Let's talk about the TCP/IP protocol processing flow

​When a user uses a command with the TCP/IP application layer protocol, a chain of events is initiated. The user's command or message passes through the TCP/IP protocol stack on the local machine and then reaches the recipient's protocol over the network medium. The protocols at each layer on the sending host add information to the original data.

As the user's commands pass through the protocol stack, the protocols at each layer of the sending host also interact with their counterparts on the receiving host.

Data encapsulation and TCP/IP protocol stack

A packet is the basic unit of information transmitted over a network and consists of at least a header containing the sending and receiving host addresses and a body containing the data to be transmitted. As a packet passes through the TCP/IP protocol stack, the protocols at each layer add or remove fields from the basic header. When the protocol on the sending host adds data to the packet header, the process is called data encapsulation. In addition, each layer has different terminology for the modified packet, as shown in the following figure.

This article summarizes the life cycle of a data packet, from the time a user issues a command or sends a message to the time the corresponding application on the receiving host receives the data packet.

Application layer - user initiated communication

The history of data packets begins when a user on one host sends a message or issues a command that must access a remote host. The application protocol associated with the command or message formats the data packet so that it can be processed by the appropriate transport layer protocol, TCP or UDP.

Suppose a user issues the rlogin command to log in to a remote host. The rlogin command uses the TCP transport layer protocol. TCP expects to receive data in the form of a byte stream containing the information in the command. Therefore, rlogin sends this data as a TCP stream.

However, not all application layer protocols use TCP. Suppose a user wants to mount a file system on a remote host, thereby starting the NIS+ application layer protocol. NIS+ uses the UDP transport layer protocol. Therefore, the data packet containing the command must be formatted in the way that UDP expects. This type of data packet is called a message.

Transport layer - data encapsulation begins

When data reaches the transport layer, the protocol at that layer starts the data encapsulation process. The final result depends on whether TCP or UDP processes the information.

(1) TCP segmentation

TCP is often called a "connection-oriented" protocol because it ensures that data is successfully delivered to the receiving host. The above diagram shows how the TCP protocol receives a stream from the rlogin command. TCP divides the data received from the application layer into multiple segments and attaches a header to each segment.

The segment header contains the sender and receiver ports, segment ordering information, and a data field called a checksum. The TCP protocol on both hosts uses the checksum data to determine whether the data has been transmitted correctly.

(2) Establishing a TCP connection

TCP uses segments to determine if the receiving host is ready to receive data. When the sending TCP wants to establish a connection, it sends a segment called a SYN to the peer TCP protocol running on the receiving host. The receiving TCP returns a segment called an ACK to confirm the successful receipt of the segment. The sending TCP sends another ACK segment and then continues to send data. This exchange of control information is called a three-way handshake.

(3) UDP packets

UDP is a "connectionless" protocol. Unlike TCP, it does not check to make sure the data reaches the receiving host. Instead, UDP takes the message received from the application layer and formats it into UDP packets. UDP appends a header to each packet that contains the sending and receiving host ports, a field containing the packet length, and a checksum.

The sending UDP process attempts to send a packet to the peer UDP process on the receiving host. The application layer determines whether the receiving UDP process acknowledges receipt of the packet. UDP does not require receipt notification. UDP does not use a three-way handshake.

Internet Layer

Both TCP and UDP pass their segments and packets down to the Internet layer, where they are processed by the IP protocol. IP prepares them for delivery by formatting them into units called IP datagrams. IP then determines the IP addresses of the datagrams so that they can be delivered efficiently to the receiving host.

(1) IP datagram

In addition to the information added by TCP or UDP, IP also appends an IP header to the header of a segment or packet. Information in the IP header includes the IP addresses of the sending and receiving hosts, the length of the datagram, and the sequence order of the datagram. This information is provided if the datagram exceeds the byte size allowed for a network packet and must be fragmented.

Data Link Layer - Framing

Data link layer protocols, such as PPP, format IP datagrams into frames. They append a third header and a footer to "frame" the datagram. The frame header includes a cyclic redundancy check (CRC) field that is used to check for errors as the frame travels across the network medium. The data link layer then passes the frame to the physical layer.

Physical Network Layer - prepares frames for transmission

The physical network layer on the sending host receives the frame and converts the IP address into a hardware address appropriate for the network medium. The physical network layer then sends the frame out over the network medium.

How the receiving host processes the packet

When a packet arrives at the receiving host, it passes through the TCP/IP protocol stack in the reverse order of the sender. The diagram above illustrates this path. In addition, each protocol on the receiving host strips off the header information that the peer on the sending host attached to the packet. Here is what happens:

• The physical network layer receives packets in the form of frames. It calculates the CRC of the packets and then sends the frames to the data link layer.
• The data link layer verifies that the CRC of the frame is correct and removes the frame header and CRC. Finally, the data link protocol sends the frame to the Internet layer.
• The Internet layer reads the information in the header to identify the transmission and determine if it is a fragment. If the transmission is fragmented, IP reassembles the fragments into the original datagram. It then strips off the IP header and passes the datagram to the transport layer protocol.
• The transport layer (TCP and UDP) reads the header to determine which application layer protocol must receive the data. TCP or UDP then strips off its associated headers and sends the message or stream to the receiving application.
• The application layer receives the message and performs the action requested by the sending host. ​