TCP/IP Protocol Suite

The TCP/IP model (Internet model) is the practical foundation of the Internet. The original RFC model has 4 layers: Application, Transport, Internet, Network Access (Link). Many textbooks (Forouzan) use a 5-layer version: Application, Transport, Network (Internet), Data Link, Physical. The TCP/IP Application layer combines OSI's Application + Presentation + Session. The TCP/IP Network Access layer combines OSI's Data Link + Physical (in the 4-layer view). Key protocols by layer: Application = HTTP, FTP, SMTP, DNS, SNMP, TELNET; Transport = TCP, UDP; Internet = IP, ICMP, IGMP, ARP (debated placement); Link = Ethernet, Wi-Fi. Remember: TCP/IP has fewer layers and was built before its model was formally defined.

OSI has 7 layers; TCP/IP has 4 (or 5). OSI is a reference/theoretical model (protocols defined after the model); TCP/IP is protocol-driven (model defined after protocols). OSI strictly separates services, interfaces, and protocols; TCP/IP does not. OSI's Network layer supports both connectionless and connection-oriented service; OSI Transport is only connection-oriented. TCP/IP's Internet (Network) layer is connectionless only; its Transport layer supports both (TCP=connection-oriented, UDP=connectionless). OSI was a documentation model that largely failed commercially; TCP/IP succeeded as the Internet standard. Mapping: OSI top 3 (App+Pres+Session) = TCP/IP Application; OSI bottom 2 = TCP/IP Network Access.

GATE CSE almost never lets a Computer Networks paper escape without one or two questions on which protocol sits at which layer of the TCP/IP suite. The questions are mark-rich and time-cheap once you have the mapping memorised cleanly.

Definition: The TCP/IP model is the four-layer architecture (Link, Internet, Transport, Application) that actually runs the Internet. Every protocol that moves data over the network has a "home layer" where it does its main job.

Definition: A port number is a 16-bit identifier that the Transport layer uses to deliver data to the correct application — for example, port 80 for HTTP and port 443 for HTTPS.

A quick map of the layers

The TCP/IP suite (often called the Internet model) has four layers, from bottom to top:

1. Link layer (also called Network Access / Data Link) — moves raw frames over a physical medium.
2. Internet layer (Network layer) — routes packets between networks.
3. Transport layer — provides process-to-process communication.
4. Application layer — provides services directly to user programs.

Some textbooks split the bottom into Physical + Data Link to align with the seven-layer OSI model, but the protocols stay in the same places.

Application-layer protocols (well-known ports)

These protocols use either TCP or UDP (or both) underneath, and most have a well-known port number that GATE loves to test.

• HTTP — HyperText Transfer Protocol — port 80 (TCP). Carries the World Wide Web.
• HTTPS — HTTP over TLS — port 443 (TCP). The secured version.
• FTP — File Transfer Protocol — uses two TCP ports: 21 for control and 20 for data.
• SMTP — Simple Mail Transfer Protocol — port 25 (TCP). Pushes mail between mail servers.
• POP3 — Post Office Protocol v3 — port 110 (TCP). Pulls mail from a server to a client.
• IMAP — Internet Message Access Protocol — port 143 (TCP). Synchronises mail.
• DNS — Domain Name System — port 53. Uses UDP for ordinary queries and TCP for zone transfers and large responses.
• DHCP — Dynamic Host Configuration Protocol — ports 67 (server) and 68 (client). Uses UDP because the client does not yet have an IP address when it sends the first packet.
• TELNET — port 23 (TCP). Remote login (insecure).
• SSH — Secure Shell — port 22 (TCP). Secure remote login.
• SNMP — Simple Network Management Protocol — port 161 (UDP) for agents and 162 for traps.
• TFTP — Trivial FTP — port 69 (UDP). Used in PXE boot and network device firmware loads.

Transport-layer protocols

Only two matter for GATE in the TCP/IP world:

• TCP — Transmission Control Protocol. Connection-oriented, reliable, byte-stream. Provides three-way handshake, sequence numbers, acknowledgements, retransmission, flow control (sliding window) and congestion control. Used by HTTP, HTTPS, FTP, SMTP, POP3, IMAP, TELNET, SSH.
• UDP — User Datagram Protocol. Connectionless, unreliable, message-oriented. No handshake, no acknowledgements, no congestion control. Used where speed matters more than reliability — DNS queries, DHCP, TFTP, SNMP, VoIP, online games, video streaming.

GATE often asks comparisons: "Which of the following is connection-oriented?", "Which protocol is used by DHCP?" — and the answers depend on this short list.

Internet (Network) layer protocols

• IP (IPv4 / IPv6) — Internet Protocol. The layer's workhorse: it provides best-effort, connectionless routing of packets from source to destination.
• ICMP — Internet Control Message Protocol. Carries network-control messages such as echo request/reply (ping), destination unreachable, time exceeded (used by traceroute), and redirect. ICMP messages are encapsulated inside IP datagrams but are considered part of the Internet layer alongside IP.
• IGMP — Internet Group Management Protocol. Used by hosts and routers to manage multicast group membership. Also encapsulated within IP.
• ARP — Address Resolution Protocol. Maps an IPv4 address to a MAC address on the local link. ARP sits at the boundary between the Link and the Internet layer — it is essentially Link-layer in operation, but it is needed for Internet-layer addressing to work. Different textbooks place it differently; both Forouzan and Tanenbaum are common GATE references and disagree slightly. GATE itself usually treats ARP as Link layer.
• RARP — Reverse ARP — maps a MAC to an IPv4 address; obsolete, replaced by DHCP.

In IPv6 the equivalent of ARP is NDP (Neighbour Discovery Protocol), which uses ICMPv6.

Link-layer protocols

These live at the bottom and deal with frames on a wire or air.

• Ethernet (IEEE 802.3) — the dominant wired LAN technology.
• Wi-Fi (IEEE 802.11) — wireless LAN.
• PPP — Point-to-Point Protocol. Used historically for dial-up, modern WAN links and PPPoE/PPPoA.
• Token Ring (IEEE 802.5) — legacy LAN technology, mostly of historical interest, but it still appears in GATE memory aids.
• HDLC — High-level Data Link Control — used in some WAN links.

Why it matters

GATE CSE typically allocates two-to-three marks on Computer Networks to "layer mapping" or "which protocol is connection-oriented" questions. These are pure-recall questions with very low solving time. If you can hold the mapping below in your head, you save 5-7 minutes in the paper and almost guarantee 2-3 marks. Even when the question is wrapped inside a wireshark trace or a routing scenario, the answer almost always reduces to "find the protocol, identify the layer, recall its port".

Real-world example: When you type gate.iitd.ac.in in a browser, your machine first sends a DNS query (UDP, port 53, Application layer). The DNS reply gives an IP address. The browser then opens a TCP connection (Transport) to that IP on port 443. Routing happens at the IP (Internet) layer; an intermediate router may send back an ICMP "time exceeded" message if a TTL expires. On your LAN, ARP is used to find your default gateway's MAC address (Link). Finally, the actual web page arrives via HTTPS (Application). A single page-load touches every layer of the TCP/IP suite — and GATE can ask about each step.

Common misconception: "ICMP and ARP are Transport-layer protocols because they 'do not carry user data'." Wrong. ICMP and IGMP belong to the Internet (Network) layer, even though they ride on top of IP. ARP sits at the Link layer in most modern textbooks because it operates on MAC addresses within a single broadcast domain.

Another mistake is to mix up DNS uses UDP only. DNS uses UDP for small queries (the typical case) and TCP for zone transfers and responses larger than 512 bytes (or 4096 with EDNS0). GATE has set questions to test exactly this nuance.

A third confusion: DHCP uses TCP. No — DHCP must use UDP because the client has no IP address at the moment of DHCPDISCOVER and cannot complete a TCP three-way handshake.

Cover the answer, recall, then check. 12 cards on the TCP/IP protocol suite for GATE CSE.

Q1. List the layers of the TCP/IP model.
A1. Application, Transport, Internet (Network), and Network Access/Link. Often expanded to 5 by splitting Link into Data Link + Physical.

Q2. How do the TCP/IP layers map onto OSI?
A2. TCP/IP Application = OSI Application+Presentation+Session; Transport = Transport; Internet = Network; Link = Data Link + Physical.

Q3. Which protocol is the core of the Internet layer, and what are its guarantees?
A3. IP — connectionless, best-effort, unreliable, unordered delivery. Reliability, if needed, is added by the Transport layer (TCP).

Q4. Name the two Transport-layer protocols and their key contrast.
A4. TCP (connection-oriented, reliable, ordered, flow+congestion control) and UDP (connectionless, unreliable, low-overhead, no congestion control).

Q5. Which supporting protocols live at/around the Internet layer?
A5. ICMP (error/control messages), IGMP (multicast group management), ARP (IP→MAC), RARP (MAC→IP).

Q6. ICMP messages are carried inside what?
A6. ICMP is encapsulated inside IP datagrams (protocol number 1), yet it is considered part of the Internet layer, not the Transport layer.

Q7. Which model came first, and which is a "reference" model only?
A7. TCP/IP protocols were implemented first (practical). OSI is a theoretical/reference model standardized later; TCP/IP has no separate Session/Presentation layers.

Q8. Give protocol number examples used in the IP header's Protocol field.
A8. ICMP = 1, IGMP = 2, TCP = 6, UDP = 17. The field tells the receiver which upper-layer protocol to demultiplex to.

Q9. Where does ARP sit in the TCP/IP stack (common GATE debate)?
A9. Between the Internet and Link layers — it resolves a Layer-3 IP address to a Layer-2 MAC address, so it bridges the two.

Q10. Why is TCP/IP called an "hourglass" model?
A10. Many application/transport protocols above and many link technologies below, but everything narrows to a single Internet-layer protocol (IP) in the middle.

Q11. Name typical Application-layer protocols and their transport choice.
A11. HTTP/FTP/SMTP/TELNET → TCP; DNS/DHCP/TFTP/SNMP/RIP → UDP (DNS uses TCP for large/zone transfers).

Q12. Which addresses operate at Application, Transport, Internet, and Link layers?
A12. Application → names/URLs; Transport → port numbers (16-bit); Internet → IP address (32-bit v4); Link → MAC address (48-bit).

Worked Example

Problem: Assign each protocol to its layer in the four-layer TCP/IP model: HTTP, TCP, UDP, IP, ARP, Ethernet. How does the TCP/IP model's layering compare with the 7-layer OSI model?

Solution:
The TCP/IP model has four layers: Application, Transport, Internet, and Network Access (Link).

Place each protocol:

• HTTP → Application layer (handles web request/response semantics).
• TCP and UDP → Transport layer (process-to-process delivery; TCP reliable, UDP best-effort).
• IP → Internet layer (logical addressing and routing across networks).
• Ethernet → Network Access / Link layer (framing and physical delivery on the local link).
• ARP → resolves IP to MAC addresses; it bridges Internet and Link layers and is usually classified at the Link (Network Access) layer.

Comparison with OSI: the TCP/IP Application layer combines OSI's Application, Presentation, and Session layers; the TCP/IP Network Access layer combines OSI's Data Link and Physical layers. Transport and Internet map directly to OSI's Transport and Network layers.

Answer: HTTP → Application; TCP, UDP → Transport; IP → Internet; ARP, Ethernet → Network Access (Link). TCP/IP's 4 layers condense OSI's 7 (merging the top three and the bottom two).