🌐 Phase 1 · Networking 🟢 Beginner MODULE 03

Protocols and Models

⏱️ 3.5 hours
📖 Theory + Lab
🧩 10 Questions
🏗️ 1 Lab
Module progress0%
🎯 What you'll learn: Communication fundamentals, network protocols and their functions, the TCP/IP and OSI reference models, data encapsulation at each layer, Protocol Data Units (PDUs), and how Layer 2 and Layer 3 addresses work together.

Communication Fundamentals

All communication — whether human language or network data — requires three things: a source (the sender), a channel (the medium that carries the message), and a destination (the receiver). Networks are built on this same principle.

For communication to work reliably, both parties must agree on rules: how to encode information into signals (bit patterns), how to format and encapsulate data (agreed structure), timing rules (flow control and response timeouts), and delivery options (who receives the message).

Communication Flow
💻 Source
Encoding
Channel / Media
Decoding
🖥️ Destination

Delivery Options

📩
Unicast
One-to-one communication. The most common delivery method. A single source sends to a single specific destination.
Most Common
📢
Multicast
One-to-many specific group. Data is sent to a group of interested receivers. Used for streaming, routing protocols (OSPF, EIGRP).
Group Delivery
📡
Broadcast
One-to-all on the network segment. Every device receives the message. Used by ARP, DHCP. Limited to the local network.
All Devices

Network Protocols

A protocol is a set of rules that defines exactly how communication happens between devices. Without protocols, devices from different manufacturers could never communicate. Protocols specify addressing, reliability, flow control, sequencing, error detection, and the application interface.

Real-world network communication is never a single protocol working alone. When you browse a website, multiple protocols work together simultaneously — HTTP + TCP + IP + Ethernet are all active at the same time. This is called a protocol stack: a hierarchical set of protocols where each layer provides services to the layer above it.

HTTP / HTTPS
Web Browsing
Application-layer protocol for transferring web pages. HTTPS adds TLS encryption. Port 80 (HTTP), Port 443 (HTTPS).
DNS
Name Resolution
Translates human-readable domain names (bitwithbite.com) into IP addresses. Runs on UDP/TCP port 53.
DHCP
IP Addressing
Automatically assigns IP addresses, subnet mask, gateway, and DNS to hosts. UDP ports 67 (server) / 68 (client).
FTP
File Transfer
Transfers files between hosts. Uses TCP ports 20 (data) and 21 (control). SFTP adds SSH encryption.
SMTP / IMAP
Email
SMTP sends email (port 25/587). IMAP retrieves email from server (port 143/993). POP3 also retrieves (port 110).
TCP
Reliable Transport
Connection-oriented, guaranteed delivery, error checking, sequencing. Slower but reliable. Layer 4.
UDP
Fast Transport
Connectionless, no guaranteed delivery, no sequencing. Fast and lightweight. Used for DNS, streaming, VoIP. Layer 4.
IP
Addressing/Routing
Provides logical addressing (IP addresses) and routing between networks. Layer 3. IPv4 and IPv6.
Ethernet
Local Network
The dominant wired LAN technology. Uses MAC addresses for local delivery. Layer 2. IEEE 802.3 standard.

TCP/IP Protocol Suite

The TCP/IP protocol suite is the actual standard used by the internet and all modern networks. It is defined in open RFC (Request for Comments) documents. TCP/IP has four layers — each responsible for specific functions:

🌐
Application
HTTP, HTTPS, FTP, SMTP, DNS, DHCP, Telnet, SSH. User-facing protocols and services.
Layer 7/6/5 equiv
🚚
Transport
TCP (reliable, connection-oriented) and UDP (fast, connectionless). Port numbers live here.
Layer 4 equiv
🗺️
Internet
IPv4, IPv6, ICMPv4, ICMPv6, ARP. Logical addressing and routing between networks.
Layer 3 equiv
🔌
Network Access
Ethernet, 802.11 (WiFi), PPP, Frame Relay, ATM. Physical transmission and MAC addressing.
Layer 2/1 equiv
Protocol stack example — web browser visiting https://bitwithbite.com
STACK
! Web browser visiting https://bitwithbite.com
!
! Layer 7 - Application: HTTP/HTTPS request
GET /index.html HTTP/1.1
Host: bitwithbite.com
!
! Layer 4 - Transport: TCP segment
! Source Port: 49152 (random ephemeral)
! Destination Port: 443 (HTTPS)
! Sequence Number: 100
!
! Layer 3 - Internet: IP packet
! Source IP: 192.168.1.50 (your PC)
! Destination IP: 104.21.48.1 (web server)
!
! Layer 2 - Network Access: Ethernet frame
! Source MAC: AA:BB:CC:11:22:33 (your NIC)
! Destination MAC: 00:11:22:33:44:55 (router)

The OSI Reference Model

The OSI model (Open Systems Interconnection) was developed by the ISO to provide a universal reference framework for how different network systems could communicate regardless of vendor. It has 7 layers, each with a clearly defined role. OSI is primarily a reference model — TCP/IP is the actual implementation used on real networks.

💡
Memory trick: "Please Do Not Throw Sausage Pizza Away"
Physical, Data Link, Network, Transport, Session, Presentation, Application — layers 1 through 7. Or reverse it for top-down: "All People Seem To Need Data Processing."
LayerNamePDUKey Protocols / DevicesFunction
7ApplicationDataHTTP, DNS, DHCP, FTP, SMTPUser interface, application services
6PresentationDataSSL/TLS, JPEG, MP3, ASCIIEncryption, decryption, compression, translation
5SessionDataNetBIOS, PPTP, RPCSession management, dialog control
4TransportSegmentTCP, UDP, Port NumbersReliable/unreliable delivery, segmentation, ports
3NetworkPacketIP, ICMP, ARP, RoutersLogical addressing, routing between networks
2Data LinkFrameEthernet, 802.11, Switches, MACPhysical addressing, MAC addresses, frame delivery
1PhysicalBitCables, Hubs, Repeaters, NICBits on the wire — electrical, light, or radio signals
📝
CCNA exam tip: Know which layer each device operates at
Hub = Layer 1 | Switch = Layer 2 | Router = Layer 3. Also know PDUs by layer: bit (L1), frame (L2), packet (L3), segment (L4). These distinctions appear on almost every CCNA exam.

OSI vs TCP/IP Comparison

Both models describe the same network communication, but from different perspectives. TCP/IP is the practical implementation; OSI is the theoretical reference. They map to each other as follows:

🔵
TCP/IP Model
Application — layers 7+6+5
Transport — layer 4
Internet — layer 3
Network Access — layers 2+1
Real Implementation
📐
OSI Model
Application (7) — user interface
Presentation (6) — format/encrypt
Session (5) — session control
Transport (4) — TCP/UDP
Network (3) — IP routing
Data Link (2) — MAC/frames
Physical (1) — bits/cables
Reference Framework
🤔
Why two models?
OSI was designed as a vendor-neutral reference standard for troubleshooting and interoperability. TCP/IP was developed independently (by DARPA) and became the internet's actual protocol suite. Today we use OSI as the conceptual reference and TCP/IP as the real implementation. When a network engineer says "Layer 2 problem" they mean the Data Link layer — even if the actual protocol in use is TCP/IP.

Data Encapsulation

Segmentation is the process of breaking large messages into smaller pieces for transmission. This allows different conversations to be interleaved (multiplexing) and means only the failed segment needs retransmitting — not the whole message.

Encapsulation is what happens as data travels down the protocol stack. Each layer adds its own header (and sometimes a trailer) to the data from the layer above. The receiver reverses this process — de-encapsulation — stripping each header as data moves up the layers.

Encapsulation — Data Moving Down the Layers
Data (Application)
[TCP Header | Data] — Segment (Transport)
[IP Header | TCP Header | Data] — Packet (Network)
[ETH Header | IP | TCP | Data | ETH Trailer] — Frame (Data Link)
01001010 10110101... — Bits (Physical)
Data
Application layer PDU
Segment
Transport layer PDU (L4)
Packet
Network layer PDU (L3)
Frame
Data Link layer PDU (L2)
Bit
Physical layer PDU (L1)

Layer 2 and Layer 3 Addresses

Networks use two different kinds of addresses simultaneously, each serving a different purpose:

Layer 3 (IP) address — a logical address that identifies the source and destination host across the entire network path. IP addresses are used end-to-end: the source IP and destination IP remain the same from the very first hop to the very last hop.

Layer 2 (MAC) address — a physical address burned into the NIC. MAC addresses are only used hop-by-hop between directly connected devices. Every time a packet crosses a router, the router builds a new frame with new source and destination MAC addresses for the next segment of the journey.

ARP (Address Resolution Protocol) is the mechanism that resolves an IP address to a MAC address when both devices are on the same network segment.

How Addresses Change Across Hops
💻 PC
IP: 10.0.0.1
MAC: AA:BB:CC
Frame 1: src AA:BB:CC → dst 11:22:33
───────→
IP stays: 10.0.0.1→203.0.113.5
🔀 Router
Layer 3
MAC: 11:22:33
Frame 2: src 44:55:66 → dst EE:FF:00
───────→
IP stays: 10.0.0.1→203.0.113.5
🖥️ Server
IP: 203.0.113.5
MAC: EE:FF:00
⚠️
Common exam trap: MAC addresses change at each router hop
MAC addresses change at each router hop. IP addresses do NOT change (unless NAT is involved). A packet from PC to web server keeps the same source and destination IP address the whole way across the internet. Only the Layer 2 MAC address changes at each hop as a new frame is built for the next network segment.
🔬
Lab — Install and Use Wireshark
See real protocols in action on your own network
What you need: A Windows, Mac, or Linux computer with internet access. Wireshark is free and open-source.

Step 1: Download Wireshark from wireshark.org and install it (accept all defaults).

Step 2: Launch Wireshark, select your active network interface (Wi-Fi or Ethernet), and click the blue shark fin to start a capture.

Step 3: Open a web browser and visit any website (try bitwithbite.com). Let it load fully.

Step 4: Return to Wireshark and click the red square to stop the capture. In the filter bar, type dns and press Enter.

Step 5: Find a DNS query packet (type A). Right-click it and choose Follow → UDP Stream. Identify: Source IP, Destination IP (is it 8.8.8.8 = Google DNS?), the DNS query name, and the IP returned in the DNS response.

Step 6: Clear the filter and type tcp.flags.syn==1. Find the TCP 3-way handshake: SYN → SYN-ACK → ACK. This is TCP establishing a connection before any HTTP data transfers.

What you should see: Real Layer 2 (Ethernet), Layer 3 (IP), Layer 4 (TCP/UDP), and Layer 7 (DNS/HTTP) data in every packet. The OSI model made real.
💡 Show hints
  • Filter by http to see HTTP (unencrypted) requests — note the GET method and Host header
  • Filter by ip.addr == 8.8.8.8 to see only Google DNS traffic
  • Click any packet, expand the layers in the bottom pane — you'll see all OSI layers
  • The Ethernet II section = Layer 2 (MAC addresses)
  • Internet Protocol section = Layer 3 (IP addresses)
  • Transmission Control Protocol / UDP = Layer 4 (ports, sequence numbers)
🧩 Module 3 Quiz
10 questions — Protocols and Models
1. How many layers does the OSI model have?
2. At which OSI layer do routers operate?
3. What is the PDU name at the Transport layer?
4. Which TCP/IP layer combines OSI layers 7, 6, and 5?
5. Data encapsulation means:
6. Which protocol resolves IP addresses to MAC addresses?
7. As a packet travels from source to destination through multiple routers, which address changes at each hop?
8. The OSI model was designed primarily for:
9. UDP is best described as:
10. Which layer of the OSI model handles encryption and decryption?
Finished this module?
Mark it complete to track your progress.
🎉
Module 3 Complete!
You understand the OSI and TCP/IP models, data encapsulation, PDUs, and how Layer 2 and Layer 3 addresses work together. Next — the Physical Layer!
← Course Home
Phase 1 · CCNAModule 3 of 17
🗒 Cheat Sheet 📝 Worksheet