TCP/IP & How Data Travels

The OSI model is the theory. TCP/IP is what the real internet actually runs on. In this lesson you'll learn the four-layer TCP/IP model, watch how a connection is set up with the famous three-way handshake, meet the ports and protocols you'll see for the rest of your career, and take your first gentle steps into IP addressing.

OSI vs. TCP/IP — two maps of the same city

The TCP/IP model is a simpler, practical model with 4 layers. Think of OSI as the detailed textbook diagram and TCP/IP as the working version engineers actually use.

TCP/IP layer	Rough OSI equivalent	Examples
Application	OSI 5, 6, 7	HTTP, HTTPS, DNS, SMTP, FTP, SSH
Transport	OSI 4	TCP, UDP
Internet	OSI 3	IP, ICMP
Network Access (Link)	OSI 1, 2	Ethernet, Wi-Fi, MAC

TCP vs. UDP — two ways to send data

Analogy — Registered mail vs. a postcard TCP is registered mail: the receiver signs for every piece, and anything lost is sent again. Slower, but nothing goes missing — perfect for web pages, files, and email. UDP is a postcard: you drop it and move on. No signature, no re-sends — but it's fast, which is exactly what you want for live video calls, gaming, and DNS lookups where a tiny bit of loss is better than waiting.

	TCP	UDP
Reliable?	Yes — confirms & re-sends	No guarantee
Ordered?	Yes, arrives in order	Not guaranteed
Speed	Slower (more checking)	Faster (less overhead)
Used for	Web, email, file transfer, SSH	Video/voice calls, DNS, gaming

The TCP three-way handshake (how a connection starts)

Before TCP sends any real data, the two computers do a quick three-step greeting to agree they're both ready. This is the three-way handshake.

Analogy — Answering the phone

SYN — You call: “Hi, can you hear me?” (client says "let's synchronise")
SYN-ACK — They answer: “Yes I hear you, can you hear me?”
ACK — You confirm: “Yes! Let's talk.” Now the real conversation begins.

# The handshake, drawn out: Client Server | --------- SYN --------> | (1) "Let's connect" | <------- SYN-ACK -------- | (2) "OK, I'm ready too" | --------- ACK --------> | (3) "Great, connected!" | ===== data flows both ways ==|

Why attackers care A SYN flood attack sends thousands of step-1 “SYN” messages but never completes step 3, leaving the server holding open half-finished calls until it runs out of resources. Understanding the handshake is what lets you recognise and stop this. Port scanners (like Nmap) also use the handshake cleverly to learn which doors are open — you'll do this in Module 3.

Ports — the numbered doors on a computer

A single computer runs many services at once (web, email, remote login). Ports are numbered doors (0–65535) so data reaches the right service. An IP address gets you to the building; the port number gets you to the right room.

Port	Protocol	What it's for	Encrypted?
20 / 21	FTP	Transferring files (old style)	No
22	SSH	Secure remote login to a machine	Yes
23	Telnet	Old remote login — avoid, sends passwords in the clear	No
25	SMTP	Sending email	Sometimes
53	DNS	Turning names into IP addresses	Usually no
80	HTTP	Websites (unencrypted)	No
443	HTTPS	Websites (encrypted — the padlock)	Yes
3389	RDP	Remote Desktop (Windows)	Yes

Memorise these 22 (SSH), 53 (DNS), 80 (HTTP), 443 (HTTPS). You will see these thousands of times. Notice the pattern: the secure versions matter — 22 and 443 encrypt; 23 and 80 do not.

A first look at IP addressing & subnets

An IPv4 address is four numbers (0–255) separated by dots, like 192.168.1.10. It has two parts: the network part (which street) and the host part (which house). The subnet mask tells you where the split is.

You'll often see “slash notation” like 192.168.1.0/24. The /24 means “the first 24 bits are the network,” which leaves room for 254 usable devices (192.168.1.1–254).

Analogy — Street and house number In “10 Kwacha Road,” the road name is the network and the number 10 is the host. Everyone on Kwacha Road is on the same subnet; to reach another road you go through the router (the junction).

Range	Name	Used for
10.0.0.0 – 10.255.255.255	Private	Big internal networks
172.16.0.0 – 172.31.255.255	Private	Medium internal networks
192.168.0.0 – 192.168.255.255	Private	Homes & small offices
127.0.0.1	Loopback	“This same computer” (localhost)

Private addresses are reused inside millions of homes and never travel on the open internet directly; a router translates them to one public address using NAT (Network Address Translation). We'll go deep on subnetting in a later lesson — for now, just recognise these ranges.

Command demo

$ ss -tan # Show all TCP connections and their state (LISTEN, ESTABLISHED, etc.). # "ESTABLISHED" = a completed three-way handshake, right now. $ cat /etc/services | grep -E "\b(ssh|http|https)\b" # Look up which port a service uses, straight from the system's list. $ dig +short example.com # A DNS lookup (port 53): ask "what IP is example.com?"

Try It Yourself (practice terminal)

Try: ss -tan, dig +short example.com, or ping -c 1 127.0.0.1 (ping yourself — the loopback address).

kali@lab: ~

TCP/IP practice. Try a command below.

kali@lab:~$

Practical Exercise 3.1 — Watch a handshake happen

You'll capture the three-way handshake with your own eyes using tcpdump (a traffic recorder we cover fully in Module 4). Do this on your own machine only.

Open Terminal A and start listening for traffic to example.com's web port:
$ sudo tcpdump -n -i any host example.com and tcp # -n don't resolve names, -i any = any interface. Leave this running.
Open Terminal B and make one connection:
$ curl -s -o /dev/null https://example.com
Look back at Terminal A. Near the top you'll see three lines with flags:
Flags [S] = SYN (step 1) · Flags [S.] = SYN-ACK (step 2) · Flags [.] = ACK (step 3). You just watched a TCP connection be born.
Press Ctrl + C in Terminal A to stop.

Quick check: Which port carries encrypted web traffic (the padlock in your browser)?

Port 80

Port 22

Port 443

Port 53

Port 443 is HTTPS (encrypted web). Port 80 is plain HTTP, 22 is SSH, and 53 is DNS.

Why does this matter for your career? TCP/IP is the internet. Firewalls are configured in terms of ports and protocols. Every port scan, every packet capture, every firewall rule you'll ever write depends on this lesson. Ports, protocols, and the handshake are guaranteed exam material on Security+, Network+, and CCNA, and they're the first thing you'll actually use when you start scanning in Module 3.

Key takeaways

The TCP/IP model has 4 practical layers: Application, Transport, Internet, Link.
TCP = reliable (registered mail); UDP = fast but no guarantee (postcard).
TCP starts with the three-way handshake: SYN → SYN-ACK → ACK.
Ports are numbered doors; memorise 22, 53, 80, 443.
Private ranges (10.x, 172.16–31.x, 192.168.x) live inside networks; NAT shares one public address.