Network Protocols
Master the core protocols of computer networks. Explore TCP vs. UDP, the TCP 3-way handshake, IP, ICMP, DHCP, DNS, ARP, and common ports.
What is a Network Protocol?
A Network Protocol is a standardized set of rules, formats, and procedures that govern how computers and devices format, transmit, receive, and interpret data packets across a network. Without protocols, devices from different manufacturers running different operating systems would be unable to decode each other's electronic signals, rendering communication impossible.
Protocols exist at every layer of the network stack. They handle everything from error correction and flow control to data formatting, encryption, and logical address resolution.
Core Network Protocols Comparison Table
This table compares the most important protocols that power local networks and the Internet:
| Protocol Name | OSI Layer | Default Port | Primary Function | Underlying Transport |
|---|---|---|---|---|
| TCP | Transport (Layer 4) | N/A | Guarantees reliable, ordered end-to-end data delivery. | N/A |
| UDP | Transport (Layer 4) | N/A | Fast, connectionless, lightweight data transmission. | N/A |
| IP | Network (Layer 3) | N/A | Handles packet addressing and routing across networks. | N/A |
| ICMP | Network (Layer 3) | N/A | Sends error messages and operational info (e.g., ping). | N/A (Encapsulated in IP) |
| ARP | Data Link (Layer 2) | N/A | Resolves logical IP addresses to physical MAC addresses. | N/A |
| DNS | Application (Layer 7) | 53 | Translates domain names (e.g., google.com) to IP addresses. | UDP (queries) / TCP (zone transfers) |
| DHCP | Application (Layer 7) | 67 / 68 | Dynamically assigns IP addresses to devices on boot. | UDP |
| HTTP / HTTPS | Application (Layer 7) | 80 / 443 | Transmits web pages and resources. HTTPS adds TLS security. | TCP |
| SSH | Application (Layer 7) | 22 | Securely logs into remote systems and terminals. | TCP |
| FTP | Application (Layer 7) | 20 / 21 | Transfers files between client and server. | TCP |
Transport Layer: TCP vs. UDP
The Transport Layer relies on two distinct protocols, chosen based on the speed and reliability requirements of the application:
- TCP (Transmission Control Protocol) — A **connection-oriented** protocol. Before sending data, it establishes a virtual connection between the sender and receiver. It monitors packet delivery, resends lost packets, and guarantees that packets are reassembled in the correct order.
*Best For:* Web browsing (HTTP/S), email (SMTP/IMAP), file transfers (FTP), secure shells (SSH). - UDP (User Datagram Protocol) — A **connectionless** protocol. It sends packets (datagrams) directly without establishing a connection or verifying delivery. It has no overhead, making it extremely fast.
*Best For:* Real-time video streaming, VoIP calls, online gaming, DNS queries.
The TCP 3-Way Handshake (Connection Setup)
To establish a reliable connection, TCP uses a three-step handshake process:
- SYN (Synchronize) — The client sends a packet containing a SYN flag and a random initial sequence number (e.g., Seq=X) to the server to request a connection.
- SYN-ACK (Synchronize-Acknowledge) — The server receives the request, allocates resources, and responds with a packet containing a SYN-ACK flag. It sets the acknowledgement number to X+1, and generates its own sequence number (Seq=Y).
- ACK (Acknowledge) — The client receives the response and sends an ACK packet back to the server, setting the acknowledgement number to Y+1. The connection is now established, and data transfer can begin.
Connection Teardown: When data transfer is complete, TCP closes the connection using a 4-step exchange utilizing **FIN** (Finish) and **ACK** flags from both sides.
TCP Flow Control and Error Recovery
TCP maintains reliability through advanced flow-control mechanisms:
- Sliding Window — To prevent the sender from overwhelming the receiver with too much data, the receiver advertises a "window size" (the amount of data it can buffer). The sender adjusts its transmission speed dynamically based on this window.
- Sequence Numbers & Retransmissions: Every byte of data is assigned a sequence number. If the recipient detects a gap in sequence numbers, it requests a retransmission of the missing packet.
Address Resolution Protocol (ARP)
While routers and software use IP addresses to direct packets, switches and local network cards use MAC addresses. **ARP** is the translation mechanism between Layer 2 and Layer 3. When your computer wants to send a packet to a local IP address (e.g., `192.168.1.1`), it broadcasts an ARP request: *"Who has IP 192.168.1.1? Tell MAC address [My MAC]."* The target device replies with its MAC address. Your computer then caches this in its **ARP Table** to prevent repeating the query.
Frequently Asked Questions (FAQ)
❓ What is the difference between TCP and UDP?
TCP is connection-oriented, reliable, guarantees packet ordering, and handles error correction, making it slower due to protocol overhead. UDP is connectionless, fast, has zero delivery guarantees, and does not reorder packets, making it ideal for real-time applications where speed is more important than perfect accuracy.
❓ How does DHCP dynamically assign IP addresses?
DHCP operates using the **DORA** process:
- Discovery: The client broadcasts a request looking for a DHCP server.
- Offer: The DHCP server offers an available IP address.
- Request: The client requests to lease that IP address.
- Acknowledgement: The server confirms the lease and provides DNS and gateway details.
❓ What is the purpose of ICMP?
ICMP (Internet Control Message Protocol) is a network-layer protocol used by routers and hosts to communicate diagnostic and error information. It is not used to transmit user data. The most common use cases are the `ping` utility (which uses ICMP Echo Request and Echo Reply packets) and `traceroute` (which uses ICMP Time Exceeded messages to map network paths).
❓ What happens if ARP gets spoofed?
ARP Spoofing is a cyber attack where a hacker sends forged ARP messages onto a local network. The hacker associates their own MAC address with the IP address of a legitimate device (like the default gateway router). As a result, all local traffic meant for the router is sent to the hacker instead, enabling Man-in-the-Middle (MitM) attacks.
What's Next?
Advance your network protocol studies:
- Learn how web browsers use HTTP/HTTPS at the Application Layer in HTTP & HTTPS.
- Explore how DNS resolves domain names in DNS Explained.
- Learn subnet calculations and IP ranges in IP Addressing & Subnetting.
- Study the physical boundary devices in Topologies & Hardware.