The internet runs on a family of protocols commonly called the TCP/IP protocol suite. Web requests, API calls, email, remote shells, and database connections all depend on this suite, even when the application does not use TCP directly.

The TCP/IP model organizes these protocols into four layers:

Each layer solves a different part of communication. Application protocols define the messages programs exchange. Transport protocols move data between processes. The Internet layer routes packets between networks. The Network Access layer carries data across the current local link.

TCP/IP is named after two core protocols, Transmission Control Protocol and Internet Protocol, but the suite includes many other protocols. UDP, ICMP, HTTP, DNS, Ethernet, and WiFi all participate in a TCP/IP network.

Unlike a purely conceptual reference model, TCP/IP describes the architecture used by the internet. Its layer boundaries still involve some interpretation, but they correspond closely to deployed protocols and operating-system networking stacks.

The stack places application communication at the top and local network transmission at the bottom.

The layer names matter more than their numbers. Some sources number the Application layer as Layer 4 and Network Access as Layer 1. Others avoid TCP/IP layer numbers because they can be confused with OSI layer numbers.

The following table summarizes the responsibilities and common protocols:

The model uses Network Access, Link, and Network Interface as names for the bottom layer. They describe the same broad scope. A five-layer variation separates physical transmission into its own layer, but the original four-layer view groups local framing and physical transmission together.

TCP/IP is more than a diagram. It is a collection of protocols that cooperate through defined interfaces.

An application can use HTTP without knowing how an Ethernet frame is constructed. TCP can carry bytes without knowing what those bytes mean to the application. IP can route a packet without requiring a specific transport protocol. Ethernet can carry an IP packet without understanding the packet's final destination beyond the current link.

This design allows protocols at one layer to change while preserving the service expected by adjacent layers.

For example, a laptop can move from WiFi to wired Ethernet while continuing to use IP, TCP, and HTTP. A web service can replace HTTP/1.1 with HTTP/2 while continuing to communicate through TCP and IP. A monitoring application can use UDP instead of TCP while relying on the same IP routing system.

The internet architecture is often illustrated as an hourglass. Many applications and transport behaviors exist above IP. Many local network technologies exist below it. IP provides the common packet format and addressing system that connects them.

This narrow common Internet layer is sometimes called the thin waist of the internet architecture. Any application that can send data through IP can operate over any link technology capable of carrying IP packets.

The Application layer contains the protocols and data formats that networked programs use to communicate.

It defines questions such as:

HTTP defines methods, headers, status codes, and resource identifiers for web communication. DNS defines queries and records for name resolution. SMTP defines commands and responses for transferring email. SSH defines secure remote access behavior.

An HTTP request is Application-layer data:

The Application layer in the TCP/IP model covers a broad scope. Data representation, encryption, compression, and session management often live inside application protocols or supporting libraries. TLS, JSON, authentication tokens, and application sessions therefore appear within or near this layer in practical TCP/IP discussions.

The operating system does not need to understand an HTTP method to deliver the request. It treats the application output as data to be passed to the selected transport protocol.

Application-layer failures include name-resolution errors, TLS certificate failures, authentication errors, malformed messages, unsupported protocol versions, and HTTP error responses. Lower layers may deliver the data correctly while the application rejects its meaning.

The Transport layer moves data between processes on endpoint hosts.

IP addresses identify network interfaces or hosts. Transport-layer port numbers identify application endpoints within those hosts.

Consider this connection:

The source port lets the client operating system associate returning data with the correct socket. Destination port 443 identifies the service accepting HTTPS connections on the server.

This process is called multiplexing and demultiplexing. Many applications can use the network at the same time because the transport layer keeps their communication separate using protocol and endpoint information.

TCP

TCP provides a connection-oriented, ordered byte stream. Its responsibilities include:

TCP reliability applies to byte delivery while the connection remains usable. It does not guarantee that an application operation completed. A connection can fail after a server processes a request but before the client receives the response.

UDP

UDP provides connectionless datagram delivery. Each datagram is an independent message with source and destination ports.

UDP does not provide built-in connection setup, retransmission, ordered delivery, or congestion control. This smaller service can suit applications that tolerate loss, implement their own recovery, or use a higher-level protocol built over UDP.

DNS commonly uses UDP for many queries and can use TCP when required. Real-time media often uses UDP because late data may have little value. QUIC uses UDP as its foundation and implements additional transport behavior above it.

Transport-layer failures include connection timeouts, refused ports, reset connections, repeated retransmissions, and attempts to send datagrams to an unavailable service.

The Internet layer moves packets from a source host to a destination across interconnected networks.

Its core protocol is IP:

An IP packet includes source and destination addresses plus control fields used during forwarding. Routers inspect the destination address, consult their routing information, and send the packet toward a suitable next hop.

IP provides a best-effort datagram service. The network attempts to deliver each packet, but IP does not promise delivery, ordering, or protection from duplicates. The transport protocol or application decides whether it needs those properties.

This division keeps routers focused on packet forwarding. A router does not maintain TCP's end-to-end byte order for every connection passing through it. The endpoint transport implementations handle that state.

ICMP also belongs to the Internet layer. It carries network control and error information, including destination-unreachable messages and hop-limit expiration. Diagnostic tools such as ping and traceroute use ICMP behavior, although filtering can affect their results.

The Internet layer hides differences between local network technologies. A packet can leave a client over WiFi, cross provider fiber links, and arrive over Ethernet. The frame format can change at every link while the IP packet continues toward its destination.

Internet-layer failures include incorrect addresses, missing routes, expired hop limits, IP-based filtering, and packet loss along the path.

The Network Access layer handles communication over the network directly attached to a device. It combines local-link delivery with physical transmission.

Its responsibilities include:

Ethernet and WiFi are common Network Access technologies. Ethernet frames commonly use MAC addresses for local delivery. WiFi provides its own wireless framing and medium-access rules.

When a client sends a packet to a remote server, the first frame usually targets the local default gateway. The gateway removes the incoming frame, examines the IP packet, and creates a new frame for the next link.

The frame therefore has hop-by-hop scope. Its addressing and format apply to one link. The IP packet has broader scope and guides delivery across multiple networks.

ARP is commonly placed at the boundary between Network Access and Internet. It maps an IPv4 address on the local network to a MAC address so the sender can construct a frame. IPv6 uses Neighbor Discovery for related local-neighbor functions.

Network Access failures include disconnected media, weak wireless signals, incorrect VLAN membership, missing local address resolution, frame errors, and failed interfaces.

An application passes data down the stack before transmission. Each layer adds the information needed to provide its service.

For an HTTP request over TCP, IP, and Ethernet:

The receiving host reverses the process:

This transformation is not performed by one component. The application or library creates the application message. The operating-system networking stack usually handles TCP and IP. The network-interface hardware and driver handle much of the Network Access work.

Routers process a different portion of the stack than endpoint hosts.

The router receives a WiFi frame in this example, extracts the IP packet, and chooses a next hop. It then places the packet in an Ethernet frame for the outgoing link. It normally does not process the HTTP request or participate in the endpoint's TCP byte stream.

NAT gateways, firewalls, proxies, and other middleboxes can inspect or modify information from additional layers. The diagram shows the basic forwarding path before those additional functions are applied.

TCP/IP places much of the communication intelligence at endpoint hosts.

The network core forwards IP packets using a best-effort service. Endpoints implement application behavior, transport reliability, encryption, retries, and stateful conversations according to their needs.

This separation supports many different applications without requiring routers to understand each one. A router can forward a new application protocol as long as the traffic uses supported network and link protocols.

The division is not absolute. Networks can enforce security policies, translate addresses, balance connections, prioritize traffic, or proxy application requests. The baseline architecture still separates the following scopes:

Application scope: What the message means to the programs.

Transport scope: Which endpoint processes communicate and what delivery behavior they receive.

Internet scope: How packets move between source and destination networks.

Network Access scope: How a packet crosses the current local link.

The four-layer TCP/IP model groups several responsibilities that the seven-layer OSI model separates.

TCP/IP's Application layer covers application protocols as well as most presentation and session behavior.

The Transport layers align closely. Both describe delivery between endpoint processes.

The TCP/IP Internet layer corresponds to OSI's Network layer. The different name distinguishes the TCP/IP architectural layer from a generic network-access mechanism.

TCP/IP's Network Access layer combines OSI's Data Link and Physical layers.

This mapping is approximate. Protocols such as TLS, QUIC, ARP, and VPN tunneling cross or blur the boundaries in both models.

Consider a client requesting:

The four-layer view describes the exchange as follows.

Application

DNS resolves api.example.com to an IP address. The client establishes HTTPS security and creates an HTTP request for /orders/123.

Transport

The client communicates from a temporary source port to the server's destination port. TCP may provide the transport for HTTP/1.1 or HTTP/2. HTTP/3 instead uses QUIC over UDP.

Internet

IP packets carry source and destination addresses. Routers forward each packet across interconnected networks toward the server.

Network Access

The client sends the first frame over WiFi or Ethernet to its next hop. Each router receives the packet through one link and sends it through another. The server's local network delivers the final frame to the server interface.

The response uses the same four responsibilities in the opposite direction. The route and link technologies may differ, but the server still creates application data, transport carries it between processes, IP routes packets, and local links transmit frames.

A failed API request can be narrowed by checking one TCP/IP layer at a time.

Network Access

Confirm that the interface is active, the cable or wireless link works, and the device can communicate with its local gateway. A failed local link prevents every higher layer from operating.

Internet

Check IP configuration and routing. Determine whether packets can reach the destination network and whether filtering blocks the path. A valid local connection does not guarantee a valid route.

Transport

Check the destination protocol and port. A TCP refusal means the destination or an intermediate device actively rejected the connection. A timeout can indicate packet loss, filtering, a missing route, or an unresponsive service.

Application

Check DNS results, TLS negotiation, authentication, request formatting, and application responses. An HTTP 500 response proves that communication reached an HTTP server, but the server failed while processing the request.

Layer-based diagnosis prevents unrelated fixes. Changing HTTP headers cannot repair a disconnected interface, and changing a route cannot correct an expired TLS certificate.

The TCP/IP model assigns clear responsibilities, while several protocols combine them.

TLS protects application data while running over a transport protocol. Implementations commonly place it in an application library, browser, proxy, or runtime.

QUIC runs over UDP but provides reliable streams, congestion control, connection management, and built-in TLS security. It implements transport-like behavior in user space while using UDP for operating-system and network compatibility.

VPNs encapsulate packets inside another protocol. An inner IP packet can represent the application's network communication, while an outer packet carries it between tunnel endpoints.

Proxies and service meshes terminate one connection and create another. The original exchange becomes multiple TCP/IP exchanges connected by application-aware software.

These cases are easier to describe by naming the exact function and protocol than by forcing every component into one layer. The four-layer model remains useful because its main questions stay stable: what message is being exchanged, how do endpoint processes communicate, how are packets routed, and how does each local link carry them?

The TCP/IP model describes internet communication with four layers: Application defines program messages and services, Transport provides process-to-process delivery through protocols such as TCP and UDP, Internet uses IP to address and route packets, and Network Access carries frames and signals across each link.

IP provides a common layer that lets applications and link technologies evolve independently. End hosts handle application and transport behavior, while routers primarily forward IP packets between links.

The most important idea is:

The TCP/IP model maps the deployed internet stack so you can trace data from application to interface, identify which component handles each protocol, and isolate failures.