Prerequisites: basic programming. No networking experience is required. Outcome: explain which part of a network delivers bytes, selects a destination, or interprets an application message. Allow: 20 minutes, including the exercise.

​
Start with one message

A camera application wants to send a temperature reading to a dashboard. The application creates the bytes temperature=23.5. Those bytes cannot travel directly through a cable. Several protocols add information that helps other devices deliver and interpret them. A protocol is an agreement about message formats and behavior. A layer groups protocols with related responsibilities. Each layer uses services from the layer below it.

​
The TCP/IP model

The Internet model groups communication into four layers. The physical medium sits below the link protocols in this model. See RFC 1122, section 1.1.3. The layers help you ask precise questions. A working Wi-Fi connection does not prove that a remote application accepted your credentials. A successful DNS lookup does not prove that the destination port is reachable.

​
Where the seven OSI layers fit

OSI means Open Systems Interconnection. Its seven-layer model is useful vocabulary, especially when someone says “layer 3” or “layer 4.” It is a reference model, not a requirement that every application implements seven separate modules. The model is defined in ITU-T X.200. The mapping is approximate. Modern protocols often combine responsibilities from several OSI layers. For example, QUIC combines transport functions with a TLS handshake. Do not force it into one OSI box to decide how it works.

​
Encapsulation: add information around the data

Encapsulation means that a protocol wraps data with information for its own layer. For a simple UDP application, the transmitted structure looks like this:
The Ethernet header identifies the next device on the local link. The IP header identifies the source and destination IP addresses. The UDP header includes source and destination ports. The application decides what temperature=23.5 means. At the receiver, each layer processes its information and passes the remaining data upward. Do not confuse an Ethernet frame with a QUIC frame. An Ethernet frame crosses a link; a QUIC frame is an instruction inside a QUIC packet.

​
Switches, routers, and endpoints

A switch normally forwards Ethernet frames within a local network, using MAC addresses. A router forwards IP packets between networks, using its routing table. An endpoint runs the application that sends or receives the message. One physical device can perform several of these roles. For a remote destination, the laptop sends a local frame to its router. The packet inside that frame still names the remote server as its IP destination. Each routed link uses a new link-layer envelope. NAT, when present, can also change IP addresses and ports; the routing lesson explains it.

​
TCP, UDP, and QUIC

TCP provides an ordered byte stream with loss recovery. Your application must define message boundaries within that stream. For example, one call to send() does not imply one matching call to recv(). UDP preserves datagram boundaries, but does not itself guarantee delivery, order, or duplicate suppression. An application chooses how to handle those conditions. See RFC 768. QUIC uses UDP packets and adds encrypted connections, independent reliable streams, and other transport functions. The QUIC DATAGRAM extension also supports unreliable application messages. “Uses UDP” therefore does not mean “all application data is unreliable.” See RFC 9000 and RFC 9221. For browser media, the protocol path can include MoQ, WebTransport, HTTP/3, QUIC, UDP, and IP. These names describe different responsibilities, not competing names for the same protocol. Level 101 explains their relationships.

​
Worked diagnosis

A browser loads the portal over HTTPS, but the media connection fails. The engineer says, “Port 443 works, so the network is fine.” That conclusion is too broad. TCP port 443 and UDP port 443 are different endpoints for firewall purposes. A successful HTTPS request over TCP does not establish that UDP can reach the media service. It also does not establish that both services use the same hostname or route. Record the hostname, IP address, transport protocol, destination port, and failing operation before changing anything. These details let the next engineer reproduce the same connection attempt.

​
Exercise

  1. A cable is disconnected. Which OSI layer is the first place to investigate?
  2. An IP route selects the wrong gateway. Which OSI layer describes that decision?
  3. The service returns a permission error. Does changing the subnet mask directly fix that permission?
  4. Why can two applications both use port 443 when one uses TCP and the other uses UDP?
  1. Start at layer 1, the physical medium. Then check whether the interface reports a working link.
  2. Routing is a layer 3 function. Check the destination address and the selected route.
  3. No. A permission response directs the investigation toward application identity and authorization. Check the service and credential used.
  4. The transport protocol is part of the endpoint identity. TCP and UDP have separate port spaces.
Completion check: explain why “the network works” is less useful than “TCP reaches this host on port 443.” Next: IP addresses, subnets, and CIDR.