Last updated · reviewed for accuracy
The OSI Model
By the end of this lesson the seven layers stop being a mnemonic to recite and become a checklist you can run a real web request through, and a shared language for saying exactly where things break.
What is the OSI model?
The OSI model is a seven-layer reference model that splits network communication into stacked responsibilities, from physical signalling at layer 1 to application data at layer 7. Each layer solves one problem and relies on the layer beneath it, giving engineers a shared vocabulary for design and troubleshooting.
It is not how software is literally written (the internet runs on the leaner TCP/IP stack) but it survives because it is a superb vocabulary. When a colleague says “sounds like a layer 2 problem,” they have excluded half the universe of causes in five words.
What does each layer do?
Layers 1–4 move data: physical signals, switched frames, routed packets, and end-to-end transport. Layers 5–7 make data meaningful: sessions, representation and encryption, and finally the application protocols like HTTP and DNS that users actually touch.
| Layer | Name | Unit | Lives here | A failure looks like |
|---|---|---|---|---|
| 1 | Physical | bits | Cables, radio, optics | No link light at all |
| 2 | Data link | frames | Ethernet, switches, MACs | Works on one switch port, not another |
| 3 | Network | packets | IP, routers | Can ping the LAN, nothing beyond it |
| 4 | Transport | segments | TCP, UDP, ports | Ping works but the port is closed |
| 5 | Session | – | Dialog control | Logins that drop mid-conversation |
| 6 | Presentation | – | TLS, encodings | Certificate warnings, garbled text |
| 7 | Application | data | HTTP, DNS, SMTP | Page loads but the app misbehaves |
How does encapsulation work?
Each layer wraps the data from the layer above in its own header, like nested envelopes: an HTTP request rides inside a TCP segment, inside an IP packet, inside an Ethernet frame. The receiving host unwraps the envelopes in reverse order, each layer reading only its own header.
application GET /learn/subnetting.html HTTP/1.1 transport TCP src 51742 → dst 443, seq 1 network IP 10.0.0.5 → 84.32.84.32 data link ETH b8:27:eb… → gateway MAC physical …10110010 on the wire
Open any packet in Wireshark and you will see exactly these nested headers: the capture pane is an encapsulation diagram that happens to be real.
How do you troubleshoot with layers?
Work bottom-up and let each layer clear the one below: check the link light (1–2), ping the gateway (3), test the port (4), then blame the application (7). The layer where the test first fails is where the problem lives: everything above it is a symptom.
- Link light on? If not, stop. It’s physical.
pingthe default gateway. Failure here is addressing or switching.pingsomething beyond the gateway. Failure here is routing.- Test the actual port (
curl, telnet). Reachable host, closed port → layer 4+.
See the layers for real
Capture your own traffic in Wireshark basics and watch every layer of this lesson appear in the packet detail pane. Then meet the model the internet actually runs on: The TCP/IP stack.
Frequently asked questions
Which layer does a switch operate at? A router?
A plain switch forwards frames using MAC addresses, so it is a layer 2 device; a router forwards packets using IP addresses, layer 3. Layer 3 switches blur the line by doing both in one box, but the functions remain distinct: switching moves frames inside a network, routing moves packets between networks.
Is the OSI model actually used, or is it just theory?
The internet runs on TCP/IP, not on a literal OSI implementation, but OSI is used every day as vocabulary. Job interviews, vendor documentation, firewall rules (“layer 7 filtering”) and troubleshooting conversations all lean on the layer numbers, which is why it is still taught first.
What layer is TLS?
Practically, TLS sits between transport and application: it rides on TCP and wraps application data. Textbooks often file it under layer 6 (presentation) because it transforms and encrypts representation. Both answers are defensible; saying “between 4 and 7” with the reasoning is the strongest interview answer.
What is the best mnemonic for the layers?
Bottom-up, “Please Do Not Throw Sausage Pizza Away” (Physical, Data link, Network, Transport, Session, Presentation, Application) is the classic. But mnemonics fade: tracing one real request through all seven layers, as this lesson does, is what makes the order stick permanently.