What you are watching

You send “Hi” to a friend on WhatsApp from a phone on home Wi-Fi. The message is followed down your phone's network stack, out through your router, across the internet to a WhatsApp server, and up the stack on your friend's phone.

Seven layers, four of them real

The OSI model names seven layers, and every syllabus teaches all seven. The Internet Protocol Suite is commonly modeled as four: Link, Internet, Transport and Application. Real protocols are then mapped onto OSI's names, and the mapping does not fit cleanly.

This simulation shows all seven floors, because you will be examined on all seven. But Presentation (6) and Session (5) are dimmed and add no header block, because no real packet carries one. Count the blocks as they appear: you get five, not seven.

Is this TCP/IP? Yes.

“TCP/IP” means two different things, and both apply here. As a protocol pair, this message is carried by TCP at Layer 4 running on top of IPv4 at Layer 3 — you can confirm it on the wire, because the IP header’s Protocol field is set to 6, the IANA number for TCP. As a reference model, TCP/IP is the four-layer stack — link, internet, transport, application — which is exactly why two of the seven OSI floors below are dimmed.

The one thing worth stating clearly, so nobody over-generalises: WhatsApp messaging uses TCP; WhatsApp voice and video calls do not. Calls use UDP with SRTP for the media, because real-time audio cannot wait for a retransmission — a packet that arrives late is already useless, so dropping it beats resending it. Media attachments are different again: they are uploaded to and downloaded from a blob store over HTTPS, which is TCP once more. This simulation follows the text-message path, which is the TCP case.

Where the encryption actually lives

The OSI model traditionally associates encryption with the Presentation Layer as a conceptual function. In modern Internet applications such as WhatsApp, encryption is implemented within the Application Layer rather than by a separate Presentation Layer. Your message is encrypted twice here, and both encryptions happen inside the application, above TCP:

• Signal Protocol — end-to-end encryption between the two phones. WhatsApp's own servers cannot read it. Keys come from an X3DH handshake and a Double Ratchet, giving every single message its own key.
• Noise Protocol Framework — a second, separate encrypted channel between your phone and WhatsApp's server, using Curve25519, AES-GCM and SHA-256. This one hides your metadata and login credentials from anyone watching the network — your ISP, the café Wi-Fi, a firewall on the path. It does not hide them from WhatsApp itself, because WhatsApp's server is the far end of this channel and decrypts it on arrival.

Neither is a “presentation layer”. Both are the application doing its own work.

Yes, the server is real — and that matters

The most common misunderstanding about “end-to-end encrypted” is that the two phones connect directly to each other. They do not. Every WhatsApp message travels to a real server, running on real hardware in one of Meta's data centres, and that server forwards it on.

Two things make this unavoidable. Both phones sit behind NAT on private addresses, so neither can be reached directly from the internet. And your friend's phone may simply be switched off — the server has to hold the message until it comes back online.

So what does the encryption actually buy you? The server terminates the Noise channel, which means it can see the metadata: who is messaging whom, when, and how much. What it cannot do is read the message itself, because the Signal ciphertext inside is only decryptable by the recipient's device. End-to-end encryption does not remove the middleman. It makes the middleman blind to the contents.

Things worth noticing

• It is not HTTP. WhatsApp uses its own binary protocol. It began life as XMPP and has diverged a long way since. Today it almost always runs on TCP port 443, with 80 as a fallback and 5222 now largely historical — port 443 makes it look like ordinary HTTPS to a firewall, but the bytes inside are nothing like HTTPS.
• IP addresses do not always survive. Your phone's source address, 192.168.1.24, is private. Your home router rewrites it during NAT, so the server never sees it. The common claim that “the IP addresses never change end to end” is false on any home network.
• Layer 2 changes at every hop. Your phone builds an 802.11 Wi-Fi frame. Your router throws it away and builds a fresh Ethernet frame for the uplink. Same IP packet, different frame, different addresses — every hop.
• CSMA/CA is Wi-Fi, not Ethernet. Wi-Fi avoids collisions before they happen (CA). Classic Ethernet detected them after (CD). Modern switched Ethernet is full duplex and uses neither.
• Small messages are not segmented. “Hi” is two characters. TCP only splits data once it exceeds the maximum segment size, around 1460 bytes. Upload a file to see real segmentation.
• The server is a relay, not the destination. Both phones sit behind NAT and cannot reach each other directly. WhatsApp stores the message and forwards it — and because of the Signal layer, it forwards something it cannot read.

Example addresses

Public addresses shown here come from the ranges reserved for documentation (198.51.100.0/24 and 203.0.113.0/24), so no real host is ever implied. Private addresses, ports, MACs and sequence numbers are realistic examples of what you would see in a packet capture.