Fundamentals of Computer Networks Study Notes

Internetworking and Network Models

1. Computer Networks

A computer network is a group of connected devices that exchange data using agreed rules. These devices may include computers, phones, servers, printers and networking equipment.

For example, a college laboratory can connect its computers and a printer through a switch. Students can send print jobs to the shared printer and access files on a server. This local communication does not require an Internet connection.

Networks support:

• Resource sharing: Several computers use the same printer or storage system.
• Communication: Users exchange messages, voice, video and files.
• Access to services: Applications use web servers, databases and other remote services.
• Centralized administration: An organization can manage shared services and user access from central systems.

A network connection alone does not ensure successful communication. The devices must also have compatible protocols, suitable addresses and working services.

Basic terminology

A device can have more than one network interface. A laptop may have Ethernet and Wi-Fi interfaces; a router normally has interfaces connecting different networks.

A protocol specifies the format of messages (syntax), what their fields mean (semantics), and rules for their exchange, such as order and timing. Merely connecting two devices does not ensure that they understand each other's messages.

Bandwidth, throughput and delay

In discussions of digital network capacity, bandwidth usually means the rated data-carrying capacity of a link, measured in bits per second. A 100 Mbps link can carry up to 100 million bits per second at its stated link rate.

Throughput is the actual rate achieved. It can be lower because of protocol overhead, congestion, errors or limitations of the communicating devices.

Latency, or delay, is the time taken for data to travel from one point to another. A link can have high capacity and still have high delay.

A bit and a byte are different: 8 bits = 1 byte. Ignoring overhead, 100 Mbps corresponds to 12.5 million bytes per second. It does not mean 100 million bytes per second.

In signal theory, bandwidth can instead mean a frequency range measured in hertz. The context determines which meaning applies. Baud measures symbols per second; it is not always equal to bits per second because one symbol may represent multiple bits.

2. Components of a Network

End devices

End devices produce or consume application data. A client laptop requests a web page; a server provides it. A network printer receives print jobs.

A client requests a service. A server provides a service. These terms describe roles, not just types of hardware. The same computer can be a client for one service and a server for another.

In a client–server network, services are provided by designated servers. This supports centralized management, but access to a service depends on its server being available.

In a peer-to-peer network, participating computers can share resources directly and act as both clients and servers. This can suit a small group, although consistent administration becomes harder as the group grows.

Network interface card

A network interface card (NIC), also called a network adapter, connects a host to the network. It may be built into the device or added separately.

An Ethernet NIC handles both physical signalling and data-link functions such as sending and receiving Ethernet frames. Its Ethernet MAC address identifies an interface for local frame delivery. An ordinary Ethernet MAC address is 48 bits, or 6 bytes, commonly written as hexadecimal pairs, such as 02:11:22:33:44:55.

MAC addresses are often assigned by manufacturers, but software can also configure them. A MAC address should not be treated as an unchangeable identity of an entire computer.

Intermediate devices and media

Intermediate devices help move data between end systems. Switches connect devices within a LAN; routers connect IP networks; wireless access points connect wireless clients to a network.

Copper cables carry electrical signals, optical fibre carries light signals, and wireless media carry electromagnetic signals. The medium carries a representation of bits; it does not decide which application should receive those bits.

3. Basic Network Types

Classification by coverage

These categories describe typical scope; they are not defined by one universal distance limit. A large campus can contain several interconnected LANs. Wired and wireless devices can belong to the same local network.

Internet, intranet and extranet

The Internet is the global collection of interconnected networks using the Internet protocol suite. It is a network of networks, not a single computer or a single organization's LAN.

An intranet is a private organizational network that uses Internet technologies. An employee-only internal website is an example.

An extranet gives selected external users controlled access to organizational resources. A supplier portal is an example. Controlled external access does not make all internal resources public.

The World Wide Web is one service that runs over the Internet. Email and remote login are other services. The Web and the Internet are not interchangeable terms.

Unicast, broadcast and multicast

• Unicast: Communication addressed to one receiver.
• Broadcast: Communication addressed to all devices in the relevant broadcast domain.
• Multicast: Communication addressed to members of a selected group.

A broadcast does not mean a message is delivered to every device on the Internet. Its scope is limited by the network's boundaries.

4. Links, Transmission Modes and Topologies

Point-to-point and multipoint links

A point-to-point link connects two endpoints. A direct connection between a computer and a switch port is an example.

A multipoint link is shared by more than two devices. The devices need rules for sharing its capacity and access to the medium.

Transmission modes

Full-duplex describes simultaneous two-way communication. Merely saying that a connection is point-to-point does not prove that it operates in full-duplex mode.

Physical and logical topology

Topology is the arrangement of a network.

• Physical topology describes the actual arrangement of devices and links.
• Logical topology describes how communication flows or how devices share the medium.

A hub-based Ethernet network can be physically arranged as a star while behaving logically as a shared bus. All attached devices share the hub's communication medium.

In a full mesh, every pair of nodes has a direct link. In a partial mesh, only selected pairs do. For n nodes, a full mesh needs n(n − 1)/2 bidirectional point-to-point links. Four nodes therefore need six links. Each pair is counted once.

5. Internetworking and Networking Devices

Internetworking means connecting separate networks so that devices on them can communicate. For example, a college may connect its administration LAN and laboratory LAN through a router.

Early networks often operated as separate systems. Internetworking created a need for common addressing and communication rules across different underlying technologies. TCP/IP emerged from ARPA/DARPA-supported network-interconnection work and became the basis for connecting diverse networks. It developed before the OSI reference model; it is not an implementation derived from OSI.

How internetworking developed

ARPANET dates from 1969, but TCP/IP itself was designed during the 1970s. Saying that “TCP/IP was developed in the 1960s” confuses the first network with the later internetworking protocols.

TCP/IP became dominant largely because it was already implemented, freely distributed (for example in Berkeley Unix) and in production use while the separate OSI protocol suite was still being standardized. OSI's lasting influence is its reference model and vocabulary. Terms such as “Layer 2 switch” and “Layer 3 device” come from it.

Today TCP/IP connects home networks, enterprise LANs, data centres, cloud platforms and mobile networks. IPv6 extends the same internetworking idea with a much larger address space.

Repeater and hub

A repeater regenerates received signals so that they can continue across a link. It does not read destination IP addresses or make routing decisions.

A hub is a multiport repeater. When it receives a signal on one port, it repeats it through the other ports. It does not learn which computer owns which MAC address.

If eight computers connect to a hub and one sends a frame to another, the other seven computers receive the repeated transmission at their interfaces. The addressed receiver accepts the intended unicast frame; other interfaces normally discard it. Receiving a signal is different from delivering its data to an application.

Repeaters and hubs operate at OSI Layer 1, the physical layer, because their main function concerns signals and bits.

Bridge and Layer 2 switch

A bridge connects LAN segments and filters or forwards frames using MAC addresses.

A Layer 2 switch is functionally a multiport bridge. It maintains a MAC address table, also commonly called a CAM table, associating MAC addresses with switch ports.

Its basic operation is:

1. Read the source MAC address of an incoming frame and learn the port on which that source is reachable.
2. Look up the destination MAC address.
3. Forward a known unicast frame through the appropriate port, rather than repeating it through every port.
4. If the destination is unknown, flood the frame through eligible ports in the same VLAN, except the incoming port.
5. Forward broadcasts through eligible ports in that same VLAN.

A VLAN is a logical separation of a switched network into distinct broadcast domains. For a basic network with all ports in one VLAN, the switch does not create a separate broadcast domain for every port.

A Layer 2 switch uses a MAC table for local frame forwarding. It does not use an IP routing table to perform that Layer 2 task.

Router and default gateway

A router forwards IP packets between networks. It examines the destination IP address and consults its routing table to select the next hop or outgoing interface.

A next hop is the next device to which a packet is sent on its journey. The default gateway of a host is normally a router interface on the host's own local network, used when traffic must leave that network and no more specific host route applies.

An IP subnet is a logical group of IP addresses sharing a network portion. A host uses its address and subnet mask or prefix to determine whether a destination is local. In a correctly configured basic LAN, hosts in the same subnet can communicate directly at the link layer; reaching another subnet requires routing.

Suppose Computer A and a printer belong to the same local IP subnet. Computer A can send to the printer directly through a switch. If A must reach a server on another subnet, it sends the packet through a router.

A router is a Layer 3 device because its routing decision uses network-layer information, especially the destination IP address. It also needs Layer 1 and Layer 2 functions on its interfaces. Calling it a Layer 3 device does not mean it lacks lower layers.

A host with two network interfaces is not automatically a router. Forwarding between those interfaces must be supported and enabled.

Multilayer switch, access point and gateway

A multilayer switch can perform Layer 2 switching and Layer 3 routing. Therefore, “all switches operate only at Layer 2” is too broad. The device's function matters.

A wireless access point, in ordinary bridging operation, links wireless clients to a LAN. It uses wireless physical signalling and Layer 2 forwarding. Wireless access and IP routing are separate functions, although a home networking device may combine them in one box.

The word gateway has two common meanings:

• A default gateway is the router used to reach other IP networks.
• A protocol gateway translates between different protocols or application systems. Its layer depends on the translation performed.

There is no single OSI layer that describes every device called a gateway. Some textbooks say that a gateway “operates at all seven layers”. That describes a gateway translating between completely different protocol stacks. It does not describe an ordinary default gateway, which is a Layer 3 router.

A modem performs modulation and demodulation: it converts between data and the signal form required by an access link. This is primarily a physical-transmission function. A combined home modem/router can also perform routing and other functions.

A firewall permits or blocks traffic according to security rules. A basic packet filter may examine IP addresses and transport ports, while application-aware filtering can inspect higher-layer information. A firewall therefore cannot be assigned one universal layer without specifying its operation. Routing chooses where traffic goes; filtering decides whether it is allowed.

Collision domains and broadcast domains

A collision occurs when devices transmit at the same time on a shared half-duplex medium and their transmissions interfere.

A collision domain is the shared area in which such collisions can occur. A hub extends one shared collision domain. Bridges and switches separate it into segments.

A broadcast domain is the group of interfaces reached by a Layer 2 broadcast. A basic switch forwards broadcasts within the VLAN. Routers normally stop Layer 2 broadcasts at routed boundaries.

A switch with eight active host ports is conventionally described as having eight separate collision domains. On correctly operating full-duplex links, collisions do not occur. The domain count describes isolation, not an expectation that collisions happen on those links.

6. Why Networking Uses Layers

Sending a file requires several different tasks: representing the file, selecting a service, handling transport, finding a path, delivering locally and transmitting signals. A layered architecture divides these tasks into manageable groups.

Each layer provides services to the layer above and uses services from the layer below. This makes it easier to replace one technology without redesigning every application. For example, IP can operate over Ethernet or Wi-Fi.

Three terms describe these relationships:

• Service: What a layer offers to the layer above.
• Interface: How adjacent layers in the same system access each other's services.
• Protocol: Rules followed by corresponding, or peer, entities on different systems.

Peer layers communicate logically. The transport layer on one host behaves as though it communicates with the remote transport layer. Actual data travels down through the sender's lower layers, across physical media and up through the receiver's layers.

Layering also supports troubleshooting. A broken cable, an incorrect route and a failed web service concern different functions. One symptom may have several possible causes, so a layer association is a starting point, not proof of a diagnosis.

7. The OSI Reference Model

OSI means Open Systems Interconnection. It is a seven-layer reference model developed by the International Organization for Standardization (ISO).

A reference model describes responsibilities and relationships. It is not itself a protocol that a computer transmits across a cable.

Layers 1–3 are often grouped as network-support layers, while Layers 5–7 are grouped as user-support layers. The transport layer connects the two groups by providing communication services for processes.

Layer 1: Physical

The physical layer represents bits as electrical, optical or radio signals and sends them through a medium.

Its responsibilities include:

• Signal characteristics and representation of 0 and 1.
• Bit rate and timing synchronization between transmitter and receiver.
• Physical interfaces, connectors and media characteristics.
• Point-to-point or multipoint link arrangements.
• Physical topology and transmission direction: simplex, half-duplex or full-duplex.

Line coding represents bits using signal patterns. Modulation varies a signal characteristic to carry information. Channel coding introduces redundancy that can help detect or correct transmission errors. These are physical-layer concepts; detailed coding calculations are not needed to distinguish their layer.

Multiplexing lets multiple signals or data streams share a communication resource. When referring to sharing a physical channel, it concerns transmission. This differs from transport multiplexing, which separates application conversations using ports.

The physical layer does not select an IP route or identify an application using a port number.

Layer 2: Data Link

The data-link layer organizes local transmission into frames. A frame is a structured unit containing control information and a payload.

For an IP packet carried over Ethernet, the packet becomes the frame's payload. Ethernet adds a header containing source and destination MAC addresses and a trailer containing a Frame Check Sequence (FCS).

Important responsibilities are:

1. Framing: Mark the boundaries of each unit sent over the link.
2. Physical addressing: Identify local sender and receiver interfaces, such as with Ethernet MAC addresses.
3. Access control: Govern use of a shared medium.
4. Error detection/control: Identify damaged frames and, where the link protocol supports it, recover from errors.
5. Link-level flow control: Where supported, prevent a sender from overwhelming the next receiver.

CRC means Cyclic Redundancy Check. Ethernet uses a CRC in its FCS to detect corruption. Detecting damage does not mean Ethernet automatically repairs the frame or retransmits it. Recovery capabilities depend on the protocol.

IEEE 802 describes two data-link sublayers:

• MAC — Media Access Control: Medium access and MAC addressing; functions depend on the LAN technology.
• LLC — Logical Link Control: Provides an interface to network-layer protocols. Some LLC services can provide flow/error control, but this does not mean every Ethernet frame uses acknowledged LLC delivery.

CSMA/CD is associated with shared half-duplex Ethernet access; CSMA/CA is associated with Wi-Fi access. Their role is medium access, not IP routing.

Ethernet framing, PPP and HDLC are examples of data-link functions/protocols. Ethernet and Wi-Fi also have physical-layer specifications; neither entire technology belongs exclusively to one layer.

Layer 3: Network

The network layer supports delivery from a source host to a destination host, potentially across several networks.

Its central responsibilities are:

• Logical addressing: IP addresses identify interfaces in an IP network structure.
• Routing: Determine paths through interconnected networks.
• Forwarding: Send a particular packet through the chosen next hop/interface.

IPv4 addresses are 32 bits; IPv6 addresses are 128 bits. These are logical addresses, distinct from an Ethernet MAC address.

IP — Internet Protocol provides connectionless, best-effort packet delivery. “Connectionless” means IP does not establish a connection before sending each packet. “Best effort” means it attempts delivery without guaranteeing arrival, ordering or freedom from duplication.

ICMP — Internet Control Message Protocol supports error reporting and diagnostics. For example, ping uses ICMP echo messages. ICMP is carried directly in IP, not through TCP or UDP.

IP forwarding does not by itself deliver data to the correct application process. That is a transport-layer responsibility.

Layer 4: Transport

The transport layer provides process-to-process communication between end systems. A host can run several network applications at once; transport protocols help deliver each conversation to the correct endpoint.

A port number identifies a transport endpoint/service on a host. It is not a physical socket on a switch. TCP and UDP use 16-bit port fields, giving values from 0 to 65535.

An endpoint is commonly represented by an IP address and port number. A TCP connection is identified by the combination of source IP, source port, destination IP and destination port. A destination port alone does not uniquely identify a connection across the network.

Depending on the protocol, transport functions include segmentation, reassembly, connection management, flow control and error recovery.

Segmentation divides an application's data stream into smaller transport units. At the receiver, reassembly reconstructs the data for the application. TCP sequence information lets the receiver put bytes in order even if network packets arrive out of order. Multiplexing allows several application conversations to share the host's network access; demultiplexing delivers incoming data to the appropriate endpoint using transport information.

TCP — Transmission Control Protocol provides a reliable, ordered byte stream between applications. It uses sequence information, acknowledgments and retransmission to deal with loss and ordering. Its connection establishment uses SYN → SYN-ACK → ACK, the three-way handshake.

SYN requests synchronization of sequence numbers; ACK acknowledges received information. The initiating endpoint sends SYN, the other replies with SYN-ACK, and the initiator acknowledges with ACK. This prepares transport communication; it does not create a dedicated physical cable between the hosts.

Reliability does not mean a failed network can never prevent delivery. A TCP connection can fail. TCP also does not encrypt application data by itself.

UDP — User Datagram Protocol sends independent datagrams without a TCP-style connection setup. It has no built-in retransmission, delivery-order guarantee or receiver flow-control mechanism. It does have a checksum mechanism for error detection; connectionless does not mean “no error checking.”

A delay-sensitive application may prefer UDP because waiting for a late retransmission may be less useful than continuing with fresh data. This does not mean every video application uses UDP or that UDP is always faster in every situation.

Why live video and voice commonly use UDP: in a video call, voice call or live game, a packet that arrives after its playback moment is useless. Retransmitting it would delay everything behind it, because TCP delivers bytes strictly in order. With UDP, the application can skip or conceal the missing piece and continue with fresh data. Such applications often carry media using RTP (Real-time Transport Protocol) over UDP; RTP adds sequence numbers and timestamps so the receiver can reorder and time playback.

Pre-recorded (on-demand) streaming is different. The player buffers several seconds ahead, so a retransmission usually arrives before it is needed. Many on-demand services therefore deliver video over HTTP and TCP. Newer HTTP/3 uses QUIC, which runs over UDP but implements its own reliability and congestion control. The choice depends on whether lateness or loss matters more to the application.

Flow control protects a receiver from a sender that is too fast. Congestion control addresses excessive traffic within the network. These are different problems. Link-level flow control concerns one link; TCP flow control concerns the receiving endpoint.

Layer 5: Session

The session layer coordinates a dialog, or ongoing interaction, between communicating applications.

Its conceptual responsibilities include:

• Establishing, maintaining and ending sessions.
• Dialog control: coordinating which participant may act or send at a particular stage.
• Token management: allowing only the permitted participant to perform a critical operation.
• Synchronization: placing checkpoints in a long activity so it can resume from an agreed point after interruption.

For example, imagine a transfer with checkpoints after every 50 completed records. If interruption occurs after record 120, a supported checkpoint mechanism can resume after record 100 instead of restarting from record 1.

Session checkpoints concern the progress of an application activity. TCP acknowledgments concern transport delivery. These are different responsibilities even when a real application implements them together.

Layer 6: Presentation

The presentation layer concerns how data is represented, so that the receiver can interpret it correctly.

Its conceptual functions are:

• Translation: Convert representations such as character encodings or number formats.
• Compression/decompression: Reduce the amount of data and restore it at the receiver.
• Encryption/decryption: Transform readable data into protected form and recover it with the appropriate key.

If two systems represent text differently, successful bit delivery alone is insufficient. They must agree on the representation or translate it.

In an OSI responsibility question, data-format conversion and encryption are presentation-layer functions. In actual TCP/IP systems, encryption can be implemented at different layers; it is incorrect to insist that all encryption occurs only at Layer 6. Format names such as JPEG describe representations, not transport protocols.

Layer 7: Application

The application layer provides networking services used by application software. It defines such things as web requests, file-transfer operations and email exchange.

A browser is a program; HTTP is an application-layer protocol used by that program. Application software and an application-layer protocol are related but are not the same thing.

A protocol can carry address information and still operate at the application layer. DNS and DHCP are examples.

Real-world examples at each OSI layer

A NIC performs both Layer 1 and Layer 2 functions. Some question banks list it under one of those layers only; the more precise answer is both.

Session- and presentation-layer examples are few because TCP/IP applications usually perform those functions themselves. TLS shows why exact placement is debated. OSI-style questions usually list it under Presentation, as encryption, or Session. In a real TCP/IP stack it runs above TCP and below the application protocol: HTTPS = HTTP over TLS over TCP.

Firewalls and load balancers are classified by what they inspect. A packet filter works with Layer 3 and 4 information. An application-aware firewall or HTTP load balancer also examines Layer 7 data.

8. The TCP/IP Model

TCP/IP means Transmission Control Protocol/Internet Protocol. The name refers to a suite containing many protocols, not just TCP and IP. The suite supports private networks as well as the Internet.

Four-layer model

The TCP/IP application layer covers responsibilities associated with the OSI application, presentation and session layers. Those functions have not disappeared merely because the model has no separate boxes for them.

The network-access layer groups the lower-level responsibilities commonly explained as physical and data-link functions in OSI.

Five-layer teaching model

A five-layer Internet model separates network access into data link and physical layers:

Application
Transport
Network / Internet
Data Link
Physical

This is a different way of describing the same broad communication functions. A question that asks for the number of TCP/IP layers must specify the convention. The four-layer model is used for the TCP/IP comparison below.

OSI and TCP/IP compared

OSI is a general reference framework with seven separately named layers. TCP/IP describes the architecture and protocols used for Internet communication. The mapping is useful, but real protocols do not always fit into exactly one OSI box.

The OSI model alone does not guarantee successful delivery. For TCP/IP, the chosen protocol matters: TCP provides reliability mechanisms, while UDP does not provide the same service.

Address resolution and protocol mapping

DNS can resolve a hostname to an IP address. ARP — Address Resolution Protocol resolves a known local next-hop IPv4 address to a link-layer address, normally an Ethernet MAC address. ARP does not resolve a hostname.

ARP messages are carried directly inside link-layer frames (Ethernet type value 0x0806), not inside IP, UDP or TCP. An ARP request is a local broadcast, so it does not cross a router. A host never uses ARP to learn the MAC address of a server on a remote subnet; it learns its default gateway's MAC instead.

ARP supports the boundary between IP and local-link delivery. In the four-layer TCP/IP convention used here, it is treated as a link/network-access mechanism. Diagrams sometimes group it beside IP to show its supporting relationship. Its function and local-link scope are more useful than assigning it an unexplained OSI layer number.

RARP — Reverse Address Resolution Protocol is a historical mechanism for obtaining a protocol address using a known hardware address. It is not reverse DNS, which looks up name information associated with an IP address.

9. Encapsulation and De-encapsulation

Headers, trailers, payloads and PDUs

A header is control information placed before data. A trailer is control information placed after data. The payload is the content carried by that layer.

A Protocol Data Unit (PDU) is the unit processed by a particular protocol layer. An entire upper-layer PDU becomes the payload of the lower layer.

Encapsulation at the sender

Encapsulation is the addition of protocol control information as data moves down the stack.

For application data sent using TCP, IPv4 and Ethernet:

1. The application creates data, such as a web request.
2. TCP adds a transport header, including port and sequence information, to form a TCP segment.
3. IP adds a network header, including source and destination IP addresses, to form an IP packet.
4. Ethernet adds its local-link header and FCS trailer, forming a frame.
5. The physical layer represents the frame's bits as signals on the medium.

Application data
[TCP header | Application data]
[IP header | TCP header | Application data]
[Ethernet header | IP header | TCP header | Application data | FCS]
Bits represented as signals on the link

The usual shorthand is:

Data → TCP segment → IP packet → Frame → Bits

With UDP, the transport unit is a UDP datagram, rather than a TCP segment. “Datagram” can also refer to an IP packet; its layer must be clear from context.

Not every message uses TCP or UDP. For example, an ICMP message is carried directly inside an IP packet. Also, a real Internet exchange does not necessarily add seven separate headers merely because OSI has seven layers.

De-encapsulation at the receiver

De-encapsulation reverses the process:

1. Physical signalling is interpreted as bits.
2. The link layer interprets the frame and checks its link-level information.
3. The IP packet is extracted and processed by the network layer.
4. The transport protocol processes its header and passes the data to the appropriate endpoint.
5. The application interprets the received message.

Bits → Frame → IP packet → TCP segment → Application data

Headers and trailers are processed and removed at their relevant layers; they are not simply handed to the user as file content.

Three different kinds of address

A frame carrying an IP packet can contain all three kinds at once, in different headers. They are complementary, not alternatives.

10. Following Data Across a Router

Consider this network, with both links using Ethernet:

Computer A ── Switch ── Router R ── Server B
              LAN 1                 LAN 2

Assume A and B are on different IP subnets. R can route between them. There is no address translation, tunnelling or proxying.

1. A creates an IP packet addressed to B's IP address.
2. Because B is remote, A chooses R as the next hop.
3. A obtains R's local-interface MAC address, using ARP if necessary.
4. A sends an Ethernet frame with A's MAC as source and R's LAN 1 MAC as destination. Inside it, the IP destination is still B.
5. The switch forwards the frame using its MAC address table.
6. R receives the frame, removes the incoming link encapsulation and examines the destination IP address.
7. R consults its routing table and creates a new outgoing frame for LAN 2.
8. The new frame uses R's LAN 2 MAC as source and B's MAC as destination.
9. B receives the frame and processes it up the stack.

The link-layer envelope changes at the router. The source and destination IP addresses remain unchanged under the stated assumptions. However, the whole IP header is not unchanged: an IPv4 router decrements the Time to Live (TTL) value and updates the IPv4 header checksum. TTL prevents packets from circulating indefinitely.

Ordinary forwarding does not terminate the application's TCP connection at each router. The router is not the receiver of the web request merely because it receives a local frame.

If A and B are on the same local subnet, A instead uses B as the local next hop and sends the frame to B's MAC. A router is not required for that local exchange.

One application, different link technologies

An Internet service provider can carry the same customer's IP traffic across several types of links. A web exchange might use HTTP over TCP over IP, while one link carries the IP packet in Ethernet and another carries it in PPP.

The local frame format changes with the link. The application need not become a different protocol simply because the underlying link changes. This is a practical benefit of layering and internetworking.

Applying the models to a corporate or cloud network

An employee in a branch office uses a Wi-Fi laptop to open a company application hosted in a cloud data centre. Each part of the path concentrates on different layers:

The frames are rebuilt on every link. The application data, TCP connection and IP endpoints stay end-to-end unless a device deliberately changes or terminates them. Examples are address translation (NAT, Topic 12), a proxy or a load balancer.

If the employee reports that “the application is slow”, the model helps divide the problem. Is Wi-Fi signal quality poor (Layers 1–2)? Is a route or firewall rule wrong (Layers 3–4)? Or is the application server itself overloaded (Layer 7)?

11. Layer-Based Interpretation of Network Problems

A working physical connection does not prove that IP addressing, routing and application services are correct. Likewise, failure of one web request does not by itself identify a broken cable.

12. Complete End-to-End Encapsulation Walkthrough

Suppose a browser on Computer A sends a small request to a web service on Server B. The application creates the request data. The transport layer places that data in a TCP segment and identifies application endpoints with port numbers. The Internet layer places the segment in an IP packet whose addresses identify A and B. The network-access layer places the packet in a frame addressed to the next hop on the current link. The physical layer transmits signals.

~~~text Application request ↓ add TCP header [TCP header | request] ↓ add IP header [IP header | TCP header | request] ↓ add link header and trailer [Ethernet header | IP header | TCP header | request | FCS] ↓ represent as signals bits cross the first link ~~~

Each bracketed unit becomes the payload of the next lower layer. “Payload” therefore depends on viewpoint. The TCP segment is an IP payload; the entire IP packet is an Ethernet payload.

At a router, processing does not normally continue to the destination web application:

~~~text incoming frame checked and removed ↓ IP destination and routing information examined ↓ TTL updated ↓ packet enclosed in a new outgoing-link frame ↓ outgoing bits ~~~

At Server B, de-encapsulation continues through transport to the application. The destination transport port helps the operating system deliver the data to the correct endpoint. Browser and server communicate logically as application peers, while the bytes use every required lower layer.

What changes and what remains

This avoids two errors: claiming that “nothing changes” at a router, and claiming that the router replaces the final IP destination with its own address.

13. Selecting and Interpreting Network Devices

A device should be classified by the function it performs, not only by the product name.

A basic switch does not become a router merely because it forwards a broadcast through several ports. A router does not become an application server merely because it receives a frame on the route toward that server.

When a switch learns, it records the source MAC address and incoming port. If a destination MAC is known, it forwards the unicast through the selected port. If an eligible destination is unknown, it floods copies within the VLAN except through the incoming port. Flooding does not rewrite the unicast destination into a broadcast address.

A Layer 2 broadcast is also forwarded within its broadcast domain. A router normally separates Layer 2 broadcast domains and does not simply repeat that frame into another IP network.

14. A Layer-by-Layer Diagnostic Method

Troubleshooting becomes clearer when checks follow dependencies:

1. Physical: Is the interface active and is a usable signal present?
2. Data link: Is the device on the intended local segment or VLAN? Are frames received without link errors?
3. Network: Are the IP address, subnet decision, next hop and route appropriate?
4. Transport: Is the required endpoint reachable, and does its exchange behave as expected?
5. Application: Does the required service, such as DNS or the requested application, respond correctly?

This is a reasoning method, not a rule that every investigation must finish one layer before observing another. Evidence can point directly higher.

If a user reaches a server by IP address but not by hostname, the test provides evidence that the tested IP path works. DNS name resolution is the more direct area to investigate. Replacing a cable without further evidence ignores that distinction.

If a host communicates within its subnet but not with a remote subnet, local physical and data-link communication works for those tests. Check its subnet decision, default gateway and routing path. The symptom does not prove which route is missing, but it narrows the involved functions.

15. Model Interpretation Rules

• Models describe responsibilities; implementations can combine them.
• A protocol can help supply addresses without belonging to the Network layer. DNS and DHCP are application protocols.
• A conceptual Presentation responsibility does not require a separately named TCP/IP Presentation layer.
• Device layer labels describe forwarding functions. A multilayer device can perform more than one.
• Seven OSI layers do not imply seven separate headers in every message.
• Lower-layer connectionless delivery can support an upper-layer reliable service because layers add different behavior.
• Peer communication is logical. Actual information reaches a peer through lower layers and physical links.

These rules make OSI and TCP/IP useful analytical tools without treating either diagram as a literal picture of every software component.