Computer Networking Basics: How Data Moves Between Machines

When two computers exchange data, the data does not travel as a single stream. It is broken into pieces, wrapped in layers of addressing and control information, sent across physical media, and reassembled at the destination. Each layer of the network stack has a specific job, and understanding those jobs in the order they happen explains most of what can go wrong and why.

This page describes the mechanism of data transfer between two machines on an IP network, from the application down to the wire and back up. It does not cover wireless specifics or advanced routing protocols; it covers the path a typical packet takes and the roles of the devices and protocols along the way.

The Layered Model in Practice

The OSI model lists seven layers, but the TCP/IP model collapses them into four: Application, Transport, Internet, and Link. Data moves down the stack on the sending machine, across the network, and up the stack on the receiving machine. Each layer adds its own header (and sometimes trailer) to the data, a process called encapsulation. The receiving machine strips these headers in reverse order.

The important point is that each layer only communicates with its peer layer on the other machine. The transport layer on the sender talks to the transport layer on the receiver; it does not care about the physical medium. This separation is what allows the same web request to work over Ethernet, Wi-Fi, or fiber.

Step-by-Step: What Happens to Your Data

Consider a simple action: a browser requests a web page from a server. The following sequence occurs, in this order.

1. Application Layer: The Request Is Formed

The browser creates an HTTP request. This is plain text (or binary, with HTTP/2) that includes the method (GET), the path (/index.html), and headers. The application hands this data to the operating system’s network stack, specifying the destination IP address and port (usually 80 for HTTP, 443 for HTTPS).

At this point, the data is just a blob of bytes. It has no network addressing yet.

2. Transport Layer: Segmentation and Ports

The transport layer, typically TCP (Transmission Control Protocol) or UDP (User Datagram Protocol), takes the application data and divides it into segments. TCP adds a header containing source and destination port numbers, sequence numbers, and flags. The port numbers identify which application on each machine should receive the data. The sequence numbers allow the receiver to reassemble segments in order and detect missing ones.

TCP also establishes a connection before sending data, using a three-way handshake (SYN, SYN-ACK, ACK). This ensures both ends are ready and agree on initial sequence numbers. UDP, in contrast, sends datagrams without a connection, which is faster but less reliable.

The transport layer does not know or care about the path the data will take. It only cares about end-to-end delivery between the two ports.

3. Internet Layer: IP Addressing and Routing

The internet layer, using IP (Internet Protocol), encapsulates each TCP segment into a packet by adding an IP header. This header contains the source and destination IP addresses. These addresses are logical, hierarchical addresses that identify the network and the host. The IP layer is responsible for routing the packet across networks to the destination.

If the destination is on a different network, the sending machine does not send the packet directly to the destination. It sends it to its default gateway (usually a router). The router examines the destination IP address, consults its routing table, and forwards the packet to the next hop. This process repeats until the packet reaches the destination network.

IP is connectionless: each packet is routed independently. Two packets from the same message may take different paths. The IP header also includes a time-to-live (TTL) field, decremented at each hop, to prevent packets from looping forever.

4. Link Layer: Physical Addressing and Framing

Before the packet can leave the machine, the link layer (Ethernet, Wi-Fi, etc.) wraps it in a frame. The frame header contains the source and destination MAC (Media Access Control) addresses. MAC addresses are physical addresses burned into the network interface card (NIC). They are used only for delivery within the same local network segment.

The sending machine determines the MAC address of the next hop (either the destination or the gateway) using the Address Resolution Protocol (ARP). ARP broadcasts a request asking “who has IP address X?” and the owner replies with its MAC address. The frame is then transmitted onto the physical medium as a sequence of electrical signals, light pulses, or radio waves.

5. Physical Transmission and Reception

The frame travels across the physical medium to the next device. On a typical home network, this is a switch. A switch learns which MAC addresses are on which ports and forwards the frame only to the correct port, not to all ports. The frame is received by the destination NIC, which checks the frame check sequence (FCS) for errors. If the frame is intact, the NIC strips the link layer header and passes the packet up to the IP layer.

6. Up the Stack on the Receiver

The IP layer on the receiving machine checks the destination IP address. If it matches (or is a broadcast/multicast address), it strips the IP header and passes the segment to the transport layer. The transport layer uses the port number to deliver the data to the correct application. TCP reassembles segments in order, acknowledges received data, and retransmits any missing pieces. The application then processes the data—in this case, the web server sends back an HTTP response, and the process repeats in reverse.

Key Devices and Their Roles

What People Get Wrong About Networking

A common misconception is that IP addresses are used for delivery on the local network. In reality, IP addresses are used for end-to-end routing, but the actual delivery on a local segment uses MAC addresses. When a packet is sent to a remote network, the IP header’s destination address remains the final destination, but the link layer’s destination MAC address is that of the next-hop router. This is why ARP is needed: to find the MAC address of the gateway.

Another common error is thinking that TCP and IP are the same thing. They are separate protocols in separate layers. TCP provides reliable, ordered delivery between applications; IP provides best-effort delivery of packets between hosts. A TCP connection can span multiple IP hops, but each hop only cares about IP.

A third mistake is assuming that a switch can route between subnets. A switch operates at Layer 2 and only forwards frames within a single broadcast domain. If two devices are on different IP subnets, they must communicate through a router, even if they are connected to the same switch. The switch sees MAC addresses, not IP addresses, and will not forward packets across subnets.

These mistakes are natural because the OSI model is often taught as a rigid sequence, and people tend to equate IP with “the network” and MAC with “the hardware.” The reality is that both are used, but at different points in the journey.

How to See This in Action

On a Windows machine, the ipconfig command shows the IP configuration of the network interfaces, including the IPv4 address, subnet mask, and default gateway. The arp -a command displays the ARP cache, which maps IP addresses to MAC addresses for local devices. The tracert command (or traceroute on Linux) shows the path a packet takes to a destination, revealing each router hop.

ipconfig /all

This displays detailed IP configuration, including MAC address (Physical Address), IP address, subnet mask, and default gateway. The output shows what the machine believes its network settings are.

arp -a

This lists the IP-to-MAC address mappings the machine has learned. If a device is not listed, the machine will need to ARP for it before sending frames.

tracert example.com

This shows the sequence of routers (hops) between the machine and the destination. Each line lists a hop’s IP address and the round-trip time. This demonstrates that packets pass through multiple networks, each with its own router.

These commands are diagnostic, not repair tools. They help you observe the mechanism described above.

The Role of DNS

Before any of the above can happen, the application must know the destination IP address. Most often, the user types a name like example.com, not an IP. The Domain Name System (DNS) translates that name into an IP address. DNS is a distributed database; the machine queries a DNS server, which may query other servers, until it finds the answer. The result is cached locally for a period (TTL).

DNS operates at the application layer, but it is essential for networking because it provides the IP address that the lower layers need. Without DNS, you would have to remember IP addresses for every service.

Conclusion

Understanding the flow of data—from application to transport to internet to link, and back up—explains how networks function. Each layer has a distinct role, and the separation of concerns allows the internet to scale. When something fails, the failure often occurs at a specific layer, and knowing which layer helps diagnose the problem. This page has described the normal mechanism; troubleshooting specific failures is covered in other articles.