TCP/IP Key Points for WJEC Computer Science | TCP/IP 考点精讲

📚 TCP/IP Key Points for WJEC Computer Science | TCP/IP 考点精讲

The TCP/IP protocol suite is the foundation of modern networking, enabling billions of devices to communicate across the internet. For WJEC A-Level Computer Science, you must understand its four-layer architecture, core protocols, addressing mechanisms, and the processes that ensure reliable data transmission. This article breaks down every essential concept, from the three-way handshake to DNS resolution, with clear explanations and practical examples tailored to the specification.

TCP/IP 协议族是现代网络的基石，支撑着数十亿设备在互联网上通信。在 WJEC A-Level 计算机科学中，你需要掌握其四层架构、核心协议、寻址机制以及确保可靠数据传输的过程。本文从三次握手到域名解析，逐项解析每个核心概念，配以清晰说明和贴合考纲的实例，帮助你系统掌握考点。

1. The TCP/IP Model and Its Four Layers | TCP/IP 模型与四层结构

The TCP/IP model organises network communication into four abstraction layers: Application, Transport, Internet, and Link (Network Access). Unlike the OSI model, TCP/IP groups functions into a more pragmatic stack, directly reflecting real-world implementation.

TCP/IP 模型将网络通信划分为四个抽象层：应用层、传输层、网际层和链路层（网络接入层）。与 OSI 模型不同，TCP/IP 将功能整合到更实用的分层结构中，直接反映了现实世界的实现方式。

Each layer provides specific services to the layer above, using protocols tailored to its function. When sending data, headers are added at each layer (encapsulation); upon receipt, corresponding headers are removed (de-encapsulation).

每一层都向上层提供特定服务，并使用适合其功能的协议。发送数据时，每一层都会添加报头（封装）；接收时，对应的报头会被移除（解封装）。

Application Layer: Handles high-level protocols such as HTTP, FTP, SMTP, DNS, and DHCP. It provides services directly to user applications.
应用层：处理 HTTP、FTP、SMTP、DNS、DHCP 等高层协议，直接为应用程序提供服务。
Transport Layer: Establishes host-to-host communication. TCP provides reliable, connection-oriented delivery, while UDP offers connectionless, low-latency transmission.
传输层：建立主机到主机的通信。TCP 提供可靠的面向连接传输，UDP 提供无连接的低延迟传输。
Internet Layer: Routes packets across networks using IP (IPv4/IPv6). It handles logical addressing and fragmentation/reassembly.
网际层：使用 IP（IPv4/IPv6）跨网络路由数据包，负责逻辑寻址和分片/重组。
Link Layer: Controls the physical hardware and local network communication, dealing with MAC addresses and frame transmission.
链路层：控制物理硬件及本地网络通信，处理 MAC 地址和帧传输。

2. IP Addressing and Subnetting | IP 地址与子网划分

An IP address is a logical identifier assigned to each device on a TCP/IP network. IPv4 uses 32-bit addresses written in dotted decimal notation (e.g., 192.168.1.10), while IPv6 uses 128-bit addresses in hexadecimal (e.g., 2001:0db8:85a3::8a2e:0370:7334).

IP 地址是分配给 TCP/IP 网络中每台设备的逻辑标识符。IPv4 使用 32 位地址，以点分十进制表示（如 192.168.1.10）；IPv6 使用 128 位地址，以十六进制表示（如 2001:0db8:85a3::8a2e:0370:7334）。

A subnet mask distinguishes the network portion from the host portion of an IPv4 address. For example, 255.255.255.0 means the first three octets define the network, leaving the last octet for 254 usable host addresses.

子网掩码用于区分 IPv4 地址中的网络部分和主机部分。例如，255.255.255.0 表示前三个字节定义网络，最后一个字节可容纳 254 个可用主机地址。

IP Address	Subnet Mask	Network ID
192.168.5.37	255.255.255.0	192.168.5.0
10.0.12.45	255.255.255.128	10.0.12.0 (routable range .1–.126)

Classless Inter-Domain Routing (CIDR) notation abbreviates the mask: 192.168.5.0/24 indicates a 24-bit network prefix. In exams, you may be asked to calculate the number of subnets or hosts given a CIDR suffix.

无类别域间路由（CIDR）记法可缩写掩码：192.168.5.0/24 表示网络前缀为 24 位。考试中可能要求根据 CIDR 后缀计算子网数或主机数。

3. MAC Addresses and ARP | MAC 地址与 ARP

A MAC (Media Access Control) address is a unique 48-bit identifier burned into a NIC by the manufacturer. It is used at the Link Layer for communication within the same local network.

MAC（媒体访问控制）地址是制造商烧录到网卡的唯一 48 位标识符，用于链路层在同一本地网络内通信。

The Address Resolution Protocol (ARP) maps an IP address to its corresponding MAC address. A device broadcasts an ARP request (“Who has 192.168.1.5? Tell 192.168.1.3”), and the owner replies with its MAC. ARP caches reduce future broadcasts.

地址解析协议（ARP）将 IP 地址映射为对应的 MAC 地址。设备广播 ARP 请求（“谁有 192.168.1.5？请告诉 192.168.1.3”），拥有者回复其 MAC 地址。ARP 缓存可减少后续广播。

IPv6 replaces ARP with Neighbor Discovery Protocol (NDP), which uses ICMPv6 messages for similar functions.

IPv6 用邻居发现协议（NDP）取代 ARP，使用 ICMPv6 报文实现类似功能。

4. The Internet Protocol (IP) and Routing | IP 协议与路由

IP is a connectionless, best-effort delivery protocol. It does not guarantee delivery or ordering – higher layers (e.g., TCP) handle reliability if needed.

IP 是一种无连接的尽力投递协议，不保证送达或顺序——如需可靠性则由高层（如 TCP）处理。

Each IP packet contains a header with source and destination addresses, a time-to-live (TTL) counter to prevent infinite loops, and a protocol field indicating the encapsulated transport protocol (e.g., 6 for TCP, 17 for UDP).

每个 IP 数据包都包含源地址和目的地址、用于防止无限循环的生存时间（TTL）计数器，以及一个指示封装传输协议的协议字段（如 6 代表 TCP，17 代表 UDP）。

Routers use routing tables to determine the next hop for each packet. A default gateway handles traffic destined for outside the local network. Routing can be static or dynamic (using protocols like OSPF, BGP).

路由器根据路由表确定每个数据包的下一跳。默认网关处理发往本地网络之外的流量。路由可以是静态的，也可以是动态的（使用 OSPF、BGP 等协议）。

5. TCP: Connection-Oriented Reliability | TCP：面向连接的可靠性

Transmission Control Protocol (TCP) ensures reliable data delivery through sequence numbers, acknowledgements, flow control, and error checking. It establishes a virtual connection before data transfer using the three-way handshake.

传输控制协议（TCP）通过序列号、确认、流量控制和差错检测确保可靠的数据传输。它在数据传输前通过三次握手建立虚拟连接。

Sequence numbers allow the receiver to reassemble out-of-order segments, while the sliding window mechanism controls the amount of unacknowledged data that can be in flight, preventing overwhelming the receiver.

序列号使接收方能够重组乱序的报文段，而滑动窗口机制则控制传输中未确认数据的数量，避免接收方过载。

6. The TCP Three-Way Handshake | TCP 三次握手

The handshake initialises a TCP connection. Steps:

三次握手初始化 TCP 连接，步骤如下：

SYN: Client sends a segment with the SYN flag set and a random initial sequence number (ISN = x).
SYN：客户端发送一个设置了 SYN 标志的报文段，并附上随机初始序列号（ISN = x）。
SYN-ACK: Server replies with both SYN and ACK flags set, acknowledging x+1 and providing its own ISN = y.
SYN-ACK：服务器回复同时设置了 SYN 和 ACK 标志的报文段，确认号为 x+1，并提供自己的 ISN = y。
ACK: Client sends an ACK segment acknowledging y+1. Connection is now ESTABLISHED.
ACK：客户端发送 ACK 报文段，确认号为 y+1。此时连接进入 ESTABLISHED 状态。

This exchange synchronises sequence numbers needed for reliable data transfer. A similar four-way FIN/ACK process is used to gracefully close the connection.

此交换同步了可靠传输所需的序列号。关闭连接时采用类似的四次 FIN/ACK 过程。

7. UDP: Lightweight, Connectionless Transport | UDP：轻量级无连接传输

User Datagram Protocol (UDP) sends datagrams without establishing a connection, offering no guarantee of delivery, order, or duplication prevention. Its 8-byte header contains only source port, destination port, length, and checksum.

用户数据报协议（UDP）无需建立连接即可发送数据报，不保证送达、顺序或防止重复。其 8 字节头部仅包含源端口、目的端口、长度和校验和。

UDP is ideal for real-time applications where speed matters more than perfect reliability: VoIP, online gaming, video streaming, and DNS queries. The lack of overhead reduces latency.

UDP 非常适合对速度要求高于完美可靠性的实时应用：VoIP、在线游戏、视频流和 DNS 查询。无额外开销降低了延迟。

Feature	TCP	UDP
Connection	Connection-oriented	Connectionless
Reliability	Guaranteed via ACKs	No guarantee
Speed	Slower (overhead)	Faster (minimal overhead)
Use cases	Web browsing, email, file transfer	Streaming, gaming, DNS

8. Ports and Socket Communication | 端口与套接字通信

A port number identifies a specific process or service on a host, allowing multiplexing of multiple connections over a single IP address. A socket is the combination of an IP address and a port number (e.g., 192.168.1.10:80).

端口号用于标识主机上的特定进程或服务，允许多个连接通过一个 IP 地址进行复用。套接字是 IP 地址和端口号的组合（如 192.168.1.10:80）。

Well-known port numbers (0–1023) are reserved for standard services: HTTP uses TCP port 80, HTTPS port 443, FTP ports 20/21, SMTP port 25, DNS UDP port 53. Ephemeral ports (49152–65535) are assigned dynamically to client processes.

公认端口号（0–1023）保留给标准服务：HTTP 使用 TCP 端口 80，HTTPS 端口 443，FTP 端口 20/21，SMTP 端口 25，DNS UDP 端口 53。临时端口（49152–65535）动态分配给客户端进程。

9. DNS: The Internet’s Phone Book | DNS：互联网的电话簿

The Domain Name System translates human-readable domain names (www.example.com) into IP addresses. It is hierarchical and distributed, ensuring scalability.

域名系统将人类可读的域名（www.example.com）转换为 IP 地址。它采用分层和分布式结构，确保了可扩展性。

A DNS resolver typically queries root servers, then Top-Level Domain (TLD) servers (.com), and finally authoritative nameservers for the specific domain. Caching at each level speeds up repeated lookups.

DNS 解析器通常先查询根服务器，然后是顶级域（TLD）服务器（.com），最后查询该域名的权威名称服务器。各层缓存可加速重复查询。

DNS primarily uses UDP for speed, but can fall back to TCP if responses exceed 512 bytes or for zone transfers. In the exam, know how to interpret a simple DNS hierarchy and identify A records (IPv4) and AAAA records (IPv6).

DNS 主要使用 UDP 以提高速度，但如果响应超过 512 字节或进行区域传输时可能会回退到 TCP。考试中，应能解释简单的 DNS 层次结构，并识别 A 记录（IPv4）和 AAAA 记录（IPv6）。

10. DHCP: Automatic IP Configuration | DHCP：自动 IP 配置

Dynamic Host Configuration Protocol (DHCP) automates the assignment of IP addresses, subnet masks, default gateways, and DNS servers to client devices. It operates on a lease basis, reclaiming addresses when a lease expires.

动态主机配置协议（DHCP）可自动为客户端设备分配 IP 地址、子网掩码、默认网关和 DNS 服务器。它采用租约方式，当租约到期时会将地址收回。

The DHCP process uses four broadcasts: DISCOVER, OFFER, REQUEST, and ACK (DORA). Clients broadcast a DISCOVER, the server responds with an OFFER containing an available IP, the client REQUESTs it, and the server ACKnowledges.

DHCP 过程通过四次广播完成：DISCOVER、OFFER、REQUEST 和 ACK（DORA）。客户端广播 DISCOVER，服务器用 OFFER 回复一个可用 IP，客户端 REQUEST 申请该 IP，服务器 ACK 确认。

If no DHCP server is available, a client may assign itself an Automatic Private IP Address (APIPA) in the 169.254.x.x range, enabling limited local communication.

如果没有可用的 DHCP 服务器，客户端可能会给自己分配一个 169.254.x.x 范围内的自动专用 IP 地址（APIPA），从而实现有限的本地通信。

11. Network Address Translation (NAT) and Port Forwarding | NAT 与端口转发

NAT allows multiple devices on a private network (using private IPv4 addresses like 192.168.x.x) to share a single public IP address. The router maintains a translation table, mapping internal private IP:port to an external public IP:port.

NAT 允许多个使用私有 IPv4 地址（如 192.168.x.x）的设备共享一个公网 IP 地址。路由器维护一个转换表，将内部私有 IP:端口映射到外部公网 IP:端口。

Port forwarding (static NAT) permanently maps a specific external port to an internal IP and port, enabling external access to an internal server (e.g., a web server behind a router).

端口转发（静态 NAT）将特定外部端口永久映射到内部 IP 和端口，使外部能够访问内部服务器（如路由器后面的 Web 服务器）。

12. Common Application Layer Protocols in TCP/IP | TCP/IP 中常见应用层协议

WJEC expects familiarity with key application-layer protocols and their transport bindings:

WJEC 期望你熟悉关键的应用层协议及其传输层绑定：

HTTP/HTTPS: Hypertext Transfer Protocol (Secure) – TCP ports 80 and 443. HTTPS uses TLS/SSL encryption underneath.
HTTP/HTTPS：超文本传输协议（安全版）——TCP 端口 80 和 443。HTTPS 底层使用 TLS/SSL 加密。
FTP: File Transfer Protocol – TCP ports 20 (data) and 21 (control). Transfers files between client and server.
FTP：文件传输协议——TCP 端口 20（数据）和 21（控制），用于在客户端和服务器之间传输文件。
SMTP: Simple Mail Transfer Protocol – TCP port 25. Used to send emails between mail servers.
SMTP：简单邮件传输协议——TCP 端口 25，用于在邮件服务器之间发送电子邮件。
POP3/IMAP: Post Office Protocol 3 / Internet Message Access Protocol – TCP ports 110 and 143 respectively. Retrieve emails from a server.
POP3/IMAP：邮局协议 3 / 互联网消息访问协议——分别使用 TCP 端口 110 和 143，用于从服务器检索电子邮件。
SSH: Secure Shell – TCP port 22, provides encrypted remote administration.
SSH：安全外壳协议——TCP 端口 22，提供加密的远程管理。

13. Security Considerations at Each Layer | 各层的安全考量

Security is integrated into the TCP/IP stack. At the link layer, MAC filtering can restrict access. Network layer firewalls filter IP packets based on rules, while Transport layer security (TLS) encrypts TCP sessions (e.g., HTTPS).

安全性已被集成到 TCP/IP 协议栈中。在链路层，MAC 地址过滤可限制访问。网络层防火墙根据规则过滤 IP 数据包，而传输层安全协议（TLS）则加密 TCP 会话（如 HTTPS）。

Application layer protocols like DNSSEC add authentication to DNS responses, preventing cache poisoning. Understanding the location of security mechanisms helps you evaluate risks in a network stack.

应用层协议如 DNSSEC 为 DNS 响应添加身份验证，防止缓存投毒。理解安全机制在协议栈中的位置有助于评估网络风险。

Common attacks target TCP/IP weaknesses: SYN flood (exploits three-way handshake), IP spoofing, ARP spoofing, and DNS cache poisoning. Mitigations include rate limiting, ingress filtering, and mutual authentication.

常见攻击利用 TCP/IP 弱点：SYN 泛洪（利用三次握手）、IP 欺骗、ARP 欺骗和 DNS 缓存投毒。缓解措施包括速率限制、入口过滤和双向认证。

14. Exam-Style Application: Tracing a Web Request | 考题应用：跟踪一次 Web 请求

Given a scenario like typing a URL, you should trace the entire TCP/IP stack: DNS resolution (UDP/53) to get the IP; TCP three-way handshake to establish a connection to the server’s port 80 or 443; HTTP GET request and response; packet routing via IP; and frame delivery via MAC addresses on the local link. This end-to-end understanding is frequently tested.

对于输入 URL 这样的场景，你应能追踪整个 TCP/IP 协议栈：DNS 解析（UDP/53）获取 IP；TCP 三次握手建立与服务器端口 80 或 443 的连接；HTTP GET 请求与响应；数据包通过 IP 路由；以及在本地链路上通过 MAC 地址进行帧传输。这种端到端的理解经常会被考察。

Be prepared to identify which layer is responsible for what, and what headers are added as data moves down the stack.

做好准备指出每一层负责什么，并明确数据向下传递时添加了哪些报头。

Published by TutorHao | Computer Science Revision Series | aleveler.com

更多咨询请联系16621398022（同微信）

TCP/IP Key Points for WJEC Computer Science | TCP/IP 考点精讲