

Encapsulation: what each layer adds

As data passes down the stack at the sender, each layer adds its own header (and the link layer often a trailer too) in front of the data it receives from the layer above. This is encapsulation. At the receiver, data passes up the stack and each layer removes its own header, reads it, and passes the remaining data up.

Application   [ HTTP request: GET /index.html ... ]
Transport     [ TCP header | HTTP request              ]            -> segment
Internet      [ IP header  | TCP header | HTTP request ]            -> packet
Link          [ Frame hdr  | IP header  | TCP header | HTTP request | trailer ]  -> frame

Header added by	Contains (main fields)
Transport (TCP)	source and destination port numbers, sequence number, acknowledgement number, checksum
Internet (IP)	source and destination IP addresses, time to live (hop limit), protocol, header checksum
Link (Ethernet)	source and destination MAC addresses; the trailer holds a frame check sequence

Sending a message from one host to another

This is the sequence the syllabus asks for. Suppose a browser on host A requests a web page from server B.

Worked examples

Practice questions

Answers

1. A set of rules governing the transmission of data between devices, including the format of the data, addressing, timing/sequencing and error handling.

2. Any three of: the format of the data and headers; how devices are addressed; the order and timing of messages; error detection and correction; flow control; how a connection is set up and ended; the signalling/transmission medium.

3. A set of protocols organised into layers, where each layer has a specific function, provides services to the layer above and uses the services of the layer below; each layer communicates logically with the corresponding layer on the other device.

4. Application (HTTP, FTP, SMTP, POP3, IMAP, BitTorrent); Transport (TCP or UDP); Internet (IP); Link (Ethernet or Wi-Fi).

5. Any two of: splits data into segments and adds sequence numbers; adds source and destination port numbers so data reaches the correct process; establishes a connection (TCP); acknowledges received segments and retransmits lost ones; checks each segment for errors with a checksum; reassembles segments in the correct order; controls the flow of data.

6. An IP address identifies the host (device) on the internet that the packet must reach, and is used by routers to deliver the packet across networks. A port number identifies the process or service on that host (for example a web server on port 80) that should receive the data.

7. IP is a best-effort protocol: packets may be lost, duplicated, corrupted or arrive out of order, and IP does nothing about it. TCP provides the reliability on top: it numbers segments, checks them, acknowledges them, retransmits any that are lost and reorders them, so the application receives exactly the data that was sent.

8. The link layer (to receive and send frames on each network it connects to) and the internet layer (to read the destination IP address and decide, using its routing table, where to forward the packet). It does not need the transport or application layers because it does not need to know which process the data is for or what the data means; it only moves packets towards their destination host.

9. Link layer: receives the signals, rebuilds the frames, checks them for errors, checks the destination MAC address, removes the frame header and passes the packet up. Internet layer: checks the destination IP address is this host, removes the IP header and passes the segment up. Transport layer: checks each segment's checksum, sends acknowledgements, asks for retransmission of missing segments, puts the segments in order using sequence numbers, removes the TCP headers and delivers the data to the process listening on the destination port (80/443). Application layer: the web server software reads the HTTP request and acts on it.

10. Ethernet and Wi-Fi are both link-layer protocols. Because the layers are independent and communicate through fixed interfaces, changing the link layer does not affect the internet, transport or application layers above it. Browsers (HTTP) and email software (SMTP, IMAP) are application-layer programs, which hand data to TCP exactly as before; only the network interface hardware and its link-layer drivers change.