What is the difference between TCP and UDP in plain terms?

TCP is like a tracked parcel service: it confirms delivery, retransmits lost items, and keeps order. UDP is like dropping a postcard in a mailbox: it is sent and forgotten, with no confirmation — faster but no guarantees.

Why should I not block all ICMP in my firewall?

ICMP is used for path MTU discovery, which lets endpoints agree on the largest packet size the path supports. Blocking it causes silent fragmentation failures where large transfers stall even though small packets succeed.

What does 'connection refused' mean versus a timeout?

Refused means the remote host sent a TCP RST back — it received your SYN but nothing is listening on that port. A timeout means packets are silently dropped, usually by a stateful firewall with no matching allow rule.

How can one server handle thousands of HTTPS connections on a single IP and port 443?

Because each connection is identified by the full 5-tuple: protocol, server IP, server port, client IP, and client ephemeral port. Every client uses a unique source port, so all connections remain distinct even though the destination is the same.

Is the OSI model the same as the TCP/IP model?

No. OSI has seven layers (adding Presentation and Session above Transport, and splitting Network Access into Data Link and Physical). TCP/IP uses four layers. Both describe the same real protocols; OSI is more granular and common in vendor documentation, while TCP/IP maps more directly to Linux kernel internals.

TCP/IP Protocols Explained

Every packet that crosses a Linux network follows rules defined by the TCP/IP protocol suite. Before you can read a tcpdump trace, write an nftables ruleset, or debug a refused connection, you need a firm mental model of what each protocol does and how the layers fit together. This guide builds that foundation from the ground up.

The Layered Model: How TCP/IP Stacks Up

TCP/IP is commonly described as a four-layer model. Each layer handles a specific concern and hands data to the layer above or below it.

Layer	Name	What it handles	Example protocols
4	Application	User-facing data formats and sessions	HTTP, SSH, DNS, SMTP
3	Transport	End-to-end delivery, reliability, ports	TCP, UDP
2	Internet	Logical addressing, routing between networks	IP (v4/v6), ICMP
1	Network Access	Physical transmission, hardware addressing	Ethernet, Wi-Fi, ARP

The OSI model splits these into seven layers, and you will hear both used. For practical Linux work, the four-layer TCP/IP view maps directly to what you see in kernel documentation and tools like ss and tcpdump.

IP: The Internet Protocol

IP sits at the Internet layer and does one job: get a packet from a source address to a destination address, possibly across many routers. It is connectionless and unreliable — it makes a best effort but gives no delivery guarantee. Higher layers handle reliability if they need it.

IPv4 Addressing

An IPv4 address is 32 bits written as four decimal octets separated by dots: 192.168.1.50. A subnet mask (or CIDR prefix) defines which bits identify the network and which identify the host. 192.168.1.0/24 means the first 24 bits are the network; hosts range from .1 to .254, with .0 as the network address and .255 as the broadcast address.

IPv6 Addressing

IPv6 uses 128-bit addresses in eight colon-separated hex groups: 2001:db8::1. The double colon compresses consecutive all-zero groups. Linux has supported IPv6 for decades; most modern services should be dual-stack.

Inspect your current IP addresses on any distro:

ip addr show

A key field in the IP header is the TTL (Time to Live). Each router decrements it by one. When it hits zero, the packet is dropped and an ICMP "Time Exceeded" message is sent back — the mechanic that makes traceroute work.

How Routing Works in Brief

The kernel consults a routing table to decide where to send each packet. View it with:

ip route show

If no specific route matches, the packet goes to the default gateway — the router that connects your network to the rest of the internet.

ICMP: The Internet Control Message Protocol

ICMP travels inside IP packets and carries diagnostic and error messages between hosts and routers. It is not a transport protocol; applications do not use it to exchange data.

Common ICMP message types you will encounter:

Echo Request / Echo Reply (type 8/0) — the basis of ping
Destination Unreachable (type 3) — the target host or port cannot be reached
Time Exceeded (type 11) — TTL expired; used by traceroute
Redirect (type 5) — a router tells a host to use a better route

ping -c 4 8.8.8.8

traceroute 8.8.8.8

ICMPv6 extends this for IPv6 and also replaces ARP via Neighbor Discovery Protocol (NDP). Never blindly block all ICMP in a firewall — doing so breaks path MTU discovery and causes hard-to-diagnose connectivity problems.

TCP: The Transmission Control Protocol

TCP provides a reliable, ordered, connection-oriented byte stream between two endpoints. Every byte sent is acknowledged; lost segments are retransmitted. This makes TCP the right choice when data integrity matters more than raw speed: web traffic (HTTP/HTTPS), SSH, database connections, email.

The Three-Way Handshake

Before any data flows, TCP establishes a connection:

SYN — the client sends a segment with the SYN flag set and a random initial sequence number.
SYN-ACK — the server acknowledges the client's sequence number and sends its own.
ACK — the client acknowledges the server. The connection is now established.

You can watch this live with tcpdump:

tcpdump -i eth0 -n 'tcp[tcpflags] & (tcp-syn|tcp-ack) != 0' port 80

Key TCP Concepts

Sequence and acknowledgment numbers — track which bytes have been received.
Flow control (window size) — the receiver advertises how much buffer space it has; the sender cannot outrun it.
Congestion control — algorithms (CUBIC, BBR) slow the sender when the network is congested.
FIN/RST teardown — a FIN starts a graceful close; an RST is an abrupt reset, often seen when a port has nothing listening.

View active TCP connections and their states:

ss -tn

UDP: The User Datagram Protocol

UDP is connectionless and unreliable — there is no handshake, no acknowledgment, no guaranteed ordering. A UDP datagram is sent and immediately forgotten. What you lose in reliability you gain in low overhead and latency.

UDP fits use cases where occasional loss is acceptable or where the application handles its own reliability:

DNS queries (fast, single request/response)
DHCP
NTP (time synchronization)
Video/audio streaming and VoIP
Modern QUIC-based HTTP/3 (builds reliability on top of UDP itself)

View active UDP sockets:

ss -un

Ports: Addressing Services Within a Host

An IP address identifies a machine. A port number (16-bit: 0–65535) identifies a specific service or socket on that machine. TCP and UDP each have their own port space.

Port ranges by convention:

0–1023 — well-known ports; require root to bind. Examples: 22 (SSH), 80 (HTTP), 443 (HTTPS), 53 (DNS).
1024–49151 — registered ports for applications.
49152–65535 — ephemeral (dynamic) ports; the kernel assigns these to outgoing connections.

A connection is uniquely identified by the 5-tuple: protocol, source IP, source port, destination IP, destination port. This is why one server IP on port 443 can handle thousands of simultaneous HTTPS clients — each client uses a different ephemeral source port.

List which ports are listening and which process owns them:

ss -tlnp

The -p flag requires root to show process names for ports you do not own. Output will look similar to:

# State   Recv-Q  Send-Q  Local Address:Port  Peer Address:Port  Process
# LISTEN  0       128     0.0.0.0:22         0.0.0.0:*          users:(("sshd",pid=823,fd=3))

How the Layers Work Together: A Concrete Example

When you run curl https://example.com, here is what happens at each layer:

Application — curl builds an HTTP GET request. TLS negotiates encryption first.
Transport — TCP wraps the data in segments, adds source/destination ports (ephemeral ↔ 443), manages sequencing.
Internet — IP adds source/destination addresses, consults the routing table, sets TTL.
Network Access — Ethernet wraps the IP packet in a frame addressed to the next-hop MAC address (resolved via ARP or NDP), and puts it on the wire.

At the far end, the stack is unwrapped in reverse: Ethernet → IP → TCP → HTTP. Responses travel back the same way.

Verifying Your Understanding with Real Tools

Run a packet capture and watch all four layers at once. Install tcpdump if needed:

# Debian/Ubuntu
sudo apt install tcpdump

# Fedora/RHEL
sudo dnf install tcpdump

# Arch
sudo pacman -S tcpdump

Capture a DNS lookup (UDP) and an HTTP connection (TCP) together:

sudo tcpdump -i any -n -v 'port 53 or port 80' &
curl http://neverssl.com
wait

You will see DNS queries over UDP port 53, then a TCP three-way handshake to port 80, data exchange, and a FIN teardown — the entire model playing out in real time.

Troubleshooting: Common Confusion Points

Connection refused vs. timeout — Refused means a RST came back: something is listening on the IP but not on that port, or a firewall sent the RST. Timeout means packets are being silently dropped, often by a stateful firewall with no matching rule.
High TTL on ping but traceroute fails — Intermediate routers may block ICMP Time Exceeded while letting Echo through. Not a bug in your stack.
ss shows CLOSE_WAIT sockets piling up — The remote side closed the connection but your application has not called close(). This is an application bug, not a kernel issue.
Port 80 works but 443 does not — Likely a firewall rule missing for TCP 443, or a TLS certificate/listener misconfiguration. Check ss -tlnp to confirm the service is actually bound to 443.
Ephemeral port exhaustion — Under heavy outbound connection load (load balancers, scrapers), you can run out of source ports. Check /proc/sys/net/ipv4/ip_local_port_range and consider widening it.