4.9.4.1 - TCP and IP layers, sockets and ports

The four TCP/IP layers

Layering divides communication into related jobs so that an application can use a service without implementing every detail below it.

The four-layer TCP/IP model in this specification is application, transport, network and link. Do not substitute the seven-layer OSI model when asked for these four layers.

The application layer is not just the user interface: it supplies network protocol behaviour. The transport layer is also broader than TCP; UDP offers a different service without TCP's reliable ordered byte stream. The network layer cannot assume every local link uses the same physical technology, so the link layer handles that technology's details.

[DIAGRAM: asset_slug: tcpip-encapsulation; description: A TCP exchange moves down application, transport, network and link at the sender, then up those four layers at the receiver.]

At the sender, encapsulation adds control information as data passes down the stack. For a TCP exchange, application data is carried by TCP segments; each segment is carried inside an IP packet, which is carried in a link frame. The link can also add an error-check trailer. At the receiver, decapsulation removes the relevant layer's control information and passes its payload up to the next layer.

TCP can number data, use acknowledgements, retransmit missing data and deliver an ordered stream to the application. IP forwards addressed packets but does not itself guarantee delivery or order. Routers act principally on the network-layer destination and send packets through appropriate link-layer connections; they do not need to process the whole application's request to forward it.

Layer boundaries make change manageable. A web application can keep its application protocol while the local connection changes from wired Ethernet to WiFi. The link implementation changes while the higher layers can continue providing their services. Interoperability still requires each peer to implement compatible rules at the relevant layers.

MAC addresses on the local link

Local delivery needs to identify the next interface on the link, which is a different job from identifying the final IP destination.

A Media Access Control (MAC) address identifies an interface for link-layer delivery on technologies such as Ethernet and WiFi. Switches can use destination MAC addresses to choose a local outgoing port. MAC addresses are commonly presented as hexadecimal values. They are often assigned to adapters, but can be changed or spoofed, so they are not an infallible or permanent identity for a user.

If a host sends to a destination outside its local IP network, the first local frame is addressed to the router's local interface. The carried IP packet is addressed to the remote destination. When the router forwards onto another link, it creates the appropriate link frame for that next hop. The local source/destination MAC addresses can therefore change from hop to hop while the final IP destination remains the remote host, in this example with no address translation.

If the destination is on the same local network, the link frame can be addressed directly to that destination interface. The addressing mechanisms used to discover a next-hop MAC are separate from DNS, which resolves domain names. DNS does not supply the MAC address of a distant server for every Internet link.

Sockets and application endpoints

A computer can run many communicating applications at once, so an IP address alone is insufficient to direct incoming data to the intended service.

A port number identifies a transport endpoint/service on a host. A socket is the endpoint through which an application uses transport communication; at this level its address is described by an IP address and a port number, with the transport protocol also relevant. The same numerical port can be used separately with TCP and UDP.

For example, a TCP client endpoint might be 192.0.2.10 with port 53000, communicating with server 198.51.100.20 at port 443. These example addresses are documentation addresses, not instructions to contact real hosts. The IP address identifies the host/interface at the network layer; the port identifies the relevant endpoint at transport. A TCP connection is distinguished by the pair of endpoints, including both source and destination addresses and ports.

Several clients can contact one server port at once because their connections have different endpoint pairs. Even one client can open several connections if it uses different client ports. The server can therefore associate returning data with the correct exchange rather than merely with “the computer using port 443”.

A socket does not create a separate physical cable. The operating system directs received data to the appropriate local endpoint/connection, keeping concurrent applications' exchanges separate over the same network interface.

Well-known ports and client ports

A predictable server port lets a client find a service, while a temporary client port helps identify that client's exchange.

Well-known ports, conventionally 0–1023, are assigned to familiar services so clients have a standard destination to contact. Examples include HTTP on TCP 80 and HTTPS on TCP 443. A server can be configured to use a different port, but clients then need to know that port explicitly. A port number identifies a service endpoint; it does not prove that the traffic really is the claimed protocol or is safe.

When initiating a connection, a client normally selects an available temporary or ephemeral port for its own endpoint. Exact allocation ranges depend on the operating system/configuration; do not assume every client port has one compulsory range. The outgoing TCP segment carries the client port as its source port and the service port as its destination port. Replies reverse those roles, allowing delivery to the waiting client endpoint.

For a client at port 53000 contacting HTTPS at port 443, the outgoing segment uses source 53000 and destination 443. The reply uses source 443 and destination 53000. A second connection can use a different client port, so both can coexist with the same server service.