What Is TCP/IP? The Internet Core Protocol Suite

What Is TCP/IP?

TCP/IP is the foundational communication [protocol](/learning-center/what-is-the-osi-model-all-7-layers-explained) suite of the internet. It defines how data is packaged, addressed, transmitted, routed, and received. Without TCP/IP, the internet as we know it would not exist.

The name combines two protocols:

• TCP (Transmission Control protocol) — ensures reliable, ordered delivery of data
• IP (Internet protocol) — handles addressing and [Routing](/learning-center/what-is-the-network-layer-osi-model-layer-3) of packets

## The [TCP/IP model](/learning-center/what-is-the-osi-model-all-7-layers-explained)

TCP/IP uses a 4-layer model:

  ┌──────────────────────────┐
  │   4. Application Layer   │  HTTP, HTTPS, DNS, SMTP, FTP, SSH
  ├──────────────────────────┤
  │   3. Transport Layer     │  TCP, UDP
  ├──────────────────────────┤
  │   2. Internet Layer      │  IP (IPv4, IPv6), ICMP, ARP
  ├──────────────────────────┤
  │   1. Network Access      │  Ethernet, Wi-Fi, physical cables
  └──────────────────────────┘

## How IP Works

The Internet protocol assigns a unique address to every device. When data is sent, IP wraps it in a packet containing:

• Source [IP address](/learning-center/what-is-an-ip-address-IPv4-and-addressing-explained)-ipv6-and-addressing-explained) — where the packet came from
• Destination [IP address](/learning-center/what-is-an-ip-address-IPv4-and-addressing-explained)-ipv6-and-addressing-explained) — where the packet is going
• TTL (Time to Live) — prevents packets from looping forever

### IPv4-address-ipv4-IPv6-and-addressing-explained) vs IPv6

| Feature | IPv4-address-ipv4-IPv6-and-addressing-explained) | IPv6 | |---------|------|------| | Address length | 32-bit | 128-bit | | Example | 192.168.1.1 | 2001:0db8::1 | | Total addresses | ~4.3 billion | 340 undecillion | | Status | Still dominant | Growing adoption |

## How TCP Works — The Three-Way Handshake

Before exchanging data, TCP establishes a connection using a three-way handshake:

  Client                    Server
    │──── SYN ────────────→│   "I want to connect"
    │←─── SYN-ACK ─────────│   "OK, I acknowledge"
    │──── ACK ────────────→│   "Great, connection open"
    │     [Data Transfer]   │
    │──── FIN ────────────→│   "I am done"
    │←─── FIN-ACK ─────────│   "Closing connection"

After the handshake, TCP tracks every segment and requires acknowledgements (ACKs). If a segment is lost, TCP retransmits it automatically.

## TCP vs UDP

| Feature | TCP | UDP | |---------|-----|-----| | Connection | Handshake required | Connectionless | | Reliability | Guaranteed delivery | No guarantee | | Speed | Slower | Faster | | Use cases | Web, email, file transfer | Gaming, VoIP, DNS, streaming |

## port-ports-explained) Numbers

IP addresses route to the right device; port-ports-explained) numbers route to the right application.

### well-known ports-ports-explained)-tcp-and-udp-ports-explained)

| port-ports-explained) | protocol | Purpose | |------|----------|---------| | 22 | SSH | Secure remote shell | | 25 | SMTP | Email sending | | 53 | DNS | domain-kerberos-directory-services-explained) name resolution | | 80 | HTTP | Unencrypted web traffic | | 443 | HTTPS-how-https-keeps-your-data-safe)-tls-how-https-keeps-your-data-safe) | Encrypted web traffic | | 3389 | RDP | Windows Remote Desktop |

## A Packet's Journey

When you type google.com:

1. DNS resolves the domain-kerberos-directory-services-explained) to an [IP address](/learning-center/what-is-an-ip-address-IPv4-and-addressing-explained)-ipv6-and-addressing-explained)
2. TCP performs a three-way handshake to open a connection
3. A [TLS handshake](/learning-center/what-is-SSL-tls-how-HTTPS-keeps-your-data-safe) encrypts the connection (HTTPS)
4. An HTTP GET request is sent inside the encrypted tunnel-how-virtual-private-networks-work)
5. The server responds and TCP reassembles packets in order
6. The connection closes with a FIN exchange

## TCP/IP and cybersecurity

Attackers exploit TCP/IP mechanisms:

• SYN flood-attack-distributed-denial-of-service-explained) — floods servers with SYN packets without completing handshakes (DoS attack)
• IP Spoofing — forges source IP to disguise origin
• [port-ports-explained) scanning](/learning-center/what-is-a-port-tcp-and-udp-ports-explained) — probes open ports to map running services
• packet sniffing — captures unencrypted traffic

  # Scan a host for open ports
  nmap -sV 192.168.1.1

  # See active TCP connections
  netstat -an | grep ESTABLISHED

## Quick Recap

• IP handles addressing and [Routing](/learning-center/what-is-the-network-layer-osi-model-layer-3) between devices
• TCP guarantees reliable, ordered delivery via handshakes and acknowledgements
• UDP is faster but without delivery guarantees
• port-ports-explained) numbers direct traffic to the correct application
• TCP/IP is the universal language of the internet — every cybersecurity professional must master it