The OSI Model

Seven layers that describe how data moves from one application to another across a network.

What Is the OSI Model?

The Open Systems Interconnection (OSI) model is a reference framework published by ISO. It splits network communication into seven layers. Each layer has one job, serves the layer above it, and relies on the layer below it.

Real networks run on the TCP/IP suite rather than OSI protocols. Engineers still use OSI terms every day, though: "that's a Layer 2 problem," "a Layer 4 load balancer," "a Layer 7 firewall."

Memory trick (Layer 7 down to 1): All People Seem To Need Data Processing: Application, Presentation, Session, Transport, Network, Data Link, Physical.
Layer 1 up to 7: Please Do Not Throw Sausage Pizza Away.

The 7 Layers

· Application Data
· Presentation Data
· Session Data
· Transport Segment / Datagram
· Network Packet
· Data Link Frame
· Physical Bits

#	Layer	Job	Examples	Devices
7	Application	Network services for applications	HTTP, HTTPS, DNS, SMTP, SSH, FTP, DHCP, SNMP	L7 firewall, proxy
6	Presentation	Formatting, encryption, compression	TLS, JPEG, ASCII, UTF-8	—
5	Session	Opens, manages and closes sessions	NetBIOS, RPC, SQL sessions	—
4	Transport	End-to-end delivery, ports, reliability	TCP, UDP	Stateful firewall, L4 load balancer
3	Network	Logical addressing and routing	IPv4, IPv6, ICMP, OSPF, BGP	Router, L3 switch
2	Data Link	MAC addressing, framing, error detection	Ethernet, 802.1Q, ARP*, STP, Wi-Fi (802.11)	Switch, bridge, NIC
1	Physical	Bits on the wire	Copper, fiber, radio, RJ45, SFP	Cable, hub, repeater, transceiver

*ARP sits between Layers 2 and 3. It maps IP addresses to MAC addresses. Most people file it under Layer 2.

Layer by Layer

Layer 1: Physical

Moves raw bits as electrical signals, light, or radio waves. Covers cable types, connectors, voltages, speed and duplex.

Problems here: bad cable, dirty fiber, wrong SFP, duplex mismatch, interface down/down.
Check with: link lights, show interfaces, light levels (show interfaces transceiver).

Layer 2: Data Link

Delivers frames between devices on the same local network using 48-bit MAC addresses, for example 00:1A:2B:3C:4D:5E. Ethernet adds a frame check sequence (FCS) so corrupted frames get dropped.

Two sublayers: LLC (Logical Link Control) and MAC (Media Access Control).
Problems here: wrong VLAN, trunk not allowing the VLAN, STP blocking, MAC flapping.
Check with: show mac address-table, show vlan brief, show spanning-tree.

Layer 3: Network

Moves packets between networks using IP addresses. Routers read the destination IP and pick a path from their routing table.

Problems here: wrong IP or subnet mask, missing default gateway, missing route.
Check with: ping, traceroute, show ip route.

Layer 4: Transport

Delivers data between applications using port numbers.

	TCP	UDP
Connection	Connection-oriented (3-way handshake: SYN, SYN-ACK, ACK)	Connectionless
Reliability	Acknowledgements, retransmission, ordering	Best effort
Flow control	Yes (windowing)	No
Used by	HTTP/S (80/443), SSH (22), SMTP (25)	DNS (53), DHCP (67/68), SNMP (161), VoIP

Layer 5: Session

Sets up, keeps track of, and tears down sessions between applications, including checkpoints and recovery. Modern protocols usually handle this inside the application.

Layer 6: Presentation

Makes sure the receiver can read the data: character encoding, compression, and encryption. TLS encryption is often described as a Layer 6 job.

Layer 7: Application

The protocols applications use to talk over the network. When you load https://networking.joeit.net, your browser uses DNS to find the IP and HTTPS to fetch the page.

Encapsulation

As data goes down the stack on the sender, each layer adds its own header. This is called encapsulation. The receiver strips the headers as the data goes back up (de-encapsulation).

Application data:                              [ DATA ]
L4 adds TCP header (ports):           [ TCP | DATA ]                 = Segment
L3 adds IP header (IPs):         [ IP | TCP | DATA ]                 = Packet
L2 adds Ethernet header/trailer: [ ETH | IP | TCP | DATA | FCS ]     = Frame
L1 sends it as:                  10110010 01101... = Bits

Key point: At each router hop, the Layer 2 frame is rebuilt with new source and destination MAC addresses. The Layer 3 source and destination IPs stay the same (unless NAT is used).

OSI vs TCP/IP

OSI	TCP/IP model
7 Application, 6 Presentation, 5 Session	Application
4 Transport	Transport
3 Network	Internet
2 Data Link, 1 Physical	Network Access (Link)

Troubleshooting with the OSI Model

Three common approaches:

Bottom-up: start at Layer 1 and work up. Best when you have no idea where the problem is.
Top-down: start at the application. Good when only one app is broken.
Divide and conquer: start in the middle with a ping (Layer 3). If it works, look up the stack. If it fails, look down.

L1  show interfaces status          ! is the link up? errors?
L2  show mac address-table          ! is the MAC learned in the right VLAN?
L3  ping 8.8.8.8 / show ip route    ! do we have a route and a reply?
L4  telnet host 443 / nc -zv host 443   ! is the port open?
L7  curl -I https://host            ! does the app respond?

Check Yourself

1. What is the PDU at Layer 3?

A packet.

2. A switch makes forwarding decisions using which address?

The destination MAC address (Layer 2).

3. Which layer uses port numbers?

Layer 4, Transport (TCP/UDP).

4. A user can ping a server but the website won't load. Which layers should you check next?

Layer 4 (is TCP 80/443 open or blocked by a firewall?) and Layer 7 (is the web service running?).

5. As a packet crosses a router, which addresses change?

The source and destination MAC addresses change. The IP addresses stay the same unless NAT is in use.