AP Networking 4.2: The Language of the Network: Protocols and the OSI and TCP/IP Models

A protocol is a rule set two devices follow so data arrive intact, and the OSI and TCP/IP models organize those protocols into layers. Learn what DNS, DHCP, TCP, UDP, IP, and HTTPS each do, how the seven OSI layers line up with the four TCP/IP layers, and how analysts use the layers to find faults fast.

Picture the grocery store from Unit 4's scenario on a busy Saturday: one card swipe touches four protocols. DNS turns the processor's name into an address, IP carries the packets, TCP guarantees every byte arrives, and HTTPS keeps the card number encrypted. When any link breaks, the layer models say where to look first.

• What is a network protocol?
• Protocols that identify devices: MAC, ARP, IP, DHCP, DNS
• Protocols that package and verify: ICMP, TCP, UDP
• Protocols you use directly: HTTP, FTP, email
• The OSI model: seven layers and their PDUs
• The TCP/IP model and how the two line up
• Troubleshooting by layers
• Bottom-up, top-down, middle-out
• Practice: Layer Detective
• Three free practice questions
• Key terms
• Frequently asked questions

What is a network protocol?

A network protocol defines the rules that make sure data are recognized and handled properly during transmission. Both ends follow the same rules, which is why a register built by one company can talk to a server built by another. The dozens of protocols cluster into three working families: identify, deliver, and serve. Learn the family and the names get easier.

Protocols that identify devices: MAC, ARP, IP, DHCP, DNS

Data are useless on the wrong machine, so one family exists just to get addressing right.

Protocol	What it does	Store example
MAC + ARP	Identify devices on the local network by hardware address	The switch delivers frames to register 4's MAC address
IP	Identifies devices on local and remote networks	The price server is 192.168.10.5 inside; the processor is 198.51.100.44 outside
DHCP	Assigns IP addresses to devices automatically	A new handheld scanner boots and gets 192.168.20.61 with zero typing
DNS	Translates domain names into IP addresses	pay.grocer-processor.com becomes 198.51.100.44 before the charge

The DNS step is the one students underestimate. Typing google.com quietly triggers a lookup that returns one of Google's public addresses, such as 172.253.63.100, and only then does the browser connect. That makes DNS a spectacular single point of failure: kill it and every connection by name dies while every connection by number still works. Remember that asymmetry.

Protocols that package and verify: ICMP, TCP, UDP

The second family decides how data are packaged and whether anyone checks that they arrived.

Protocol	Character	Use it when
TCP	Connection-oriented: tracks acknowledgements, resends missing data	Complete, accurate delivery is essential: payments, file transfers, web pages
UDP	Connectionless: no acknowledgements, no resends	Speed beats accuracy: streaming, online gaming, live audio
ICMP	Reports transmission time and errors	Diagnostics: it is the engine inside ping and traceroute

Resist the instinct that TCP is simply better. A payment over UDP could silently lose a digit; a music stream over TCP would stutter resending notes the listener already passed. The two make opposite trades on purpose, and the AP exam asks which trade fits which job.

Protocols you use directly: HTTP, FTP, email

The third family defines how users request, send, and receive content and services.

Job	Protocols	Notes
Load web pages	HTTP, HTTPS	HTTPS is HTTP with encryption; the register's price pages use it
Transfer files	FTP, SFTP	SFTP is the secure choice for the nightly inventory upload to headquarters
Send email	SMTP	Sends the customer's digital receipt
Retrieve email	POP3, IMAP	Pull messages down to a mail client

The OSI model: seven layers and their PDUs

With this many protocols in play, analysts need an organizer. The Open Systems Interconnection (OSI) model sorts network functions into seven layers, giving every analyst the same vocabulary for devices, protocols, and data. No packet ever consults it; people do.

Each layer names its protocol data unit, or PDU: one unit of information in flight, data plus the protocol information needed to deliver it. On the way down the stack, each layer wraps the data with more headers; that wrapping is encapsulation, and the PDU renames as it happens.

OSI layer	PDU	What lives here
7 Application, 6 Presentation, 5 Session (the upper layers)	Data	Application protocols such as DNS, DHCP, HTTPS, SSH; software and operating systems
4 Transport	Segments	TCP and UDP; gateways and firewalls
3 Network	Packets	IP addressing and ICMP; routers and layer-3 switches
2 Data link	Frames	Ethernet and MAC addresses; NICs and layer-2 switches
1 Physical	Bits	Cables, connectors, and wireless transmitters

The TCP/IP model and how the two line up

The TCP/IP model describes the same communication in four layers, with the same PDU pattern: bits and frames at network access, packets at internet, segments at transport, data at application. The mapping between the models is fixed; memorize it once:

OSI layers	TCP/IP layer
5-7 (the upper layers)	Application
4 Transport	Transport
3 Network	Internet
1-2 Physical and Data link	Network access

Follow one payment down the stack: HTTPS builds the request as data, TCP breaks it into acknowledged segments, IP addresses each packet, and Ethernet frames it onto the wire as bits. At the processor's end it unwraps in reverse.

Troubleshooting by layers

You already own the five-step loop from Topic 1.1: observe, try the obvious, diagnose, fix cheapest-first, verify. Topic 3.6 sharpened the diagnose step by comparing documentation against reality. The layer models upgrade it again: isolate the symptom to a layer and you know where to begin. A cable problem lives at the physical layer; a firewall issue lives at the transport layer.

The working move is clearing layers with evidence: every test that succeeds rules layers out. A lit link light clears layer 1. Reaching a local machine clears layer 2. A successful ping by IP clears layers 1 through 3. If all that works but a name lookup times out, the fault is DNS, above. That logic is the difference between swapping cables for an hour and finding the problem in three commands.

Know what lives where: the "what lives here" column of the OSI table above is the suspect roster once a layer is implicated.

Bottom-up, top-down, middle-out

The symptoms pick your starting point. Bottom-up starts with physical checks: right for hard-down symptoms like a dead link light after someone moved shelving. Top-down starts at the application: right when one program on one machine fails right after its own update. Middle-out starts with the network settings and moves up or down: right when addressing is the fastest thing to check.

This is also where you audit an AI suggestion instead of obeying it. An assistant may confidently say "check the cabling first." That is a real approach, but if web browsing already works on the affected machine, layers 1 through 4 are cleared by evidence. AI proposes a starting layer; the checks that already passed decide whether to accept it.

Practice: Layer Detective

Round 1 hands you a protocol in action; place it on the OSI stack, then the TCP/IP stack. Round 2 hands you a symptom set from the Saturday incident; pick the layer to investigate first and the first check to run there. Cases and choices shuffle every time; one case includes an AI suggestion to audit.

Three free practice questions

Try these before opening the answers, the way the AP exam pairs an artifact with a symptom.

1. Payments must arrive complete and acknowledged; the store's live music stream needs real-time speed. Which transport protocol fits each, and why?

TCP for payments: it tracks acknowledgements and resends missing data. UDP for the stream: it trades accuracy for speed, and a resent note would arrive too late to matter (EK 4.2.A.3).

2. A layer-2 switch forwards frames by MAC address. Which OSI layer is that, and which TCP/IP layer does it map to?

Frames and MAC addresses are OSI layer 2, the data link layer, which correlates with the TCP/IP network access layer (EK 4.2.B.3, 4.2.B.4).

3. A register pings its gateway and 8.8.8.8 by IP successfully, but a name lookup for the ordering page times out. Which layer holds the fault?

The upper layers: the working pings clear layers 1 through 3, so a failed name lookup with working IP connectivity is the DNS fingerprint (EK 4.2.C.1).

Key terms

Protocol

Rules that ensure data are recognized and handled properly in transit.

DNS

Translates domain names into IP addresses.

DHCP

Assigns IP addresses to devices automatically.

TCP

Connection-oriented transport that acknowledges and resends; accuracy first.

UDP

Connectionless transport that favors speed; streaming and gaming.

ICMP

Reports transmission time and errors; behind ping and traceroute.

PDU (protocol data unit)

One unit of information in flight: bits, frames, packets, segments, or data by layer.

Encapsulation

Each layer wrapping the data with its own protocol information on the way down.

Upper layers

OSI layers 5-7 together; they map to the TCP/IP application layer.

Frequently asked questions

What is the difference between the OSI model and the TCP/IP model?

Both describe how computers communicate. OSI uses seven layers, TCP/IP four: OSI 1-2 map to network access, 3 to internet, 4 to transport, 5-7 to application.

Is the OSI model actual software running in the network?

No. It is a reference model, a shared map and vocabulary. No packet consults it; analysts use it to organize protocols and structure troubleshooting.

What are the PDUs at each OSI layer?

Bits at layer 1, frames at layer 2, packets at layer 3, segments at layer 4, and data at layers 5-7. TCP/IP follows the same pattern.

What is the difference between TCP and UDP?

TCP tracks acknowledgements and resends missing data, so it is used when accuracy is essential. UDP skips that for speed, so it carries streaming and gaming.

What does DNS actually do?

It translates domain names into the IP addresses networks route on. Typing google.com returns an address such as 172.253.63.100, and the browser connects to that.

What is the difference between DNS and DHCP?

DHCP hands a device its own IP address when it joins the network. DNS translates other machines' names into addresses. One configures you; the other finds them.

Which OSI layer does a switch work at? A router? A firewall?

A standard switch forwards frames at layer 2. A router forwards packets at layer 3. Firewalls and gateways are treated as transport, layer 4.

Which layer should I check first when something breaks?

Let the symptoms decide. Hard-down hardware signs point bottom-up from physical; one failing app points top-down from the application; addressing oddities suggest middle-out.

If ping works, is the network fine?

Partly. A successful ping by IP clears layers 1 through 3 but says nothing about a firewall rule or DNS above, which is why payments can fail while pings succeed.

Why does HTTPS matter more than HTTP in a store network?

HTTPS is HTTP with encryption. Card data and credentials must never cross the network readable. The same logic applies to SFTP over FTP.

AP is a trademark of the College Board, which was not involved in the production of, and does not endorse, this resource.