TCP/IP Data Format: From Ethernet Frame to TCP Segment

TCP/IP is the protocol family used by Ethernet devices, PLCs, HMIs, SCADA systems, gateways, web servers, computers, and many embedded products. When a device sends data over a network, the data is not sent alone. It is wrapped with several headers that describe where the data must go, how it should be delivered, and how the receiver can verify it.

The important idea is encapsulation. Each layer adds its own header around the data from the layer above it. On receive, the headers are removed in the opposite order.

Application Data
  -> TCP Segment
    -> IP Packet
      -> Ethernet Frame

Where TCP/IP Fits

TCP/IP is usually explained as layers. For most practical debugging, the following view is enough:

Layer	Protocol example	Main job	Addressing
Application	HTTP, Modbus TCP, MQTT, DNS	Defines the meaning of the payload	Application-specific
Transport	TCP or UDP	Uses ports and manages communication between processes	Port number
Internet	IPv4 or IPv6	Routes packets between networks	IP address
Link	Ethernet	Moves frames on the local network	MAC address

Ethernet Frame Format

Ethernet is the local network format. It moves data between devices on the same physical or switched network. Ethernet uses MAC addresses, not IP addresses.

Destination MAC | Source MAC | EtherType | Payload | FCS
    6 bytes     |  6 bytes   |  2 bytes  | 46-1500 | 4 bytes

Field	Size	Description
Destination MAC	6 bytes	MAC address of the next device that should receive the frame.
Source MAC	6 bytes	MAC address of the sender on the local network.
EtherType	2 bytes	`0x0800` means IPv4, `0x86DD` means IPv6, and `0x0806` means ARP.
Payload	46 to 1500 bytes	Usually an IP packet. Padding is added if the payload is too short.
FCS	4 bytes	Frame check sequence used by Ethernet hardware to detect errors.

The normal Ethernet MTU is 1500 bytes. This means the Ethernet payload can carry up to 1500 bytes of IP packet data unless jumbo frames are used.

IPv4 Packet Format

IP is responsible for moving packets from one IP address to another. Routers look at the IP header to decide where the packet should go next.

IPv4 Header | IP Payload
20-60 bytes | TCP, UDP, ICMP, or another protocol

IPv4 field	Size	Purpose
Version	4 bits	For IPv4, this value is `4`.
IHL	4 bits	Internet Header Length. Minimum value is `5`, meaning 20 bytes.
DSCP/ECN	1 byte	Quality of service and congestion notification information.
Total Length	2 bytes	Complete IP packet length, including IP header and payload.
Identification, Flags, Fragment Offset	4 bytes	Used when an IP packet is fragmented into smaller pieces.
TTL	1 byte	Time to live. Each router decreases it. When it reaches zero, the packet is discarded.
Protocol	1 byte	`6` means TCP, `17` means UDP, and `1` means ICMP.
Header Checksum	2 bytes	Error check for the IPv4 header only, not the payload.
Source IP	4 bytes	IPv4 address of the sender.
Destination IP	4 bytes	IPv4 address of the receiver.
Options	0 to 40 bytes	Optional fields. Most normal packets do not use them.

TCP Segment Format

TCP provides reliable byte-stream communication. It uses sequence numbers, acknowledgements, retransmission, flow control, and flags. Protocols such as HTTP, HTTPS, Modbus TCP, SSH, and MQTT commonly use TCP.

TCP Header | TCP Payload
20-60 bytes | Application data

TCP field	Size	Purpose
Source Port	2 bytes	Port number used by the sender process.
Destination Port	2 bytes	Port number used by the receiver process.
Sequence Number	4 bytes	Position of the first byte in this segment within the TCP byte stream.
Acknowledgement Number	4 bytes	Next byte expected from the other side when ACK is set.
Data Offset	4 bits	TCP header length. Minimum value is `5`, meaning 20 bytes.
Flags	9 bits	Control bits such as SYN, ACK, FIN, RST, PSH, and URG.
Window Size	2 bytes	How many bytes the sender of this segment is ready to receive.
Checksum	2 bytes	Error check for TCP header, payload, and parts of the IP header.
Urgent Pointer	2 bytes	Used only when urgent data is indicated.
Options	0 to 40 bytes	Used for features such as maximum segment size and window scaling.

Common TCP Flags

SYN: Starts a TCP connection and synchronizes sequence numbers.
ACK: Confirms that data or a connection step was received.
FIN: Gracefully closes one direction of the connection.
RST: Immediately resets the connection, usually because something is wrong or closed.
PSH: Asks the receiver to deliver data to the application quickly.

TCP Three-Way Handshake

Before application data is sent with TCP, the two devices create a connection. This is the three-way handshake:

Client -> Server : SYN
Server -> Client : SYN, ACK
Client -> Server : ACK

After this, both sides know the initial sequence numbers and can start exchanging application data reliably.

UDP Datagram Format

UDP is simpler than TCP. It does not create a connection, does not retransmit lost data, and does not guarantee order. It is useful for DNS, DHCP, discovery protocols, some real-time streams, and systems where the application handles reliability itself.

Source Port | Destination Port | Length | Checksum | Data
  2 bytes   |     2 bytes      |2 bytes | 2 bytes  | variable

UDP has only an 8-byte header. This makes it lightweight, but the application must tolerate loss, duplicates, and reordering if they matter.

Byte Order

TCP/IP headers use network byte order, which means big endian. Multi-byte values are sent with the most significant byte first.

Port 502 decimal = 0x01F6
Bytes on the wire = 01 F6

This matters when you inspect packets, build headers manually, or parse network data on a little-endian microcontroller.

Ports and Sockets

An IP address identifies a device or interface. A port identifies the application service inside that device. Together, IP address, transport protocol, and port form a socket endpoint.

Port	Protocol	Typical service
`80`	TCP	HTTP
`443`	TCP	HTTPS
`502`	TCP	Modbus TCP
`53`	UDP or TCP	DNS
`1883`	TCP	MQTT

Example Packet

Suppose a PC sends a Modbus TCP request to a PLC. The application data is the Modbus TCP message. TCP adds source and destination ports. IP adds source and destination IP addresses. Ethernet adds source and destination MAC addresses.

Ethernet:
  Destination MAC = PLC MAC
  Source MAC      = PC MAC
  EtherType       = 0x0800 (IPv4)

IPv4:
  Source IP       = 192.168.1.20
  Destination IP  = 192.168.1.10
  Protocol        = 6 (TCP)

TCP:
  Source Port     = 49152
  Destination Port= 502
  Flags           = PSH, ACK

Application:
  Modbus TCP request payload

If you capture this in Wireshark, you will see the same layers expanded in order: Ethernet, IPv4, TCP, then the application protocol.

MTU, MSS, and Payload Size

With a normal Ethernet MTU of 1500 bytes, the largest IPv4 packet payload is smaller because the IP header takes space. If the IPv4 header is 20 bytes and the TCP header is 20 bytes, the maximum TCP payload is normally 1460 bytes.

Ethernet MTU        = 1500 bytes
IPv4 header         =   20 bytes
TCP header          =   20 bytes
TCP payload / MSS   = 1460 bytes

MSS means Maximum Segment Size. It is the largest TCP payload that can be sent in one TCP segment without IP fragmentation on that path.

What Usually Goes Wrong

Confusing MAC addresses with IP addresses. MAC is local-link addressing; IP is network addressing.
Using the wrong port number, especially with industrial devices that support multiple services.
Forgetting that TCP is a stream, not a message protocol. One application message may arrive split or combined with another.
Assuming UDP delivery is guaranteed. UDP packets can be lost, duplicated, or received out of order.
Ignoring network byte order when parsing multi-byte fields.
Sending packets larger than the path MTU and causing fragmentation or dropped traffic.
Filtering only by IP address during debugging and missing that the problem is actually TCP flags, ports, or handshake state.

Conclusion

TCP/IP data format is easier to understand when you follow the encapsulation path. Application data becomes a TCP segment or UDP datagram. That becomes an IP packet. The IP packet becomes an Ethernet frame on the local network.

In practical debugging, always check the layers in order: link layer, IP addressing, transport protocol, port number, and finally the application payload. This method makes packet captures much easier to read and helps separate wiring, routing, firewall, socket, and application problems.