The OSI Model

Networking is a field of thousands of protocols, standards and boxes from vendors who never agreed on anything. The OSI model is the shared filing system that lets you compare any two of them.

The Open Systems Interconnection reference model was published by the ISO to give the industry a common point of reference. It divides everything a network does into seven layers, each responsible for one family of jobs, each depending on the layer beneath it and serving the layer above it.

What the model actually buys you

• A common vocabulary. Saying “this is a Layer 2 problem” tells another engineer more in four words than a paragraph of description would.
• Interoperability reasoning. Two devices can talk if they share a protocol at the layer in question. Your laptop and a web server on the other side of the world have almost nothing in common — but they both speak IP at Layer 3, so they can reach each other.
• A troubleshooting order. Faults can be chased layer by layer instead of guessed at. There is a whole module on this at the end of the lesson.
• Separation of concerns. Fibre replaced copper without rewriting HTTP, because the physical layer changed and nothing above it needed to care.

Think of it as a bookcase

A useful way to picture the model is a bookcase with seven shelves. Similar books are grouped on a shelf; similar protocols and functions are grouped in a layer. The shelves have an order and things generally sit where you expect — but the bookcase is a convenience for finding things, not a law of physics.

Payload, and why the distinction matters

When you load a web page, the thing you actually want is the text and images. Everything else — addresses, ports, checksums — exists only to get that content to you. The generic term for “the data itself, as distinct from the delivery information wrapped around it” is the payload. Every layer treats what it received from the layer above as payload, and adds its own delivery information around it. That single idea is the whole of encapsulation, which you will meet two modules from now.

Seven layers, from the wire up to the software. Click any layer to see what it owns.

Memorising the order

You will need the order cold — plenty of questions do nothing more than ask which layer sits above or below another. Two mnemonics cover both directions:

The whole model on one page

Upper layers and lower layers

Layer 4 is the dividing line. Layers 1 to 3 are the lower or media layers — they are the network’s business, concerned with getting bits from one place to another. Layers 5 to 7 are the upper or host layers — they are the application’s business and run on the endpoints. The transport layer sits between the two, taking messages from above and handing segments below.

Data does not travel down the stack unchanged. Each layer wraps what it was given in its own header — and the wrapped-up result gets a different name at each level.

Protocol data units

A protocol data unit (PDU) is the name for the chunk of information a given layer hands to its peer on the other host. Engineers say “packet” loosely for all of them, but the exam expects the precise name:

Encapsulation, step by step

Walk a single HTTP request from your browser down to the wire and out the other side. Watch what gets added at each step, and what it is for.

Decapsulation on the way up

The receiver reverses the process. Crucially, each layer knows what to do next because the layer below told it: the Ethernet header has an EtherType field saying “this is IPv4”, the IP header has a Protocol field saying “this is TCP”, and the TCP header has a destination port saying “this is for the web server”. That chain of hand-offs is what makes the stack work without any layer needing to understand the others.

Encapsulation

Wrapping data from an upper layer in the header (and sometimes trailer) of a lower layer as it moves down the stack.

Decapsulation

Stripping those headers back off, layer by layer, as data moves up the stack on the receiving host.

PDU

Protocol data unit — the named unit of data at a given layer: data, segment, packet, frame, bits.

Payload

The data being carried, as distinct from the headers wrapped around it to deliver it.

MTU

Maximum transmission unit — the largest payload a link will carry in one frame, commonly 1500 bytes on Ethernet. Anything larger must be fragmented or dropped.

Puts raw bits onto a wire, a fibre, or the air — and defines what a bit physically is.

The physical layer is the only layer that touches anything you can hold. It is concerned with the transmission of bits and with the physical and electrical characteristics of the network. It has no idea what an address is.

How a bit is represented

Data is binary, and something physical has to stand for a 1 and a 0. Two broad approaches:

• Current state modulation — the presence or absence of voltage (on copper) or light (on fibre) represents the bit. Voltage present is a 1, voltage absent is a 0.
• State transition modulation — the change between states represents the bit, rather than the state itself.

Radio adds its own family: amplitude modulation varies signal strength, frequency modulation varies frequency.

Bit synchronisation

Both ends have to agree on where one bit ends and the next begins, or the receiver reads garbage from a perfectly good signal.

Bandwidth usage: baseband and broadband

Multiplexing

Multiplexing is how several conversations share one physical medium.

Also defined here

• Wiring standards — the TIA/EIA-568A and 568B pinouts that say which coloured pair lands on which pin of an RJ45 connector.
• Physical topology — how the cabling is physically laid out: star, bus, ring, mesh, hub-and-spoke. Contrast this with the logical topology, which is a Layer 2 concept.

Devices

Cabling, transceivers and SFPs, repeaters, media converters, patch panels, hubs (legacy).

Packages bits into frames and moves them across a single link, hop by hop.

The data link layer is responsible for:

• Packaging data into frames and transmitting them on the network
• Keeping frames within the maximum transmission unit (MTU) of the media
• Error detection and correction
• Uniquely identifying devices by physical address
• Flow control

The only layer with sublayers

Layer 2 is split in two, and the exam expects you to know which half does what.

MAC addresses

A MAC address is 48 bits, written as twelve hexadecimal digits — for example 58:55:CA:EB:27:83. It splits neatly in half:

Error detection

Devices and protocols

Devices: Switches, bridges, NICs, wireless access points.

Protocols: Ethernet (802.3), Wi-Fi (802.11), STP, VLANs (802.1Q), LACP, PPP, HDLC, ARP*

Forwards data between networks using logical addresses.

Layer 2 moves a frame across one link. Layer 3 is what gets data across a network of networks — it is the layer the internet is built on. Most people think “routing and IP” when they hear network layer, and that is right, but the layer owns more than that.

Logical addressing

Where Layer 2 uses a burned-in physical address, Layer 3 uses a logical address — one that is assigned, can be changed, and carries structure. An IP address encodes both a network and a host within it, which is what makes routing possible at all: a router does not need to know about every host on the internet, only about networks.

Switching techniques at Layer 3

“Switching” here means deciding how data should be forwarded — not the Layer 2 box on your rack. Three techniques:

Route discovery and selection

A router forwards using its routing table, which gets populated three ways:

• Directly connected — networks the router has an interface on
• Static routes — entered by hand by an administrator
• Dynamic routing protocols — OSPF, EIGRP, BGP and RIP, which learn routes from neighbouring routers and adapt when topology changes

Connection services

Layer 3 offers its own reliability helpers, which matter when the data link layer’s LLC sublayer is not providing them:

• Flow control (congestion control) — stop a sender transmitting faster than the receiver can absorb
• Packet reordering — reassemble packets into the right sequence, which is needed because load balancing across multiple links can deliver them out of order

Inside the IPv4 header

Two fields are worth committing to memory. TTL (time to live) is decremented by one every time the packet passes through a router; at zero the packet is discarded, which is what stops a routing loop consuming the network forever — and it is also the mechanism traceroute exploits to map a path. Protocol names the Layer 4 protocol inside: 6 for TCP, 17 for UDP, 1 for ICMP.

Devices and protocols

Devices: Routers, multilayer (Layer 3) switches, Layer 3 firewalls.

Protocols: IPv4, IPv6, ICMP, IPsec, OSPF, EIGRP, BGP, RIP, NAT

Decides whether delivery is reliable, and which application on the host gets the data.

The transport layer is the dividing line in the model. Messages from the upper layers (5–7) are taken and encapsulated into segments for the lower layers (1–3); data arriving from below is decapsulated and passed up. It answers two questions: how reliable does this need to be, and which application is it for.

TCP versus UDP

Flow control at Layer 4

Two mechanisms, and they are not the same thing:

• Windowing — the sender transmits several segments before pausing for an acknowledgement, and a single acknowledgement can cover the whole window. TCP uses a sliding window: it starts small, and the window grows as acknowledgements come back cleanly. If an acknowledgement fails to arrive within the round-trip time, or a configured maximum is reached, growth stops.
• Buffering — a device such as a router holds segments in a queue when there is not enough bandwidth to send them right now. Queues are finite, so sustained congestion eventually means drops.

Ports

A port number identifies which application on a host the data belongs to. It is 16 bits, so the range is 0 to 65535, and it splits into three bands:

Socket

The combination of an IP address and a port number. A pair of sockets — one at each end — uniquely identifies a single conversation.

Round-trip time (RTT)

How long it takes for a segment to reach the receiver and its acknowledgement to come back. TCP uses it to decide when a segment is lost.

Segmentation

Splitting an upper-layer message into pieces small enough for the network to carry, and numbering them so the receiver can reassemble.

The three layers above transport run on the hosts, not on the network. In practice they are often handled together by a single protocol — which is exactly why the TCP/IP stack collapses them into one. The exam still expects you to separate them.

Layer 5 — Session

Sets up, maintains and tears down the conversation between two applications.

A session is a conversation that must be kept distinct from other conversations, so data from two of them never intermingles. The layer’s job splits three ways:

Example protocol: SIP, which sets up, maintains and tears down voice and video calls. NetBIOS and RPC are also commonly cited here.

Layer 6 — Presentation

Translates data into a format both ends agree on, and encrypts or compresses it.

• Data formatting. One application may encode text as ASCII and another as EBCDIC; the presentation layer translates so both sides understand the same bytes. The same applies to media formats — JPEG, GIF, MPEG.
• Encryption. Scrambling data so an interceptor cannot read it, and unscrambling it for the intended recipient. TLS is the protocol usually placed here.
• Compression. Shrinking the data before it is handed down.

Layer 7 — Application

Provides network services to software, and advertises what is available.

• Application services — the network-facing services software calls on: file sharing, email, name resolution, web.
• Service advertisement — some services announce themselves periodically (a networked printer broadcasting its availability); others register with a central directory such as Active Directory, which other devices then query.

Sorting the upper three

The OSI model was designed to be generic. Almost every network you will touch runs TCP/IP — so there is a second, four-layer model that describes the same journey with less ceremony.

The TCP/IP stack, also called the DoD model, was developed by the US Department of Defense. It has four layers rather than seven, and the difference is entirely in where the boundaries are drawn — nothing is missing.

Why both models still exist

The four-layer model is easier to apply: you rarely have to agonise over whether something is session or presentation, because the question does not arise. SIP is a good example — placing it in OSI takes some thought, but in TCP/IP it is obviously an application layer protocol that gets encapsulated inside TCP.

The seven-layer model won the vocabulary war anyway. Nobody says “a network interface layer problem”; they say “a Layer 2 problem”. Even engineers working purely in TCP/IP use the OSI numbers, which is precisely why the exam tests the model you use less and talk about more.

One request, all seven layers, real numbers. This is the scenario most OSI exam questions are a slice of.

A client at 10.1.1.1 loads a page from a web server at 172.16.1.2. Here is what each layer contributes on the way out.

Addresses and ports, both directions

What changes at each router along the way

The packet crosses several routers before it arrives. At each one the same three things happen, and nothing else:

1. The incoming frame is discarded entirely after its FCS is validated — Layer 2 addressing only ever described that one link.
2. The TTL is decremented by one, and the header checksum recalculated. If TTL hits zero the packet is dropped and an ICMP time-exceeded message is returned to the sender.
3. A new frame is built with the router’s own MAC as source and the next hop’s MAC as destination, and it goes back out.

The IP addresses, the ports and the payload are untouched from end to end — unless NAT is in the path, in which case the source IP address and port are rewritten at the network boundary (Layers 3 and 4), which is precisely why NAT is described as operating there.

This is why the model earns its place on the exam. A layered model turns “the internet is broken” into a sequence of questions with definite answers.

Three approaches

Symptom to layer

Place these faults

Twelve questions across everything in this lesson. Every answer comes with an explanation — read them even when you get it right.

Where to go next

You now have the framework every other Network+ topic hangs off. When you meet a new protocol or device, the first question worth asking is which layer it lives at — the answer usually tells you most of what it does.