Reference / TCP-IP fundamentals

Read the network one layer at a time.

This Tping reference explains how TCP/IP addressing, headers, ports, flags, and response behavior fit together. Use it to form better packet-testing hypotheses before running a controlled, authorized experiment.

tcp-observer — frame 0042

ethernet  src 02:42:ac:11:00:02
          dst 02:42:ac:11:00:03

ipv4      src 192.0.2.10
          dst 198.51.100.24
          ttl 64  protocol TCP

tcp       sport 49152  dport 443
          flags SYN  seq 184203
scope: documented lab traffic

The model

Separate the roles.

TCP/IP is easier to troubleshoot when each layer has a clear job. A packet capture shows these pieces together, while a test can change one field and observe what follows.

From wire to application

Link layerFrames, hardware addresses, and the local delivery segment.
Internet layerIP addressing, routing decisions, fragmentation, and hop limits.
Transport layerPorts, delivery semantics, sequencing, acknowledgements, and flags.
Application layerProtocols such as HTTP, DNS, and SSH that give payloads meaning.

A packet is context

A single frame rarely answers a complete diagnostic question. Compare the outgoing packet, the response, timing, route, and filtering conditions.

question: does port 443 respond?
observe: SYN → SYN/ACK or filtered
record: route, timing, flags, policy
repeat only inside the approved scope

Header reference

Fields that change the result.

Packet-generation tools expose details that ordinary connectivity checks hide. Interpret each field alongside the operating system, route, firewall, and capture point.

Field	What it describes	Diagnostic question
Source / destination IP	Logical endpoints used for routing.	Is the packet addressed to the intended interface?
Protocol	The next interpretation, such as ICMP, TCP, or UDP.	Will the receiving stack handle this protocol?
Source / destination port	Transport endpoints associated with an application service.	Is a service or filter rule relevant to this port?
Flags	Control bits describing a TCP exchange or state.	Does the response match the expected state transition?
TTL / hop limit	A limit that prevents indefinite forwarding.	Where might the packet have expired or been filtered?

Interpretation noteA missing response is not proof of a down host. Filtering, asymmetric routing, rate limits, local policy, and capture placement can produce the same observation.

Working method

Turn fields into evidence.

Use a small, repeatable sequence rather than changing several packet properties at once. The record is as important as the transmission.

Map the path

Note the test interface, route, address family, gateway, and capture location.

Choose one variable

Change a protocol, port, flag, or hop limit only when it answers a defined question.

Compare the exchange

Match transmitted and received headers, timing, state, and policy conditions.

TCP/IP FAQ

Clarify the basics.

Short answers for readers preparing their first packet-level investigation.

What is the difference between TCP and UDP?

TCP establishes a stateful exchange with sequencing and acknowledgements. UDP is connectionless and provides a smaller transport header without those delivery mechanisms.

What does a TCP SYN indicate?

A SYN requests the beginning of a TCP connection and carries an initial sequence value. A SYN/ACK response indicates that the peer accepted the proposed opening at that point in the path.

Does an open port prove an application is healthy?

No. It shows that traffic reached a listener or intermediary that responded. Application behavior requires a protocol-appropriate request and further observation.

Why can IPv4 and IPv6 behave differently?

They can use different addresses, routes, firewall policies, DNS results, and interface preferences. Test and record the address family explicitly.

What should I record in a packet test?

Record scope, time, interface, command or configuration, versions, relevant headers, capture point, response, and any filtering or routing conditions.

Have a correction?

Send a focused documentation question or compatibility observation. Exclude credentials, private captures, and confidential network details.

Contact Tping