The Layered Network Model

A network stack is built in layers because no single piece of code should have to understand fiber optics and retransmission and HTTP. Each layer solves exactly one problem and treats the layer below it as a dumb pipe. That separation is what lets Wi-Fi replace Ethernet without touching a line of TCP.

The five-layer model everyone actually uses:

Encapsulation and demultiplexing

Sending is encapsulation: the application's bytes become TCP's payload; that whole TCP segment becomes IP's payload; that whole IP packet becomes a link frame. Each layer prepends its own header and hands the result down. The payload of one layer is the complete unit of the layer above — layers never reach into each other's internals.

Receiving runs the tape backwards, and each layer faces the same question: who above me does this belong to? The answer is a small demultiplexing key in the header it just parsed:

IP's Protocol byte selects ICMP / TCP / UDP; TCP and UDP's destination port selects the process. Get one demux key wrong and the packet is delivered to the wrong handler — a bug you cannot see in a debugger, only in a packet capture.

What you will build

A userspace TCP/IP stack that speaks to a Linux TUN device. The kernel hands you raw IP packets; you implement everything from IP upward: parse headers, demultiplex to ICMP / UDP / TCP, keep per-connection TCP state (handshake, sliding window, teardown), and write replies back. You will not reimplement Wi-Fi or drivers — the link layer stays the kernel's job.

This is not a toy pattern. gVisor, slirp4netns, and lwIP are production userspace stacks built exactly this way: sandboxing, container networking, and embedded devices all run IP in userspace.

What trips people up

The mental trap is imagining a layer "knows about" the layers far from it. It does not. TCP never sees a MAC address; Ethernet never sees a port. Every layer reads exactly one header — its own — and uses one field to decide who gets the payload next. Hold that rule and the rest of this course is bookkeeping.