chapter1: TCP/IP

A layered model lets a Wi-Fi engineer work on signals without knowing HTTP, and a web developer write apps without knowing signal propagation. Each layer has one job and a defined interface to the layers above and below.

Layers don’t need to know what’s inside the layers above or below them. IP doesn’t care that TCP is inside it. TCP doesn’t care that HTTP is inside it. This ignorance is intentional — it’s what lets you swap Ethernet for Wi-Fi without changing a single line of application code.

Each layer reads only its own wrapper, strips it, and passes the rest up. The router reads the IP header — not the TCP segment inside. This separation means IPv6 can replace IPv4 without changing TCP or HTTP.

MAC addresses identify hardware and can’t be organised hierarchically. IP addresses are logical and assignable — they can be grouped by network prefix, enabling routers to forward data efficiently across the entire internet.

Without subnetting, every device in a company would be on one giant broadcast domain — every ARP and discovery packet would hit every machine. Subnetting creates isolated segments, improves performance, and adds security boundaries between departments.

IPv4 was designed in 1981 for a small research network. IPv6 solves the exhaustion problem with 128-bit addresses, and also adds built-in IPSec, simpler routing headers, stateless autoconfiguration, and eliminates the need for NAT.

You know the IP of who you want to reach, but not their MAC. ARP broadcasts “Who has IP X? Tell me your MAC.” — and only the device with that IP replies. The result gets cached, so ARP doesn’t happen for every packet.

IP is deliberately "dumb" — it routes packets fast and drops them when the network is congested. This is a feature. TCP compensates on top, adding reliability, ordering, and flow control. The separation lets the internet scale: IP doesn't slow down for acknowledgments; TCP handles that at the endpoints.

Two steps only confirm one direction. Three steps confirm both directions and let both sides exchange Initial Sequence Numbers simultaneously. You cannot accomplish this in fewer than three messages.

IP may drop, duplicate, or reorder packets at any time. TCP detects all three failure modes: sequence numbers catch ordering and duplicates; ACK numbers catch losses. Anything not confirmed gets retransmitted.

A 10 Gbps server and a phone on slow mobile data have wildly different processing speeds. Without flow control, the server would fill the phone's buffer until packets drop — then TCP retransmits everything anyway, wasting bandwidth. Flow control avoids this entirely.

TCP needs to signal many things — open a connection, acknowledge data, close gracefully, abort. Packing these into individual bits in the header means all this signalling adds zero overhead to data segments. The bits are always there anyway.

TCP is full-duplex — both sides send independently. A FIN from one side is a half-close: "I'm done sending, but I can still receive." The other side might still have data to send. The connection only fully closes when both sides have FIN'd and both FINs are acknowledged.

Reliability costs time. Every ACK, retransmit, and handshake adds latency. For a video call, a 200ms delayed packet is worse than a dropped one — the moment is gone. For a file download, a single missing byte is catastrophic. The right protocol depends entirely on whether silence (no ACK) is worse than delay.

Computers communicate using IPs (like 93.184.216.34) but humans remember names (like example.com). DNS is the translation layer. It also enables load balancing, failover, CDN routing, and email authentication — it's far more than just a lookup table.

TCP delivers bytes reliably, but doesn't define what those bytes mean. HTTP defines the format and vocabulary: how to request a resource, how to describe the response, how to pass metadata. Without HTTP, every browser would need a custom agreement with every web server.

Sending (SMTP) is a push operation to a server that may be temporarily unavailable. Retrieval (IMAP/POP3) is a pull operation that needs to manage folder state. IMAP and POP3 have entirely different philosophies: where mail lives and whether multiple devices should stay in sync.

Before DHCP, every device required a manually configured IP, subnet mask, gateway, and DNS server. In a company with thousands of machines — or a café with daily visitors — that doesn't scale. DHCP makes joining a network a zero-configuration experience.

Switches connect devices on the same network. Routers connect different networks together — including your home network to the internet. Every time a packet crosses from one IP subnet to another, it passes through a router. The internet is, at its core, a massive mesh of routers sharing routing information.

A hub broadcasts every frame to every port — everyone sees everything. A switch learns which MAC address lives on which port (MAC address table) and forwards frames only to the correct port. This dramatically reduces unnecessary traffic and gives you basic isolation between devices.

IPv4 has ~4 billion addresses. There are ~15 billion internet-connected devices. NAT bridges this gap: your home router presents one public IP to the internet while your 10 devices use private addresses internally. The router tracks which internal device made each request and maps responses back correctly.

Every open port is a potential entry point. Firewalls enforce a policy: which traffic is allowed, from where, to where, on which ports. Without them, any internet device could attempt connections to your services. They're the primary tool for enforcing network boundaries.