AP Subject A 16: Network Layers, TCP/UDP, and Ports

2026 exam basis · revised/sources checked 2026-10-21 · primary locale: Korean

Learning index

Scope/terms → OSI and TCP/IP → devices/encapsulation → TCP/UDP → ports/worked trace → five questions → review.

1. Official scope and terminology

This maps to IPA Ver.7.2, Major Category 3 / Middle Category 10 Network, PDF pp.47–49 / printed-footer pp.43–45: OSI layers, connection devices, TCP/IP roles, representative ports, ARP/IP/TCP/UDP. Detailed CIDR/subnet arithmetic and routing are deferred to AP17; detailed DNS, HTTP, TLS, and QUIC are deferred to later lessons.

KO	JA	EN	Role
물리 계층	物理層	physical layer	bits/signals
데이터 링크 계층	データリンク層	data-link layer	link frames/MAC
네트워크 계층	ネットワーク層	network layer	IP/routing
전송 계층	トランスポート層	transport layer	TCP/UDP/ports
캡슐화	カプセル化	encapsulation	wrap an upper PDU
흐름/혼잡 제어	フロー/輻輳制御	flow/congestion control	protect receiver/network

MAC identifies the local-link next-hop interface; IP identifies a routed endpoint/interface; a port distinguishes a transport/application endpoint within a host; a protocol identifier tells IP what upper protocol (TCP/UDP) follows. ARP resolves a next-hop IPv4 address to a MAC on the local link.

2. OSI seven layers and practical TCP/IP mapping

OSI	Role	TCP/IP 4-layer study mapping	Example
7 Application	user service	Application	HTTP, DNS
6 Presentation	representation	Application	encoding
5 Session	dialogue	Application	session
4 Transport	endpoint transport	Transport	TCP, UDP
3 Network	logical address/path	Internet	IP
2 Data link	link frame	Network access	Ethernet, MAC
1 Physical	bits/media	Network access	cable/radio

This is a practical study approximation, not an exact one-to-one standards equivalence. A layer uses the layer below and serves the layer above.

3. Devices and encapsulation

Device	Typical layer	Basis
repeater/hub	L1	regenerates/forwards signals or bits
bridge/L2 switch	L2	forwards frames by MAC
router/L3 switch	L3	chooses next hop by destination IP/routing table
gateway	context-dependent	default gateway is usually an L3 router; a protocol-conversion gateway may be higher-layer

Send order: application data → TCP segment or UDP datagram → IP packet → link frame → bits; reception de-encapsulates in reverse. When a router forwards between Ethernet-like links, the L2 header and next-hop MAC change, and IPv4 TTL or IPv6 Hop Limit decreases. End-to-end IPs normally remain, with NAT as an explicit exception.

4. TCP versus UDP

TCP starts with SYN → SYN-ACK → ACK and exposes a byte stream, not application message boundaries. Sequence numbers, acknowledgments, checksum error detection, retransmission, and reordering support reliability. The advertised receive window is flow control protecting the receiver. The congestion window, slow start, congestion avoidance, and loss signals are congestion control protecting the network.

UDP is connectionless and preserves datagram/message boundaries. It has a checksum field: zero means unused in IPv4, while IPv6 generally requires the checksum except for narrowly specified exceptions. A checksum detects corruption; it does not guarantee delivery or order. UDP has no built-in handshake, delivery/order/retransmission guarantee, flow control, or congestion control. UDP does not remove responsibility: the application/protocol must add required reliability and responsible congestion behavior.

5. Ports and one bidirectional trace

Service	Transport/port	Service	Transport/port
FTP data/control	TCP 20/21	SSH/Telnet	TCP 22/23
SMTP/DNS	TCP 25 / TCP·UDP 53	DHCP server/client	UDP 67/68
HTTP/POP3	TCP 80/110	NTP/IMAP	UDP 123 / TCP 143
SNMP	UDP 161/162	IANA https	TCP 443; UDP 443

These are IANA service registrations/default conventions—not proof of application identity or security. A server commonly listens on a service port; a client selects an ephemeral source port. IANA registers https on both TCP/443 and UDP/443. HTTP/3 runs over QUIC under RFC 9114 and commonly uses UDP/443, but the port alone does not identify that protocol. Mechanics are deferred.

Trace assumptions: client 192.0.2.10:51514 is on an IPv4 Ethernet LAN, 198.51.100.20:443 is outside its local subnet, the routing table selects the configured default gateway, and all routed links discussed in this trace are Ethernet-like. Under these conditions it opens TCP. Because it is remote, the client resolves and addresses the default gateway’s MAC, not the server’s MAC. The switch forwards by MAC. The router removes the frame, selects an IP route, decrements TTL, and re-encapsulates for the next link. The server replies 443 → 51514 with SYN-ACK; the client’s ACK completes the handshake. Return destination port is 51514. Per-hop L2 addresses change; without NAT the endpoint IP/port pair remains.

6. Five original questions

Q1

On IPv4 Ethernet, with the destination outside the local subnet and the default route selected, which is correct? ア A hub chooses IP routes. イ The host uses its default-gateway MAC and the router routes by destination IP. ウ A port identifies the link next hop. エ A gateway is always L1.

Answer: イ (2). ア Hub is L1. イ correctly joins device/address roles. ウ MAC identifies the link next hop. エ Gateway is context-dependent.

Q2

Which statement is correct for a routed hop between Ethernet-like links? ア Endpoint IPs must change each hop. イ TTL increases. ウ A router decrements TTL and re-encapsulates with next-link L2/MAC; without NAT endpoint IPs normally remain. エ A switch selects Internet routes by TCP port.

Answer: ウ (3). ア They normally remain. イ TTL decreases. ウ is correct. エ L2 switches forward by MAC.

Q3

Which TCP statement is correct? ア ACK makes checksum unnecessary. イ Receive window protects only the network. ウ cwnd is the receiver buffer size. エ Receive window protects the receiver; cwnd/slow start protect the network; sequence numbers, ACKs, and retransmission aid reliability.

Answer: エ (4). ア TCP also uses a checksum. イ It protects the receiver. ウ cwnd controls network congestion. エ separates reliability, flow, and congestion correctly.

Q4

Which UDP statement is correct? ア It is connectionless, preserves datagram boundaries, and higher protocols add needed reliability and responsible congestion behavior. イ It includes a three-way handshake and ordered delivery. ウ It is a boundaryless byte stream. エ UDP applications have no congestion responsibility.

Answer: ア (1). ア is correct. イ and ウ describe TCP. エ responsibility remains above UDP.

Q5

A client :51514 connects to remote TCP :443. Typical destination port of the server reply? ア 20 イ 51514 ウ 443 エ 68

Answer: イ (2). ア is FTP data. イ is the client ephemeral port. ウ is the server service port. エ is DHCP client.

Key: [2, 3, 4, 1, 2] = [イ, ウ, エ, ア, イ].

7. Quick sheet, traps, self-check, review

• Quick: MAC=present link, IP=route, port=endpoint inside host; de-encapsulate frame→packet→segment/datagram→data.
• Traps: a port proves neither identity nor encryption; do not reduce TCP/UDP to “slow/fast”; gateway layer depends on context.
• Self-check: recite seven layers; distinguish whom flow/congestion control protects; explain MAC, TTL, and return port in the trace.
• Day 1: recall tables. Day 3: redraw PDU and 51514↔443 trace. Day 7: retry questions and explain every distractor.

Official sources and notice

First-party sources, checked 2026-10-21: IPA syllabus Ver.7.2, IETF RFC 1122, RFC 9293 TCP, RFC 5681 TCP congestion control, RFC 768 UDP, RFC 8200 IPv6, RFC 9114 HTTP/3, IANA port registry.

Independent study material; not affiliated with IPA, IETF, or IANA. No past questions or third-party commentary were used. No pass guarantee.