Layers and protocols

Networking is easier to reason about in layers. Each layer solves a narrower problem and provides a service to the layer above it.

• Application: HTTP, DNS, SSH, and the rules applications understand
• Transport: TCP or UDP communication between processes
• Internet: IP addressing and routing between networks
• Link: delivery across one local link, such as Ethernet or Wi-Fi

The model is a tool, not a physical stack inside a cable. Implementations sometimes cross layer boundaries, but the separation still helps you ask precise questions.

Watch the layers in one request

You can see the layers take turns in a single curl call:

curl -v https://flaviocopes.com/ -o /dev/null

Read the output top to bottom:

* Host flaviocopes.com:443 was resolved.
* IPv4: 104.21.4.157, 172.67.132.90
*   Trying 104.21.4.157:443...
* Connected to flaviocopes.com (104.21.4.157) port 443
* SSL connection using TLSv1.3
> GET / HTTP/2
< HTTP/2 200

The first two lines are DNS, an application-layer protocol, turning a name into IP addresses. Trying ... Connected is the transport layer opening a TCP connection to port 443, carried by IP packets across many links you never see. The TLS line secures that connection. Only then does HTTP — the application protocol you actually wanted — send GET / and receive a 200.

One command, four layers, each doing one job in sequence.

Why layers matter for debugging

When a website fails, “the network is broken” is too vague. The failure might be name resolution, routing, a TCP port, TLS, or the HTTP application. Layers give each possibility a name.

Compare these two failures:

curl https://doesnotexist.flaviocopes.com/
# curl: (6) Could not resolve host

curl https://flaviocopes.com:9999/ --connect-timeout 3
# curl: (28) Connection timed out

The first error is an application-layer DNS failure: the name has no address. The second is a transport failure: the name resolved fine, but nothing answered on TCP port 9999. Two different layers, two completely different fixes.

My advice is to name the layer before touching any configuration. If DNS failed, don’t restart your router. If TCP timed out, don’t edit /etc/hosts. The model exists so you can point at the right problem.