TCP/IP — the layered model and ports
Between typing https://example.com and the page appearing, many layers do work. Turn a domain name into an IP address. Choose a route. Split into packets, put them in order, retransmit the missing ones.
Doing all of this in a single program isn't realistic. TCP/IP is a design that splits by role into layers, so an upper layer doesn't need to know the details of the layer below it.
What you'll learn in this chapter
- Why splitting into layers, and TCP/IP's four-layer model
- The division of labor between IP, TCP, and UDP
- The three ranges of port numbers, and the difference between server and client
- Whether IANA registration is required when creating your own protocol
None in particular. If you've used a web site in a browser, you're ready.
Splitting into layers
TCP/IP is made of four layers. Mapped to the OSI reference model's seven layers, it looks like this.
| TCP/IP | OSI | Responsibility | Representative |
|---|---|---|---|
| Application layer | 5–7 (session, presentation, application) | The content of the exchange | HTTP, DNS, SMTP |
| Transport layer | 4 (transport) | How to deliver | TCP, UDP |
| Internet layer | 3 (network) | Where to deliver | IP, ICMP |
| Link layer | 1–2 (physical, data link) | Hand off to the neighboring device | Ethernet, Wi-Fi |
Each layer delegates "carrying" to the layer below. People writing HTTP don't think about packet splitting or retransmission. People implementing TCP don't worry whether it's radio or fiber. This division of labor is the source of the flexibility to combine different technologies.
OSI has seven layers, but in practice people talk about TCP/IP's four. The numbers when a load balancer is called "L7" or "L4" refer to OSI layer numbers: L7 looks inside HTTP content to route, L4 routes by TCP port only. A cloud example is covered by Practical AWS Guide — ALB. How a load balancer distributes across multiple servers is covered in Scaling directions.
IP — where to deliver
IP (Internet Protocol) handles destination specification and route selection. It tags each packet with source and destination IP addresses, and routers pick the next hop by looking at those.
IP offers no guarantees.
- Packets can be lost
- Order can be rearranged
- Duplicates can arrive
The only promise is "deliver as best we can" (best-effort). That's the concession that let networks scale.
TCP and UDP — how to deliver
The transport layer sits on top of IP and decides how to deliver.
| TCP | UDP | |
|---|---|---|
| Connection | Yes (established up front) | None |
| Delivery guarantee | Yes (retransmits) | None |
| Order guarantee | Yes | No |
| Speed | Relatively slower | Fast |
| Uses | Web, mail, file transfer | Video and audio in online meetings, DNS queries |
TCP exchanges three messages to establish a connection, but the client waits only one round trip. The third message, the ACK, needs no reply, so data can start flowing right after it.
This is the three-way handshake. It exchanges sequence numbers so subsequent packets can be reordered and losses detected.
UDP skips this. It doesn't retransmit on loss. In a voice call, moving forward with a missing bit is better than getting the audio late, so that concession fits.
Port numbers
An IP address only identifies "which machine". A single machine runs a web server, a mail server, and more, so you need a number to decide which application receives the packet. That's the port number.
It's 16 bits, so 0 to 65535, divided into three ranges.
| Range | Name | Use |
|---|---|---|
| 0–1023 | System Ports (well-known ports) | Assigned by IANA. HTTP is 80, HTTPS is 443, SSH is 22 |
| 1024–49151 | User Ports (registered ports) | Assigned by IANA. PostgreSQL's 5432, etc. |
| 49152–65535 | Dynamic Ports (ephemeral ports) | Not assigned by IANA. Reserved for one-off use |
The server's port doesn't change
When you visit https://www.example.com, the browser connects to a server port fixed at 443.
It has to be fixed. The client needs to know the port in advance; without a way to know, it can't connect. If a URL has no port, the default derived from the scheme is used (80 for http, 443 for https).
Meanwhile, the client-side source port changes. On each connection the OS picks a free number and assigns it. Which range it picks from varies by OS. This lets the client distinguish which of several simultaneous connections a response is for.
Client 192.0.2.10:52341 → Server 203.0.113.5:443
Client 192.0.2.10:52342 → Server 203.0.113.5:443
What changes is the client-side port after the : (52341 and 52342). The server's 443 stays put.
IANA registration is optional
When creating your own protocol and picking a port, applying to IANA is not required.
RFC 6335 §8.1.2 says the Dynamic Ports (49152–65535) "have been specifically set aside for local and dynamic use and cannot be assigned through IANA". There is nothing to apply for in that range. That rule covers the Dynamic Ports only; the System Ports and the User Ports do have an IANA registry.
The IANA registry is a mechanism for interoperability. Creating the shared understanding of "this port means this service" makes conflicts easier to avoid and defaults easier to pick. If your internal system or experimental protocol doesn't need to share conventions with the outside, using an unregistered port is fine.
LAN uses TCP/IP too
"TCP/IP is a protocol for the internet; LANs use something else" doesn't apply today. Home and office LANs also run on TCP/IP.
Accessing a home printer at 192.168.1.20 or hitting an internal file server both use IP. 192.168.x.x and 10.x.x.x are private IP address ranges — they don't leave the network for the internet, but the protocol is the same TCP/IP.
Historically, LAN-only protocols (IPX/SPX, NetBEUI, etc.) had a period of use, but you rarely see them now. One of the reasons TCP/IP became widely used is that the same protocol handles both LAN and internet.
Relation to HTTP
HTTP is an application-layer protocol; it's carried by the transport layer below.
| Transport | |
|---|---|
| HTTP/1.1 | TCP |
| HTTP/2 | TCP |
| HTTP/3 | UDP (via QUIC) |
HTTP/1.1 and HTTP/2 run on TCP. The understanding that HTTP/1 uses TCP/IP is correct.
HTTP/3 is the exception, layering QUIC on top of UDP and doing retransmission and ordering there. The design reduces the round trips of TCP connection establishment and avoids one lost packet from stalling other streams. The reduction in round trips comes from QUIC integrating TLS 1.3 into connection setup, not from dropping encryption.
Common misconceptions
"Port numbers only apply to the server side." — Both ends need ports. The server listens on a set port like 443; the client is assigned a free one by the OS on each connection. Multiple simultaneous connections to the same server work because the source ports differ per connection.
"Building your own protocol requires IANA registration." — Optional. The Dynamic Ports (49152–65535) are the range RFC 6335 §8.1.2 puts outside IANA assignment, so there is nothing to apply for. The registry is for interoperability, not an obligation.
"TCP/IP is only for the internet; LANs don't use it." — LANs use it too. They just use the private IP address ranges. The protocol is the same.
"All HTTP runs on TCP." — HTTP/3 runs on QUIC on top of UDP. HTTP/1.1 and HTTP/2 are TCP.
"UDP is a degraded version of TCP." — Different purpose. Dropping delivery guarantees keeps latency low, so for use cases prioritizing real-time behavior, UDP is more appropriate.
Exercises
Q1. You open the same page on the same server in two tabs. How are the two TCP connections distinguished?
Answer and explanation
Answer: By the client-side source port number.
A TCP connection is identified by the four-tuple "source IP, source port, destination IP, destination port". Both connections hit the same server on the same service, so destination IP and port (443) are identical. Source IP is the same machine.
Only the source port differs. The OS assigns a different number per connection.
Connection 1: 192.0.2.10:52341 → 203.0.113.5:443
Connection 2: 192.0.2.10:52342 → 203.0.113.5:443
It's not that "the server opens a new port per connection". The server keeps listening on 443.
Q2. You want to build an internal protocol on top of TCP using port 9500. Do you need to apply to IANA?
Answer and explanation
Answer: No.
The IANA registry is a mechanism to build "this port means this service" shared understanding with the outside world. An internal-only protocol shares conventions only within your organization, so registration has no meaning.
That said, 9500 is in the User Ports range (1024–49151), so another service may already be using it. Check the registry before use and confirm it doesn't collide with other software on the same machine.
To reliably avoid conflicts, making it configurable is practical.
Q3. Which of the following is best served by UDP?
A. Bank transfer processing
B. Audio in an online meeting
C. Software download
D. DNS lookup
Answer and explanation
Answer: B and D
| Suited protocol | Reason | |
|---|---|---|
| A Transfer | TCP | Not one byte may be missing. Order must be guaranteed |
| B Audio | UDP | Audio that arrives late is unusable; small losses don't ruin conversation |
| C Download | TCP | File would corrupt. Delivery guarantee is essential |
| D DNS query | UDP | Query and response fit in one round trip. TCP would add setup, not worth it |
The axes are "would loss break it" and "would delay break it". Loss-would-break-it goes to TCP; delay-would-break-it goes to UDP.
DNS falls back to TCP when the response is large (over 512 bytes, for example). It's not UDP forever.
Summary
- TCP/IP is four layers, each delegating carrying to the one below. Corresponds to the seven of OSI
- IP decides destination and route but guarantees neither delivery nor order
- TCP establishes a connection with the three-way handshake and builds reliability via retransmission and reordering. UDP skips these to prioritize speed
- Three port ranges. 0–1023 and 1024–49151 are IANA-assigned; 49152–65535 is out of assignment scope
- The server port is fixed. What changes per connection is the client-side source port
- IANA registration is optional — a mechanism for interoperability
- LANs also use TCP/IP. Not internet-only
- HTTP/1.1 and HTTP/2 are TCP; HTTP/3 runs on QUIC over UDP
- Practical AWS Guide — VPC — Using IP addresses and CIDR in cloud network design
- RFC 6335 — Port number management procedures
What to read next
- DNS — The mechanism that looks up an IP address from a name