TCP/IP

TCP/IP

TCP/IP stands for Transmission Control Protocol/Internet Protocol.
It is the fundamental networking architecture used by the modern Internet and by many private networks.

TCP/IP is not just one protocol. It is a collection of protocols that work together to provide
communication between computers, phones, servers, network devices and applications.

For cybersecurity professionals, understanding TCP/IP is essential because network attacks,
security controls, logs, firewalls, intrusion detection systems and network investigations
all depend heavily on TCP/IP concepts.

1. Why TCP/IP Matters

When you open a website, send an email, connect to a server or access a cloud application,
multiple networking protocols work together.

A simplified communication process might look like this:

Application
     ↓
Transport
     ↓
Internet
     ↓
Network Access
     ↓
Physical Network

Each layer performs a particular function while cooperating with the layers above and below it.

2. The TCP/IP Model

A commonly taught TCP/IP model contains four major layers:

Some educational materials divide the Network Access layer into separate
Data Link and Physical layers, resulting in a five-layer model.
The terminology can vary, but the underlying networking concepts remain closely related.

3. Application Layer

The Application layer contains protocols that provide network services
used by applications.

Examples include:

• HTTP — web communication.
• HTTPS — encrypted web communication using TLS.
• DNS — name resolution.
• SSH — secure remote administration.
• SMTP — email transfer.
• IMAP — email access.
• DHCP — automatic network configuration.

The Application layer does not mean only the visual application that a user interacts with.
It refers to protocols and services that applications use to communicate over a network.

4. Transport Layer

The Transport layer provides communication between application processes
running on different systems.

Two major transport protocols are:

• TCP
• UDP

TCP

TCP is connection-oriented and provides mechanisms for reliable and ordered delivery.
It uses acknowledgements, sequencing and retransmission mechanisms.

UDP

UDP is connectionless and has lower protocol overhead.
It does not provide TCP’s built-in reliability mechanisms.
Applications can implement their own reliability or use UDP where immediate delivery
is more important than retransmission.

5. Internet Layer

The Internet layer is responsible for logical addressing and routing packets
between networks.

The Internet Protocol, especially IPv4 and IPv6, operates at this layer.

Example IPv4 address:

192.168.1.25

Example IPv6 address:

2001:db8::25

Routers use IP addressing and routing information to determine how packets should travel
toward their destination.

6. Network Access Layer

The Network Access layer deals with local network communication and
access to the underlying transmission medium.

Examples include:

• Ethernet.
• Wi-Fi.
• MAC addressing.
• Local frame delivery.

A switch, for example, uses MAC addresses to make local forwarding decisions.

7. TCP/IP and the OSI Model

The OSI model contains seven layers, while the commonly taught TCP/IP model contains four layers.
They are different conceptual models, but they describe many of the same networking functions.

The models are useful for learning and troubleshooting because they help professionals
separate different networking responsibilities.

8. Encapsulation

When an application sends information across a network, each TCP/IP layer can add
information needed by that layer.
This process is called encapsulation.

Conceptually:

Application Data
      ↓
TCP Header + Data
      ↓
IP Header + TCP Segment
      ↓
Ethernet/Wi-Fi Header + IP Packet
      ↓
Network Transmission

At the receiving system, the process is reversed.
This is called decapsulation.

9. Data Units

Different layers use different terms for the data being processed.

These terms help cybersecurity students understand network captures and security logs.

10. IP Addresses and Routing

An IP address provides logical addressing.
Routers use routing information to move packets between networks.

Consider:

Computer
192.168.1.20

        ↓

Router
192.168.1.1

        ↓

Internet

        ↓

Remote Server
203.0.113.20

The local computer sends traffic toward its default gateway.
The router then determines where the packet should be forwarded.

11. Default Gateway

A default gateway is normally the router or Layer 3 device
that a host uses when sending traffic to destinations outside its local network.

For example:

IP Address:       192.168.1.20
Subnet Mask:      255.255.255.0
Default Gateway:  192.168.1.1

If the destination is outside the local subnet, the host can send the packet
toward the default gateway.

12. Ports and Sockets

TCP/IP communication commonly uses a combination of:

• Source IP address.
• Source port.
• Destination IP address.
• Destination port.
• Transport protocol.

This information helps identify a communication flow.

Example:

Source:
192.168.1.20:51544

Destination:
203.0.113.50:443

Protocol:
TCP

This could represent a client connecting from a temporary source port
to an HTTPS service on port 443.

13. TCP Three-Way Handshake

TCP normally establishes a connection using a three-step handshake.

Client                       Server

   | -------- SYN ----------> |
   | <------ SYN-ACK -------- |
   | -------- ACK ----------> |
   |                          |
   |     TCP connection       |

The handshake allows the two endpoints to establish the initial state
needed for the TCP connection.

Security monitoring systems can observe TCP connection behavior and use it
as part of broader traffic analysis.

14. TCP/IP Example: Opening a Website

Suppose a user enters:

https://example.com

A simplified sequence may involve:

1. The system needs to resolve the domain name.
2. DNS communication helps identify an IP address.
3. The client establishes the appropriate transport communication.
4. TLS negotiation can establish encrypted HTTPS communication.
5. HTTP requests and responses travel through the connection.
6. Routers forward packets toward the destination.
7. The destination server processes the request and sends a response.

Many additional details exist in real-world networks, but this simplified flow
helps demonstrate how multiple TCP/IP components cooperate.

15. ICMP

Internet Control Message Protocol (ICMP) is used for network control,
diagnostic and error-reporting purposes.

Tools such as ping commonly use ICMP Echo Request and Echo Reply messages
for IPv4.

Example:

ping 192.168.1.1

ICMP is not TCP or UDP and does not use TCP/UDP port numbers.

16. TCP/IP and Cybersecurity

Cybersecurity professionals work with TCP/IP at many levels.

17. Source and Destination Information

A network connection often contains source and destination information.

For example:

Source IP:      192.168.1.20
Source Port:    51544

Destination IP: 203.0.113.50
Destination:    443

Protocol:       TCP

During an investigation, analysts may ask:

• Who initiated the connection?
• What system received it?
• Which port was contacted?
• Was the connection encrypted?
• Was the destination expected?
• Did the connection happen once or repeatedly?
• Was the communication permitted by the firewall?

18. Private and Public IP Addresses

Private IPv4 addresses are commonly used inside local networks.
Common private ranges include:

10.0.0.0/8
172.16.0.0/12
192.168.0.0/16

Public IP addresses are used for communication across publicly routed networks.
Network Address Translation (NAT) is commonly used to allow multiple private devices
to communicate through one or more public addresses.

19. NAT and TCP/IP

Network Address Translation (NAT) changes or maps addressing information
as traffic passes between networks.

A simplified home-network example:

Laptop
192.168.1.20
       |
       v
Home Router
Public IP
       |
       v
Internet

NAT can allow multiple internal devices to share a public IPv4 address.
Security controls and routing behavior depend on the specific implementation.

20. DNS in the TCP/IP Stack

DNS is an Application-layer protocol that translates domain names into information
needed by network applications.

For example:

www.example.com
        |
        v
DNS Resolver
        |
        v
203.0.113.50

The browser can then use the resulting address to communicate with the destination.

Cybersecurity teams monitor DNS because domain-resolution activity can provide useful
context during security investigations.

21. DHCP in the TCP/IP Stack

DHCP helps clients obtain network configuration automatically.

A simplified IPv4 DHCP process is often remembered as:

DORA

Discover
Offer
Request
Acknowledge

The exact network behavior can be more detailed, but DORA is a useful introductory model.

22. TCP/IP Troubleshooting Approach

When a network connection fails, a layered troubleshooting approach can help.

Step 1 — Physical / Network Access

Check the network cable, Wi-Fi connection, interface status and local connectivity.

Step 2 — IP Configuration

Check the IP address, subnet mask, gateway and DNS configuration.

Step 3 — Local Gateway

Test whether the default gateway is reachable.

Step 4 — DNS

Check whether domain names resolve correctly.

Step 5 — Remote Service

Check whether the destination service and required port are reachable.

Step 6 — Application

Determine whether the application itself is functioning correctly.

23. Useful TCP/IP Commands

Windows

ipconfig
ipconfig /all
ping 8.8.8.8
ping example.com
tracert example.com
nslookup example.com
netstat -ano

Linux

ip addr
ip route
ping 8.8.8.8
ping example.com
traceroute example.com
dig example.com
ss -tuln

The exact availability of some commands depends on the operating system and installed tools.

24. TCP/IP Security Controls

Security controls can operate at different points in the TCP/IP communication process.

• Firewalls: Control network traffic.
• IDS/IPS: Detect or help prevent suspicious network activity.
• TLS: Protect application communication cryptographically.
• Network segmentation: Limits unnecessary communication paths.
• Access control: Restricts who or what can access services.
• VPNs: Provide protected communication tunnels in appropriate scenarios.
• Network monitoring: Provides visibility into traffic and connections.

25. TCP/IP Security Investigation Example

Suppose a workstation begins making repeated outbound TCP connections to an unfamiliar
external address.

An analyst can examine:

1. Source IP address.
2. Destination IP address.
3. Source port.
4. Destination port.
5. Transport protocol.
6. Process responsible for the connection.
7. DNS queries associated with the destination.
8. Firewall decisions.
9. Connection frequency and timing.
10. User and endpoint context.

No single field necessarily proves malicious activity.
The value comes from correlating multiple pieces of evidence.

26. Packet Capture and TCP/IP

Packet-capture tools can display information from different TCP/IP layers.
A captured packet may contain:

• Ethernet or Wi-Fi information.
• Source and destination MAC addresses.
• Source and destination IP addresses.
• TCP or UDP information.
• Port numbers.
• Application-layer information.

Security analysts can use packet captures to investigate network problems,
understand communication patterns and identify suspicious behavior.

Packet inspection must be performed only on networks and systems where the analyst
has appropriate authorization.

27. Simple TCP/IP Flow

Application
     |
     | HTTP / HTTPS / DNS / SSH
     v
Transport
     |
     | TCP / UDP
     v
Internet
     |
     | IPv4 / IPv6
     v
Network Access
     |
     | Ethernet / Wi-Fi
     v
Physical Network

This layered structure makes complex networking easier to understand because each layer
has a defined responsibility.

28. Practical Lab

Perform this exercise only on your own computer or an authorized training environment.

Windows

1. Run ipconfig /all.
2. Record your active IPv4 address.
3. Identify the default gateway.
4. Identify the DNS server if displayed.
5. Run ping against your gateway.
6. Run nslookup for a domain you are authorized to query.
7. Run netstat -ano and identify one active connection or listening port.

Linux

1. Run ip addr.
2. Run ip route.
3. Identify your default route.
4. Run ping against your gateway.
5. Use dig to inspect a DNS lookup.
6. Run ss -tuln to view listening sockets.

29. Review Exercise

Complete the following table:

30. Key Takeaways

• TCP/IP is a family of networking protocols used by the Internet and many private networks.
• The common four-layer TCP/IP model contains Application, Transport, Internet and Network Access layers.
• TCP and UDP operate at the Transport layer.
• IP operates at the Internet layer.
• Ethernet and Wi-Fi operate primarily within the Network Access portion of the model.
• Encapsulation occurs as data moves down the protocol stack.
• Decapsulation occurs as data moves up the receiving stack.
• IP addresses provide logical addressing and support routing.
• Ports identify application communication endpoints.
• TCP uses mechanisms for reliable and ordered delivery.
• UDP provides simpler connectionless transport.
• TCP/IP knowledge is essential for firewalls, monitoring, incident response and network security.
• Network investigations should correlate IPs, ports, protocols, processes and other evidence.

31. Final Review Questions

1. What does TCP/IP stand for?
2. What are the four commonly taught TCP/IP layers?
3. What is the purpose of the Application layer?
4. What is the difference between TCP and UDP?
5. What is the purpose of the Internet layer?
6. What does a default gateway do?
7. What is encapsulation?
8. What is decapsulation?
9. What is the relationship between an IP address and a port?
10. What protocol is commonly used to resolve domain names?
11. What protocol can be used to test basic IP connectivity with ping?
12. Why is TCP/IP knowledge important to cybersecurity professionals?
13. What information might an analyst examine when investigating a suspicious TCP connection?
14. Why should packet capture and network inspection be performed only with proper authorization?

Lesson conclusion:
TCP/IP provides the foundation for understanding how modern network communication works.
A cybersecurity professional who understands the TCP/IP stack can better interpret network
traffic, configure security controls, troubleshoot connectivity and investigate suspicious
communications.