TCP/IP Stack
Definition
Four-layer model that actually runs the internet: Link, Internet, Transport, Application. Defined by the IETF and mapped onto the OSI layers for analytical use.
- Layers
- Link, Internet, Transport, Application
- Standards body
- IETF
- Comparison model
- Mapped onto OSI's 7 layers for analysis
- Role
- The model actually implemented on the internet
Common questions
Why do forensic and network analysts still reference the OSI model if TCP/IP is what actually runs?+
OSI's finer seven-layer breakdown gives a more granular vocabulary for explaining where in the communication path a problem or artifact sits, for example separating physical, data link, and network layers that TCP/IP folds into one Link layer, so it remains a useful teaching and analytical framework even though TCP/IP is the deployed implementation.
Which TCP/IP layer is most relevant to attributing an IP address in an investigation?+
The Internet layer, since that is where IP addressing and routing occur; the Transport layer above it (TCP or UDP) supplies the port numbers that identify the specific application or service involved in the communication.
Related terms
- CIDR (Classless Inter-Domain Routing)
- A compact notation for IP address ranges that appends a prefix length to the address, such as 192.168.1.0/24. The prefix length states...
- MAC Address (OUI)
- 48-bit hardware address. First 24 bits are the Organisationally Unique Identifier assigned by IEEE to a vendor; the lower 24 are the...
- OSI Reference Model
- Seven-layer ISO/IEC 7498-1 model describing how network functions are partitioned: Physical, Data Link, Network, Transport, Session, Presentation, Application. A teaching model, not...
- RFC 1918 Private Space
- Three IPv4 ranges reserved for private use: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16. Not routable on the public internet; require NAT at the edge.
- SLAAC
- Stateless Address Autoconfiguration. IPv6 host generates its own address from the router-advertised /64 prefix plus a 64-bit interface identifier (EUI-64 or RFC...