a TCP segment
When TCP has bytes to send, it doesn't dribble them out one at a time — it packages a chunk of the byte stream together with a header full of bookkeeping and hands the whole thing to the network layer. That package is a TCP segment: it's the unit TCP actually puts on the wire. The header is like the label on a shipping box, carrying everything the other end needs to file the contents correctly and keep the conversation in sync.
The TCP header (usually 20 bytes) packs a lot into a small space. It begins with the source port and destination port for demultiplexing. Then a 32-bit sequence number (the stream position of this segment's first byte) and a 32-bit acknowledgment number (the next byte expected from the other side). A set of control flags signals the segment's role — SYN to open, ACK to acknowledge, FIN to close, RST to abort, and others. A window field advertises the receiver's free buffer space for flow control. A checksum guards the whole segment against corruption, and there's room for options (like the maximum segment size). After the header comes the payload — the actual application bytes, possibly none at all for a pure control segment like a bare ACK.
Why it matters: the segment header is where all of TCP's machinery lives — multiplexing (ports), ordering and reliability (sequence and acknowledgment numbers), connection setup and teardown (flags), flow control (window), and integrity (checksum) are all just fields you can point to. A naming note worth getting right: TCP calls its unit a segment; the network layer wraps it in an IP datagram; informally people say 'TCP packet,' but strictly the IP layer owns the word packet.
A bare acknowledgment is a segment with the ACK flag set, an acknowledgment number naming the next wanted byte, a window value, a valid checksum — and zero payload bytes. A connection-opening segment has the SYN flag set and carries the sender's initial sequence number.
Ports, seq/ack numbers, flags, window, checksum — then the payload.
TCP's unit is a 'segment'; the IP layer's is a 'datagram' or 'packet'. The header carries no encryption — anyone on the path can read its fields and payload unless an upper layer like TLS encrypts the data.