# Exercise 1 — TCP/IP vs OSI, Mapped

## Scenario

A new hire on your team keeps mixing up OSI and TCP/IP terminology in code review comments ("that's an OSI layer 4 header" when looking at raw packet capture data that's really organized around TCP/IP's model). You want to write a short mapping document to settle it, and use a real capture to ground it.

## Deliverables

1. **Mapping table.** Reproduce a table with columns: TCP/IP layer | OSI layer(s) it absorbs | One protocol example | One reason the merge makes sense (why those OSI layers didn't need to be kept separate in practice).

2. **Terminology precision.** For each term below, state which TCP/IP layer it belongs to, and the correct name for "a unit of data" at that layer (message, segment, packet, or frame):
   - A DNS query
   - A TCP SYN
   - An IP packet with a TTL of 1
   - An Ethernet frame with a broadcast destination MAC

3. **Real command mapping.** For each command below, state which TCP/IP layer it primarily operates at and what specific problem at that layer it would help you diagnose:
   - `ping 8.8.8.8`
   - `curl -v https://example.com`
   - `ss -tlnp` (or `netstat -an` on macOS)
   - `arp -a`

4. **Design reasoning.** In 3-5 sentences, explain why IP being a "connectionless, best-effort" protocol (no guarantees, no memory of previous packets) is what allows routers to scale to handling billions of independent flows, tying your answer to the "Under the Hood" explanation in the theory file about why reliability was pushed up to the transport layer instead of built into IP.

## Notes

- Answer directly in this file, under each numbered heading.
- Where you're unsure of an exact protocol/tool detail, state your best reasoning rather than leaving it blank — the goal is to practice mapping real things onto the model, not memorize trivia.