← Back to Network Stacks Index

🔷 OSI Model

Open Systems Interconnection Reference Model - The Foundation of Network Communication

What is the OSI Model?

The Open Systems Interconnection (OSI) model is a conceptual framework created by the International Organization for Standardization (ISO) in 1984. It standardizes the functions of a communication system into seven distinct layers, each with specific responsibilities. While the OSI model itself is not directly implemented in real networks (TCP/IP won that battle), it remains the universal language for discussing network architecture, troubleshooting communication problems, and understanding how different protocols interact.

Think of the OSI model as a blueprint or reference architecture. Just as architects use standardized drawings to communicate building designs regardless of the actual construction methods, network professionals use the OSI model to discuss network functions regardless of the specific vendor implementations. It provides a common vocabulary and framework that transcends individual technologies.

Why Seven Layers? Each layer represents a distinct level of abstraction, with upper layers relying on services provided by lower layers without needing to know implementation details. This separation of concerns allows protocols at different layers to evolve independently and enables modular troubleshooting where you can isolate problems to specific layers.

🧠 Memorizing the Layers

The layers are numbered from bottom (1) to top (7). Here are popular mnemonics to remember them:

Bottom to Top (1→7):
Please Do Not Throw Sausage Pizza Away
Top to Bottom (7→1):
All People Seem To Need Data Processing
Alternate (1→7):
Please Do Not Tell Sales People Anything
Alternate (7→1):
All Professors Should Teach Networking Daily Please
7

Application Layer

"Where users and applications interact with the network"

The Application Layer is the closest to the end user and provides network services directly to user applications. This layer doesn't refer to the applications themselves (like Chrome or Outlook), but rather the network services and protocols that applications use to communicate over the network.

Primary Functions

  • Provides network services to applications
  • Identifies communication partners
  • Determines resource availability
  • Synchronizes application communication
  • Handles authentication and privacy
Common Protocols
  • HTTP/HTTPS - Web browsing
  • SMTP/POP3/IMAP - Email
  • FTP/SFTP - File transfer
  • DNS - Name resolution
  • SSH - Secure remote access
  • SNMP - Network management
  • DHCP - IP address assignment
📧 Real-World Example: Sending an Email

When you send an email using Outlook, Thunderbird, or webmail, the Application Layer handles the SMTP protocol interaction. Your email client communicates with the mail server using SMTP commands (MAIL FROM, RCPT TO, DATA). The Application Layer formats these commands, handles authentication, and manages the email transmission process. The actual email client software operates above Layer 7, using the services this layer provides.

🔧 Layer 7 Troubleshooting
  • Symptom: Can't access a specific website but can ping the server
  • Common Causes: Web server down, incorrect URL, DNS issues, firewall blocking HTTP/HTTPS, proxy problems
  • Tools: curl, wget, telnet to port 80/443, browser developer tools, Wireshark (filter: http)
  • Quick Test: curl -v http://example.com shows detailed HTTP conversation
Key Concept: Layer 7 is about the semantics of data - what the data means and how applications should interpret it. Lower layers care about getting data from point A to point B; Layer 7 cares about what that data represents.
6

Presentation Layer

"Data formatting, encryption, and compression"

The Presentation Layer acts as a translator, ensuring that data sent from the application layer of one system can be read by the application layer of another system. It handles data format conversion, encryption/decryption, and compression/decompression. This layer presents data in a format that the application can understand, regardless of how it was encoded during transmission.

Primary Functions

  • Data format translation (ASCII, EBCDIC, Unicode)
  • Encryption and decryption (SSL/TLS)
  • Data compression and decompression
  • Character set conversion
  • Graphics format handling (JPEG, GIF, PNG)
Common Standards/Protocols
  • SSL/TLS - Encryption
  • MIME - Email attachments
  • JPEG, GIF, PNG - Image formats
  • MPEG, QuickTime - Video formats
  • ASCII, Unicode - Character encoding
  • XDR - Data representation
🔐 Real-World Example: HTTPS Encryption

When you visit a secure website (https://), the Presentation Layer handles the SSL/TLS encryption. Your browser encrypts the HTTP request before sending it, and the web server's Presentation Layer decrypts it upon receipt. The response is encrypted by the server and decrypted by your browser. This happens transparently - the Application Layer (HTTP) doesn't need to know about the encryption; it just sends and receives plain HTTP data.

🔧 Layer 6 Troubleshooting
  • Symptom: Garbled characters in email or webpage, SSL/TLS certificate errors
  • Common Causes: Character encoding mismatch, corrupted encryption, expired certificates, incompatible cipher suites
  • Tools: openssl, browser security tab, character encoding converters
  • Quick Test: openssl s_client -connect example.com:443 tests SSL/TLS connection
Modern Reality: In practice, many Presentation Layer functions have been absorbed into the Application Layer in modern protocols. For example, HTTP itself now handles MIME types, and applications often handle their own encryption (HTTPS = HTTP + TLS).
5

Session Layer

"Managing connections and dialogues between applications"

The Session Layer establishes, manages, and terminates connections (sessions) between applications. It controls the dialogues between computers, determining whether communication is simplex (one-way), half-duplex (two-way but not simultaneous), or full-duplex (simultaneous two-way). This layer also handles session checkpointing and recovery, allowing interrupted sessions to resume from where they left off.

Primary Functions

  • Session establishment and termination
  • Dialog control (simplex, half-duplex, full-duplex)
  • Synchronization and checkpointing
  • Session recovery after failures
  • Managing multiple sessions per application
Common Protocols
  • NetBIOS - Session services
  • PPTP - VPN tunneling
  • RPC - Remote procedure calls
  • SQL - Database sessions
  • NFS - Network file system
  • SMB/CIFS - File sharing
💾 Real-World Example: Database Connection

When your application connects to an Oracle database, the Session Layer manages the database session. It establishes the connection, maintains the session state (keeping track of transactions), provides checkpointing so interrupted queries can resume, and ensures proper session termination when you disconnect. If your network connection drops briefly, the Session Layer can re-establish the session and continue where you left off without losing your transaction state.

🔧 Layer 5 Troubleshooting
  • Symptom: Applications timeout or disconnect unexpectedly, can't maintain persistent connections
  • Common Causes: Session timeout settings, firewall dropping idle connections, NAT session table overflow
  • Tools: netstat (view active sessions), application logs, network flow monitors
  • Quick Test: netstat -an | grep ESTABLISHED shows active sessions
Blurred Lines: Like the Presentation Layer, Session Layer functions are often implemented within applications or handled by Layer 4 (Transport) protocols in modern networks. TCP's connection management handles many traditional Session Layer responsibilities.
4

Transport Layer

"End-to-end communication and reliability"

The Transport Layer provides transparent transfer of data between end systems and is responsible for end-to-end error recovery and flow control. It ensures complete data transfer with protocols like TCP (reliable, connection-oriented) or provides faster, connectionless delivery with UDP (unreliable but efficient). This layer segments data from the upper layers and reassembles it at the destination, adding port numbers to identify specific applications.

Primary Functions

  • Segmentation and reassembly
  • End-to-end connection management
  • Error detection and recovery
  • Flow control (prevent overwhelming receiver)
  • Port addressing (multiplexing/demultiplexing)
  • Quality of Service (QoS)
Key Protocols
  • TCP - Reliable, connection-oriented
  • UDP - Fast, connectionless
  • SCTP - Stream Control Transmission
  • DCCP - Datagram Congestion Control
Protocol Data Unit (PDU): Segment (TCP) or Datagram (UDP)
Addressing: Port Numbers (0-65535)
Common Ports: HTTP:80 HTTPS:443 SSH:22 FTP:21 DNS:53 SMTP:25
📦 Real-World Example: TCP Three-Way Handshake

When you connect to a web server, TCP performs a three-way handshake at Layer 4:
1. SYN: Client sends synchronize packet (I want to connect)
2. SYN-ACK: Server acknowledges and synchronizes back (OK, I'm ready)
3. ACK: Client acknowledges server's response (Great, let's communicate)
This establishes a reliable connection before any HTTP data is exchanged. TCP then segments the HTTP request, tracks sequence numbers, handles retransmission of lost segments, and ensures data arrives in order.

🔧 Layer 4 Troubleshooting
  • Symptom: Connection refused, port unreachable, slow performance, packet loss
  • Common Causes: Firewall blocking ports, service not listening, MTU issues, network congestion
  • Tools: netstat, ss, telnet, nc (netcat), nmap, tcpdump/Wireshark
  • Quick Tests:
  • telnet example.com 80 - Test if port 80 is open
  • netstat -tuln - Show listening ports
  • ss -tan - Show all TCP connections with numbers
TCP vs UDP: Use TCP when you need reliability (web, email, file transfer). Use UDP when speed matters more than perfection (streaming video, VoIP, gaming, DNS queries). TCP guarantees delivery but adds overhead; UDP is faster but doesn't guarantee anything.
3

Network Layer

"Routing and logical addressing across networks"

The Network Layer handles routing data packets between different networks. It provides logical addressing (IP addresses) and determines the best path for data to travel from source to destination across multiple networks. This layer is where routers operate, making decisions about forwarding packets based on routing tables and protocols. It's responsible for packet forwarding, routing, and congestion control across interconnected networks.

Primary Functions

  • Logical addressing (IP addresses)
  • Routing and path determination
  • Packet forwarding
  • Fragmentation and reassembly
  • Network interconnection
  • Quality of Service management
Key Protocols
  • IPv4/IPv6 - Internet Protocol
  • ICMP - Error reporting (ping)
  • RIP, OSPF, EIGRP - Routing protocols
  • BGP - Border Gateway Protocol
  • ARP - Address Resolution
  • IPsec - IP Security
Protocol Data Unit (PDU): Packet
Addressing: IP Addresses (IPv4: 192.168.1.1 or IPv6: 2001:db8::1)
Key Device: Router
🗺️ Real-World Example: Routing Across the Internet

When you access a website hosted across the country, Layer 3 handles routing. Your router examines the destination IP address, consults its routing table, and forwards the packet to the next hop (your ISP). Each router along the path repeats this process, using routing protocols like BGP to determine the best path. The packet might traverse 10-15 routers (hops) before reaching the destination. Each router only needs to know the next hop - no single router knows the complete path.

Try it: traceroute example.com shows each Layer 3 hop your packets take to reach the destination.

🔧 Layer 3 Troubleshooting
  • Symptom: Can't reach remote network, routing loops, incorrect routing, network unreachable
  • Common Causes: Incorrect routing table, missing default gateway, misconfigured subnet mask, routing protocol issues, firewall filtering
  • Tools: ping, traceroute/tracert, route/ip route, arp, Wireshark (filter: ip or icmp)
  • Quick Tests:
  • ping 8.8.8.8 - Test Layer 3 connectivity to Google DNS
  • ip route show - Display routing table (Linux)
  • route print - Display routing table (Windows)
  • arp -a - Show ARP cache (IP to MAC mappings)
Key Distinction: Layer 3 is about getting packets between different networks. Layer 2 (below) is about getting frames within a single network segment. Routers work at Layer 3; switches typically work at Layer 2 (though Layer 3 switches exist).
2

Data Link Layer

"Physical addressing and media access control"

The Data Link Layer provides node-to-node data transfer within the same network segment and handles error detection and correction from the Physical Layer. It's divided into two sublayers: LLC (Logical Link Control) and MAC (Media Access Control). This layer adds physical addresses (MAC addresses) to packets, creating frames, and controls how devices on a shared medium access the network to avoid collisions.

Primary Functions

  • Physical addressing (MAC addresses)
  • Frame formatting and organization
  • Media access control (when to transmit)
  • Error detection (CRC checks)
  • Flow control between adjacent nodes
  • Link management
Key Protocols/Technologies
  • Ethernet - Most common LAN technology
  • Wi-Fi (802.11) - Wireless LAN
  • PPP - Point-to-Point Protocol
  • HDLC - High-level Data Link Control
  • Frame Relay - WAN technology
  • ATM - Asynchronous Transfer Mode
Protocol Data Unit (PDU): Frame
Addressing: MAC Addresses (48-bit hex: 00:1A:2B:3C:4D:5E)
Key Devices: Switch, Bridge, Wireless Access Point
🔄 Real-World Example: Ethernet Frame Delivery

When your computer sends data to a printer on the same network, Layer 2 handles local delivery. Your NIC (Network Interface Card) wraps the Layer 3 packet in an Ethernet frame, adding the destination MAC address (printer's physical address) and source MAC address (your computer's). The frame is broadcast on the Ethernet segment, and the switch uses its MAC address table to forward the frame only to the port where the printer is connected. The printer's NIC sees its MAC address and accepts the frame.

The Ethernet frame also includes a CRC (Cyclic Redundancy Check) that detects transmission errors. If the CRC doesn't match, the frame is discarded, and upper layers handle retransmission.

🔧 Layer 2 Troubleshooting
  • Symptom: Local network connectivity issues, duplicate IP addresses, MAC address conflicts, switching loops
  • Common Causes: Bad cable, switch port failure, spanning tree issues, VLAN misconfiguration, MAC table overflow
  • Tools: arp, ip neighbor, switch MAC table, Wireshark (filter: eth), ping
  • Quick Tests:
  • ip link show - Show network interfaces and status
  • arp -a - View ARP cache (Layer 2 to Layer 3 mapping)
  • ethtool eth0 - Check physical link status and speed
  • On switch: show mac address-table - View MAC learning
Switches vs Hubs: Modern networks use switches (Layer 2 devices that intelligently forward frames based on MAC addresses). Old hubs were Layer 1 devices that simply repeated signals to all ports, causing collisions. If you still have hubs, replace them immediately!
VLANs: Virtual LANs (VLANs) are a Layer 2 technology that allows you to segment a physical network into multiple logical networks. This improves security and reduces broadcast domains. VLAN tagging (802.1Q) adds a VLAN ID to Ethernet frames.
1

Physical Layer

"Raw bits on the wire - hardware transmission"

The Physical Layer is responsible for the actual physical connection between devices and the transmission and reception of raw bit streams over a physical medium. This includes the hardware components like cables, connectors, network cards, and the electrical or optical signals that represent data. It defines the hardware specifications: voltage levels, timing, physical data rates, maximum transmission distances, and physical connectors.

Primary Functions

  • Bit transmission (1s and 0s)
  • Physical medium specification
  • Signal encoding and modulation
  • Connector and pin specifications
  • Transmission timing and synchronization
  • Voltage/current levels
Key Technologies
  • Copper cables: Cat5e, Cat6, Cat6a, Cat7
  • Fiber optic: Single-mode, Multi-mode
  • Wireless: Radio frequencies, infrared
  • Ethernet standards: 10BASE-T, 100BASE-TX, 1000BASE-T, 10GBASE-SR
  • Connectors: RJ45, LC, SC, ST
Protocol Data Unit (PDU): Bits (raw 1s and 0s)
Key Devices: Hubs, Repeaters, Cables, Connectors, Network Interface Cards (physical components)
⚡ Real-World Example: Ethernet Cable Transmission

When data travels over a Cat6 Ethernet cable, Layer 1 converts digital bits into electrical signals. A '1' might be represented by +2.5V and a '0' by -2.5V (simplified). These voltage changes travel down the copper wires at nearly the speed of light. The receiving network card detects these voltage levels and converts them back to digital bits.

For gigabit Ethernet (1000BASE-T), the Physical Layer uses sophisticated encoding schemes like 4D-PAM5 that transmit across all four pairs of wires simultaneously. The cable quality, length (max 100 meters for copper), and proper termination all affect Layer 1 performance.

🔧 Layer 1 Troubleshooting
  • Symptom: No link light, physical connection fails, excessive errors, speed/duplex mismatch
  • Common Causes: Bad cable, loose connector, wrong cable type, excessive cable length, electromagnetic interference, damaged port
  • Tools: Cable tester, loopback adapter, visual inspection, ethtool, interface statistics
  • Quick Tests:
  • Visual: Check link lights on both ends
  • ethtool eth0 - Check link status, speed, duplex
  • ip -s link show eth0 - Show error counters
  • Try different cable or port to isolate problem
  • Check for: bent pins, loose connections, cable damage
Common Mistake: Using the wrong cable type. Crossover cables are needed to connect like devices (switch to switch, computer to computer) in older networks. Modern devices support Auto-MDI/MDIX which automatically detects and adjusts, but older equipment requires proper cable selection.
Cable Categories:
Cat5e: Up to 1 Gbps, 100 meters
Cat6: Up to 10 Gbps (55m) or 1 Gbps (100m)
Cat6a: Up to 10 Gbps at 100 meters
Cat7: Up to 10+ Gbps, better shielding
Fiber: Up to 100+ Gbps, kilometers of distance

📊 Protocol Data Units (PDUs) by Layer

Each layer has its own name for the data it handles. Understanding PDUs is essential for troubleshooting - when you capture traffic with Wireshark, you see these different encapsulations.

Layer Layer Name PDU Name Addressing Key Devices
7 Application Data Application-specific Application proxies, L7 firewalls
6 Presentation Data - Gateways
5 Session Data - Gateways
4 Transport Segment (TCP) / Datagram (UDP) Port numbers (0-65535) Advanced firewalls
3 Network Packet IP addresses Routers, L3 switches
2 Data Link Frame MAC addresses Switches, bridges, WAPs
1 Physical Bits - Hubs, repeaters, cables

📦 Data Encapsulation Process

As data moves down the OSI layers for transmission, each layer adds its own header (and sometimes trailer) information. This process is called encapsulation. At the receiving end, each layer removes its corresponding header in a process called decapsulation.

Sending Data (Top to Bottom):

  1. Application Layer (7-5): User creates data (email, web request)
  2. Transport Layer (4): Adds TCP/UDP header with port numbers → Segment
  3. Network Layer (3): Adds IP header with source/destination IP → Packet
  4. Data Link Layer (2): Adds Ethernet header/trailer with MAC addresses → Frame
  5. Physical Layer (1): Converts frame to electrical/optical signals → Bits
Receiving Data (Bottom to Top):
  1. Physical Layer (1): Receives bits, converts to frame
  2. Data Link Layer (2): Removes Ethernet header, checks CRC, passes packet up
  3. Network Layer (3): Removes IP header, passes segment up
  4. Transport Layer (4): Removes TCP/UDP header, reassembles data
  5. Application Layer (7-5): Delivers data to application

🔍 Systematic Troubleshooting: The Layer Approach

The OSI model provides a systematic troubleshooting methodology. Work from the bottom up or top down:

Bottom-Up (Physical to Application):
  1. Layer 1: Is the cable plugged in? Link lights on?
  2. Layer 2: Can you ping a device on the same subnet?
  3. Layer 3: Can you ping your default gateway? A remote IP?
  4. Layer 4: Is the port open? Can you telnet to it?
  5. Layer 7: Is the application responding correctly?
Top-Down (Application to Physical):

Start with the user's complaint (can't access website) and work down until you find where the problem starts.

Divide and Conquer:

Test at Layer 3 (ping). If it works, problem is Layer 4+. If it fails, problem is Layer 1-3.

Remember: The OSI model is a teaching and troubleshooting tool, not a strict implementation guide. Real protocols don't always fit neatly into one layer. For example, ARP operates between Layers 2 and 3, and many modern protocols combine functions from multiple layers. The value of the OSI model is in providing a common framework for understanding and discussing network communication.