Protocols and Models
Communication Fundamentals
All communication — whether human language or network data — requires three things: a source (the sender), a channel (the medium that carries the message), and a destination (the receiver). Networks are built on this same principle.
For communication to work reliably, both parties must agree on rules: how to encode information into signals (bit patterns), how to format and encapsulate data (agreed structure), timing rules (flow control and response timeouts), and delivery options (who receives the message).
Delivery Options
Network Protocols
A protocol is a set of rules that defines exactly how communication happens between devices. Without protocols, devices from different manufacturers could never communicate. Protocols specify addressing, reliability, flow control, sequencing, error detection, and the application interface.
Real-world network communication is never a single protocol working alone. When you browse a website, multiple protocols work together simultaneously — HTTP + TCP + IP + Ethernet are all active at the same time. This is called a protocol stack: a hierarchical set of protocols where each layer provides services to the layer above it.
TCP/IP Protocol Suite
The TCP/IP protocol suite is the actual standard used by the internet and all modern networks. It is defined in open RFC (Request for Comments) documents. TCP/IP has four layers — each responsible for specific functions:
! Web browser visiting https://bitwithbite.com ! ! Layer 7 - Application: HTTP/HTTPS request GET /index.html HTTP/1.1 Host: bitwithbite.com ! ! Layer 4 - Transport: TCP segment ! Source Port: 49152 (random ephemeral) ! Destination Port: 443 (HTTPS) ! Sequence Number: 100 ! ! Layer 3 - Internet: IP packet ! Source IP: 192.168.1.50 (your PC) ! Destination IP: 104.21.48.1 (web server) ! ! Layer 2 - Network Access: Ethernet frame ! Source MAC: AA:BB:CC:11:22:33 (your NIC) ! Destination MAC: 00:11:22:33:44:55 (router)
The OSI Reference Model
The OSI model (Open Systems Interconnection) was developed by the ISO to provide a universal reference framework for how different network systems could communicate regardless of vendor. It has 7 layers, each with a clearly defined role. OSI is primarily a reference model — TCP/IP is the actual implementation used on real networks.
| Layer | Name | PDU | Key Protocols / Devices | Function |
|---|---|---|---|---|
| 7 | Application | Data | HTTP, DNS, DHCP, FTP, SMTP | User interface, application services |
| 6 | Presentation | Data | SSL/TLS, JPEG, MP3, ASCII | Encryption, decryption, compression, translation |
| 5 | Session | Data | NetBIOS, PPTP, RPC | Session management, dialog control |
| 4 | Transport | Segment | TCP, UDP, Port Numbers | Reliable/unreliable delivery, segmentation, ports |
| 3 | Network | Packet | IP, ICMP, ARP, Routers | Logical addressing, routing between networks |
| 2 | Data Link | Frame | Ethernet, 802.11, Switches, MAC | Physical addressing, MAC addresses, frame delivery |
| 1 | Physical | Bit | Cables, Hubs, Repeaters, NIC | Bits on the wire — electrical, light, or radio signals |
OSI vs TCP/IP Comparison
Both models describe the same network communication, but from different perspectives. TCP/IP is the practical implementation; OSI is the theoretical reference. They map to each other as follows:
Transport — layer 4
Internet — layer 3
Network Access — layers 2+1
Presentation (6) — format/encrypt
Session (5) — session control
Transport (4) — TCP/UDP
Network (3) — IP routing
Data Link (2) — MAC/frames
Physical (1) — bits/cables
Data Encapsulation
Segmentation is the process of breaking large messages into smaller pieces for transmission. This allows different conversations to be interleaved (multiplexing) and means only the failed segment needs retransmitting — not the whole message.
Encapsulation is what happens as data travels down the protocol stack. Each layer adds its own header (and sometimes a trailer) to the data from the layer above. The receiver reverses this process — de-encapsulation — stripping each header as data moves up the layers.
Layer 2 and Layer 3 Addresses
Networks use two different kinds of addresses simultaneously, each serving a different purpose:
Layer 3 (IP) address — a logical address that identifies the source and destination host across the entire network path. IP addresses are used end-to-end: the source IP and destination IP remain the same from the very first hop to the very last hop.
Layer 2 (MAC) address — a physical address burned into the NIC. MAC addresses are only used hop-by-hop between directly connected devices. Every time a packet crosses a router, the router builds a new frame with new source and destination MAC addresses for the next segment of the journey.
ARP (Address Resolution Protocol) is the mechanism that resolves an IP address to a MAC address when both devices are on the same network segment.
IP: 10.0.0.1
Layer 3
IP: 203.0.113.5
Step 1: Download Wireshark from wireshark.org and install it (accept all defaults).
Step 2: Launch Wireshark, select your active network interface (Wi-Fi or Ethernet), and click the blue shark fin to start a capture.
Step 3: Open a web browser and visit any website (try bitwithbite.com). Let it load fully.
Step 4: Return to Wireshark and click the red square to stop the capture. In the filter bar, type
dns and press Enter.Step 5: Find a DNS query packet (type A). Right-click it and choose Follow → UDP Stream. Identify: Source IP, Destination IP (is it 8.8.8.8 = Google DNS?), the DNS query name, and the IP returned in the DNS response.
Step 6: Clear the filter and type
tcp.flags.syn==1. Find the TCP 3-way handshake: SYN → SYN-ACK → ACK. This is TCP establishing a connection before any HTTP data transfers.What you should see: Real Layer 2 (Ethernet), Layer 3 (IP), Layer 4 (TCP/UDP), and Layer 7 (DNS/HTTP) data in every packet. The OSI model made real.
💡 Show hints
- Filter by
httpto see HTTP (unencrypted) requests — note the GET method and Host header - Filter by
ip.addr == 8.8.8.8to see only Google DNS traffic - Click any packet, expand the layers in the bottom pane — you'll see all OSI layers
- The Ethernet II section = Layer 2 (MAC addresses)
- Internet Protocol section = Layer 3 (IP addresses)
- Transmission Control Protocol / UDP = Layer 4 (ports, sequence numbers)