TCP/IP, Ports, and Protocols

TCP/IP, Ports, and Protocols

Photo by Miguel Á. Padriñán on Pexels

TCP/IP is the language of the internet. Every network communication uses TCP/IP protocols. Understanding IP addressing, ports, and protocols is essential for troubleshooting connectivity issues.

The OSI Model (7 Layers)

• Layer 7 — Application: HTTP, HTTPS, DNS, SMTP, FTP — what the user interacts with

• Layer 6 — Presentation: Encryption, compression — TLS/SSL

• Layer 5 — Session: Establishes and manages sessions — NetBIOS, RPC

• Layer 4 — Transport: TCP/UDP — reliable delivery vs fast delivery

• Layer 3 — Network: IP addressing and routing — IPv4, IPv6

• Layer 2 — Data Link: MAC addresses, switches — Ethernet, Wi-Fi

• Layer 1 — Physical: Cables, signals — RJ-45, fiber, radio

Mnemonic: All People Seem To Need Data Processing (top to bottom)

The TCP/IP Model (4 Layers)

Simplified version used in practice:

• Application (combines OSI 5-7): HTTP, DNS, SMTP

• Transport: TCP, UDP

• Internet: IP, ICMP

• Network Access (combines OSI 1-2): Ethernet, Wi-Fi

TCP vs UDP

TCP (Transmission Control Protocol): Connection-oriented, reliable. Establishes connection with 3-way handshake (SYN, SYN-ACK, ACK). Guarantees delivery, order, and error checking. Slower but reliable. Used for: web browsing (HTTP/HTTPS), email (SMTP/IMAP), file transfer (FTP), remote login (SSH).

UDP (User Datagram Protocol): Connectionless, fast. No guarantee of delivery, order, or error checking. Fire and forget. Faster but unreliable. Used for: DNS, streaming video, VoIP, gaming, DHCP.

When to use which: TCP when every packet matters (file transfer, email). UDP when speed matters more than perfection (streaming, gaming).

Common Ports to Memorize

Web:

• Port 80 — HTTP (unencrypted web)

• Port 443 — HTTPS (encrypted web with TLS)

• Port 8080 — HTTP alternate (common for proxies, dev servers)

Email:

• Port 25 — SMTP (sending email, unencrypted)

• Port 587 — SMTP Submission (sending email with auth, encrypted)

• Port 110 — POP3 (receiving email, downloads and deletes)

• Port 143 — IMAP (receiving email, syncs across devices)

• Port 993 — IMAPS (IMAP over SSL/TLS)

• Port 995 — POP3S (POP3 over SSL/TLS)

Remote Access:

• Port 22 — SSH (secure remote login)

• Port 23 — Telnet (unencrypted, legacy — never use)

• Port 3389 — RDP (Remote Desktop Protocol)

• Port 5900 — VNC (Virtual Network Computing)

File Transfer:

• Port 20/21 — FTP (data/control)

• Port 445 — SMB (Windows file sharing)

• Port 2049 — NFS (Linux file sharing)

Infrastructure:

• Port 53 — DNS (name resolution)

• Port 67/68 — DHCP (IP assignment)

• Port 123 — NTP (time sync)

• Port 161/162 — SNMP (network monitoring)

• Port 389/636 — LDAP/LDAPS (directory services)

• Port 88 — Kerberos (authentication)

IPv4 Addressing

IPv4 addresses are 32-bit numbers written as four octets (e.g., 192.168.1.100). Each octet ranges 0-255.

Private IP Ranges (RFC 1918):

• 10.0.0.0 to 10.255.255.255 (10.x.x.x/8) — large networks

• 172.16.0.0 to 172.31.255.255 (172.16-31.x.x/12) — medium networks

• 192.168.0.0 to 192.168.255.255 (192.168.x.x/16) — small networks, home routers

APIPA (Automatic Private IP Addressing): 169.254.x.x — assigned when DHCP fails. If you see a 169.254 address, DHCP is not working.

Loopback: 127.0.0.1 — refers to the local machine. Ping 127.0.0.1 to test if TCP/IP is functioning.

Subnet Masks:

• /24 (255.255.255.0): 254 usable hosts — most common for small networks

• /16 (255.255.0.0): 65,534 usable hosts — medium networks

• /8 (255.0.0.0): 16 million hosts — large enterprises

Subnet Calculation: A /24 network 192.168.1.0/24 has 256 addresses (0-255), but .0 is the network address and .255 is the broadcast address, leaving 254 usable host addresses (192.168.1.1 to 192.168.1.254).

IPv6 Addressing

IPv6 uses 128-bit addresses written as 8 groups of 4 hex digits (e.g., 2001:0db8:85a3:0000:0000:8a2e:0370:7334). Leading zeros can be omitted, consecutive zero groups replaced with ::.

Key differences from IPv4:

• No NAT needed — every device gets a public IP

• No broadcast — uses multicast instead

• Built-in security (IPSec mandatory)

• Stateless autoconfiguration (SLAAC)

• Link-local addresses start with fe80::

DNS (Domain Name System)

DNS translates domain names to IP addresses. Without DNS, you'd type 142.250.80.46 instead of google.com.

DNS Record Types:

• A — domain to IPv4 address (example.com → 192.0.2.1)

• AAAA — domain to IPv6 address

• CNAME — alias (www.example.com → example.com)

• MX — mail server (where to deliver email)

• TXT — text records (SPF, DKIM, DMARC verification)

• NS — name servers for the domain

• PTR — reverse DNS (IP to name)

DNS Troubleshooting:

• nslookup example.com — query DNS records

• dig example.com — detailed DNS query (Linux/macOS)

• ipconfig /flushdns — clear DNS cache (Windows)

• If DNS fails, try 8.8.8.8 (Google DNS) or 1.1.1.1 (Cloudflare DNS) as alternatives

Step-by-Step: Troubleshooting Internet Connectivity

Step 1: Ping loopback: ping 127.0.0.1 — tests if TCP/IP is working on the local machine.

Step 2: Ping local gateway: ping 192.168.1.1 — tests if you can reach the router.

Step 3: Ping external IP: ping 8.8.8.8 — tests if internet routing works.

Step 4: Ping domain: ping google.com — tests if DNS resolution works. If 8.8.8.8 works but google.com doesn't, DNS is the problem.

Step 5: Check IP config: ipconfig /all (Windows) or ip addr (Linux) — verify IP, subnet mask, gateway, DNS servers.

Step 6: If 169.254.x.x: DHCP failed. Restart the DHCP service or router. Try ipconfig /release then /renew.

Step 7: If DNS fails: try nslookup, check DNS server settings, try alternative DNS (8.8.8.8, 1.1.1.1).

Step 8: Check firewall rules — may be blocking outbound traffic.

Free Network Diagnostic Tools

ping: Tests connectivity to a host. Available on all platforms.

traceroute / tracert: Shows the path packets take to a destination. Identifies where connectivity fails. Linux/macOS: traceroute, Windows: tracert.

nslookup / dig: DNS lookup tools. dig is more detailed and available on Linux/macOS.

netstat / ss: Shows active connections and listening ports. ss is the modern replacement on Linux.

tcpdump: Command-line packet capture. Like Wireshark without the GUI. Useful for remote servers.

Key Takeaways

• TCP is reliable (3-way handshake), UDP is fast (no handshake)

• Memorize common ports: 22(SSH), 80(HTTP), 443(HTTPS), 3389(RDP), 53(DNS)

• Private IP ranges: 10.x, 172.16-31.x, 192.168.x — not routable on the internet

• 169.254.x.x means DHCP failed — check the DHCP server or cable

• DNS translates names to IPs — if ping 8.8.8.8 works but google.com doesn't, DNS is broken

Common Questions

Q: What is NAT and why do we use it?
A: Network Address Translation translates private IPs to a public IP. It allows multiple devices to share one public IP address, conserving IPv4 addresses.

Q: Why can I ping 8.8.8.8 but not google.com?
A: DNS resolution is failing. Your DNS server (usually your router or ISP) is not responding. Try changing DNS to 8.8.8.8 or 1.1.1.1.