Software Systems Atlas

English

中文

English

中文

Theme

VOL 04 / CH 01 / LESSON 01

1.1 Network Layers and How a Data Packet Crosses Them ​

Sending a line such as GET / is easy. The network stack still has to identify the destination host, choose a route, deliver the bytes to the right process, and recover when a segment is lost. If application code owned every one of those jobs, replacing a network interface could force a rewrite of the application.

Layering assigns those responsibilities to adjacent interfaces. Ethernet can be replaced with Wi-Fi below, and HTTP/1.1 can be replaced with HTTP/2 above, without rewriting every other layer. That isolation is what makes the model useful for both implementation and diagnosis.

Real protocols do not pass through seven perfectly isolated software modules. Implementations optimize across layers, and middleboxes may observe or modify several of them. The rest of the lesson uses concrete headers, addresses, and states to describe each step.

1. Two Common Models ​

The OSI seven-layer model provides a consistent terminology for describing responsibilities, while internet engineering typically adopts a more compact TCP/IP layering approach:

TCP/IP PerspectiveCorresponding OSI LayerCommon Protocols or Mechanisms
Application LayerApplication, Presentation, SessionHTTP, DNS, TLS, SSH
Transport LayerTransportTCP, UDP, UDP used by QUIC
Network LayerNetworkIPv4, IPv6, ICMP/ICMPv6, routing
Data Link LayerData LinkEthernet, Wi-Fi, ARP, VLAN
Physical LayerPhysicalCopper cable, fiber, radio waves

TLS is often depicted between the application and transport layers; QUIC combines encryption, reliable transmission, and multiplexing directly atop UDP. The value of these models lies not in debating where a protocol should fit into a single box, but in asking "who is responsible for this functionality."

Physical media are listed separately here to make transmission conditions explicit; a common four-layer TCP/IP model groups them with the link layer. NDP performs local-link functions such as neighbor discovery, but its messages are carried in ICMPv6. They are not simply IPv6 versions of ARP frames.

2. Encapsulation: Adding Control Information at Each Layer ​

The browser constructs an HTTP request from application semantics. As it moves down the stack, each layer adds its own headers; the link layer may also include trailers:

text
application bytes
  └─ transport header + application bytes
       └─ IP header + transport packet
            └─ link header + IP packet + link trailer

On the receiving end, the data is reverse-parsed and routed to the correct upper layer based on header fields, a process known as demultiplexing:

The diagram shows containment, not a one-to-one mapping from an application message to a TCP segment or frame. TCP can split or combine bytes, TLS records have their own boundaries, and HTTP/2 or QUIC streams share a connection.

  • The Ethernet type can indicate whether the payload is IPv4 or IPv6;
  • The IP next-header/protocol field can identify TCP, UDP, or ICMP;
  • The TCP/UDP destination port helps the kernel locate the appropriate socket;
  • TLS SNI can select the target service name, while ALPN negotiates the application protocol; HTTP Host/:authority identifies the request authority.

These fields reside within different trust and visibility boundaries. After TLS is enabled, link and network devices can still see IP addresses and ports on the outer layers, but cannot access or read the encrypted HTTP content. QUIC further encrypts more transport control information, yet still relies on UDP/IP headers for forwarding.

3. One HTTPS Request ​

Assume a client opens a new HTTPS connection without a proxy, with the name configured in a local test environment. www.example.test uses a reserved testing suffix and should not be expected to resolve through public DNS. The conceptual steps for https://www.example.test/catalog are:

  1. Resolve the hostname: A browser or system resolver queries DNS to obtain one or more IPv4/IPv6 addresses;
  2. Select an address and route: The kernel selects the next hop and outgoing interface based on the routing table;
  3. Resolve the neighbor: On a local network requiring link addresses, such as Ethernet, ARP (for IPv4) or NDP (for IPv6) is used to discover the next-hop link address;
  4. Establish a transport connection: TCP completes the handshake, or the client initiates QUIC over UDP;
  5. Establish a secure session: TLS verifies the server's identity and negotiates cryptographic keys; QUIC includes built-in TLS 1.3 handshake;
  6. Exchange application messages: An HTTP request is sent, and a response is received;
  7. Reuse or close: The connection may be reused for subsequent requests or closed according to the protocol.

Caching can skip some of these steps: DNS results may already be cached, an existing connection in the connection pool might be reused, and TLS sessions can be resumed. As a result, the actual network path observed depends on the current state of the system.

These are not seven sequential round trips for every protocol. QUIC coordinates transport and TLS establishment, and resumption can reduce handshake cost without removing all authentication or key state. Name resolution may itself generate network traffic.

4. Addresses, Ports, and Names Answer Different Questions ​

IdentifierScopeAnswers the Question
Domain nameApplication/naming systemWhich logical service do I want to access?
IP addressNetwork layerWhich network interface or node should the packet be routed to?
TCP/UDP portTransport layerAfter reaching the host, which endpoint should receive the data?
MAC addressSingle layer-2 linkWho should the current hop hand the frame to?
Socket five-tupleTransport sessionWhich protocol flow is this?

The common five-tuple consists of source IP, source port, destination IP, destination port, and transport protocol. NAT or proxies may alter some of these fields, so the five-tuple observed by clients and servers may differ.

This is a common TCP/UDP flow identifier, not a complete definition of every connection’s identity. QUIC connection IDs can preserve a connection across address changes; application pools and proxies maintain additional state.

A domain name does not point to a single fixed server. DNS can return multiple addresses based on location, health, or policy, and reverse proxies or CDNs further select backend services based on Host, SNI, path, or other criteria.

5. What Changes at Each Hop ​

Assume Host A accesses Host B through two routers:

text
A ── link 1 ── R1 ── link 2 ── R2 ── link 3 ── B

At each router:

  • The incoming frame is received and removed;
  • The router examines the IP header, decrementing either the IPv4 TTL or the IPv6 Hop Limit;
  • Routing tables are queried to determine the next hop;
  • A new frame is constructed for the next link;
  • The source and destination link addresses in the frame are updated to reflect this hop.

End-to-end IP addresses typically remain unchanged, though NAT, tunneling, or proxies may alter or encapsulate them. TCP headers are generally interpreted by endpoints, but intermediate devices may still track or modify certain fields. Treating "layer-2 changes at each hop, layer-3 remains constant" as an absolute rule overlooks the realities of modern networks.

Suppose a host is 192.0.2.10/24 with gateway 192.0.2.1, and only a connected and a default route. A local-subnet destination needs its own link address; 203.0.113.20 needs the gateway’s link address while retaining the remote IP destination. This Python 3 model does not read or modify the machine’s routing table:

python
from ipaddress import ip_interface, ip_address

interface = ip_interface("192.0.2.10/24")
gateway = ip_address("192.0.2.1")
for target in [ip_address("192.0.2.20"), ip_address("203.0.113.20")]:
    next_hop = target if target in interface.network else gateway
    print(target, next_hop)
# 192.0.2.20 192.0.2.20
# 203.0.113.20 192.0.2.1

Real systems also consider more-specific routes, policy routing, and neighbor caches. Crossing subnets does not mean using ARP to ask for the remote server’s MAC. A packet starting at TTL 64 normally reaches B at 62 after the two illustrated router forwards; ordinary layer-2 switches do not decrement IP TTL for switching.

6. Switches, Routers, and Proxies ​

A switch forwards frames within the same Layer 2 broadcast domain based on MAC addresses and learns which source MAC addresses correspond to which ports.

A router forwards packets between different IP networks, using longest prefix matching to determine the next hop and decrementing the hop limit with each hop.

A layer-4 load balancer typically distributes connections based on IP address, port, and transport flow.

A layer-7 reverse proxy understands application protocols like HTTP and can route traffic by domain name, path, header, or user identity.

A single device can assume multiple roles. In cloud networks, a "router" may be implemented as distributed software, and packet inspection might not reveal all the intermediate steps occurring on traditional physical hardware.

7. MTU and Header Overhead ​

The size of a network layer packet that a link can carry is limited by its MTU. If the Ethernet MTU is 1500 bytes, the application payload of an IPv4/TCP packet is typically less than 1500 bytes because space must also be reserved for IP and TCP headers. TCP options, IPv6, tunnels, and encryption further reduce the available payload space.

Do not treat "1500 - 20 - 20 = 1460" as a fixed or permanent MSS for any connection:

Distinguish the MSS advertised in a SYN from the data fitting in a particular segment. RFC 9293 §3.7.1 calculates an MTU-based advertised MSS by subtracting fixed IP/TCP header lengths; the sender then reduces actual data length for IP/TCP options in use. TLS overhead occupies TCP data space without directly changing the MSS option.

  • The IPv4 header can contain options;
  • The TCP header can contain options;
  • IPv6 has a different base header size and may include extension headers;
  • VPNs or overlay networks add an additional layer;
  • The smallest MTU along the path might be smaller than the MTU of the outgoing interface.

IPv4 routers can fragment packets under certain conditions; IPv6 routers do not perform in-path fragmentation, so the sender must adjust based on the Path MTU. Reliable protocols generally avoid IP fragmentation whenever possible.

For path MTU 1500, no IPv4 options, and 12 bytes of TCP options, a segment can carry at most 1500-20-32=1448 TCP data bytes without fragmentation, assuming the peer MSS permits it. The advertised value can still be 1460. HTTP content must additionally share that space with TLS and other application framing.

8. What Layer Does the Socket API Expose? ​

Common socket types:

python
import socket

with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as tcp:
    print(tcp.family == socket.AF_INET, tcp.type == socket.SOCK_STREAM)
with socket.socket(socket.AF_INET, socket.SOCK_DGRAM) as udp:
    print(udp.family == socket.AF_INET, udp.type == socket.SOCK_DGRAM)
# True True
# True True

SOCK_STREAM provides a byte stream interface, where applications do not see TCP segment boundaries; SOCK_DGRAM preserves datagram boundaries but still requires handling of packet loss, out-of-order delivery, duplication, and size limits.

Here AF_INET explicitly selects IPv4 TCP/UDP. These sockets are created and automatically closed without binding, connecting, or sending data. If a UDP receive buffer is smaller than a datagram, an API can truncate it and discard the remainder; a later read does not recover the rest as it would from a TCP stream.

Typical applications do not directly construct IP or Ethernet headers. Raw sockets, packet sockets, or packet capture interfaces expose lower-level capabilities and require platform permissions as well as different checksum and routing rules. The next chapter will fully explain the byte-stream semantics of sockets.

9. localhost Also Adheres to Protocol Semantics ​

When accessing 127.0.0.1 or ::1, packets are processed by the loopback interface and typically do not pass through physical network interfaces. TCP still provides connection, byte stream, sequence number, and termination semantics, and socket programs still encounter issues such as short reads, short writes, and message boundary problems.

Thus, local testing can validate application framing and state machine behavior, but it does not represent real network conditions such as round-trip time (RTT), packet loss, MTU, intermediate network devices, or bandwidth. To introduce these factors, network namespaces, traffic control, virtual machines, or isolated test networks must be used.

10. Layered Troubleshooting Is Not Moving Mechanically from Layer 1 to Layer 7 ​

When encountering "the website is down," first gather evidence that quickly narrows the scope:

PhenomenonNext Evidence
DNS resolution failureresolver configuration, DNS response, record and TTL
Address exists but connection times outrouting, packet capture showing SYN, ACL/firewall rules, return path
Immediate connection refusedtarget is reachable but no listener on the port, or device actively rejects the connection
TCP succeeds but TLS failsSNI, certificate chain, time, TLS version/cipher suites, ALPN
TLS succeeds but HTTP errorstatus code, headers, proxy/backend logs, request ID
Only large requests failPath MTU, fragmentation, buffer size and timeout settings
Only high-concurrency requests failbacklog settings, connection pool limits, port/FD limits, queuing and resource caps

ping tests a specific type of ICMP reachability. A ping failure might indicate ICMP is being filtered; a ping success does not prove that TCP port 443, TLS, or the application layer is healthy.

The correct use of layered troubleshooting is to map evidence to responsibilities and validate the interfaces between adjacent layers, not to rely on a single command declaring "network is fine."

11. Common Misconceptions ​

"OSI has seven layers, so each layer has its own header." The session and presentation layers often exist as libraries or application protocols, not as distinct, separable headers on every packet.

"TCP is responsible for finding the target host." IP and routing handle traversal across networks; TCP is responsible for end-to-end reliable byte streams and congestion control.

"A port belongs to a specific process." A port is part of a transport endpoint identifier. The kernel demultiplexes traffic based on address, port, protocol, and socket state. Multiple sockets can share the same port under certain rules.

"HTTPS is HTTP with an encrypted header added." HTTP/1.1 or HTTP/2 over TLS/TCP uses TLS records and key state. HTTP/3 uses QUIC packet protection with keys derived from a TLS handshake, without the TLS record layer.

"Capturing a single frame reveals the entire end-to-end path." A typical packet capture only shows the link-layer traffic sent or received on the local interface. Intermediate hops re-encapsulate the frames, so the full path is not visible.

12. Summary ​

A layered model breaks down network responsibilities into replaceable interfaces:

  • The application layer defines message semantics;
  • The transport layer establishes endpoints and provides either a byte stream or datagram;
  • IP enables packet forwarding hop by hop across the network;
  • The link layer handles the frame at the current hop;
  • DNS, TLS, proxies, and NAT enrich the actual request path beyond what the four-layer model shows;
  • Encapsulation adds headers, and demultiplexing uses those headers to route to the appropriate upper layer;
  • Troubleshooting requires gathering symptoms first, then tracing them down to a specific layer and its state.

The layered model now explains how a request crosses the network. The next lesson, 2.1 TCP Socket Lifecycle, starts at connect/accept and handles short reads, EOF, and half-close.

References ​

Built with VitePress | Software Systems Atlas

Copyright 2026 Steven Yang