Network Models, Protocols and Data Communication

Introduction

Computer networks enable devices, applications, and users to exchange information across local and global environments. A web request, cloud-storage upload, video call, or database transaction appears to an application as a simple operation, but it depends on many coordinated functions: addressing, routing, error detection, sequencing, flow control, encryption, and media access. These functions are organized through network models and implemented by protocols.

This chapter develops the conceptual and practical foundation required to understand how data moves between interconnected systems. It focuses on the Open Systems Interconnection (OSI) reference model and the Internet’s TCP/IP model, then connects those models to encapsulation, frames, packets, segments, ports, sockets, standards, and troubleshooting.

Learning Objectives

By the end of this chapter, you should be able to:

1. Explain the purpose and structure of the OSI and TCP/IP models.
2. Relate OSI layers to practical Internet protocols and devices.
3. Describe encapsulation and decapsulation.
4. Distinguish frames, packets, segments, datagrams, ports, and sockets.
5. Explain how protocol standards support interoperability.
6. Trace data through a typical client–server communication.
7. Analyze common failures using layered troubleshooting.
8. Evaluate security, governance, and operational implications of protocol choices.

1. Why Network Models Are Needed

Networking is a distributed engineering problem. A single communication may involve different operating systems, network-interface technologies, transmission media, routers, firewalls, and application programs. If every application had to understand every physical technology, network design would become unmanageable.

A layered model solves this problem by dividing communication into related responsibilities. Each layer:

• provides services to the layer above;
• uses services from the layer below;
• communicates logically with its peer layer on another system; and
• hides implementation detail that is not relevant to adjacent layers.

Layering provides modularity, interoperability, easier testing, and fault isolation. It also has limitations. Real protocols do not always fit neatly into one layer, and excessive layering can introduce overhead or obscure performance problems.

A useful distinction is between a service, an interface, and a protocol. A service describes what a layer offers; an interface describes how a neighboring layer requests it; and a protocol defines the rules used by peer entities to communicate.

2. The OSI Reference Model

The OSI model, standardized by ISO/IEC 7498-1, has seven layers. It is primarily a conceptual and teaching framework, although its terminology remains valuable in design and troubleshooting.

The upper three layers are often combined in practical TCP/IP implementations. For example, an application may handle data representation and session functions itself rather than relying on separate protocol layers.

2.1 Physical Layer

The physical layer transmits raw bits as electrical, optical, or radio signals. Its concerns include signal timing, modulation, frequency, voltage or light levels, connectors, and transmission media. A physical-layer fault may result from a damaged cable, incorrect transceiver, radio interference, or loss of power.

The physical layer does not interpret an IP address or application message. It provides the means by which encoded bits travel over a link.

2.2 Data-Link Layer

The data-link layer organizes bits into frames for delivery across one local link or broadcast domain. It commonly provides:

• frame delimitation;
• source and destination hardware addresses;
• media-access control;
• error detection, often using a frame check sequence; and
• rules for sharing a medium.

Ethernet and IEEE 802.11 wireless LANs operate primarily at this layer. A switch examines link-layer addresses to forward frames within a local network. Link-layer addressing is local in scope; it is not a substitute for an end-to-end network-layer address.

2.3 Network Layer

The network layer provides logical addressing and forwarding between different networks. Internet Protocol (IP) uses source and destination IP addresses. Routers inspect the destination address, consult a routing table, and forward the packet toward its destination.

The network layer usually offers a best-effort service. IP does not guarantee delivery, ordering, or duplicate suppression. Those services, when needed, are supplied by higher layers such as TCP or by the application itself.

2.4 Transport Layer

The transport layer provides process-to-process communication. It may provide reliability, sequencing, retransmission, flow control, congestion control, or simply low-overhead datagram delivery.

TCP establishes a connection and provides an ordered, reliable byte stream. UDP provides connectionless datagrams with minimal protocol overhead; it does not itself guarantee delivery, order, or non-duplication. Applications such as real-time media may prefer UDP because avoiding retransmission delay is more important than perfect delivery of every packet.

2.5 Session, Presentation, and Application Layers

The session layer coordinates logical dialogs, including checkpointing and session recovery. The presentation layer concerns data representation, such as character encoding, serialization, compression, and cryptographic transformation. In modern systems these functions are usually implemented within libraries or applications.

The application layer contains protocols that support user or system services. HTTP transfers web resources, DNS maps names to network information, SMTP transfers email, and SSH supports secure remote administration. An application-layer protocol defines message types, fields, sequencing rules, and expected responses.

3. The TCP/IP Model

The TCP/IP model reflects the architecture of the Internet more directly than OSI. A common four-layer presentation is:

Some textbooks use a five-layer model that separates the link layer into data-link and physical layers. Neither representation changes how packets are built; the distinction is mainly pedagogical.

The relationship between the models is approximate rather than exact. OSI’s application, presentation, and session layers generally map to TCP/IP’s application layer. OSI transport maps to TCP/IP transport, OSI network maps to the Internet layer, and OSI data-link and physical map to the link layer.

OSI and TCP/IP: Comparison

The OSI model is useful for precise conceptual separation and education. TCP/IP is the practical protocol architecture used by the Internet. OSI defines a general reference model, whereas TCP/IP developed around deployed protocols. Neither model should be treated as a literal diagram of every software implementation.

4. Protocols and Standards

A protocol is an agreed set of rules governing communication. Protocol rules may specify message format, field meaning, timing, sequencing, error handling, and permissible responses.

Standards enable products from different vendors to interoperate. Important standards organizations include:

• IETF, which publishes Internet standards and Requests for Comments (RFCs);
• IEEE, which develops standards such as Ethernet and Wi-Fi;
• ISO/IEC, associated with international information-technology standards;
• ITU-T, which develops telecommunications recommendations; and
• W3C, which develops many Web standards.

A protocol may be open, proprietary, de facto, or formally standardized. Standardization does not guarantee that an implementation is secure or well designed. Organizations must also consider version support, maintenance, vulnerability management, licensing, and regulatory obligations.

Protocols may be classified by function:

5. Encapsulation and Protocol Data Units

When an application sends data, each layer adds information required by its peer. This process is encapsulation. At the receiving system, headers and sometimes trailers are removed in reverse order; this is decapsulation.

The general sequence is:

Application data → transport segment or datagram → network packet → link-layer frame → physical signals.

A protocol data unit (PDU) is the data object handled at a particular layer. Common names are:

• application message or data;
• TCP segment or UDP datagram;
• IP packet or IP datagram; and
• link-layer frame.

The word “packet” is sometimes used generically, but precise technical writing should identify the relevant layer.

Figure: Headers are added during encapsulation and removed or interpreted during decapsulation. A router normally removes the incoming link-layer frame and creates a new link-layer frame for the next hop while retaining the IP packet, subject to processing such as TTL or hop-limit reduction.

5.1 Headers and Trailers

A header precedes a payload; a trailer follows it. A TCP header may contain source and destination ports, sequence information, acknowledgment information, flags, and a checksum. An IP header contains source and destination addresses and forwarding-related fields. An Ethernet frame includes source and destination MAC addresses and normally a frame-check sequence.

A frame is therefore not simply “the data.” It is a structured PDU containing control information and a payload. At every router hop, the link-layer header and trailer normally change because the next physical or logical link may be different. The IP packet is forwarded across the internetwork, while the local frame is rebuilt for each link.

6. Addresses, Ports, and Sockets

Different identifiers operate at different scopes:

• A MAC address identifies a network interface at the local link layer.
• An IP address identifies a network-layer endpoint interface and supports routing.
• A port number identifies a transport-layer service or process endpoint.
• A socket is an operating-system abstraction used by an application to send and receive data.

A TCP connection is commonly identified by a four-tuple:

The protocol, such as TCP, is also relevant to a complete connection identity. A client normally uses a temporary ephemeral source port, while a server listens on a known service port. For example, a browser may connect from a high-numbered ephemeral port to a web server’s TCP port 443 for HTTPS.

A socket is not identical to a port. A port is a numerical transport identifier; a socket includes addressing and protocol context and is represented through an API such as the Berkeley sockets interface. UDP communication is commonly described using source and destination ports, but it does not establish a TCP-style connection.

7. How Data Moves Through an Interconnected System

Consider a user entering a secure Web address.

1. The browser constructs an HTTPS request.
2. The system resolves the server name, usually through DNS.
3. A transport protocol is selected. HTTPS commonly uses TCP with TLS, although HTTP/3 uses QUIC over UDP.
4. The transport layer identifies the client and service using ports or QUIC connection identifiers.
5. IP adds source and destination addresses.
6. The host determines the next hop. If the destination is remote, the next hop is usually the default gateway.
7. The local network resolves the gateway’s link-layer address, for example using ARP in IPv4 or Neighbor Discovery in IPv6.
8. The network interface creates a frame and transmits signals.
9. Each router receives a frame, validates it, removes the link-layer wrapping, examines the IP destination, decreases the IPv4 TTL or IPv6 hop limit, and forwards the packet in a new frame.
10. At the destination, the packet is delivered to the transport protocol, which delivers data to the appropriate socket.
11. TLS authenticates the server and protects application content. The browser interprets the HTTP response and renders the resource.

This process illustrates two important boundaries. IP provides host-to-host internetwork delivery, while ports and sockets support process-to-process delivery. Also, encryption changes what intermediate devices can inspect: a network can generally see addresses and traffic metadata, but TLS protects application content from ordinary intermediate inspection.

8. Reliability, Performance, and Basic Calculations

Networking performance must be interpreted carefully. Bandwidth is a capacity, measured in bits per second. Throughput is the achieved useful transfer rate. Latency is delay. They are related but not interchangeable.

For a message of size S bits sent over a link with rate R bits per second, the serialization or transmission delay is:

Here, dₜ is in seconds, S is in bits, and R is in bits per second. This formula assumes that the full message is serialized on one link and excludes propagation, processing, queuing, protocol, and retransmission delays.

Worked example. A 12,000-bit frame is sent on a 6,000,000-bit/s link:

dₜ = 12,000 ÷ 6,000,000 = 0.002 s = 2 ms

The transmission delay is 2 ms. It is not the total end-to-end delay because the signal must also propagate through the medium and may experience queuing and processing.

For a path with multiple links, transmission delays are approximately the sum of each link’s serialization delay, while propagation, processing, and queuing must also be considered. A high-bandwidth link can still have high latency, and a low-latency path can still have poor throughput if congestion or loss is severe.

TCP improves reliability through sequence numbers, acknowledgments, retransmission, and congestion control. These mechanisms introduce overhead and may increase delay. UDP avoids much of this machinery, placing responsibility for reliability and timing at the application layer when required.

9. Case Study: Cloud Application Access Across Networks

Illustrative case. A college hosts its learning-management system in a public cloud. Students report that pages load normally on campus but video lectures frequently stall from a rural broadband connection.

Background and problem

The service is reachable, DNS resolution succeeds, and the cloud application reports no server failure. The problem appears selective: ordinary pages work, while large video streams perform poorly.

Analysis

A layered investigation begins at the lowest relevant level and progresses upward. Link tests show that the rural connection has intermittent packet loss during peak hours. A path test indicates increased queuing delay at the access provider. Application logs show repeated transport retransmissions for some flows. The problem is therefore not initially attributed to the Web server merely because users experience a Web symptom.

The investigation distinguishes:

• DNS failure from successful name resolution;
• routing failure from a reachable destination;
• link congestion from application-server overload; and
• transport loss from a browser rendering defect.

Approach and solution

The institution enables adaptive bitrate streaming, which allows the application to select a lower video rate when available throughput declines. The provider is asked to investigate access-link congestion. The cloud service uses a content-delivery network so that video content is served from geographically closer locations. Monitoring records latency, loss, throughput, and HTTP response time separately.

Outcome

Page access remains reliable, and video stalls are reduced. The solution does not “increase bandwidth” by configuration alone; it combines application adaptation, traffic distribution, and provider remediation.

Learning points

1. A layered model prevents premature conclusions.
2. Throughput, latency, and loss must be measured independently.
3. Cloud performance depends on the complete path, not only the cloud server.
4. Encryption, privacy, and monitoring must be balanced when inspecting traffic.

10. Security, Governance, and Contemporary Developments

Security is not confined to one OSI layer. Threats include physical tampering, rogue access points, MAC spoofing, IP attacks, port scanning, application vulnerabilities, credential theft, and denial-of-service attacks.

Important practices include:

• use TLS and validate certificates;
• segment networks according to trust and business function;
• apply least privilege to services and administration;
• disable unnecessary ports and protocols;
• maintain accurate asset and configuration inventories;
• monitor logs and flow metadata while respecting privacy;
• patch protocol implementations and network devices; and
• use secure management protocols rather than unencrypted legacy alternatives.

Organizations should consider data-protection law, contractual obligations, retention limits, and authorized-access policies. Packet capture can expose credentials or personal information; it must be authorized, protected, and minimized.

Modern networks increasingly use IPv6, software-defined networking, virtual networks, zero-trust architectures, encrypted DNS, and cloud-native service meshes. QUIC combines transport functions with TLS over UDP and supports HTTP/3, reducing connection-establishment delay and improving behavior during changes of network path. These developments do not eliminate the value of layered reasoning; they demonstrate that practical protocols may span or reorganize traditional layers.

Artificial intelligence can assist with anomaly detection, capacity forecasting, and incident correlation. However, automated conclusions require trustworthy telemetry, representative training data, human oversight, and safeguards against false positives, privacy violations, and adversarial manipulation. AI should support—not replace—protocol knowledge and evidence-based diagnosis.

11. Best Practices for Network Analysis

A disciplined analysis should:

1. Define the user-visible symptom precisely.
2. Identify the source, destination, protocol, ports, and time period.
3. Test name resolution, reachability, routing, transport behavior, and application response separately.
4. Capture traffic only when authorized and protect sensitive data.
5. Compare a working path with a failing path.
6. Check configuration, standards compliance, and version compatibility.
7. Change one significant variable at a time where possible.
8. Document evidence, assumptions, timestamps, and remedial actions.
9. Verify the outcome after remediation.
10. Consider resilience, security, cost, and maintainability—not only immediate performance.

Chapter Summary

Network models divide communication responsibilities into manageable functions. The seven-layer OSI model is a conceptual reference framework, while the TCP/IP model reflects the architecture of deployed Internet protocols. The layers are related but are not exact equivalents in every implementation.

Protocols define communication rules, and standards organizations promote interoperability. During encapsulation, application data receives transport, network, and link-layer control information. The resulting PDUs are commonly called messages, segments or datagrams, packets, and frames. Decapsulation reverses this process at the destination.

MAC addresses support local-link delivery, IP addresses support internetwork routing, and ports identify transport-layer services. A socket provides an operating-system interface and endpoint context for applications. Routers normally replace link-layer wrapping at each hop while forwarding the IP packet. Reliability, latency, bandwidth, throughput, security, and privacy must be analyzed as distinct concerns. Layered troubleshooting provides a systematic way to diagnose cloud and enterprise network problems.

Key Terms

Encapsulation: Adding layer-specific control information around a payload.

Decapsulation: Removing or interpreting protocol information at the receiving system.

Protocol: Agreed rules governing communication.

Standard: A documented technical specification intended to promote consistent implementation.

OSI model: Seven-layer reference model for open-system communication.

TCP/IP model: Practical layered architecture underlying Internet communication.

Frame: Data-link-layer protocol data unit.

Packet: Network-layer protocol data unit, commonly an IP datagram.

Segment: TCP transport-layer protocol data unit.

Datagram: Independent message, commonly associated with UDP or IP.

Header: Control information placed before a payload.

Trailer: Control information placed after a payload.

MAC address: Link-layer hardware or interface identifier used on a local network.

IP address: Logical network-layer address used for internetwork delivery.

Port: Transport-layer number identifying a service endpoint.

Socket: Operating-system communication endpoint abstraction.

Router: Device that forwards packets between networks.

Switch: Device that forwards frames within a local network.

Bandwidth: Link transmission capacity in bits per second.

Latency: Time taken for data or a signal to experience delivery delay.

Review Questions

Short Answer Questions

1. What is the purpose of a layered network model?
2. State two differences between TCP and UDP.
3. What information does a router primarily use to forward an IP packet?
4. Distinguish a port from a socket.
5. Define encapsulation and decapsulation.

Long Answer Questions

1. Explain all seven OSI layers and relate each to practical technologies.
2. Compare the OSI and TCP/IP models, including their strengths and limitations.
3. Describe the complete path of an HTTPS request from a client to a cloud server.
4. Explain how frames, packets, segments, headers, and trailers are related.
5. Discuss how protocol standards support interoperability and what standards do not guarantee.

Analytical / Application Questions

1. A user can resolve a service name but cannot open a connection to the service. Use a layered approach to identify tests and possible failure points.
2. A video service works well on a low-latency connection but stalls on a congested high-bandwidth connection. Analyze the roles of latency, throughput, loss, and transport behavior.
3. Design a secure troubleshooting procedure for a cloud network that balances packet-level evidence with privacy and authorization requirements.

Multiple Choice Questions with Answers

Question 1

Which OSI layer is primarily responsible for logical addressing and routing between networks?

A. Data Link

B. Network

C. Transport

D. Session

Correct Answer: B. Network

Question 2

What is added to application data by the transport layer during encapsulation?

A. A transport header

B. A fibre-optic signal only

C. A MAC address only

D. A DNS zone file

Correct Answer: A. A transport header

Question 3

Which device normally forwards frames using link-layer addresses?

A. Router

B. Switch

C. Application server

D. DNS resolver

Correct Answer: B. Switch

Question 4

Which statement best describes TCP?

A. It provides an ordered and reliable byte stream

B. It provides only physical signal transmission

C. It provides name resolution without transport delivery

D. It is always faster because it retransmits no data

Correct Answer: A. It provides an ordered and reliable byte stream

Question 5

A port number primarily identifies what?

A. A physical cable type

B. A local broadcast domain

C. A transport-layer service or process endpoint

D. A router’s geographic location

Correct Answer: C. A transport-layer service or process endpoint

Question 6

What normally happens to the link-layer frame when a router forwards an IP packet to the next hop?

A. It remains unchanged across every link

B. It is removed and a new link-layer frame is created

C. It is encrypted by DNS

D. It becomes a TCP socket

Correct Answer: B. It is removed and a new link-layer frame is created

Question 7

A 12,000-bit frame is transmitted over a 6,000,000-bit/s link. What is its serialization delay?

A. 0.002 s

B. 0.02 s

C. 2 s

D. 200 s

Correct Answer: A. 0.002 s

Question 8

Which organization publishes Internet Requests for Comments and develops many Internet standards?

A. IETF

B. IEEE exclusively

C. W3C exclusively

D. ISO only

Correct Answer: A. IETF

Question 9

Which identifier is primarily used for local-link delivery?

A. MAC address

B. URL path

C. TCP sequence number

D. DNS record lifetime

Correct Answer: A. MAC address

Question 10

Which statement about UDP is correct?

A. It guarantees ordered delivery by definition

B. It provides connectionless datagrams with limited built-in reliability

C. It operates only at the physical layer

D. It cannot use port numbers

Correct Answer: B. It provides connectionless datagrams with limited built-in reliability