← Home

TCP/IP Fundamentals

The TCP/IP suite is how modern Ethernet-based networks — including most Industrial Automation and Control System (IACS) plant networks — actually move packets. Where the OSI Model is a teaching framework, TCP/IP is the practical stack: IP at the network layer, TCP or UDP at the transport layer, and application protocols (HTTP, Modbus TCP, OPC UA, and others) above.

Related: OSI Model | Switches and VLANs | Network Topologies | Modbus TCP | Network Segmentation | Network Attacks

IPv4 addressing

Every device on a TCP/IP network needs a unique IP address, separate from the Ethernet (MAC) physical address. IPv4 uses a 32-bit address written in quad-dotted decimal (for example 192.168.10.15), allowing roughly 4.3 billion addresses.

Subnet membership is defined by a subnet mask:

ARP — mapping IP to MAC

On a local Ethernet segment, IP packets must still be delivered to a MAC address. Address Resolution Protocol (ARP) asks the LAN: “Who has this IP?” The owner replies with its MAC. Devices cache recent IP↔MAC mappings in an ARP table to reduce broadcasts.

ARP is a frequent target for local attacks (see ARP spoofing). IPv6 does not use ARP; it uses neighbor solicitation instead.

Routing — three common cases

Routers (Layer 3) forward packets between networks using static or dynamic routing tables. Hosts use the same ideas:

  1. Same subnet — ARP finds the peer MAC; send directly on the LAN.
  2. Different subnet, known route — send to the configured next-hop router that knows how to reach that network.
  3. No specific route — send to the default gateway; that router (often also a firewall) forwards toward the destination, possibly over multiple hops.

ICMP (Internet Control Message Protocol) carries diagnostics and error reports (for example unreachable destinations). Engineers use it for troubleshooting; attackers and scanners also probe with it — see network discovery and scanning.

Routers vs Layer 3 switches

A classic router connects LANs and often a WAN, with an IP routing table. A Layer 3 switch can switch within a LAN like Layer 2 and also route between subnets — typically without a WAN edge. Collapsing accounting, engineering and PLC networks onto one L3 switch can cut cost and increase flexibility, but concentrates risk: evaluate segmentation and trust boundaries carefully (network segmentation).

IPv6 (highlights for OT)

Transport: TCP and UDP

The transport layer makes end hosts appear directly connected: numbering, reordering, end-to-end error recovery and flow control as needed.

Protocol Style Typical use
TCP Connection-oriented; reliable delivery, acknowledgements, retransmission Sessions that must not lose data (many IT apps; some industrial protocols)
UDP Connectionless; low overhead, no guaranteed delivery Fast streams, discovery, some real-time or simple industrial traffic

Port numbers

TCP and UDP identify applications with port numbers. The combination of source and destination IP + port steers data to the correct service.

Range Name Notes
0–1023 System / well-known e.g. HTTP 80, DNS 53, many industrial defaults
1024–49151 User / registered Registered application ports
49152–65535 Dynamic / ephemeral / private IANA suggested client return ports; OS defaults vary (older Windows used narrower ranges; many Linux builds use other ephemeral ranges)

Servers typically listen on well-known or registered ports; clients often use ephemeral return ports assigned by the OS.

Key takeaways