The four layers of the TCP/IP model are:
  • Application (Process)
  • Host-to-host (Transport)
  • Internet
  • Network Access (Physical and Data link)


The two protocols that function at the host-to-host layer of the TCP/IP model are TCP and
UDP. (TCP is a connection-oriented, reliable protocol. UDP is a connectionless and unacknowledged protocol.). The protocol number for TCP is 6. The protocol number for UDP is 17.A TCP header contains 20 bytes, and a UDP header contains 8 bytes.

To pass information (such as e-mail) to upper layers, TCP and UDP use Port numbers. These
port numbers are used to keep track of different conversations among different hosts at the same time. Originating source port numbers are dynamically assigned by the source host, which is a number greater than 1023.Defined in RFC 1700, the well-known port numbers are 1 to 1023.

The steps for the TCP three-way handshake are as follows:

Step 1. The source host sends a SYN to the destination host.

Step 2. The destination host replies with a SYN/ACK to the source host.

Step 3. The source host replies with an ACK.

Some protocols that operate at the TCP/IP Internet layer are

  • IP
  • ICMP
  • ARP
  • RARP

IP is a connectionless protocol that provides best-effort delivery routing of datagram's.

ICMP is a management protocol for IP. ICMP messages are carried in IP data grams and are used to send error and control messages. An example of a utility that uses ICMP is ping.

ARP is used to resolve a known IP address to a MAC address. In order for a host to communicate with another host, it must know the MAC address of the destination host (if they are on the same network) or next hop router. This is the reason for ARP

RARP is a protocol used to find the IP address of a station that knows its MAC address. It is mainly used for diskless workstations that boot up and need an IP address. An RARP request is a broadcast packet.