Transport, Network and Link Layers | OCR H446

Learning Objectives

By the end of this topic you will be able to:

Explain the role of the Transport layer: TCP vs UDP, ports and sockets

Describe the Network layer: IP addressing and routing

Describe the Link (Data Link) layer: MAC addresses and framing

Explain how the layers interact when data is sent and received

TCP/IP Stack Summary

TCP/IP Four-Layer Model Overview

Layer	Name	Protocols	Key Function
4	Application	HTTP, FTP, DNS, SMTP	User-facing data exchange
3	Transport	TCP, UDP	End-to-end delivery, ports
2	Network / Internet	IP, ICMP	Logical addressing, routing
1	Link	Ethernet, Wi-Fi	Physical transmission, MAC

Each layer adds a header (encapsulation) when sending and strips headers when receiving (de-encapsulation). The payload of each layer becomes the data for the layer below.

Transport Layer

Transport Layer: TCP and UDP

TCP (Transmission Control Protocol)

Connection-oriented. Three-way handshake (SYN, SYN-ACK, ACK) establishes connection. Guarantees delivery, ordering, and error-checking via acknowledgements and retransmission. Used for: HTTP, email, file transfer — anything where data integrity matters.

UDP (User Datagram Protocol)

Connectionless. No handshake, no acknowledgements, no guaranteed ordering. Much lower overhead. Used for: video streaming, online gaming, DNS, VoIP — where speed matters more than guaranteed delivery.

Ports and Sockets: ports identify specific applications on a host (0–65535). A socket = IP address + port number. A TCP/UDP connection is identified by a socket pair: (source IP, source port, destination IP, destination port).

Network Layer

Network (Internet) Layer

IP (Internet Protocol): responsible for logical addressing and routing. Each packet carries source and destination IP addresses. Routers use these to forward packets hop-by-hop toward the destination.

IP is connectionless: each packet is routed independently. No pre-established path. Packets may arrive out of order — the Transport layer (TCP) handles reordering.

ICMP (Internet Control Message Protocol): used for network diagnostics. The ping command uses ICMP echo requests/replies to test reachability. traceroute uses ICMP TTL-exceeded messages to map the route.

The network layer adds an IP header: source IP, destination IP, TTL, protocol, and checksum. This header is read and updated by each router along the path.

Link Layer

Link (Data Link) Layer

MAC addresses: a 48-bit hardware address burned into each NIC (Network Interface Card), written as six pairs of hex digits (e.g. A1:B2:C3:D4:E5:F6). Used for local network delivery within the same subnet.

ARP (Address Resolution Protocol): maps IP addresses to MAC addresses on the local network. A device broadcasts "who has IP x.x.x.x?" and the owner replies with its MAC address. The result is cached in the ARP table.

Framing: the link layer wraps packets in frames with a MAC source, MAC destination, and a Frame Check Sequence (FCS) for error detection. Frames are only valid on the local link — the MAC addresses change at each router hop.

Exam Practice

OCR H446 Style · 4 marks

Explain the difference between a MAC address and an IP address. Describe when each is used when data is transmitted between two computers on different networks.

[4 marks]

IP address: a logical 32-bit (IPv4) or 128-bit (IPv6) address assigned by software. Used by routers at the Network layer to route packets across networks from source to ultimate destination. Remains constant for the entire journey.

MAC address: a 48-bit hardware address burned into the NIC. Used by switches at the Link layer for delivery on the local network segment. The MAC destination changes at every router hop — the router replaces the MAC with the next router's MAC — while the IP address stays the same.

Common Mistakes

Don't Lose Marks

Saying the IP address changes as a packet crosses routers — the IP source and destination remain constant end-to-end. Only the MAC address changes at each router hop (the router strips the old frame and creates a new one with its own MAC as source).

Confusing UDP with unreliable in a bad way — UDP is perfectly appropriate when low latency matters more than perfect delivery (streaming, gaming, DNS). The question asks you to justify the choice: don't automatically say TCP is better — it depends on the application.

Saying TCP's three-way handshake is SYN, ACK, ACK — it is SYN, SYN-ACK, ACK. The second message is from the server and combines SYN (synchronise) and ACK (acknowledge the client's SYN). Get the exact sequence right.

Transport, Network& Link Layers