A socket is not a network protocol or wire format—it is an operating system abstraction (API handle) that user-space software uses to communicate with the kernel's network subsystem.
In terms of how data flows down the stack, the hierarchy is structured into distinct layers:
┌─────────────────────────────────────────────────────────────┐
│ Layer 7: Application (HTTP/1.1, HTTP/2, Postgres, SSH) │
│ └─ Cryptography / Security: TLS (Transport Layer Security)│
├─────────────────────────────────────────────────────────────┤
│ User / Kernel Boundary: Sockets API (File Descriptor / fd) │
├─────────────────────────────────────────────────────────────┤
│ Layer 4: Transport (TCP, UDP) │
├─────────────────────────────────────────────────────────────┤
│ Layer 3: Network / Internet (IPv4, IPv6, ICMP) │
├─────────────────────────────────────────────────────────────┤
│ Layer 2: Data Link (Ethernet, Wi-Fi, MAC addresses, ARP) │
├─────────────────────────────────────────────────────────────┤
│ Layer 1: Physical (Fiber, Copper, Radio Waves, Bits) │
└─────────────────────────────────────────────────────────────┘
Layer 7: Application Layer
This is where your program's raw business protocol lives (e.g., GET /index.html, database wire formats like the PostgreSQL frontend/backend protocol, or gRPC serialization).
The Security Layer: TLS
TLS conceptually sits between the Application layer and the Transport layer.
- In user space, TLS acts as an encryption/decryption filter.
- Your application passes plaintext bytes (e.g., HTTP requests) to a TLS library (OpenSSL, BoringSSL, Rustls).
- The TLS library encrypts the payload into TLS Records (using symmetric ciphers like AES-GCM) and attaches authentication tags.
- Note on modern kernels: Features like kTLS (Kernel TLS) offload this encryption down into the OS kernel, but the protocol relationship remains identical: TLS encrypts the payload before TCP segments it.
The Boundary: Sockets API
The socket is the bridge between user-space applications and the kernel's network stack:
- In POSIX systems, calling
socket(AF_INET, SOCK_STREAM, 0)returns an integer file descriptor. - When your app writes TLS records to this socket (
write(fd, ...)) or reads from it, the OS kernel buffers the bytes and hands them to the transport protocol.
Layer 4: Transport Layer (TCP / UDP)
TCP does not understand what the application data means; it only sees a stream of bytes.
- Segmentation: Chops the byte stream into segments that fit the Maximum Segment Size (MSS, typically 1460 bytes).
- Guarantees: Adds sequence numbers, acknowledgment tracking, retransmissions, flow control (window scaling), and congestion control algorithms (Cubic, BBR).
- Addressing: Uses Ports (e.g., port 443, port 5432) to direct traffic to the correct process on a host.
Layer 3: Network Layer (IPv4 / IPv6)
TCP segments are wrapped in IP packets.
- Addressing: Uses IP addresses (e.g.,
192.168.1.10,142.250.190.46). - Routing: Inspects routing tables and passes packets across multiple hops/routers across the internet until they reach the destination host. IP provides no delivery guarantees (best-effort delivery).
Layer 2: Data Link Layer (Ethernet, 802.11 Wi-Fi)
IP packets cannot travel across physical wires or radio waves by themselves; they must be put into frames designed for the local physical medium.
- Addressing: Uses hardware MAC addresses.
- Scope: Only functions on the local link (within your local subnet or switch). To cross to another network, the frame targets the default gateway's MAC address (resolved via ARP/NDP).
Layer 1: Physical Layer
The physical hardware that translates frames into electrical voltages, radio frequency modulations (Wi-Fi/5G), or light pulses down a fiber-optic cable.