Confusion about TCP/IP data flow in layers

Question

I'm confused about how the data flows through the layers of the TCP/IP model, so I'll just tell what I think it happens (using an email example) and I'd appreciate if you can point my mistakes.

---

Suppose A wants to send an email to B via gmail. A opens gmail, writes the text and sends. In this moment, gmail calls the Application Layer, which will provide gmail with the correct email protocol (in this case it's IMAP, but it could be SMTP or POP3). What these protocols do is to turn that email into a "box" that contains only the binary representation of this email in a way that only the same protocol can interprete: it can be encrypted, compressed, etc. Until this point, there is no address in the "box", only pure data, and the "box" is a single unit of data (that can be very large). The name of the "box" is data.

Then, the data is given to the Transport Layer (suppose it uses TCP), which will deal with the ports. My confusion starts here. Suppose gmail tab uses the port 1000 to stablish connection and the IMAP port is 143. I've read that the Transport Layer breaks data in multiple pieces if it is too big. In each of this pieces (which are called segments), it adds some things: the origin and destination ports and some security/integrity information (checksum, etc).

• What will these origin and destination ports be?
• Is the Transport Layer who breaks a big file in pieces or it comes already divided from the Application Layer?

Then, comes the Internet Layer, which takes the segments and add the origin and destination IP addresses on them, turning the segments into packets.

• How does the Internet Layer find out the destination IP address to begin with?

Lastly, the Network Access Layer, using the protocol ARP, finds out the MAC address of the destination IP and adds the origin and destination MAC addresses into the packets, turning them into frames, that will be physically send across the network using protocols such as WiFi, Ethernet, etc.

Answer 1

What will these origin and destination ports be?

The origin/Source port is randomly selected by the client. The destination port is determined by the Application.

For example, if I'm making a web request (HTTP), my destination port will be TCP port 80, and my source port will be randomly selected.

To take that a step further, let's use your example:

gmail tab uses the port 1000 to stablish connection and the IMAP port is 143.

Let's say your IP address is 1.1.1.1, and Gmail's IP address is 9.9.9.9. I'm also changing the source port to 2222, because the typical range for random source ports is 1024-65535

When you make a request, the packet L3/L4 attributes will look like this:

SRC:  1.1.1.1:2222
DST:  9.9.9.9:143

The gmail server is "listening" on port 143 for incoming IMAP requests. Upon receiving that packet, it generates a response, and the response has the reverse L3/L4 attributes as the initial packet:

SRC:  9.9.9.9:143
DST:  1.1.1.1:2222

The response is sent to destination port 2222. Your operating system has reserved this port so "listen" for the response to the outbound packet.

So you see, the port is not wasted. The port exists to listen for incoming traffic. Gmail, running IMAP software, is listening for incoming requests on port 143. And your client, who sent an IMAP request to Gmail is listening for the response on port 2222 (the port# you randomly selected).

Once the "conversation" is complete, your operating system releases port 2222, which will allow some other connection to randomly use that port again for future inbound response traffic.

Is the Transport Layer who breaks a big file in pieces or it comes already divided from the Application Layer?

This different across various implementations, but generally TCP has the ability to segment blocks of data into the necessary size to be sent across the wire. So in the case of TCP, an application can send the entire data "chunk" to be sent and let TCP break it up as needed.

UDP does not have this ability. If an application means to send a large file using UDP, it must break the file up into pieces that are appropriate for the network path.

How does the Internet Layer find out the destination IP address to begin with?

Via an external process.

For example, if you type into your command prompt "ping 8.8.8.8", you (the user) provided the IP address 8.8.8.8.

If you typed into your web browser "google.com", then your operating system would use DNS to translate "google.com" into an IP address, and now your web browser knows the IP address to send web traffic to.

---

I would recommend a read through this article (and the whole series it comes from):

https://www.practicalnetworking.net/series/packet-traveling/osi-model/

It discusses that various steps required for packets to move through a network.

Disclaimer: The blog/article is my own. It is advertisement free and not monetized, I am only providing it to benefit the reader.