# TCP/IP: what is it and how does it work?

TCP/IP is one of the implementations of "packet-switching" and forms the foundation of our modern internet.

If you want to learn more about the origin and history of the Internet, check out our article on the subject!

In other words, it's a way of transmitting data by breaking it down into several small-sized packets to send over the network.

Contrary to what is often heard, TCP/IP is not a protocol, but a suite of protocols (generally known as the "Internet Protocol Suite").

Each data packet contains two nested "boxes": the TCP part (small box) and the IP part (big box)

The IP contains information about the sender's and recipient's address, so that the packet is properly transmitted over the network and reaches the correct remote machine. On its side, TCP will ensure that the sending machine can be informed if the packet does not reach its destination and manage the resending of data if needed.

We talk about encapsulation because the TCP segment is encapsulated (included) within the IP datagram, since the packet must first reach the correct machine identified by its address before the data can be delivered to the correct application identified by its port (80 for HTTP, 22 for SSH, 21 for FTP, etc.)

In order to provide transmission error information, TCP must establish a "connection" between the sender and the recipient, which is why it is referred to as a connection-oriented protocol.

A TCP session works in three phases:

• Opening the connection
• Transferring data and handling errors
• Closing the connection

Here is the datagram of the first layer (IP):

IP Datagram (source: wikipedia)

There is a lot of different data but the most important are the following:

• "Protocol" indicates the type of protocol used to carry the data contained in "data". For example, for the TCP protocol, the value of this field will be 0110 (6 = TCP).
• "Source address" contains the IP address of the machine that sent the packet
• "Destination address" contains the IP address of the machine meant to receive the packet
• "Data" contains the data to be transported.

Here, the content of "Data" is the TCP data, whose datagram is shown below:

TCP segment contained in the Data section of the IP datagram (source: wikipedia)

The TCP frame contains various pieces of information (in addition to the encapsulated data), notably for routing (the two port addresses at the beginning of the frame), but also error-handling data: to check that packets arrive in the correct order, and that they are all complete in order to preserve data integrity.

And then what?

All "application" protocols use this suite of protocols by encapsulating their own data within these datagrams, which will be routed across the network through the mechanisms explained previously.

All the tools you use daily have the same underlying functioning: HTTP, FTP, SMTP, etc... because they share the same view of the Internet network through TCP/IP.

Note, however, that some application protocols use not the TCP/IP suite but UDP/IP, the difference of which I will explain in an upcoming article!

Each packet travels across the network, from gateway to gateway thanks to the destination IP address it contains, with any packets lost along the way being resent. Once received, the packet will be routed to the port contained in the TCP frame in order to deliver it to the correct application.

Once every packet making up a single piece of data has been received, they will be merged and finally become usable by the application in question. If the target machine wishes to send a response, it will have the full address (IP and port) of the originating machine, all it will need to do is send packets back in the other direction!