1. What is the OSI 7 Layer Model?
OSI (Open Systems Interconnection) is a reference model created by ISO. A framework that standardizes how computers communicate, split into 7 layers.
Each layer provides services to the layer above it, and receives services from the layer below it.
| Layer | Name | Key Info | Device |
|---|---|---|---|
| 7 | Application | - | - |
| 6 | Presentation | - | - |
| 5 | Session | - | - |
| 4 | Transport | TCP/UDP, Port | - |
| 3 | Network | IP Address | Router |
| 2 | Data-Link | Ethernet MAC Address | Switch |
| 1 | Physical | - | Hub |
What layering gives
- No need to design a technology end to end. Each party owns one layer
- Open standards, so multi-vendor interoperability
- A problem can be narrowed to one layer, which makes troubleshooting easier
Encapsulation
The sender adds a header at each layer going 7 down to 1 (encapsulation), the receiver strips them going 1 up to 7 (de-encapsulation).
L7 [ Data ] Data
L4 [TCP][ Data ] Segment
L3 [IP][TCP][ Data ] Packet
L2 [Eth][IP][TCP][ Data ][FCS] Frame
L1 10110100 01011101 00101110 ... bits
2. OSI vs TCP/IP Stack
OSI is conceptual. The stack that actually moves data on production networks is TCP/IP, developed by ARPA under the US DoD in the 1960s. TCP/IP is layered too, but collapses OSI's 7 layers into 4.
| OSI Model | TCP/IP Stack | Definition |
|---|---|---|
| Application / Presentation / Session | Application | Represents and encodes user data, controls dialog |
| Transport | Transport | Supports communication between end devices across networks |
| Network | Internet | Logical addressing and best path determination |
| Data Link / Physical | Link | Controls the hardware devices and media that make up the network |
PDU (Protocol Data Unit)
| TCP/IP Layer | PDU |
|---|---|
| Application | Data |
| Transport | Segment |
| Internet | Packet |
| Link | Frame |
3. Layers 7, 6, 5 (the Upper Layers)
Layer 7 Application
- Provides network services to user applications
- Unlike the other layers, provides services to no OSI layer above it
- Verifies the availability of the communication partner
- Synchronizes and agrees on error recovery procedures and data integrity control
Layer 6 Presentation
- Ensures information from the sender's application layer is readable at the receiver's
- Converts data formats between different encoding schemes into a common format
Layer 5 Session
- Establishes, manages and terminates sessions between two hosts
- Synchronizes dialog between presentation layers and manages data exchange
- A web server handles many users at once, so it tracks multiple communication processes separately
4. Layer 4 Transport
The layer of TCP/UDP and port numbers. Splits data into segments, transmits and reassembles them between end devices.
- Session Multiplexing: one host supports multiple sessions over a single link and manages each traffic stream separately. A server takes HTTP (80) and SMTP (25) traffic at once without the sessions mixing
- Flow Control: throttles the sender so data arrives only as fast as the receiver can handle
Port numbers
- The destination port identifies the upper-layer protocol (HTTP = 80, SMTP = 25)
- The sender also puts a source port in the Layer 4 header
- What distinguishes and tracks a session is the source and destination port pair
Sender → Receiver : DST 80, SRC 1500
Receiver → Sender : DST 1500, SRC 80 // ports swap on the reply
TCP vs UDP
| TCP | UDP | |
|---|---|---|
| Connection | Connection oriented (3-way handshake) | Not connection oriented |
| Sequencing | Yes | No |
| Reliability | Yes (ACK + retransmit) | No (no ACK) |
| Flow Control | Yes | No |
| Header Size | 20 Bytes | 8 Bytes |
TCP 3-way handshake.
Sender Receiver
|------------- SYN ------------->|
|<----------- SYN-ACK -----------|
|------------- ACK ------------->|
|===== connection established ===|
Full TCP / UDP header fields
TCP header (20 Bytes)
Source Port 16 | Destination Port 16 | Sequence Number 32
Acknowledgment Number 32 | Header Length 4 | Reserved 6
Code Bits 6 | Window 16 | Checksum 16 | Urgent 16
(+ Options 0 or 32)
UDP header (8 Bytes)
Source Port 16 | Destination Port 16 | Length 16 | Checksum 16
Reliability needed means TCP. Real-time traffic that can't absorb TCP's overhead means UDP.
| Protocol | Applications (Port) |
|---|---|
| TCP | FTP(21), SSH(22), Telnet(23), HTTP(80), HTTPS(443) |
| UDP | TFTP(69), SNMP(161) |
| Both | DNS(53) |
5. Layer 3 Network
Routing and QoS. IP is the main protocol and it's connectionless, so there are no acknowledgements at Layer 3. ICMP and IPSec are also Layer 3.
The IP header is 20 bytes without options.
| Field | Size | Description |
|---|---|---|
| TTL | 8 bit | Decremented by every router, discarded at 0 (prevents infinite loops) |
| Protocol | 8 bit | Identifies the upper-layer protocol (TCP=6, UDP=17) |
| Source / Destination IP | 32 bit each | Ties directly to IPv4 address length |
| Type of Service | 8 bit | QoS priority marking |
Unicast / Broadcast / Multicast
| Type | Destination | Behavior |
|---|---|---|
| Unicast | A single host | 1:1. Reaching many hosts means a separate copy to each |
| Broadcast | All hosts in the subnet | Switches forward it, routers do not |
| Multicast | Interested hosts only | One stream reaches only the hosts that want it. Routers can forward it |
Broadcasts not crossing a router = the router is the boundary of the broadcast domain.
Logical addressing
- IP addressing is a logical addressing scheme implemented at Layer 3, used to divide a network into smaller subnets
- Subnetting improves performance and security and makes troubleshooting easier
- Layer 2 MAC addressing is one giant flat scheme with no hierarchy. Layer 2 has no logical separation between networks, that only happens at Layer 3
- A host uses the subnet mask to check whether the destination is in the same subnet. Same subnet goes directly through the switch, different goes via the router
The addressing scheme itself (IP classes, mask math, CIDR, RFC 1918) is in a separate post.
6. Layer 2 Data-Link
Where frames are encoded into and decoded from bits. Error detection and correction for the Physical Layer can be provided here. Ethernet is the Layer 2 medium on LANs.
┌──────────┬─────────┬─────────┬──────────┬───────────────┬─────────┐
│ Preamble │ DST MAC │ SRC MAC │ Len/Type │ Data │ FCS │
│ 8 Bytes │ 6 Bytes │ 6 Bytes │ 2 Bytes │ 46~1500 Bytes │ 4 Bytes │
└──────────┴─────────┴─────────┴──────────┴───────────────┴─────────┘
trailer
- Preamble: frame start synchronization
- Length / Ethertype: length, or upper-layer protocol type
- FCS: error detection. A trailer at the end of the frame, not part of the header
MAC address 6 Bytes = 48 bits. Data max 1500 Bytes = Ethernet's default MTU.
Some sources list the Preamble as 7 Bytes. That's IEEE 802.3 counting Preamble 7 Bytes and SFD (Start Frame Delimiter) 1 Byte separately, which adds up to the same 8 Bytes. Cisco material and Ethernet II fold the SFD into the Preamble and call it 8 Bytes.
Preamble and SFD aren't counted in the frame size. The 64 to 1518 Byte Ethernet frame runs from DST MAC through FCS:
14 + 46 + 4 = 64,14 + 1500 + 4 = 1518.
MAC Address
| First 24 bits | Last 24 bits | |
|---|---|---|
| Name | OUI (Organizationally Unique Identifier) | Vendor Assigned |
| Assigned by | IEEE | The manufacturer |
Example (00:50:56:C0:00:08) |
00:50:56 |
C0:00:08 |
The OUI identifies the manufacturer of that Ethernet port. MAC addresses are burned into the NIC and globally unique.
MAC is 48-bit, Layer 2, fixed at manufacture, flat. IP is 32-bit, Layer 3, assigned by an admin, hierarchical. Layer 2 has no logical separation between networks, that happens at Layer 3.
7. Layer 1 Physical
Puts a bit stream onto the network as electrical impulses, light or radio signals. The electrical and mechanical layer, defining cables, interface cards and physical specifications. Media are coaxial (unused now), twisted copper pair, fiber, wireless.
- UTP (Unshielded Twisted Pair): most common for desktop PC to switch. RJ-45 connector, 100 m maximum
- Straight-Through: end device to switch (PC to Switch, Router to Switch)
- Crossover: same kind of device directly (PC to PC, Switch to Switch). Auto MDI-X handles this automatically on modern switches
- Fiber: for longer distance or higher bandwidth. Single Mode is higher bandwidth and longer reach but pricier, Multi Mode is cheaper
8. Summary
- OSI is a conceptual 7-layer model, TCP/IP is the 4-layer stack in use. PDUs are Data, Segment, Packet, Frame
- Devices by layer: L3 Router, L2 Switch, L1 Hub
- L4 distinguishes sessions by port. Reliability means TCP (20 Bytes), low latency means UDP (8 Bytes)
- L3 divides networks with logical addressing. Broadcasts don't cross routers, so the router is the boundary of the broadcast domain
- L2 MAC is 48-bit, flat, fixed at manufacture. L3 IP is 32-bit, hierarchical, assigned by an admin
- Layers 5 to 7 are the app developer's territory, layers 1 to 4 the network engineer's
Top comments (0)