The OSI Model

The OSI model is the conceptual backbone of networking. It divides the problem of "how does data get from A to B" into seven distinct layers, each with a clearly defined job. Understanding it means you can look at any networking concept — TCP, TLS, Ethernet, HTTP — and immediately understand where it fits, what it depends on, and what it provides to the layers above it.

The Seven Layers

The OSI model is read bottom to top. Lower layers deal with the physical movement of bits; higher layers deal with meaning and application. Each layer uses the services of the layer below and provides services to the layer above.

Layer 1 — Physical

The Physical layer is the raw, literal transmission of bits. Electrical voltages on a copper wire. Pulses of light in fiber optic cable. Radio waves from a WiFi antenna. This layer defines connectors, pin layouts, voltage levels, and signal timing. When your cable is unplugged or your WiFi signal is too weak, the problem is Layer 1.

Devices at this layer: cables, hubs, repeaters, network interface cards.

Layer 2 — Data Link

The Data Link layer takes raw bits from Layer 1 and organises them into frames — structured chunks with a defined start, payload, and error-checking fields. It also introduces MAC addresses: hardware identifiers burned into every network interface. Data Link is how devices on the same network (same LAN) communicate directly.

Ethernet operates here. So do WiFi (802.11) and Bluetooth. Switches operate at Layer 2 — they read MAC addresses to forward frames to the correct port.

Layer 3 — Network

The Network layer handles routing across networks. Where Data Link handles communication within a local network, Network handles communication between networks. The key protocol here is IP (Internet Protocol) — every packet gets source and destination IP addresses, and routers at Layer 3 read those addresses to forward packets hop by hop toward their destination.

ICMP (used by ping and traceroute) also lives here. Layer 3 does not guarantee delivery or ordering — that is TCP's job at Layer 4.

Layer 4 — Transport

The Transport layer handles end-to-end communication between applications on different hosts. This is where TCP and UDP live. It introduces ports — numbers that identify which application on a host should receive the traffic (port 80 for HTTP, port 443 for HTTPS, port 22 for SSH).

TCP provides reliable, ordered, error-checked delivery. UDP provides fast, connectionless, best-effort delivery. Everything discussed in TCP vs UDP happens at Layer 4.

Layer 5 — Session

The Session layer manages sessions between applications: opening them, maintaining them, and closing them cleanly. It handles authentication checkpoints and session recovery. In practice, many of its responsibilities have been absorbed by the application layer or by TCP itself.

NetBIOS and RPC (Remote Procedure Call) operate at this layer. For most web developers, Layer 5 is the one you think about least — its job gets done transparently.

Layer 6 — Presentation

The Presentation layer handles data format translation: converting data from the format the application uses into a standard network format, and vice versa on the receiving end. It also handles encryption and decryption.

TLS (Transport Layer Security) lives at Layer 6. When a browser establishes an HTTPS connection, TLS negotiates keys, encrypts the outgoing data, and decrypts the incoming data. JPEG and MPEG compression also live here — format concerns rather than routing or reliability concerns.

Layer 7 — Application

The Application layer is what users and software interact with directly. It defines the protocols that applications use to communicate: HTTP, HTTPS, DNS, FTP, SMTP, IMAP. It is not the application itself (Chrome is not a Layer 7 protocol) — it is the protocol the application speaks.

When you type a URL and press Enter, your browser uses HTTP/HTTPS (Layer 7) to construct a request. That request gets encrypted by TLS (Layer 6), handed to TCP (Layer 4) for reliable delivery, addressed by IP (Layer 3), framed by Ethernet (Layer 2), and transmitted as electrical signals (Layer 1).

How Data Travels — Encapsulation

When you send data across a network, each layer wraps the data from the layer above with its own header. This is called encapsulation.

Sending (top to bottom):

Application:   [HTTP data]
Presentation:  [TLS header][encrypted data]
Transport:     [TCP header][TLS header][encrypted data]
Network:       [IP header][TCP header][TLS header][encrypted data]
Data Link:     [Eth header][IP header][TCP header][TLS header][encrypted data][Eth footer]
Physical:      101011010011001... (bits on wire)

Each layer adds its header and treats everything from the layers above as opaque payload. The IP layer does not know or care what is inside the TCP segment. The TCP layer does not know or care about the HTTP request it is carrying.

Receiving (bottom to top):

The receiver's Physical layer collects the bits and passes frames up to Data Link. Data Link strips the Ethernet header, validates the frame, and passes the payload to Network. Network strips the IP header and passes the TCP segment to Transport. Transport strips the TCP header and passes the TLS record to Presentation. Presentation decrypts and passes the HTTP request to Application. The web server reads the HTTP request.

This is called decapsulation — each layer peels off the header it put on during sending.

The Mnemonic

The layers from bottom to top: Physical, Data Link, Network, Transport, Session, Presentation, Application.

A common mnemonic: "Please Do Not Throw Sausage Pizza Away"

Another popular one going top to bottom: "All People Seem To Need Data Processing"

Why It Matters

The OSI model is not just academic. It directly shapes how real tools and systems work:

Firewalls operate at different layers depending on their sophistication. A basic firewall operates at Layer 3/4 — it filters by IP address and port number. An application-aware firewall (Layer 7) inspects HTTP headers, DNS queries, and TLS SNI fields to make much more nuanced decisions.

Load balancers come in Layer 4 and Layer 7 flavours. A Layer 4 load balancer routes TCP connections based on IP and port — fast, but it cannot see what is inside. A Layer 7 load balancer inspects HTTP headers, paths, and cookies — it can route /api to one server pool and /static to another.

DDoS attacks target different layers. A volumetric attack floods Layer 1/2/3 with traffic. A SYN flood targets Layer 4 by exhausting TCP connection state. An HTTP flood targets Layer 7 by sending valid requests that are expensive to process.

Debugging becomes much faster when you think in layers. WiFi connected but pages not loading? Layer 1/2 are fine. Can ping 8.8.8.8 but DNS not resolving? Layer 3 is fine, problem is Layer 7. Can load HTTP but HTTPS fails? Layer 4 is fine, problem is Layer 6 (TLS).

The TCP/IP Model

In practice, implementations use a simpler 4-layer model — the TCP/IP model — which collapses OSI's seven layers:

TCP/IP Layer	OSI Layers	Protocols
Application	5, 6, 7	HTTP, DNS, SMTP, TLS
Transport	4	TCP, UDP
Internet	3	IP, ICMP
Network Access	1, 2	Ethernet, WiFi, MAC

The OSI model is the conceptual framework — useful for analysis, debugging, and understanding. The TCP/IP model is what is actually implemented in operating systems and hardware. Engineers use OSI vocabulary to talk about where things operate, and TCP/IP to describe what is actually running.

Common Protocols Per Layer

OSI Layer	Protocols and Technologies
7 — Application	HTTP, HTTPS, DNS, FTP, SMTP, IMAP, SSH, WebSocket
6 — Presentation	TLS/SSL, JPEG, MPEG, ASCII, UTF-8
5 — Session	NetBIOS, RPC, PPTP
4 — Transport	TCP, UDP, SCTP
3 — Network	IPv4, IPv6, ICMP, BGP, OSPF
2 — Data Link	Ethernet, 802.11 (WiFi), ARP, PPP
1 — Physical	Fiber, coaxial cable, twisted pair, radio spectrum

Key Takeaways

• The OSI model has seven layers: Physical, Data Link, Network, Transport, Session, Presentation, Application — each with a distinct job
• Lower layers handle physical movement of bits; higher layers handle meaning, reliability, and application logic
• Encapsulation wraps data with headers as it passes down the stack; decapsulation strips headers as it passes back up
• TCP and UDP live at Layer 4 (Transport); IP lives at Layer 3 (Network); TLS lives at Layer 6 (Presentation); HTTP lives at Layer 7 (Application)
• Firewalls, load balancers, and attacks all operate at specific layers — knowing which layer narrows debugging dramatically
• The TCP/IP model is the practical 4-layer implementation; OSI is the conceptual 7-layer framework used for analysis and discussion

This completes Networking Fundamentals. Next: Networking Intermediate — TLS deep dive, firewalls, VPNs, and more.