Operator On The Wire
Waitlist
← Back to Knowledge Base
OOTW / Chapter I - Foundation / 03. Networking / 02. TCP IP Model

TCP IP Model

The OSI Model is useful for learning networking.

However, real networks do not actually implement the OSI Model.

Modern networking is based on the TCP/IP Model.

TCPIPModel

Why Two Models Exist

OSI was designed as a theoretical framework.

TCP/IP evolved from real-world networking protocols that eventually became the Internet.

Today:

OSI
=
Learning Model

TCP/IP
=
Real Networking Model

When network engineers, administrators, attackers, and defenders discuss networking, they are usually thinking in terms of TCP/IP.

TCP/IP Layers

Unlike OSI's seven layers, TCP/IP uses four layers.

Application
Transport
Internet
Network Access

Visualized:

+-------------------+
| Application       |
+-------------------+
| Transport         |
+-------------------+
| Internet          |
+-------------------+
| Network Access    |
+-------------------+

OSI vs TCP/IP

OSI Layer 7 ┐
OSI Layer 6 ├── TCP/IP Application
OSI Layer 5 ┘

OSI Layer 4 ─── TCP/IP Transport

OSI Layer 3 ─── TCP/IP Internet

OSI Layer 2 ┐
OSI Layer 1 ┘── TCP/IP Network Access

Notice that TCP/IP combines several OSI layers together.

Application Layer

The Application Layer contains protocols used directly by applications.

Examples:

HTTP
HTTPS
DNS
FTP
SMTP
SSH
RDP
LDAP
SMB

Examples of applications:

Chrome
Firefox
curl
Outlook
mstsc

This is where most pentesters spend their time.

Transport Layer

The Transport Layer provides communication between applications.

Protocols:

TCP
UDP

Responsibilities:

Reliability
Flow Control
Segmentation
Port Numbers

Examples:

HTTPS → TCP/443

DNS → UDP/53

RDP → TCP/3389

Internet Layer

The Internet Layer is responsible for moving traffic between networks.

Protocols:

IPv4
IPv6
ICMP

Responsibilities:

Addressing
Routing
Packet Delivery

Examples:

192.168.1.10
10.0.0.5
8.8.8.8

Routers operate primarily here.

Network Access Layer

The Network Access Layer handles communication on the local network.

Examples:

Ethernet
Wi-Fi

Responsibilities:

Frames
MAC Addresses
Physical Transmission

Example MAC Address:

00:11:22:33:44:55

Switches operate primarily here.

Encapsulation

Data moves down the stack:

HTTP Request
      ↓
TCP Header
      ↓
IP Header
      ↓
Ethernet Header

Result:

[Ethernet]
    [IP]
        [TCP]
            [HTTP]

The receiver removes these headers in reverse order.

Why Operators Care

Nearly every offensive activity relies on understanding where protocols live.

Examples:

HTTP
HTTPS
DNS
LDAP
SMB
Kerberos

exist at:

Application Layer

Examples:

TCP
UDP

exist at:

Transport Layer

Examples:

IPv4
IPv6
ICMP

exist at:

Internet Layer

This allows us to immediately understand:

Where traffic exists
How traffic moves
What tools can see it
What controls can block it

Operator Notes

The TCP/IP Model is the model that actually matters in real environments.

The OSI Model teaches networking concepts.

The TCP/IP Model explains how the Internet actually works.

As we continue through OOTW, we will repeatedly reference:

  • Application Layer
  • Transport Layer
  • Internet Layer
  • Network Access Layer

because every protocol, attack, packet capture, firewall rule, and network defense ultimately lives somewhere within this stack.