The OSI Model: Seven Layers of Networking

The OSI Model: Seven Layers of Networking

What you'll learn

• Name the seven OSI layers in order and state each layer's job in one sentence
• Recognize which common devices operate at which layer
• Explain why the industry still speaks "OSI" even though real networks run TCP/IP
• Use the model as a bottom-up troubleshooting ladder
• Spot two classic layer-placement mistakes (the TCP handshake and IPsec) before they become habits

One problem, sliced into seven

This lesson builds on Chapter 2 of Dr. Tahseen Al-Doori's Network Essentials, the academic backbone of this course. Chapter 2 asks the question every networking student must answer early: when your computer sends data to another computer, what actually has to happen along the way?

The honest answer is: a lot of very different things. Something must turn your data into electrical voltage, light pulses or radio waves. Something must make sure the data reaches the right machine on your local network, and something else must carry it across the world to a network it has never seen. Something must chop a large file into pieces and reassemble it in order. Something must present the result in a format your application understands.

No single piece of software or hardware could do all of that well, so engineers used their oldest trick: divide the problem. In 1984 the International Organization for Standardization (ISO) published the OSI reference model — OSI stands for Open Systems Interconnection — which describes network communication as a stack of seven layers. A layer is one slice of the overall job, with a defined responsibility. Each layer provides a service to the layer above it and relies on the services of the layer below it, the way a courier relies on airlines without needing to know how to fly a plane.

Two more words you will use forever: a protocol is a set of rules that both sides of a communication agree to follow (the next lessons are devoted to this idea), and "the stack" is the everyday name for the layered software in your computer that implements those rules.

A popular memory aid for the layers, from bottom to top — Physical, Data Link, Network, Transport, Session, Presentation, Application — is "Please Do Not Throw Sausage Pizza Away."

The seven layers, bottom to top

Layer 1 — Physical. The physical layer turns 1s and 0s into signals appropriate for the medium — voltage changes on copper wire, light pulses in fiber, radio waves in the air — and turns received signals back into 1s and 0s. It is the only layer where data physically exists in the world. Hardware that lives here includes network adapters (in their signaling role), repeaters, hubs, modems and media converters, plus every cable and connector. When a cable is unplugged or a link light is dark, you have a physical-layer problem.

Layer 2 — Data Link. The data link layer delivers frames — the layer's parcels of data — between devices on the same local network. It addresses each frame with a MAC address, a hardware identifier assigned to every network interface (Module 4 covers MAC addresses in depth), and it error-checks frames so damaged ones are discarded rather than passed upward. The standards split this layer into two sublayers — Logical Link Control (LLC), which hands frames to the correct upper protocol, and Media Access Control (MAC), which governs addressing and access to the shared medium. Switches, bridges, network cards and wireless access points do their primary work here.

Layer 3 — Network. The network layer moves packets from network to network using logical addresses — in practice, IP addresses. Routers live here: they consult route tables to decide which direction a packet should travel next, hop by hop, until it reaches the destination network. Traditional firewalls also make their decisions at this layer. One resident worth flagging now: ICMP, the messenger protocol behind the ping command, is a network-layer companion of IP — file that fact away, because the next lesson shows why it is a classic exam trap.

Layer 4 — Transport. The transport layer manages delivery between the two end computers: it divides the outgoing data stream into segments, numbers them, and steers arriving data to the right application using port numbers. Two personalities live here. TCP is connection-oriented: it opens a connection with the famous three-way handshake, acknowledges what arrives, and retransmits what doesn't. UDP is connectionless: it sends without ceremony, trading guarantees for speed. Remember where the handshake lives — layer 4, inside TCP. We will need that fact again shortly.

Layer 5 — Session. The session layer establishes, maintains and ends dialogues between applications, deciding when a conversation is open and when it is finished. A classic analogy from Dr. Al-Doori's course pictures the session layer as the jockey and the transport layer as the horse: the horse keeps running — moving data — until the jockey signals that the race is over. An honest note for the real world: in the TCP/IP software your computer actually runs, most session duties are absorbed by TCP and by the applications themselves.

Layer 6 — Presentation. The presentation layer handles format: character encodings, compression, and (conceptually) encryption and decryption, so that data produced on one system is readable on another. In practice these jobs are performed by libraries inside applications rather than by a distinct software layer — one reason the seven-layer picture is better treated as vocabulary than as a blueprint of your operating system.

Layer 7 — Application. The application layer is where network-aware application protocols operate: HTTP for the web, SMTP for sending mail, FTP for file transfer in the book's era. A precision that separates professionals from beginners: your browser is not layer 7 — HTTP, the protocol your browser speaks, is. And the counterpart application must actually be running to answer: request a page and close your browser before it arrives, and the conversation simply dies.

Here is the device map you will use constantly:

Modern devices usually work at several layers at once; we classify each by the highest layer it uses to make its forwarding decision.

Two corrections before they become habits

Textbooks accumulate small errors over years of printings, and part of studying well is correcting them without drama. Two from the 2007 edition of Chapter 2 matter here:

• The three-way handshake belongs to TCP, at the transport layer. The book's session-layer pages mention a "Session Control Protocol (SCF)" that initiates the handshake. No such protocol exists in the standard TCP/IP suite — the SYN, SYN-ACK, ACK exchange is defined by TCP itself (its current specification is RFC 9293). A common confusion, easy to absorb, worth un-learning early.
• IPsec operates at the network layer, not the transport layer. A presentation-layer aside in Chapter 2 places IPsec — a suite that encrypts and authenticates traffic — at transport. IPsec actually protects IP packets themselves, which makes it a network-layer technology; the book's own security chapter later describes it that way. When you meet IPsec properly in Module 7, remember: layer 3.

Neither correction diminishes the chapter. The layered map it teaches is exactly right — these are pins placed one row off, now moved back.

Does anyone still teach OSI? (from the textbook to 2026)

A fair question, and a genuinely open debate in 2026. One camp — including influential modern textbooks such as Kurose and Ross's Computer Networking: A Top-Down Approach — argues that since real networks run the TCP/IP model (next lesson), courses should teach that model and skip OSI's seven layers, which never matched deployed software. The other camp points out that the industry speaks OSI every working day: engineers say "layer 2 switch," "that's a layer 3 problem," "L7 filtering" in job interviews, vendor datasheets and trouble tickets, and the model remains an excellent diagnostic checklist.

This course takes the position the book itself models: OSI is the vocabulary and the troubleshooting ladder; TCP/IP is the reality. You learn OSI to communicate with every network professional on Earth and to structure your diagnosis; you learn TCP/IP to understand what your machine actually does. You need both, and after this module you will have both.

The troubleshooting ladder

The model's greatest practical gift is an ordered checklist. When something breaks, start at layer 1 and climb: Is it plugged in — does the link light glow? (Physical.) Is the local network delivering frames? (Data link.) Can you ping your own address, your gateway, the far machine? (Network.) Is the right port open and the service configured? (Transport and up.) Lower layers are the cheapest to check and the most common culprits, so climbing bottom-up eliminates simple explanations before expensive ones — and each test you pass certifies every layer below it. In Module 8 you will run the book's classic investigation of a print job that never prints, climbing this exact ladder step by step.

Keep the map beside you from now on: Download: OSI and TCP/IP Model Reference — a one-page card with both models side by side. Print it; you will reach for it throughout the course.

Worksheet: Layer-Mapping Drill

Instructions. For each everyday networking event below, name the OSI layer (1–7) where the event primarily happens, and one reason. Work from the layer jobs above — don't peek at the self-check until all twelve are done.

1. Your Wi-Fi router converts outgoing data into radio waves.
2. An Ethernet cable is unplugged and the port's link light goes dark.
3. A switch reads the destination MAC address of an incoming frame and forwards it out a single port.
4. Your laptop discards a received frame because its error check fails.
5. A router examines a packet's destination IP address and picks the best next hop from its route table.
6. You run ping and an ICMP echo request leaves your machine.
7. A file download stalls, and missing segments are retransmitted after acknowledgments fail to arrive.
8. A live video call uses UDP because a lost fraction of a second is better than a late one.
9. Arriving data carrying destination port 443 is handed to your browser rather than your email program.
10. After all data is received, the dialogue between the two applications is formally closed.
11. A web server compresses a page and the browser decompresses it; text arrives encoded as UTF-8 and is rendered readably.
12. Your mail program speaks SMTP to hand a finished message to the mail server.

Deliverable. A twelve-row table: event number → layer number and name → one-line justification.

Self-check (answers).

1. Layer 1 — Physical. Turning bits into radio signals is the physical layer's defining job.
2. Layer 1 — Physical. Cables, connectors and link state are physical-layer territory.
3. Layer 2 — Data Link. Forwarding by MAC address is the switch's layer-2 decision.
4. Layer 2 — Data Link. Frame error-checking (and discarding damaged frames) happens here.
5. Layer 3 — Network. Routing packets between networks by IP address is the layer's core function.
6. Layer 3 — Network. ICMP is a network-layer companion of IP — not a transport protocol.
7. Layer 4 — Transport. Acknowledgment and retransmission are TCP's transport-layer services.
8. Layer 4 — Transport. Choosing UDP's connectionless delivery is a transport-layer decision.
9. Layer 4 — Transport. Port numbers steering data to applications belong to the transport layer.
10. Layer 5 — Session in OSI's vocabulary: naming the duty of opening and closing a dialogue. Worth noting the tension with item 7 and with this lesson's correction: on a real TCP/IP stack the close is TCP's own FIN exchange at layer 4, exactly as the opening handshake was. OSI names the responsibility; TCP performs it. Accept layer 4 as equally right if you justified it that way.
11. Layer 6 — Presentation. Compression and character-format translation are presentation functions.
12. Layer 7 — Application. SMTP is an application-layer protocol.

Ten or more correct: you own the map. Fewer: re-read the layer whose events you missed — the errors cluster, and the cluster tells you exactly what to review.

Check yourself

1. A user can ping her own IP address, her default gateway and a colleague's PC, but no web page loads in any browser. Which layers has her successful pinging already certified, and in which direction should she look next?
2. You read this output on a workstation: Reply from 192.168.1.1: bytes=32 time=2ms TTL=64. Which command produced it, which protocol did the test use, and at which OSI layer does that protocol operate?
3. A colleague says: "IPsec does encryption, and encryption is presentation, so IPsec is a layer 6 technology." Give the correct placement and a one-sentence justification.
4. During an interview you're asked: "The three-way handshake — which layer, and which protocol owns it?" Answer, and explain why "a session-layer control protocol" would be the wrong reply.
5. A frame arrives at a switch carrying a destination MAC address the switch has never seen. The switch floods it out every port except the one it arrived on. At which layer is the switch making this decision, and why is it not a network-layer decision?
6. A packet-capture tool shows one captured unit dissected as: Ethernet II · Internet Protocol Version 4 · Transmission Control Protocol · HTTP. Map each of the four bands to its OSI layer.

Answers

1. Successful pings certify layers 1–3: signals flow, frames deliver locally, and packets route to and beyond the gateway. The fault must sit higher — transport or application: think blocked ports, a failing name-lookup service, or browser/proxy configuration. (Ping's success says nothing about layers 4–7.)
2. The ping command; it uses ICMP, which operates at layer 3, the network layer, riding inside IP.
3. IPsec operates at layer 3, the network layer: it encrypts and authenticates IP packets themselves, regardless of what application data they carry. Encryption can occur at several layers — the layer is determined by what gets protected, not by the act of encrypting.
4. Layer 4, transport — the handshake is defined by TCP (SYN, SYN-ACK, ACK). Some older materials, including our textbook's 2007 printing, attribute it to a session-layer protocol, but no such protocol exists in the TCP/IP suite; the exchange is TCP's own.
5. Layer 2, data link: the switch's decision reads only MAC addresses. It never examines IP addresses, so it cannot be making a network-layer (routing) decision.
6. Ethernet II → layer 2 (data link); IPv4 → layer 3 (network); TCP → layer 4 (transport); HTTP → layer 7 (application). The capture shows no distinct session or presentation bands — real stacks fold those duties into TCP and the application, exactly as this lesson noted.

Key terms

• OSI model — the seven-layer reference model (ISO, 1984) describing network communication as stacked, single-responsibility services.
• Layer — one slice of the communication job, serving the layer above and using the layer below.
• Protocol — an agreed set of rules both sides of a communication follow.
• Frame — the data link layer's unit of data, addressed by MAC and error-checked.
• Packet — the network layer's unit of data, addressed by IP and routed between networks.
• Segment — the transport layer's unit of data, numbered and steered by port.
• MAC address — the hardware identifier of a network interface, used for local delivery (detailed in Module 4).
• IP address — the logical address used to route packets between networks (detailed in Module 4).
• Port — the transport-layer number that steers data to the right application (detailed in Module 5).
• Three-way handshake — TCP's connection-opening exchange: SYN, SYN-ACK, ACK.
• IPsec — a network-layer suite that encrypts and authenticates IP packets (detailed in Module 7).
• Troubleshooting ladder — diagnosing bottom-up through the layers, cheapest checks first.

Summary

• The OSI model divides network communication into seven layers, each providing services upward and consuming services downward.
• Bottom to top: Physical (signals), Data Link (frames, MAC), Network (packets, IP, routing), Transport (segments, ports, TCP/UDP), Session (dialogues), Presentation (format), Application (network-aware protocols like HTTP).
• Devices classify by their decision layer: hubs and cabling at 1, switches and NICs at 2, routers and firewalls at 3.
• Two textbook-era corrections: the three-way handshake belongs to TCP at layer 4, and IPsec operates at layer 3.
• OSI survives as the industry's shared vocabulary and as a superb bottom-up troubleshooting ladder, while real stacks implement the TCP/IP model.
• Session and presentation duties are, in practice, folded into TCP and applications — expect five bands, not seven, in real captures.
• Keep the model card handy: you will use it in every remaining module.

Next lesson

Now that you can name the layers, we trade the reference model for reality: the four-layer TCP/IP model, the wrapping process called encapsulation — and your first look at live network traffic in Wireshark.

Sources and further study

• Al-Doori, T., Network Essentials, Chapter 2 (OSI Model) — the academic backbone of this module.
• Cloudflare Learning Center, "What Is the OSI Model?" — https://www.cloudflare.com/learning/ddos/glossary/open-systems-interconnection-model-osi/
• Kurose, J. & Ross, K., Computer Networking: A Top-Down Approach (companion site) — https://gaia.cs.umass.edu/kurose_ross/index.php — the leading example of the "teach TCP/IP first" school discussed above.
• RFC 9293, "Transmission Control Protocol (TCP)" — https://www.rfc-editor.org/info/rfc9293/ — the current TCP specification, home of the three-way handshake.