OSI and TCP/IP Models

Every GATE Computer Networks question that asks "at which layer does X happen?" is testing one thing — your fluency with the OSI reference model. Once you can recite the seven layers in order, name the PDU (Protocol Data Unit) at each, and place a few canonical protocols correctly, you have unlocked perhaps the highest-yield static knowledge in the entire CN syllabus.

Definition: The OSI (Open Systems Interconnection) reference model is a seven-layer conceptual framework standardised by the ISO (International Organization for Standardization) in 1984 as ISO 7498. It describes how data should travel from a sending application across a network and back up to a receiving application, by dividing the work into seven independent, layered responsibilities.

Definition: A Protocol Data Unit (PDU) is the formatted unit of data exchanged between peer entities at the same layer. The PDU's name changes at every layer — bit at the Physical layer, frame at the Data Link layer, packet at the Network layer, segment (or datagram) at the Transport layer, and simply "data" at the upper three layers.

The seven layers, from bottom to top

The OSI model is studied bottom-up because data flows up through the layers on receive, and the lower layers are concerned with raw physical movement of bits.

1. Physical (Layer 1) — transmission of raw bits over a physical medium (copper, fibre, radio). Deals with voltages, frequencies, modulation, connector pin layout (RJ-45, RS-232), and data rate. Devices: hubs, repeaters, cables, NIC physical interface. PDU: Bit.

2. Data Link (Layer 2) — node-to-node transfer of frames across a single physical link, with error detection (CRC), framing, MAC addressing and flow control. Sub-layers: LLC (Logical Link Control) and MAC (Media Access Control). Devices: switches, bridges, NICs. Protocols: Ethernet, PPP, HDLC, IEEE 802.11 MAC. PDU: Frame.

3. Network (Layer 3) — end-to-end delivery of packets across multiple networks, routing, logical addressing (IP). Devices: routers, Layer-3 switches. Protocols: IP (IPv4, IPv6), ICMP, ARP (debated; ARP straddles L2-L3), routing protocols such as OSPF, BGP, RIP. PDU: Packet (or datagram in connectionless context).

4. Transport (Layer 4) — end-to-end process-to-process delivery, segmentation and reassembly, connection control, reliability and flow control. Protocols: TCP (reliable, connection-oriented), UDP (best-effort, connectionless), SCTP. Port numbers belong here. PDU: Segment (TCP) / Datagram (UDP).

5. Session (Layer 5) — establishment, management and termination of dialogues between applications; checkpointing and recovery for long transfers. Protocols: NetBIOS, RPC, PPTP control. PDU: Data.

6. Presentation (Layer 6) — syntax translation: encoding/decoding (ASCII, Unicode), compression, encryption/decryption. Examples: TLS/SSL operations (often discussed at L6 in academic treatments), MIME, JPEG, MPEG. PDU: Data.

7. Application (Layer 7) — the interface to end-user processes. Protocols: HTTP / HTTPS, FTP, SMTP, POP3, IMAP, DNS, DHCP, SNMP, Telnet, SSH. PDU: Data.

Mnemonics for the order

The two standard memory aids are:

Bottom-up (Physical → Application): "Please Do Not Throw Sausage Pizza Away" — P-D-N-T-S-P-A.

Top-down (Application → Physical): "All People Seem To Need Data Processing" — A-P-S-T-N-D-P.

Use whichever direction you find natural; both are universally recognised in CN textbooks.

Grouping: media vs host

A useful conceptual split:

• Layers 1–3 are the "network / media" layers: hardware-oriented, concerned with moving bits and addressing devices.
• Layers 5–7 are the "host / application" layers: software-oriented, concerned with the meaning and use of the data.
• Layer 4 (Transport) is the bridge between the two — it hides network details from the application above and provides reliability above the unreliable network below.

The PDU sequence — climb up the ladder

Why it matters: GATE has a recurring question pattern — "What is the PDU at the Transport layer?" or "Which layer fragments and reassembles?" The PDU sequence, climbed bottom-up, is:

Bits → Frames → Packets → Segments → Data (Data / Data)

A common mnemonic is "Boys From Pakistan Send Data" or "Bits, Frames, Packets, Segments, Data" read aloud as a chant. The PDU name changes because each layer adds its own header (and sometimes trailer) to the PDU it receives from the layer above — a process called encapsulation.

On encapsulation: the Application layer hands "data" down. The Transport layer prepends a TCP/UDP header → segment. The Network layer prepends an IP header → packet. The Data Link layer prepends a frame header and appends a trailer → frame. The Physical layer transmits this as a sequence of bits. At the receiver, the reverse process — decapsulation — strips the headers in reverse order.

OSI vs TCP/IP — context for GATE

The OSI model is a conceptual reference; the TCP/IP model is the protocol stack actually used on the Internet. TCP/IP has four (or five, depending on the textbook) layers: Network Access (often split into Physical + Data Link), Internet, Transport, Application. The five upper OSI layers (Session, Presentation, Application) are folded into TCP/IP's single Application layer.

GATE often asks: "Which of the following functions is performed by the Session layer of OSI?" — the trick is that TCP/IP has no separate Session layer, but OSI does. Always check whether the question is asking about OSI specifically.

Worked example

Question: A user opens https://www.iitb.ac.in/ in a browser. At which OSI layer does the TLS handshake conceptually belong, and what is the PDU at the layer below the one that adds the IP header?

Solution:
Step 1: Identify TLS. TLS provides encryption and authentication; conceptually it sits at the Presentation layer (Layer 6) in OSI treatments, though in practice it runs between TCP and HTTP.
Step 2: Identify the layer that adds the IP header. That is the Network layer (Layer 3).
Step 3: The layer above Network is Transport (Layer 4). Its PDU is the segment (TCP) or datagram (UDP).

Conclusion: TLS belongs to Layer 6 (Presentation); the PDU at the layer above the one adding the IP header is a segment (or datagram).

Common misconception

Common misconception: "Routers operate at Layer 4 because they understand ports." False. Routers operate at Layer 3 (Network), making forwarding decisions on IP addresses. Devices that inspect port numbers (firewalls doing port-based filtering, NAT gateways doing PAT) operate at Layer 4 functionally, but classical routing is purely Layer 3.

Common misconception 2: "ARP is a Layer 3 protocol because it deals with IP." Wrong — ARP resolves an IP address to a MAC address and operates between Layers 2 and 3. Most textbooks place it at Layer 2.5 or call it a Layer 2 protocol; GATE generally accepts "Layer 2" for ARP unless the option explicitly mentions Layer 2.5.

Common misconception 3: "HTTPS is its own layer." HTTPS is HTTP running over TLS. HTTP is Layer 7; TLS encryption is Layer 6 conceptually. They are not separate layers.

Real-world example

Real-world example: When a Bengaluru student opens NPTEL videos on a college Wi-Fi network, the request travels down through HTTP (L7), TLS encryption (L6), TCP segmentation (L4), IP routing (L3), Wi-Fi 802.11 framing (L2), and the radio signal itself (L1). At the NPTEL server, the same headers are stripped in reverse order until the application reads the original request. This invisible journey is what the OSI model formalises.

:::compare

Layer	Number	Name	PDU	Example protocols / devices
7	Application	Data	HTTP, FTP, DNS, SMTP, SSH
6	Presentation	Data	TLS, MIME, JPEG, ASCII
5	Session	Data	NetBIOS, RPC
4	Transport	Segment / Datagram	TCP, UDP, SCTP
3	Network	Packet	IP, ICMP, OSPF; Routers
2	Data Link	Frame	Ethernet, PPP, 802.11; Switches, Bridges
1	Physical	Bit	Cables, hubs, repeaters, NIC PHY
:::

:::keypoints

• OSI has seven layers, standardised by ISO in 1984 (ISO 7498).
• Bottom-up mnemonic: "Please Do Not Throw Sausage Pizza Away."
• Top-down mnemonic: "All People Seem To Need Data Processing."
• Layers 1–3 are media/hardware; layers 5–7 are host/software; layer 4 bridges them.
• PDU sequence (bottom-up): Bit → Frame → Packet → Segment → Data.
• Encapsulation adds a header at each layer going down; decapsulation strips them going up.
• TCP/IP collapses OSI's Session, Presentation and Application into one Application layer.
• Routers: Layer 3; Switches: Layer 2; Hubs: Layer 1; Gateways: typically all seven layers.
  :::

:::memory
OSI = "Please Do Not Throw Sausage Pizza Away" (bottom-up) for layer names.
PDU = "Boys From Pakistan Send Data" — Bits, Frames, Packets, Segments, Data.
And remember: "4 is the bridge" — Transport sits exactly in the middle, between media and host concerns.
:::

:::recap

• Seven layers, each with a defined responsibility and a named PDU.
• Memorise both the layer order and the PDU sequence; GATE tests both directly.
• Place common protocols correctly: IP at L3, TCP/UDP at L4, HTTP/DNS at L7.
• Distinguish OSI from TCP/IP; GATE questions specify which model they mean.
  :::

Every time you send a WhatsApp message, your phone quietly does seven jobs in a strict order, each handled by a different layer of the OSI model. Knowing which layer does what is one of the highest-yield ideas in GATE CSE — it appears almost every year as a one-mark direct match or as an embedded fact inside a longer scenario question.

Definition: The OSI (Open Systems Interconnection) model is a seven-layer conceptual framework, defined by ISO, that splits the work of network communication into clean, independent stages so that hardware and software from different vendors can interoperate.

The seven layers, from bottom to top, are Physical, Data Link, Network, Transport, Session, Presentation and Application. Each layer talks only to the one directly above and below it on the same machine, and to its peer layer on the remote machine. This isolation is what makes the model so powerful: you can swap copper for fibre at layer 1 without touching your browser, or change from TCP to QUIC at layer 4 without rewriting your routing tables.

Physical Layer (Layer 1)

The physical layer is the world of voltages, light pulses, radio waves and connectors. It does not understand the meaning of bits — it only transmits raw bits across a medium. Its responsibilities are bit transmission, encoding (Manchester, NRZ, etc.), signalling, bit rate, network topology (bus, star, ring, mesh) and the mechanical and electrical specifications of cables and pins (think RJ-45, CAT-6, RS-232).

Why it matters: every higher-layer feature ultimately rides on what the physical layer can sustain. If layer 1 gives you 100 Mbps with 1% bit error rate, no clever protocol above it can magically deliver gigabit reliability.

Data Link Layer (Layer 2)

The data link layer turns the raw bit stream into reliable frames between two directly connected nodes. Its job covers framing, MAC (physical) addressing, error detection using CRC, flow control, and medium access control.

It is internally split into two sublayers:

• LLC (Logical Link Control) — handles flow and error control, multiplexes upper-layer protocols.
• MAC (Media Access Control) — decides who gets to transmit on a shared medium (Ethernet's CSMA/CD, Wi-Fi's CSMA/CA).

Common exam keyword: CRC at the Data Link layer, not the network layer.

Network Layer (Layer 3)

The network layer is where end-to-end logical addressing (IP) lives. It is responsible for routing packets across multiple networks, path determination, fragmentation and reassembly when an MTU shrinks, and congestion control at the IP level. Protocols: IP, ICMP, ARP, RIP, OSPF, BGP.

Real-world example: when you open flipkart.com from a hostel Wi-Fi in Patna, a router in Mumbai decides the next hop towards Flipkart's data centre purely using layer-3 IP routing tables.

Transport Layer (Layer 4)

The transport layer provides end-to-end delivery between processes. It does segmentation of application data into segments, port addressing (so port 443 reaches HTTPS), and offers two flavours:

• TCP — connection-oriented, reliable, in-order, with flow and error control.
• UDP — connectionless, fast, no delivery guarantee.

Why it matters: students often confuse "host-to-host" (network layer) with "process-to-process" (transport layer). Layer 3 gets the packet to the right machine; layer 4 gets it to the right application on that machine.

Session Layer (Layer 5)

The session layer manages dialogs between two applications. Its functions are session establishment, maintenance and teardown, dialog control (who speaks when — full duplex, half duplex), synchronization and checkpointing (so a large file transfer can resume from the last checkpoint after a crash).

Exam tip: any mention of synchronization points, checkpointing, or dialog control almost always points to layer 5.

Presentation Layer (Layer 6)

The presentation layer is the network's translator. It handles data translation between formats (ASCII to EBCDIC), encryption and decryption, compression, and syntax/semantics of the data exchanged. SSL/TLS encryption is often associated here in the OSI mapping (in TCP/IP it sits between transport and application).

Memory hook: if the question mentions encryption or compression without giving any other clue, default to Presentation.

Application Layer (Layer 7)

The topmost layer is the user interface to network services. Protocols include HTTP, HTTPS, FTP, SMTP, POP3, IMAP, DNS, Telnet, SSH, SNMP. It does not mean the end-user application (Chrome, Gmail) itself — those are above the OSI stack. Layer 7 protocols are what those applications speak.

:::compare

Layer	Key Function	Address / Unit	Classic Keyword
7 Application	User-facing protocols	Data	HTTP, DNS, FTP
6 Presentation	Encryption, compression, translation	Data	TLS, JPEG, ASCII
5 Session	Dialog, checkpointing	Data	Sync points
4 Transport	End-to-end, ports	Segment	TCP/UDP, port
3 Network	Logical addressing, routing	Packet	IP, router
2 Data Link	Framing, MAC, CRC	Frame	MAC, switch
1 Physical	Bit transmission	Bit	Voltage, cable
:::

Common misconception: "Routers work at layer 2." Wrong — switches and bridges operate at layer 2, routers operate at layer 3. Hubs and repeaters are layer 1 devices.

Question: At which OSI layer is port addressing performed?
Solution:
Step 1: Port numbers (like 80, 443, 22) identify the destination process on a host.
Step 2: Process-to-process delivery is the defining responsibility of the transport layer.
Conclusion: Port addressing is a Transport layer function.

:::keypoints

• Routing and logical (IP) addressing are done at the Network layer.
• Framing, MAC addressing and CRC error detection live at the Data Link layer.
• Port addressing and end-to-end reliability sit at the Transport layer.
• Encryption and compression are Presentation layer responsibilities.
• Dialog control and checkpointing are Session layer features.
• The Data Link layer is split into LLC and MAC sublayers.
• Physical layer deals only with raw bits, never their meaning.
  :::

:::memory
"All People Seem To Need Data Processing" — top to bottom: Application, Presentation, Session, Transport, Network, Data Link, Physical.
Reverse it for bottom-to-top: "Please Do Not Throw Sausage Pizza Away."
:::

:::recap

• Each OSI layer has one signature responsibility — match the keyword in the question to that signature.
• Network = IP/routing, Transport = ports/TCP-UDP, Data Link = frames/MAC/CRC.
• Encryption/compression = Presentation, dialogs/checkpoints = Session.
• Hubs (L1), switches (L2), routers (L3) — never mix these up in exams.
  :::

Knowing which device operates at which layer is a frequent GATE question. Hub and Repeater operate at the Physical layer (Layer 1) - they regenerate/broadcast signals with no intelligence. Bridge and Switch operate at the Data Link layer (Layer 2) - they use MAC addresses and maintain forwarding tables. Router operates at the Network layer (Layer 3) - uses IP addresses for routing between networks. Gateway typically operates up to the Application layer (Layer 7), translating between different protocol stacks. A Layer-3 switch combines switching with routing. Memory aid: Hub=1, Switch/Bridge=2, Router=3, Gateway=all-the-way-up.

The TCP/IP model (Internet model) is the practical foundation of the Internet. The original RFC model has 4 layers: Application, Transport, Internet, Network Access (Link). Many textbooks (Forouzan) use a 5-layer version: Application, Transport, Network (Internet), Data Link, Physical. The TCP/IP Application layer combines OSI's Application + Presentation + Session. The TCP/IP Network Access layer combines OSI's Data Link + Physical (in the 4-layer view). Key protocols by layer: Application = HTTP, FTP, SMTP, DNS, SNMP, TELNET; Transport = TCP, UDP; Internet = IP, ICMP, IGMP, ARP (debated placement); Link = Ethernet, Wi-Fi. Remember: TCP/IP has fewer layers and was built before its model was formally defined.

OSI has 7 layers; TCP/IP has 4 (or 5). OSI is a reference/theoretical model (protocols defined after the model); TCP/IP is protocol-driven (model defined after protocols). OSI strictly separates services, interfaces, and protocols; TCP/IP does not. OSI's Network layer supports both connectionless and connection-oriented service; OSI Transport is only connection-oriented. TCP/IP's Internet (Network) layer is connectionless only; its Transport layer supports both (TCP=connection-oriented, UDP=connectionless). OSI was a documentation model that largely failed commercially; TCP/IP succeeded as the Internet standard. Mapping: OSI top 3 (App+Pres+Session) = TCP/IP Application; OSI bottom 2 = TCP/IP Network Access.

GATE CSE almost never lets a Computer Networks paper escape without one or two questions on which protocol sits at which layer of the TCP/IP suite. The questions are mark-rich and time-cheap once you have the mapping memorised cleanly.

Definition: The TCP/IP model is the four-layer architecture (Link, Internet, Transport, Application) that actually runs the Internet. Every protocol that moves data over the network has a "home layer" where it does its main job.

Definition: A port number is a 16-bit identifier that the Transport layer uses to deliver data to the correct application — for example, port 80 for HTTP and port 443 for HTTPS.

A quick map of the layers

The TCP/IP suite (often called the Internet model) has four layers, from bottom to top:

1. Link layer (also called Network Access / Data Link) — moves raw frames over a physical medium.
2. Internet layer (Network layer) — routes packets between networks.
3. Transport layer — provides process-to-process communication.
4. Application layer — provides services directly to user programs.

Some textbooks split the bottom into Physical + Data Link to align with the seven-layer OSI model, but the protocols stay in the same places.

Application-layer protocols (well-known ports)

These protocols use either TCP or UDP (or both) underneath, and most have a well-known port number that GATE loves to test.

• HTTP — HyperText Transfer Protocol — port 80 (TCP). Carries the World Wide Web.
• HTTPS — HTTP over TLS — port 443 (TCP). The secured version.
• FTP — File Transfer Protocol — uses two TCP ports: 21 for control and 20 for data.
• SMTP — Simple Mail Transfer Protocol — port 25 (TCP). Pushes mail between mail servers.
• POP3 — Post Office Protocol v3 — port 110 (TCP). Pulls mail from a server to a client.
• IMAP — Internet Message Access Protocol — port 143 (TCP). Synchronises mail.
• DNS — Domain Name System — port 53. Uses UDP for ordinary queries and TCP for zone transfers and large responses.
• DHCP — Dynamic Host Configuration Protocol — ports 67 (server) and 68 (client). Uses UDP because the client does not yet have an IP address when it sends the first packet.
• TELNET — port 23 (TCP). Remote login (insecure).
• SSH — Secure Shell — port 22 (TCP). Secure remote login.
• SNMP — Simple Network Management Protocol — port 161 (UDP) for agents and 162 for traps.
• TFTP — Trivial FTP — port 69 (UDP). Used in PXE boot and network device firmware loads.

Transport-layer protocols

Only two matter for GATE in the TCP/IP world:

• TCP — Transmission Control Protocol. Connection-oriented, reliable, byte-stream. Provides three-way handshake, sequence numbers, acknowledgements, retransmission, flow control (sliding window) and congestion control. Used by HTTP, HTTPS, FTP, SMTP, POP3, IMAP, TELNET, SSH.
• UDP — User Datagram Protocol. Connectionless, unreliable, message-oriented. No handshake, no acknowledgements, no congestion control. Used where speed matters more than reliability — DNS queries, DHCP, TFTP, SNMP, VoIP, online games, video streaming.

GATE often asks comparisons: "Which of the following is connection-oriented?", "Which protocol is used by DHCP?" — and the answers depend on this short list.

Internet (Network) layer protocols

• IP (IPv4 / IPv6) — Internet Protocol. The layer's workhorse: it provides best-effort, connectionless routing of packets from source to destination.
• ICMP — Internet Control Message Protocol. Carries network-control messages such as echo request/reply (ping), destination unreachable, time exceeded (used by traceroute), and redirect. ICMP messages are encapsulated inside IP datagrams but are considered part of the Internet layer alongside IP.
• IGMP — Internet Group Management Protocol. Used by hosts and routers to manage multicast group membership. Also encapsulated within IP.
• ARP — Address Resolution Protocol. Maps an IPv4 address to a MAC address on the local link. ARP sits at the boundary between the Link and the Internet layer — it is essentially Link-layer in operation, but it is needed for Internet-layer addressing to work. Different textbooks place it differently; both Forouzan and Tanenbaum are common GATE references and disagree slightly. GATE itself usually treats ARP as Link layer.
• RARP — Reverse ARP — maps a MAC to an IPv4 address; obsolete, replaced by DHCP.

In IPv6 the equivalent of ARP is NDP (Neighbour Discovery Protocol), which uses ICMPv6.

Link-layer protocols

These live at the bottom and deal with frames on a wire or air.

• Ethernet (IEEE 802.3) — the dominant wired LAN technology.
• Wi-Fi (IEEE 802.11) — wireless LAN.
• PPP — Point-to-Point Protocol. Used historically for dial-up, modern WAN links and PPPoE/PPPoA.
• Token Ring (IEEE 802.5) — legacy LAN technology, mostly of historical interest, but it still appears in GATE memory aids.
• HDLC — High-level Data Link Control — used in some WAN links.

Why it matters

GATE CSE typically allocates two-to-three marks on Computer Networks to "layer mapping" or "which protocol is connection-oriented" questions. These are pure-recall questions with very low solving time. If you can hold the mapping below in your head, you save 5-7 minutes in the paper and almost guarantee 2-3 marks. Even when the question is wrapped inside a wireshark trace or a routing scenario, the answer almost always reduces to "find the protocol, identify the layer, recall its port".

Real-world example: When you type gate.iitd.ac.in in a browser, your machine first sends a DNS query (UDP, port 53, Application layer). The DNS reply gives an IP address. The browser then opens a TCP connection (Transport) to that IP on port 443. Routing happens at the IP (Internet) layer; an intermediate router may send back an ICMP "time exceeded" message if a TTL expires. On your LAN, ARP is used to find your default gateway's MAC address (Link). Finally, the actual web page arrives via HTTPS (Application). A single page-load touches every layer of the TCP/IP suite — and GATE can ask about each step.

Common misconception: "ICMP and ARP are Transport-layer protocols because they 'do not carry user data'." Wrong. ICMP and IGMP belong to the Internet (Network) layer, even though they ride on top of IP. ARP sits at the Link layer in most modern textbooks because it operates on MAC addresses within a single broadcast domain.

Another mistake is to mix up DNS uses UDP only. DNS uses UDP for small queries (the typical case) and TCP for zone transfers and responses larger than 512 bytes (or 4096 with EDNS0). GATE has set questions to test exactly this nuance.

A third confusion: DHCP uses TCP. No — DHCP must use UDP because the client has no IP address at the moment of DHCPDISCOVER and cannot complete a TCP three-way handshake.

:::compare

Layer	Job	Representative Protocols
Application	Provide network services to user processes	HTTP(80), HTTPS(443), FTP(20/21), SMTP(25), DNS(53), DHCP(67/68), TELNET(23), SSH(22), POP3(110), IMAP(143), SNMP(161), TFTP(69)
Transport	End-to-end process communication	TCP (reliable), UDP (unreliable)
Internet (Network)	Routing of packets between networks	IP, ICMP, IGMP
Link	Frame delivery on a single link	Ethernet (802.3), Wi-Fi (802.11), PPP, Token Ring; ARP/RARP (at Link/Internet boundary)
:::

:::keypoints

• TCP/IP has four layers — Link, Internet, Transport, Application — from bottom to top.
• Application layer protocols use well-known ports: HTTP(80), HTTPS(443), FTP(20/21), SMTP(25), DNS(53), TELNET(23), SSH(22), POP3(110), IMAP(143), SNMP(161), DHCP(67/68).
• TCP is reliable and connection-oriented; UDP is unreliable and connectionless.
• DNS and DHCP primarily use UDP; DNS also uses TCP for zone transfers.
• HTTP, FTP, SMTP, POP3, IMAP, SSH, TELNET use TCP.
• ICMP and IGMP are Internet-layer companions to IP and are encapsulated within IP datagrams.
• ARP/RARP sit at the Link/Internet boundary; GATE typically treats ARP as Link layer.
• Ethernet, Wi-Fi, PPP, Token Ring are Link-layer protocols.
  :::

:::memory
For application-layer ports use "HTTP-80, HTTPS-443, FTP-21/20, SMTP-25, DNS-53, DHCP-67/68, POP3-110, IMAP-143, SSH-22, SNMP-161, TELNET-23, TFTP-69." A handy mnemonic: "H-80, S-443, F-21, M-25, D-53, P-110, I-143, S-22" — read the first letters aloud in order. For "TCP vs UDP" remember "DNS, DHCP, TFTP, SNMP, RIP, NTP, RTP all UDP", almost everything else TCP.
:::

:::recap

• Application layer holds HTTP/HTTPS/FTP/SMTP/DNS/DHCP/SSH/TELNET/POP3/IMAP/SNMP/TFTP.
• Transport layer holds TCP (reliable) and UDP (unreliable).
• Internet layer holds IP, ICMP and IGMP; ARP/RARP at the Link/Internet boundary.
• Link layer holds Ethernet, Wi-Fi, PPP and Token Ring.
• Memorise the port numbers and the TCP-vs-UDP usage — they are guaranteed GATE marks.
  :::

Every packet that leaves your laptop is dressed up in layers like an onion, and every packet arriving at the other end is peeled back the same way. That dressing and undressing is the most-asked concept in any networking interview and a guaranteed GATE CSE question. This lesson rebuilds the encapsulation–decapsulation idea so you can answer header-trailer questions without second-guessing.

Definition: Encapsulation — the process by which each layer of the sending host adds its own control information (a header, and sometimes a trailer) to the data received from the layer above, before passing it down.

Definition: Decapsulation — the reverse process at the receiver, where each layer reads and strips off the header/trailer added by its peer layer on the sender, then passes the remaining payload upward.

Definition: Protocol Data Unit (PDU) — the data unit at a particular layer along with its header/trailer. Each layer has its own PDU name (Segment, Packet, Frame, Bits).

Why Layered Models Need Encapsulation

The TCP/IP and OSI models split the work of moving bytes across a network into specialised layers. The Application layer worries about meaning ("send this HTTP GET"), Transport about reliability, Network about routing, Data Link about the next hop, and Physical about voltages on wire or radio waves. But the network only carries bits, so somewhere those layered intentions have to be packaged into a single travelling object. Encapsulation is that packaging mechanism. Each layer says: "Whatever you gave me, I will wrap with my own instructions for my counterpart on the other side, and hand it to the layer below."

The key consequence: a layer's header is a private message to its peer layer on the other host, not a message to neighbouring layers. The Transport header is read by the receiver's Transport layer; the Network header is read by every router along the path; the Data Link header by the next-hop interface. This is what textbooks call horizontal logical communication between peers, even though the physical movement of bits is strictly vertical — down the sender's stack, across the wire, up the receiver's stack.

The Five Names a Single Message Wears

As data travels down the sender's stack, the unit grows and changes name with each layer:

• Application data (also called Message or PDU at the Application layer) — the raw payload, e.g., an HTTP request or a DNS query.
• Segment (TCP) or Datagram (UDP) — formed at the Transport layer when a TCP/UDP header is prepended. The TCP header carries source and destination ports, sequence and acknowledgment numbers, window size and flags (SYN, ACK, FIN).
• Packet (also called Datagram at this layer) — formed at the Network layer when an IP header is prepended. The IP header carries source and destination IP addresses, TTL, protocol number, fragmentation flags and checksum.
• Frame — formed at the Data Link layer when a frame header is prepended and a trailer is appended. The header carries source and destination MAC addresses; the trailer carries the FCS (Frame Check Sequence) / CRC used for error detection.
• Bits — at the Physical layer, the frame is finally serialised into a stream of 0s and 1s and pushed onto the medium.

Real-world example: When you open https://www.gate.iitb.ac.in from a Wi-Fi laptop, the GET request is wrapped in a TCP segment (port 443), then in an IP packet (your private IP to IIT-B's public IP), then in an Ethernet/Wi-Fi frame (your MAC to your router's MAC), and finally radiated as bits over 2.4 / 5 GHz. The router decapsulates only up to the Data Link/Network layer (it needs the IP header to forward), rewraps with a new frame for the next hop, and onward.

Why the Data Link Layer Adds a Trailer Too

This is the most-asked GATE trick. Almost every layer adds only a header. The Data Link layer is unique — it adds both a header and a trailer. The reason is the CRC / FCS used for error detection. The transmitter computes a checksum over the header + payload and appends it as the trailer; the receiver recomputes and compares. Because the CRC must cover the whole frame, including the Data Link header, it cannot be sitting in the header — it has to come after the data. That's why the trailer exists.

Common misconception: Many students think IP also has a trailer because it has a "checksum field". It does not. IPv4 has a header checksum inside the header, covering only the header, not the data. There is no IP trailer. Only the Data Link layer attaches a trailer (FCS).

Decapsulation — Peeling the Onion at the Receiver

At the receiver, the bits arrive at the Physical layer, are reassembled into a frame, and start their journey upward. Each layer:

1. Reads the header (and trailer, in case of Data Link) addressed to it.
2. Validates it (e.g., MAC address match, IP destination match, port match).
3. Strips it off.
4. Passes the remaining payload to the next higher layer.

So at the receiver: Bits → Frame → Packet → Segment → Data — the exact mirror image of encapsulation. Each layer's "peer" header has done its job and is discarded; what remains for the Application layer is the original message.

Why it matters: This explains why a router only "looks" up to Layer 3 — it cannot read the TCP header without violating the layering, and it doesn't need to. It also explains overhead: every layer adds bytes, so the bigger the protocol stack, the more bytes of every transmission are control information rather than user data.

Question: An Ethernet frame carries an IP packet that carries a TCP segment that carries a 1000-byte HTTP request. If TCP, IP and Ethernet headers/trailers add 20, 20 and 18 bytes respectively, what is the total frame size?

Solution:
Step 1: Application data = 1000 B.
Step 2: TCP segment = 1000 + 20 = 1020 B.
Step 3: IP packet = 1020 + 20 = 1040 B.
Step 4: Ethernet frame = 1040 + 18 = 1058 B (14-byte header + 4-byte FCS trailer).
Conclusion: Total frame size = 1058 bytes, of which 58 bytes are protocol overhead.

:::compare

Layer	PDU Name	Header Added	Trailer Added	Addressing
Application	Message / Data	Application protocol header	No	URL / hostname (logical)
Transport	Segment (TCP) / Datagram (UDP)	TCP/UDP header	No	Port numbers
Network	Packet / Datagram	IP header	No	IP addresses
Data Link	Frame	MAC header	Yes (FCS / CRC)	MAC addresses
Physical	Bits	None (encodes bits)	None	Signals on medium
:::

:::keypoints

• Encapsulation = add header (and Data Link trailer) on the way down.
• Decapsulation = remove the corresponding header/trailer on the way up.
• PDU progression: Data → Segment → Packet → Frame → Bits.
• The Data Link layer is unique in adding both header and trailer.
• The trailer holds the FCS/CRC for error detection over the whole frame.
• Each header is read by the peer layer on the destination host — horizontal logical communication.
• Physical transfer is vertical: down at sender, across the wire, up at receiver.
• A router decapsulates only up to Layer 3, then rewraps with a new Layer-2 frame for the next hop.
  :::

:::memory
"Do Some Packaging For Bytes" — Data, Segment, Packet, Frame, Bits.
"Only Data Link wears a tail" — to remember that the trailer is exclusive to Layer 2.
:::

:::recap

• Encapsulation grows the PDU as it goes down: Data → Segment → Packet → Frame → Bits.
• Decapsulation reverses it at the receiver, peeling each header in order.
• Headers talk peer-to-peer; the wire moves bits vertically.
• Only the Data Link layer attaches a trailer (FCS/CRC) for error detection.
  :::

Memorize these for numericals: TCP header = 20 bytes minimum, 60 bytes maximum (with options). UDP header = 8 bytes (fixed). IPv4 header = 20 bytes minimum, 60 bytes maximum. IPv6 header = 40 bytes (fixed, no options in base header). Ethernet frame: header 14 bytes (6 dest MAC + 6 src MAC + 2 type) + 4 bytes CRC trailer = 18 bytes overhead; payload 46-1500 bytes (MTU). Total overhead for TCP/IP/Ethernet (minimum) = 20 + 20 + 18 = 58 bytes. Efficiency = payload / (payload + headers). These figures appear constantly in throughput and overhead numericals.

Q: An application sends 1000 bytes using TCP over IPv4 over Ethernet (minimum headers). What is the transmission efficiency at the Data Link layer (ignoring preamble)? Solution: Total bytes on wire = data + TCP header + IP header + Ethernet overhead = 1000 + 20 + 20 + 18 = 1058 bytes. Efficiency = useful data / total = 1000 / 1058 = 0.9452 = 94.52%. If using UDP instead of TCP: 1000 + 8 + 20 + 18 = 1046, efficiency = 1000/1046 = 95.6%. Note the Ethernet overhead of 18 bytes = 14-byte header + 4-byte FCS trailer. Always include the trailer for Data Link layer.

TCP/IP uses four distinct address types, one per relevant layer: (1) Physical/MAC address - 48-bit (6-byte), at the Data Link layer, e.g., 00:1A:2B:3C:4D:5E, used for node-to-node delivery on a LAN. (2) Logical/IP address - 32-bit (IPv4) or 128-bit (IPv6), at the Network layer, for host-to-host delivery across networks. (3) Port address - 16-bit (0-65535), at the Transport layer, identifies the specific process/application. (4) Specific/Application address - e.g., email addresses or URLs, at the Application layer, human-friendly. Memory aid (bottom-up): MAC -> IP -> Port -> Name, mirroring Physical -> Network -> Transport -> Application.

MAC address: 48 bits, globally unique (assigned by manufacturer OUI), flat addressing, changes hop-by-hop in a packet's journey (rewritten by each router). IP address: 32 bits (IPv4) / 128 bits (IPv6), hierarchical, generally constant end-to-end (except with NAT). Port number: 16 bits; well-known ports 0-1023, registered 1024-49151, dynamic/ephemeral 49152-65535. Key exam insight: during routing, the source/destination IP addresses remain unchanged across hops, but the source/destination MAC addresses are rewritten at every router. The combination of IP address + Port + protocol forms a socket, the endpoint of a connection.

Every time your browser opens a webpage, every time an SSH client reaches a remote server, every time your mail app picks up a new message — a small unsigned 16-bit number is at the centre of the action. That number is the port number. For GATE CSE, a handful of these numbers are practically free marks if memorised cleanly.

Definition: A port number is a 16-bit unsigned integer (0 to 65535) used by the transport layer (TCP or UDP) to identify a specific application or service on a host. Together with an IP address, it forms a socket.

Definition: A well-known port is one in the range 0–1023 that is reserved by IANA for standard services (HTTP, SSH, DNS, etc.). On Unix-like systems, binding to a well-known port traditionally requires root / privileged access.

The list you must memorise

GATE has historically asked the actual port numbers in MCQ form. Drill these until they are automatic:

Service	Port	Transport
FTP — Data	20	TCP
FTP — Control	21	TCP
SSH	22	TCP
TELNET	23	TCP
SMTP	25	TCP
DNS	53	UDP (queries) + TCP (zone transfers / large)
DHCP — Server	67	UDP
DHCP — Client	68	UDP
HTTP	80	TCP
POP3	110	TCP
IMAP	143	TCP
SNMP	161	UDP
HTTPS	443	TCP / TLS

Useful groupings to fix the table in memory

Trying to memorise thirteen random numbers is hard. Trying to memorise three clusters of three is easy.

• Remote access cluster: SSH 22, TELNET 23. (One letter and one number apart — easy.)
• Email cluster: SMTP 25 (send), POP3 110 (pull, deletes from server), IMAP 143 (sync, keeps on server).
• Web cluster: HTTP 80, HTTPS 443.
• FTP pair: 20 (data channel) and 21 (control channel). Mnemonic: "control is the boss → control gets the higher number 21."
• DHCP pair: 67 (server) and 68 (client). Mnemonic: alphabetical — Client is later in the alphabet than the server but has the higher number. Or: the server is the gatekeeper sitting on the lower port.
• Management: DNS 53, SNMP 161 — both UDP-leaning, both odd numbers.

Port number ranges

IANA splits the full 0–65535 range into three tiers:

• Well-known ports: 0–1023. Reserved for standard server services. Require privilege to bind on Linux/Unix.
• Registered ports: 1024–49151. Assigned by IANA to specific applications by request (e.g., 3306 for MySQL, 5432 for PostgreSQL, 8080 for HTTP-alt).
• Dynamic / private / ephemeral ports: 49152–65535. Used by client-side TCP/UDP for outgoing connections.

GATE has asked the size of each range. The well-known range is 2^10 = 1024 ports, and the dynamic range is 16,384 ports.

Sockets and the 5-tuple

A socket is the combination (IP address, port number). It uniquely identifies a communication endpoint on the network. So if a server is running at IP 10.0.0.5 listening on port 80, the socket is 10.0.0.5:80.

A TCP connection is uniquely identified by a 5-tuple:

(Source IP, Source Port, Destination IP, Destination Port, Protocol)

This is why a single web server on port 80 can handle thousands of simultaneous client connections — each client's source IP and source ephemeral port differ, so each 5-tuple is unique even though the server's IP, port, and protocol are constant.

A common GATE trick: "How many simultaneous TCP connections can a server hold on a single port?" Answer: in theory bounded only by the space of (source IP, source port) combinations and OS resources — not by the server's port count. Each connection is a different 5-tuple.

Worked example: identifying the service from a port

Question: A packet capture shows a TCP segment with destination port 25 travelling from a workstation to a mail relay. Which application-layer protocol is in use, and what is the workstation most likely doing?

Solution:

Step 1: Look up port 25 in the well-known list. Port 25 corresponds to SMTP (Simple Mail Transfer Protocol).

Step 2: SMTP is the protocol used to send outgoing email or to relay mail between mail servers.

Step 3: Because the workstation is the source and the mail relay is the destination on port 25, this is an outgoing-mail submission/relay.

Conclusion: The workstation is using SMTP (port 25) to send mail to the relay.

A useful sanity check: incoming mail to the user's mailbox is fetched via POP3 (110) or IMAP (143). If you see those ports, the direction is reversed.

Why it matters: The GATE CSE syllabus on Computer Networks reliably asks at least one direct port-number identification MCQ each year, often as a "match the following" between services and ports, or as part of a larger packet-capture/firewall-rule question. These are the most efficient marks per minute of preparation in the entire networks section.

Real-world example: When you configure a corporate firewall in India (whether at a TCS data centre or a CBI cybercrime unit), you write rules that allow outbound TCP to port 443 (HTTPS) for general web access while blocking port 23 (TELNET) because it is plaintext and dangerous. You also generally close inbound port 22 (SSH) from the public internet and expose it only through a bastion host. Every one of those rules is the well-known-ports list at work.

Common misconception: A frequent error is to claim "HTTPS uses port 80 with SSL". HTTPS uses port 443, not 80. Port 80 is plain HTTP. Confusing the two is a guaranteed mark-loss.

A second slip is to think DNS is purely UDP. DNS uses UDP/53 for normal queries because they are small and need to be fast, but it switches to TCP/53 for zone transfers and for responses larger than 512 bytes (or 4096 bytes with EDNS). GATE has asked this exact nuance.

A third trap is to flip the FTP ports: data on 20, control on 21. The control channel carries commands like USER, PASS, RETR; the data channel actually moves the file bytes. Many candidates remember "21 for FTP" and forget there are two ports.

A fourth trap is mixing the DHCP server (67) and client (68). The server listens on the lower number; clients send their broadcast DISCOVER messages from port 68 to port 67 on the broadcast address 255.255.255.255.

:::compare

Service	Port(s)	Transport	Plain or secure?	Direction of usual flow
FTP	20 (data), 21 (control)	TCP	Plain	Client ↔ Server (active/passive variants)
SSH	22	TCP	Encrypted	Client → Server (interactive shell, tunnels)
TELNET	23	TCP	Plain (insecure)	Client → Server
SMTP	25	TCP	Plain (587/465 are securer)	Client → Mail server (outbound mail)
DNS	53	UDP queries, TCP transfers	Plain (DoT 853 is secure)	Client → Resolver
DHCP	67 (server), 68 (client)	UDP	Plain	Client (broadcast) ↔ Server
HTTP	80	TCP	Plain	Client → Web server
POP3	110	TCP	Plain (995 is secure)	Client → Mail server (download mail)
IMAP	143	TCP	Plain (993 is secure)	Client ↔ Mail server (sync)
SNMP	161	UDP	Plain (v3 adds security)	Manager ↔ Agent
HTTPS	443	TCP / TLS	Encrypted	Client → Web server
:::

:::keypoints

• Port numbers are 16-bit (0–65535); well-known = 0–1023, registered = 1024–49151, dynamic = 49152–65535.
• Socket = (IP address, port number).
• A TCP connection is uniquely identified by a 5-tuple: (src IP, src port, dst IP, dst port, protocol).
• FTP 20/21, SSH 22, TELNET 23, SMTP 25, DNS 53, DHCP 67/68, HTTP 80, POP3 110, IMAP 143, SNMP 161, HTTPS 443 — memorise this list cold.
• DNS primarily UDP for queries, but TCP for zone transfers and large responses.
• Binding to a well-known port traditionally requires privileged access on Unix-like systems.
• Always check direction in packet-capture questions — source port vs destination port flips the meaning.
  :::

:::memory
"FTP-SSH-TEL-SMTP / DNS-DHCP / HTTP-POP-IMAP-SNMP-HTTPS"

Chant the numbers in three pieces:

• 20, 21, 22, 23, 25 — five consecutive services for FTP, SSH, TELNET, SMTP. (Easy: count up.)
• 53 / 67-68 — DNS and DHCP server-client pair.
• 80, 110, 143, 161, 443 — HTTP, POP3, IMAP, SNMP, HTTPS. (Notice 443 = 4 × 110 + 3; pure coincidence but a useful anchor.)

Mnemonic for FTP: "Control is crucial, gets the completer number" → 21.
Mnemonic for DHCP: "Server gets the smaller number" → 67.
:::

:::recap

• Port numbers identify applications on a host; the well-known range is 0–1023.
• A socket is (IP, port); a TCP connection is a 5-tuple (src IP, src port, dst IP, dst port, protocol).
• The 13-item table — FTP through HTTPS — is the highest-yield rote-memorisation block in GATE Networks.
• Watch for the classic traps: HTTPS = 443 (not 80), DNS uses both UDP and TCP, FTP needs two ports, DHCP server is 67 / client 68.
  :::