Master the layered architecture that underpins every network you'll troubleshoot.
The Open Systems Interconnection (OSI) model, developed by ISO in 1984, provides a conceptual framework for understanding network interactions as seven distinct layers. Each layer serves the one above it and is served by the one below.
What it does: Provides network services directly to end-user applications. This is where users interact with the network through software like browsers, email clients, and file transfer apps.
Key functions: Service discovery, user authentication, data format conversion, session management coordination.
When you open a web browser and type google.com, the Application layer prepares your request — formatting the HTTP GET method, adding headers, and passing it down to the next layer for transport.
What it does: Translates data between the application format and the network format. Handles encryption, compression, and character encoding so that data from one system can be read by another.
Key functions: Data encryption/decryption (TLS/SSL), compression/decompression, character set conversion (ASCII to UTF-8).
TLS (Transport Layer Security) sits at this boundary — when your browser establishes an HTTPS connection, the Presentation layer encrypts the data before handing it to the Transport layer.
What it does: Establishes, manages, and terminates connections (sessions) between two applications. Handles dialogue control — whether communication is simplex, half-duplex, or full-duplex.
Key functions: Session establishment and tear-down, checkpointing (for long transfers), dialog control.
A video conferencing app uses the Session layer to establish a dialogue with a remote participant, manage the exchange of audio and video streams, and cleanly terminate the session when either party hangs up.
What it does: Provides end-to-end communication between devices. Ensures complete data transfer with error checking, flow control, and segmentation/reassembly. Determines whether to use connection-oriented (reliable) or connectionless (fast) delivery.
Key functions: Segmentation, error detection/correction, flow control, congestion control, multiplexing via ports.
When downloading a file, TCP (Transport Control Protocol) segments the data, acknowledges each piece received, retransmits lost packets, and manages the speed to avoid overwhelming the receiver. A live video stream may use UDP instead for lower latency despite occasional packet loss.
What it does: Handles logical addressing and routing. Determines the best path for data to travel from source to destination across multiple networks (internetworking).
Key functions: Logical addressing (IP addresses), routing decisions, path determination, fragmentation, reverse path forwarding.
Your router examines the destination IP address in each packet and consults its routing table to determine which interface should forward the packet toward its final destination — possibly hopping through several routers across the internet.
What it does: Provides node-to-node data transfer on the same physical network segment. Handles physical addressing (MAC addresses), error detection (not correction), and access to the physical medium.
Sub-layers: LLC (Logical Link Control) — frames packets and handles error checking. MAC (Media Access Control) — controls how devices gain access to the medium and permission to transmit.
When your computer sends a frame to your router on the local LAN, the Data Link layer adds the source and destination MAC addresses, wraps the IP packet in a frame, and appends a Frame Check Sequence (FCS) for error detection.
What it does: Transmits raw bit streams over a physical medium. Defines electrical, mechanical, procedural, and functional specifications for activating, maintaining, and deactivating the physical link.
Key functions: Bit-level transmission, cabling specifications, connector types, signal encoding, voltage levels, topologies.
A Cat6 Ethernet cable carrying 1 Gbps signals uses specific voltage levels, wire pair twisting patterns, and RJ-45 connectors. The Physical layer defines exactly how those electrical pulses represent 1s and 0s traveling across the copper wires.
The TCP/IP model, developed by the U.S. Department of Defense, is the practical model that powers the modern Internet. It condenses the OSI's 7 layers into 4 functional layers.
Covers: OSI Application + Presentation + Session layers combined.
Protocols: HTTP, HTTPS, FTP, SMTP, DNS, SSH, SNMP, DHCP
In practice, the concerns of session management, data formatting, and application interaction are handled together by application-layer protocols. The TCP/IP model prioritizes practical implementation over strict theoretical separation.
Covers: Same as OSI Transport layer.
Protocols: TCP, UDP
Key concept: End-to-end reliability. TCP guarantees delivery; UDP provides fastest delivery without guarantees.
Covers: Same as OSI Network layer.
Protocols: IP (IPv4/IPv6), ICMP, IGMP, ARP (sometimes placed at Link layer)
Key concept: Logical addressing and routing across networks. Packets are addressed with IP and routed hop-by-hop.
Covers: Same as OSI Data Link + Physical layers combined.
Protocols: Ethernet, Wi-Fi (802.11), PPP, ARP, VLAN tagging
Key concept: Physical transmission media and local network delivery using MAC addresses.
| OSI Layer | Protocol Data Unit (PDU) | Key Protocols | Primary Devices | Addressing |
|---|---|---|---|---|
| 7 — Application | Data | HTTP, FTP, SMTP, DNS, SSH, SNMP | — | Application-level identifiers |
| 6 — Presentation | Data | TLS/SSL, JPEG, MPEG, ASCII, UTF-8 | — | Encoding formats |
| 5 — Session | Data | NetBIOS, RPC, SIP, NFS | — | Session IDs |
| 4 — Transport | Segment (TCP) / Datagram (UDP) | TCP, UDP, SCTP | Firewall, Load Balancer | Port numbers |
| 3 — Network | Packet | IPv4, IPv6, ICMP, IPsec, OSPF, BGP | Router, Layer 3 Switch | IP addresses |
| 2 — Data Link | Frame | Ethernet, PPP, ARP, VLAN, HDLC | Switch, Bridge, Hub | MAC addresses |
| 1 — Physical | Bits | USB, DSL, T1/E1, Fiber, Copper | Hub, Repeater, NIC | Electrical/optical signals |
Encapsulation is the process of wrapping data with protocol information as it moves down the layers on the sending side. De-encapsulation is the reverse — stripping headers as data moves up the layers on the receiving side.
At the destination, each layer removes its corresponding header: Physical converts bits back to frames → Data Link strips MAC headers to reveal packets → Network strips IP headers to reveal segments → Transport strips port info to reveal data → Upper layers process the original application data.
| Layer | PDU Name | What Gets Added |
|---|---|---|
| Application / Presentation / Session | Data | User data / API calls |
| Transport | Segment (TCP) / Datagram (UDP) | Source port, Destination port, Seq/Ack numbers, Flags |
| Network | Packet | Source IP, Destination IP, TTL, Protocol field |
| Data Link | Frame | Source MAC, Destination MAC, EtherType, FCS |
| Physical | Bits | Electrical/optical signal representation |
| Aspect | OSI | TCP/IP |
|---|---|---|
| Number of layers | 7 | 4 |
| Model type | Reference model | Protocol suite |
| Development | Theory first, protocols later | Protocols first, model later |
| Transport reliability | Both connectionless & oriented at Network layer | Only Transport layer supports both |
| Real-world use | Troubleshooting framework | Actual Internet operation |
| Adoption | Educational standard | Internet standard |
A structured, layer-by-layer approach prevents wasted effort. Start at the bottom (Physical) and work up — most problems are at lower layers.
Step 1: Identify the symptom and scope (one host? entire subnet? internet-wide?)
Step 2: Check Layer 1 — cables connected? link lights on? correct cable type?
Step 3: Check Layer 2 — MAC learning? VLAN configuration? spanning tree blocking?
Step 4: Check Layer 3 — IP configuration? routing tables? ACLs blocking traffic?
Step 5: Check Layer 4 — firewall rules? port conflicts? service listening?
Step 6: Check Layers 5-7 — application errors? DNS resolution? certificate issues?
| Layer | Common Symptoms | Diagnostic Commands | Common Fixes |
|---|---|---|---|
| L1 — Physical | No link, intermittent connectivity, collisions | show interfaces, cable tester, ping localhost | Replace cable, renegotiate duplex, check power |
| L2 — Data Link | Same-subnet unreachable, MAC Flooding, VLAN mismatch | arp -a, show mac address-table, show vlan | Verify VLAN config, clear ARP cache, check switch port |
| L3 — Network | Can't reach remote networks, routing loops | ping, traceroute, show ip route, ipconfig /all | Fix default gateway, update routing table, check ACLs |
| L4 — Transport | Service unreachable, connection refused | netstat -an, telnet <host> <port>, ss -tulpn | Start service, adjust firewall, verify port not blocked |
| L5-7 — Session/App | Application errors, slow responses, auth failures | nslookup, curl -v, browser dev tools, log inspection | Restart service, renew certificates, fix DNS, update config |