diff --git a/.zk/notebook.db b/.zk/notebook.db
index 2b380d1..a6f9d0a 100644
Binary files a/.zk/notebook.db and b/.zk/notebook.db differ
diff --git a/zk/Link_Layer_of_Internet_Protocol.md b/zk/Link_Layer_of_Internet_Protocol.md
index a6687b2..043ce86 100644
--- a/zk/Link_Layer_of_Internet_Protocol.md
+++ b/zk/Link_Layer_of_Internet_Protocol.md
@@ -25,7 +25,7 @@ same is not true for other layers. For example a device like a laptop
 participates in all four layers up to the Application Layer but a network router
 does not:
 
-![Link Layer diagram](../img/link-layer-internet-diagram.png)
+![Link Layer diagram](../img/link-layer-frame-revised.png)
 
 ## MAC addresses
 
diff --git a/zk/Transport_Layer_of_Internet_Protocol.md b/zk/Transport_Layer_of_Internet_Protocol.md
index 5e0d8f1..8a322d4 100644
--- a/zk/Transport_Layer_of_Internet_Protocol.md
+++ b/zk/Transport_Layer_of_Internet_Protocol.md
@@ -1,6 +1,6 @@
 ---
 title: Transport_Layer_of_Internet_Protocol
-tags: []
+tags: [internet, networks, ports]
 created: Tuesday, September 03, 2024
 ---
 
@@ -18,3 +18,37 @@ Protocol** (TCP).
 
 A TCP **fragment** fits within an IP packet's data section, giving us the
 following iteration of the network stack:
+
+![Transport layer fragment](../img/transport-layer-segment.png)
+
+The segment header contains a destination network port number. The port number
+identifies the specific service or process on the host device which will receive
+the data.
+
+A useful analogy:
+
+_The IP address is like the street address of an office building. The port
+number is like the office number of a specific worker within the building. Once
+a letter arrives at the building, the mail processing office (like the OS) is
+not the intended recipient. Instead the mail worker passes on the letter to the
+intended recipient. Likewise, the OS examines the port number and delivers the
+inbound data to the process listening on the specified port._
+
+## Ports
+
+A host with a single IP address can have multiple active ports, each used for
+performing a different type of activity on the network.
+
+Both servers and clients possess ports. A server will have a dedicated port
+which it listens for requests on (typically port 80 or port 443). A client will
+have an "ephemeral" port where it listens for responses from a server. They are
+ephemeral because they are open only temporarily to receive a response to a
+certain request and are assigned dynamically by the networking components of the
+OS.
+
+An IP address plus a port (e.g: 192.168.2.1:3000) constitutes an **endpoint**.
+An instance of an endpoint is a **socket**.
+
+If multiple clients connect to the same endpoint each has its own socket (for
+instance on a host that is a server). A socket can listen for new connections or
+it can represent an established, ongoing connection.