Network protocols serve specific functions that make communication across systems reliable, structured, and efficient. This content covers the core functions protocols perform — including formatting, addressing, segmentation, error detection, and flow control — with real packet data examined in Wireshark to illustrate each concept.
Protocol Functions
Our protocols try to solve some sort of problem, or come up with some sort of solution. They're performing a function. Let's take a look at some of the common functions that our protocols help solve for.
There are lots of functions that protocols do, lots of things that they're trying to accomplish. The ones that I'm going to list out here are just highlights of what these protocols do. I don't expect you to become an expert at all of these by the end of this lesson. Really, the goal is to create a firm foundation that we can build off of.
We're going to talk about what formatting and encapsulation look like, and then I'm going to show it to you on Wireshark and see what it actually looks like. We'll also talk about addressing, and then we'll take a look in Wireshark at where the addresses are. Then we'll talk about segmentation and data sequencing and how we sequence these packets, and then I'm going to show you how that's done in Wireshark. We're going to establish end-to-end connectivity. We're going to talk about error detection and control. We'll talk about flow control. We'll get into prioritization. We'll also talk about delivery options and response timeout.
One thing our protocols do is define some sort of formatting and encapsulation. That is, the data that we have needs to arrive in certain formats for whatever is receiving it to be able to understand it. Also, just to send that data, we need things like addressing. We add information in the form of headers and trailers so that it can be routed to its destination.
I wanted to give you some perspective on what we're actually looking at when it comes to Wireshark. We're going to open up Wireshark and just capture some data with Wireshark so that we can take a look at it and see what it actually looks like when we're talking about these different elements. Don't get confused with all of this -- this is just to give you some perspective on what we're talking about. It's not my intention to get really deep into the weeds at this point in time.
Let's take a look at one of these packets and see what it looks like. I'm going to select this TLS version 1.2. I'm going to open up this last section right here, which is the data, the data that's actually being transferred back and forth. In fact, we see encrypted application data. Here's this actual string, the encrypted string of the data that's being transported back and forth.
The first thing I want to talk about is the formatting. This is the data right here, and there's other information that's added to it. We've got this: it says it's application data 23, TLS version 1.2 or 0303, and the length is 38. So what Wireshark is presenting here is that 23 is the actual data, 303 is the actual data, 38 is the actual data, and this string right here is the actual data. Wireshark translates for us. This 23 translates to application data. This 0303 translates to TLS version 1.2. And then 38 is just 38, and this encrypted string is just the encrypted string.
It knows that what it's going to receive first is whatever type of packet this is, and this is application data. So the content type is what it knows that it receives first, so it's labeling this as being the content type. It's labeling this as being the version. It's labeling this as being the length. It's labeling this as being encrypted application data. It's labeling that because it's an already predefined format, so Wireshark knows that is the format.
If you want further proof of this, what we could do is go to View and say Bytes and expand this out so we can actually see the bytes. Let's click 38 right here. So 38 -- it's showing you the actual bytes that were sent over. So all zeros, which is just zero, and then there's a one for the 32 right here. So that's 32, plus a one for the four, so that's 36, and plus a one for the two, so that's 38. So what we actually see is the binary form of what this data is telling us over here.
We can do the same thing here. This says 303. This is 1 -- one is the binary equivalent of three -- and so we see 33 right there. So everything is adding up so far. That is the formatting of this, and the delivery from a format perspective.
Now let's talk about encapsulation, because we've got the actual data that we sent right here, but it's being encapsulated by this TLS version 1.2. This is additional information that's added to it so it knows how to read this data.
We also see this transmission control protocol. That's an additional level of encapsulation that happens to this, because it needs to be delivered, so we see information in there. Here's internet protocol, so that's an additional encapsulation that happens to this packet so it can be delivered. Then we see Ethernet 2 -- that's an additional encapsulation that's added to it. And then the frame, so that's an additional one. So in total we have one, two, three, four, five different encapsulations essentially that happen to this to deliver this data right here.
Many of our protocols add some sort of addressing. For instance, we need addressing to happen on a local level, so that's what one layer does. We also need to have addressing on a global scale, and that's what another layer does. There are also the different ports, so it can address which service it's attached to, and that's a level of addressing in itself.
So what does addressing look like? Number one, we have the local addressing. I can open up this Ethernet 2 and see that there's a source and destination MAC address. This is the MAC address right here, and this is what Wireshark is translating for us and saying, well, this is a Dell on here and this is MicroStar -- so whoever registered these MAC addresses. That is the local addressing there.
I can also look at the internet protocol level right here and scroll down to see the IP addresses within here. So these are the two IP addresses, the source and the destination IP address. We've got addressing there. And we also see the ports in here, so we've got a source port and a destination port. So we have addressing on multiple levels with multiple protocols.
Here we also have segmentation, that is, we need to break up big messages or big downloads into smaller messages so that they can be better transported and received. Since we're breaking this down into smaller segments, we also need some sort of sequencing. These packets could arrive in different orders. They could even take altogether different routes to get to the end destination. Because of that, this machine needs to know how to reassemble the data. So somehow we need to label this data so that when it gets to the other side, this machine knows how to put it back together.
Sequencing can happen on multiple levels, but for this particular one, the best example of this would be this sequence number right here. So this packet is 8,523. That is the sequence number of this particular packet.
Another thing some of these protocols do is establish or end a connection. Before the data is sent between these two devices, maybe what needs to happen is a connection needs to be made first. This could even be a back and forth that happens to say, "Hello, I'm going to talk with you," and, "Okay, yes, let's talk." So there will be some initial messages that are exchanged before the bulk of the data is exchanged, and then once the bulk of the data has finished exchanging, some sort of end connection to disconnect these two devices.
We can see this packet by packet -- there are multiple packets that get exchanged here. In this example right here, we're going to take a look at the communication between this device and some other device. What we see is that the first communication that happens is a SYN, like, hey, let's talk. Then there's a SYN acknowledgement that comes back, and then there's an acknowledgement. This is a three-way handshake to set up the connection, and then we connect to the website. Then to terminate this connection at the end, there's this finish that happens at the end to break the connection back down.
There are a couple of things that can happen with our communication as well. Perhaps a packet gets lost along the way and never reaches its final destination, or maybe a packet ends up getting there but it's corrupted and the data is no longer good. So we need some sort of error detection, and we actually have multiple mechanisms that do error detection within our protocols.
Error detection happens on multiple levels. We see it at the Ethernet level, and we can see it at the IP level. If I open up this right here, we see this header checksum. The header checksum is something that can identify if something's changed along the way. It's like a simple little thumbprint to make sure that nothing has changed.
There's also, in this transmission control protocol, this acknowledgement number, which allows some error detection as well. I'm not going to get into the details of how that works -- it's a little more complicated, and I'll have to create a whole video just for that. But that is how there's going to be error detection at multiple levels here.
Another thing that we need to think about is some sort of flow control, some way to meter the connection, or how much data is flowing back and forth. For instance, let's say this machine right here is sending a bunch of data to this machine right here. There could be a spot in the network that's getting congested and stacked up. Sending more data along the line only compounds this issue and causes more of a problem. So there needs to be some mechanism in place that allows this device to throttle how much information is being sent, limiting how much information is being sent so that we avoid any kind of congestion like this and making things worse.
Here again, there are several mechanisms for flow control at these different levels. But one thing that I will show you in the transmission control protocol: these acknowledgements that are sent back and forth, and these acknowledgement numbers, are something that can help with flow control. We also have something called window scaling, so this window size right here can help with flow control as well. Here again, I'm not going to get into the details of that -- that's a little more complicated -- but that's where we would find some of those elements within these different protocols.
Another thing to consider is prioritization of the different information that's flowing across your network. For instance, if we have just regular data that's flowing back and forth, the time sensitivity is probably not as great. If you're visiting a website, we want that website to be responsive, but it's not as critical as if you're streaming audio or video, or even more importantly, if you have some sort of voice over IP system, some sort of phone system that's going across this connection here. You really don't want any delays with it, because it could really lead to a very poor experience. So we need to prioritize those packets accordingly.
Prioritization of packets can be a little more difficult. For instance, we might identify certain components -- maybe the protocol that's being used by the port numbers here -- and maybe we prioritize based off of that. Although a lot of it is based off of QoS settings, in which case we would do it at the IP level and we'd have to implement some options to do that. For true prioritization, what we really have to do is take additional steps to set that up on our network, and then we incorporate it into our protocols here.
We also need some sort of response timeout. There are times when things go down on the network and so traffic is never going to get to the machine, and if it's waiting forever, that's going to be a problem. So there is some sort of timeout timer that starts, and when it counts down, perhaps it just gives up, or maybe it tries to do a retry and see if it can get that information again.
There are so many other options as well. Some of our protocols allow for additional options to be attached to these messages and sent across, and that looks very different depending on which protocol you're working with. But there are different message options that can be added to this communication.
TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.
Explore free tools and programs →