TCP/IP Exam Focus | TCP/IP 考点精讲

📚 TCP/IP Exam Focus | TCP/IP 考点精讲

The TCP/IP protocol suite is the backbone of modern networking and a core topic in CCEA Computer Science. Understanding its layered architecture, communication mechanisms, and the roles of key protocols is essential for both exam success and real-world application. This revision guide unpacks the critical concepts, from the four-layer model and data encapsulation to the details of the TCP three-way handshake and IP addressing, ensuring you can tackle any question with confidence.

TCP/IP 协议族是现代网络的支柱，也是 CCEA 计算机科学的核心主题。理解其分层架构、通信机制以及关键协议的作用，对于考试成功和实际应用都至关重要。本复习指南将剖析从四层模型、数据封装到 TCP 三次握手和 IP 寻址等关键概念，确保你能自信应对任何考题。

1. TCP/IP Protocol Suite Overview | TCP/IP 协议族概述

The TCP/IP model is a conceptual framework that standardises the functions of a telecommunication network into four abstraction layers. It was developed by the US Department of Defense and later adopted as the foundation of the Internet. Unlike the seven-layer OSI model, TCP/IP merges the top three OSI layers into a single Application layer and the bottom two into a single Network Access layer, making it a simpler and more practical reference for real networks.

TCP/IP 模型是一个将通信网络功能标准化为四个抽象层的概念框架。它由美国国防部开发，后来被采纳为互联网的基础。与七层 OSI 模型不同，TCP/IP 将 OSI 的上三层合并为一个应用层，并将下两层合并为一个网络接入层，使其成为现实中更简洁、更实用的参考模型。

Every communication on the Internet, from loading a web page to sending an email, relies on protocols defined within this suite. The name TCP/IP itself highlights the two most critical protocols: the Transmission Control Protocol (TCP) and the Internet Protocol (IP). However, the suite includes dozens of other protocols such as UDP, HTTP, FTP, SMTP, and DNS, each playing a specific role in the layers.

互联网上的每次通信，从加载网页到发送电子邮件，都依赖该协议族中定义的协议。TCP/IP 这个名称本身就突出了两个最重要的协议：传输控制协议 (TCP) 和网际协议 (IP)。然而，该协议族还包括 UDP、HTTP、FTP、SMTP 和 DNS 等数十种协议，每一种都在各层中扮演特定角色。

2. The Four-Layer Model | 四层模型

The TCP/IP model consists of four layers, each responsible for distinct tasks. From top to bottom they are: Application, Transport, Internet, and Network Access. This layered approach allows for modular design, where protocols can be updated or replaced without affecting the whole stack.

TCP/IP 模型由四层组成，每层负责不同的任务。从上到下依次为：应用层、传输层、网际层和网络接入层。这种分层方法允许模块化设计，协议可以在不影响整个协议栈的情况下进行更新或替换。

At the Application layer, user-facing protocols operate, such as HTTP for web browsing and SMTP for email. The Transport layer provides end-to-end communication services; TCP delivers reliable, ordered data streams, while UDP offers lightweight, connectionless delivery. The Internet layer handles logical addressing and routing, with IP being the workhorse that moves packets from source to destination across multiple networks. Finally, the Network Access layer defines how data is physically transmitted over a medium, encompassing hardware addresses, frame formatting, and error detection at the link level.

在应用层，运行着面向用户的协议，例如用于网页浏览的 HTTP 和用于电子邮件的 SMTP。传输层提供端到端的通信服务；TCP 提供可靠、有序的数据流，而 UDP 提供轻量级的无连接传输。网际层处理逻辑寻址和路由，IP 是将数据包从源地址跨多个网络传送到目的地的主力。最后，网络接入层定义了数据如何通过介质物理传输，包括硬件地址、帧格式化和链路级的错误检测。

3. Application Layer Protocols | 应用层协议

The Application layer is where users interact with the network. Common protocols include HTTP (HyperText Transfer Protocol) used for retrieving web pages, typically on port 80. FTP (File Transfer Protocol) uses ports 20 and 21 to transfer files between client and server. SMTP (Simple Mail Transfer Protocol) on port 25 sends emails, while POP3 (port 110) and IMAP (port 143) are used for retrieving them.

应用层是用户与网络交互的地方。常见协议包括用于检索网页的 HTTP（超文本传输协议），通常使用端口 80。FTP（文件传输协议）使用端口 20 和 21 在客户端和服务器之间传输文件。SMTP（简单邮件传输协议）在端口 25 发送电子邮件，而 POP3（端口 110）和 IMAP（端口 143）用于接收邮件。

DNS (Domain Name System) translates human-readable domain names into IP addresses. It operates over UDP port 53 (and sometimes TCP for large responses). DHCP (Dynamic Host Configuration Protocol) dynamically assigns IP addresses, subnet masks, and default gateways to devices upon network connection, using UDP ports 67 and 68.

DNS（域名系统）将人类可读的域名转换为 IP 地址。它通过 UDP 端口 53（有时对大型响应使用 TCP）运行。DHCP（动态主机配置协议）在设备连接网络时动态分配 IP 地址、子网掩码和默认网关，使用 UDP 端口 67 和 68。

Questions often ask you to match a protocol with its function or well-known port, or to explain the role of these protocols in a given scenario, such as retrieving a web page or sending an email.

考题经常会要求你将协议与其功能或公认端口进行匹配，或在给定场景（如获取网页或发送电子邮件）中解释这些协议的作用。

4. Transport Layer: TCP vs UDP | 传输层：TCP 与 UDP

The Transport layer offers two main protocols: TCP and UDP. TCP is connection-oriented, meaning it establishes a virtual circuit before data transfer. It guarantees reliable delivery through acknowledgements, retransmissions, and sequence numbers. It also provides flow control and congestion control. This makes TCP ideal for applications where data integrity is critical, such as web browsing, email, and file transfers.

传输层提供两种主要协议：TCP 和 UDP。TCP 是面向连接的，即在数据传输之前先建立一条虚拟电路。它通过确认、重传和序列号保证可靠传输。它还提供流量控制和拥塞控制。这使得 TCP 非常适合数据完整性至关重要的应用，如网页浏览、电子邮件和文件传输。

UDP, on the other hand, is connectionless. It simply sends datagrams without any handshake or guarantee of delivery. There are no acknowledgements or retransmissions, making it much faster and with lower overhead. UDP is preferred for real-time applications like VoIP, video streaming, and online gaming, where speed is more important than occasional packet loss. It is also used by DNS and DHCP for simple query-response exchanges.

另一方面，UDP 是无连接的。它只是发送数据报，没有任何握手或交付保证。没有确认或重传，因此速度更快，开销更低。UDP 是 VoIP、视频流和在线游戏等实时应用的首选，在这些应用中，速度比偶尔的数据包丢失更重要。它还被 DNS 和 DHCP 用于简单的查询-响应交换。

A comparison table is useful for exams:

下表对考试很有用：

Feature / 特性	TCP	UDP
Connection / 连接	Connection-oriented / 面向连接	Connectionless / 无连接
Reliability / 可靠性	Reliable (acknowledgements) / 可靠（确认）	Unreliable, no guarantee / 不可靠，无保证
Speed / 速度	Slower / 较慢	Fast / 快速
Overhead / 开销	Higher (header 20-60 bytes) / 较高	Lower (header 8 bytes) / 较低
Flow control / 流量控制	Yes / 有	No / 无
Typical uses / 典型用途	HTTP, FTP, SMTP, SSH	DNS, DHCP, VoIP, streaming / 流媒体

5. TCP Three-Way Handshake | TCP 三次握手

Before TCP can send data, it must establish a connection using a three-way handshake. This process synchronises the sequence numbers between client and server, ensuring both are ready for reliable communication.

在 TCP 发送数据之前，它必须通过三次握手建立连接。此过程同步客户端和服务器之间的序列号，确保双方都为可靠通信做好准备。

Step 1: The client sends a SYN (synchronise) segment with an initial sequence number x. Step 2: The server replies with a SYN-ACK, acknowledging the client’s sequence number (ACK = x+1) and providing its own initial sequence number y. Step 3: The client sends an ACK back, acknowledging the server’s sequence number (ACK = y+1). After this, the connection is established and data transfer can begin.

步骤 1：客户端发送一个带有初始序列号 x 的 SYN（同步）段。步骤 2：服务器回复 SYN-ACK，确认客户端的序列号（ACK = x+1），并提供自己的初始序列号 y。步骤 3：客户端发回 ACK，确认服务器的序列号（ACK = y+1）。握手完成后，连接建立，可以开始传输数据。

Why three steps? Two-way handshakes can lead to half-open connections if ACKs are lost. The three-way design ensures both sides can confirm each other’s readiness. Examination questions frequently ask you to label or describe the states (SYN_SENT, SYN_RECEIVED, ESTABLISHED) or to calculate sequence and acknowledgement numbers.

为什么是三步？如果 ACK 丢失，两次握手可能会导致半开连接。三次设计确保双方都能确认对方的准备就绪。考试经常要求你标注或描述状态（SYN_SENT， SYN_RECEIVED， ESTABLISHED），或计算序列号和确认号。

6. TCP Four-Way Termination | TCP 四次挥手

Closing a TCP connection requires a four-way termination handshake because each direction of data flow must be shut down independently. This allows one side to stop sending while still receiving data, a state known as half-close.

关闭 TCP 连接需要四次挥手，因为每个方向的数据流都必须独立关闭。这允许一方停止发送而仍然接收数据，这种状态称为半关闭。

The process: First, the initiating side sends a FIN segment. The receiver replies with an ACK for that FIN, but may continue sending its own data. When it is ready to close, it sends its own FIN segment. The initiator then sends a final ACK and enters the TIME_WAIT state to ensure the remote side received the acknowledgement, typically waiting for double the maximum segment lifetime. After the timer expires, the connection is fully closed.

过程如下：首先，发起方发送一个 FIN 段。接收方回复对该 FIN 的 ACK，但可能继续发送自己的数据。当它准备好关闭时，它会发送自己的 FIN 段。然后发起方发送最后的 ACK，并进入 TIME_WAIT 状态，以确保远程端收到确认，通常等待两倍的最大段生存时间。计时器到期后，连接完全关闭。

Exam questions might ask you to compare the three-way handshake with the four-way termination, or to explain why the TIME_WAIT state is necessary (to ensure the last ACK is delivered and to prevent old segments from a previous connection being misinterpreted).

考题可能会要求你将三次握手与四次挥手进行比较，或解释为什么需要 TIME_WAIT 状态（确保最后 ACK 送达，并防止来自前一个连接的旧段被误解）。

7. Internet Layer and IP Addressing | 网际层与 IP 地址

The Internet layer’s core protocol is IP, responsible for logical addressing and packet routing. IPv4 addresses are 32-bit numbers, usually expressed in dotted-decimal notation like 192.168.1.1. They consist of a network portion and a host portion, determined by a subnet mask. The address space is divided into classes (A, B, C) and also includes private addresses (e.g., 10.x.x.x, 172.16-31.x.x, 192.168.x.x) that are not routable on the public Internet and are used with NAT.

网际层的核心协议是 IP，负责逻辑寻址和数据包路由。IPv4 地址是 32 位数字，通常用点分十进制表示，如 192.168.1.1。它们由网络部分和主机部分组成，由于子网掩码确定。地址空间被划分为类别（A、B、C类），还包括私有地址（如 10.x.x.x、172.16-31.x.x、192.168.x.x），这些地址在公共互联网上不可路由，与 NAT 一起使用。

With the exhaustion of IPv4 addresses, IPv6 was introduced. It uses 128-bit addresses, written as eight groups of four hexadecimal digits, offering an enormous address space. IPv6 also simplifies header structure and supports auto-configuration. Both versions coexist, and protocols like ICMP (used by ping and traceroute) operate at the Internet layer to report errors and diagnostics.

随着 IPv4 地址的耗尽，IPv6 被引入。它使用 128 位地址，表示为八组四位十六进制数字，提供了巨大的地址空间。IPv6 还简化了报头结构并支持自动配置。两个版本共存，而 ICMP（由 ping 和 traceroute 使用）等协议在网际层运行，用于报告错误和诊断。

Routing at this layer involves routers making forwarding decisions based on the destination IP address and a routing table. Understanding how a packet travels through different networks is a key skill for exam scenarios.

这一层的路由涉及路由器根据目标 IP 地址和路由表做出转发决策。理解数据包如何穿越不同网络是考试场景中的一项关键技能。

8. Data Encapsulation and Decapsulation | 数据封装与解封装

As data moves down the TCP/IP stack, each layer adds its own header (and sometimes a trailer) around the data received from the layer above. This process is called encapsulation. When the data arrives at the destination, each layer strips off the corresponding header—decapsulation—before passing it upward.

当数据沿 TCP/IP 协议栈向下移动时，每一层都会在从上层接收到的数据周围添加自己的头部（有时还有尾部）。这个过程称为封装。当数据到达目的地时，每一层在向上传递之前会剥去相应的头部——解封装。

At the Application layer, data is simply a stream. The Transport layer encapsulates it into a segment (TCP) or datagram (UDP) by adding a header containing source and destination port numbers. The Internet layer then adds an IP header to form a packet, specifying the source and destination IP addresses. Finally, the Network Access layer adds a frame header and trailer, including MAC addresses and an error-checking CRC, for transmission over the physical medium.

在应用层，数据只是一个流。传输层通过添加包含源端口和目的端口号的头部，将其封装为段（TCP）或数据报（UDP）。然后，网际层添加 IP 头部形成数据包，指定源 IP 地址和目的 IP 地址。最后，网络接入层添加帧头和帧尾，包括 MAC 地址和用于错误检查的 CRC，以便在物理介质上传输。

This layered encapsulation is often illustrated by the PDU (Protocol Data Unit) names: Segment at Transport, Packet at Internet, Frame at Network Access. Understanding the order in which headers are added or removed is a common exam question.

这种分层封装通常用 PDU（协议数据单元）名称来说明：传输层的段、网际层的包、网络接入层的帧。理解头部添加或移除的顺序是常见的考试问题。

9. Ports and Sockets | 端口与套接字

A port is a 16-bit integer (0-65535) used by the Transport layer to identify a specific process or service on a host. The combination of an IP address and a port number creates a socket, which provides the endpoint for communication. For example, a web server listens on 192.168.1.10:80, while a client might use 192.168.1.20:54321.

端口是一个 16 位整数（0-65535），传输层用它来标识主机上的特定进程或服务。IP 地址和端口号的组合创建了一个套接字，提供通信的端点。例如，Web 服务器监听 192.168.1.10:80，而客户端可能使用 192.168.1.20:54321。

Port numbers are divided into three ranges: Well-known ports (0-1023) are assigned by IANA for system services (e.g., HTTP:80, HTTPS:443, FTP:21). Registered ports (1024-49151) are for user applications. Dynamic or private ports (49152-65535) are used temporarily for client-side connections, often assigned randomly by the operating system.

端口号分为三个范围：知名端口（0-1023）由 IANA 分配给系统服务（例如 HTTP:80、HTTPS:443、FTP:21）。注册端口（1024-49151）用于用户应用程序。动态或私有端口（49152-65535）临时用于客户端连接，通常由操作系统随机分配。

The socket pair (source IP:source port, destination IP:destination port) uniquely identifies a TCP connection. This allows a server to handle multiple connections from different clients simultaneously. Exam questions may test your ability to identify well-known ports and explain how sockets distinguish between connections.

套接字对（源 IP:源端口，目的 IP:目的端口）唯一标识一个 TCP 连接。这使得服务器可以同时处理来自不同客户端的多个连接。考题可能会测试你识别知名端口并解释套接字如何区分连接的能力。

10. Error Detection and Flow Control | 差错检测与流量控制

TCP provides reliable data transfer through several mechanisms. Each segment includes a checksum field for error detection; the receiver verifies this checksum and discards corrupted segments, triggering a retransmission if no ACK is received. TCP also uses positive acknowledgements with retransmission (PAR) and cumulative ACKs to ensure all bytes arrive in order.

TCP 通过多种机制提供可靠的数据传输。每个段都包含一个用于错误检测的校验和字段；接收方验证此校验和并丢弃损坏的段，如果没有收到 ACK 则触发重传。TCP 还使用带重传的肯定确认（PAR）和累积 ACK 来确保所有字节按序到达。

Flow control is implemented using a sliding window protocol. The receiver advertises a window size in its ACK segments, telling the sender how many bytes it can accept without acknowledgement. This prevents a fast sender from overwhelming a slow receiver. Congestion control mechanisms, such as slow start and congestion avoidance, adjust the transmission rate based on network conditions.

流量控制使用滑动窗口协议实现。接收方在其 ACK 段中通告一个窗口大小，告诉发送方在不经确认的情况下可以接受多少字节。这可以防止快速的发送方压垮慢速的接收方。拥塞控制机制，如慢启动和拥塞避免，根据网络条件调整传输速率。

UDP offers an optional checksum but no native flow control or retransmission. When needed, application-layer protocols must implement their own reliability measures. The contrast between TCP’s extensive error control and UDP’s minimalism is a favourite topic for exam comparisons.

UDP 提供可选的校验和，但没有原生的流量控制或重传。需要时，应用层协议必须实现自己的可靠性措施。TCP 广泛的错误控制与 UDP 的极简主义之间的对比是考试中比较的常考话题。

11. Summary of Key Exam Points | 考点总结

When revising TCP/IP for the CCEA exam, focus on these high-value targets: memorise the four layers and the PDUs at each. Be able to compare TCP and UDP across multiple dimensions, and sketch or describe the three-way handshake and four-way termination with sequence/acknowledgement numbers. Know the purpose and port numbers of key application-layer protocols. Understand encapsulation: what header is added at each layer, and the role of IP addresses and MAC addresses during delivery. Practice translating between domain names, IP addresses, and socket identifiers.

在为 CCEA 考试复习 TCP/IP 时，请关注这些高分目标：记住四层模型及每层的 PDU。能够从多个维度比较 TCP 和 UDP，并画出或描述三次握手和四次挥手及其序列/确认号。了解关键应用层协议的目的和端口号。理解封装：每层添加什么头部，以及 IP 地址和 MAC 地址在传输中的作用。练习域名、IP 地址和套接字标识符之间的转换。

Scenario-based questions may ask you to trace the steps when a user types a URL into a browser, explaining how DNS, TCP, HTTP, and IP interact. Others may present a packet capture and ask you to interpret the flags (SYN, ACK, FIN) or calculate handshake values. Always connect concepts across layers, and you will be well prepared.

基于场景的问题可能会要求你追踪用户在浏览器中输入 URL 时的步骤，解释 DNS、TCP、HTTP 和 IP 如何交互。其他问题可能会呈现一个数据包捕获，要求你解释标志（SYN、ACK、FIN）或计算握手值。始终跨层连接概念，这样你就能做好充分准备。

Published by TutorHao | CCEA Computer Science Revision Series | aleveler.com

更多咨询请联系16621398022（同微信）

TCP/IP Exam Focus | TCP/IP 考点精讲