The TCP/IP suite (also called the Internet protocol suite) is the layered family of communication protocols that the Internet runs on. Named after its two founding protocols, the Transmission Control Protocol (TCP) and the Internet Protocol (IP), it defines how data is addressed, packaged, routed and delivered between devices on interconnected networks.
Among internet fundamentals, the suite is the common language that lets independently operated networks, from home routers to autonomous systems on the Internet backbone, exchange traffic. Its design principle is that the network core stays simple and intelligence sits at the endpoints, which made it possible for one architecture to scale from a research network to billions of devices.
The four layers of the TCP/IP model
The TCP/IP model divides communication into four layers, each using the services of the layer below and offering services to the layer above. Some textbooks describe five layers by splitting the lowest one into physical and data link layers.
| Layer | Responsibility | Example protocols | Unit of data |
|---|---|---|---|
| Application | Services used by programs | HTTP, DNS, SMTP, TLS-based protocols | Message |
| Transport | End-to-end delivery between processes | TCP, UDP, QUIC over UDP | Segment or datagram |
| Internet | Addressing and routing across networks | IPv4, IPv6, ICMP | Packet |
| Link | Delivery on one local network | Ethernet, Wi-Fi, ARP, NDP | Frame |
As data moves down the stack, each layer adds its own header in a process called encapsulation. The receiver removes the headers in reverse order. Routers in between only need to look up to the internet layer, which keeps them fast and independent of the applications they carry.
How IP, TCP and UDP divide the work
IP provides best-effort, connectionless delivery: each packet carries a source and destination address and is forwarded hop by hop, but it may be lost, duplicated or reordered. A time-to-live or hop limit field prevents packets from circling forever.
TCP builds a reliable, ordered byte stream on top of that unreliable service. It opens a connection with a three-way handshake, numbers every byte, retransmits lost segments and uses flow control and congestion control to avoid overwhelming the receiver and the network. UDP adds only ports and a checksum, leaving reliability to the application.
| Property | TCP | UDP | QUIC |
|---|---|---|---|
| Connection setup | Three-way handshake | None | Combined with TLS 1.3 in one round trip |
| Reliability | Retransmission and ordering | None | Per stream, built in |
| Header size | 20 to 60 bytes | 8 bytes | Variable, inside UDP |
| Typical use | Web, email, file transfer | DNS queries, voice, games | HTTP/3 |
Ports identify the application on each host, from 0 to 65535. The combination of source address, source port, destination address, destination port and protocol uniquely identifies a connection.
TCP/IP suite compared with the OSI model
The OSI reference model has seven layers and is widely used for teaching and troubleshooting vocabulary, but the protocols actually deployed on the Internet follow TCP/IP. The suite was standardized by the Internet Engineering Task Force through RFC documents and favored working implementations over a complete formal model.
| OSI layers | TCP/IP layer | Comment |
|---|---|---|
| Application, presentation, session | Application | TCP/IP leaves encoding and sessions to applications |
| Transport | Transport | Direct equivalent |
| Network | Internet | IP is the single common protocol here |
| Data link, physical | Link | TCP/IP does not specify the hardware |
Real protocols do not fit layers perfectly. TLS sits between transport and application, and QUIC implements transport features in user space over UDP. The model is a useful map rather than a strict rule.
IPv4 and IPv6 within the suite
The internet layer exists in two versions that run side by side. IPv4 uses 32-bit addresses, about 4.3 billion in total, and its exhaustion led to widespread network address translation. IPv6 uses 128-bit addresses, a simplified fixed header and mandatory support for neighbor discovery.
Most networks operate in dual-stack mode, and clients prefer IPv6 when both paths work, using Happy Eyeballs logic to fall back quickly. Upper layers such as TCP and HTTP are largely unaffected by which IP version carries them, which is a direct benefit of the layered design.
Practical limits and common misconceptions
The suite’s simplicity has costs that engineers meet regularly. Security was not part of the original design, so encryption and authentication were added later through protocols such as TLS and IPsec.
| Issue | Cause | Typical remedy |
|---|---|---|
| Stalled connections on some paths | Path MTU discovery blocked by filtered ICMP | Allow required ICMP or clamp TCP MSS |
| Slow transfers on long links | Small TCP windows relative to bandwidth-delay product | Window scaling and modern congestion control |
| Head-of-line blocking | One lost TCP segment delays all later data | Multiplexed transports such as QUIC |
| Broken end-to-end reachability | Network address translation in IPv4 | IPv6 deployment |
A common misconception is that TCP guarantees delivery. It guarantees that delivered data is complete and in order, or that the connection reports a failure; it cannot force packets through a broken network.
The simple explanation
The TCP/IP suite works like the postal system for computers. IP writes the address on each envelope and lets the carriers move it from one sorting center to the next. TCP is the careful clerk who numbers every envelope, checks that all of them arrived and asks again for any that went missing.
Because every network on Earth agrees on these rules, a phone in one country can talk to a server in another without either side knowing how the networks in between are built.
How it is used in practice
A network engineer at a regional hospital investigates why remote staff can log in to the patient portal over a VPN but large reports never finish downloading. Captures show that the TCP handshake succeeds and small responses arrive, while full-size segments disappear on the path.
Applying the layered model, the engineer rules out the application and finds that a firewall drops the ICMP messages needed for path MTU discovery, while the VPN tunnel reduces the usable packet size. Clamping the TCP maximum segment size on the VPN gateway and allowing the required ICMP types solves the problem. Reports download normally the same day, without any change to the application.