OSI Model

What is it?

The Open Systems Interconnection model is an ISO standard (ISO/IEC 7498) that splits communication into seven layers. Each layer offers a service to the layer above and uses the layer below. It is a teaching and troubleshooting map — the internet’s running stack is TCP/IP, which cuts the same job into four layers.

Why does it matter?

Without a shared layering, every conversation about a failure becomes a fight about whose job it was. The OSI model lets you ask: is this a cable, a MAC table, a route, a TCP handshake, or an HTTP header? That question is how you debug, how you interview, and how you design.

Mental model

Picture a letter. You write words (application), agree on a language and envelope format (presentation/session), the post office guarantees the letter (transport), routing takes it across cities (network), trucks hop between stations (data link), and the road actually exists (physical). Encapsulation is putting a new wrapper on at each floor going down; decapsulation is unwrapping going up on the other side.

How it works

• Layer 7 Application — application data and protocols people name: HTTP, DNS, SMTP, SSH, DHCP.
• Layer 6 Presentation — encoding, compression, encryption. In TCP/IP this is folded into the application (TLS is the usual example).
• Layer 5 Session — establishing, managing, and tearing down a dialog. Thin on the internet; RPC and NetBIOS made it more explicit.
• Layer 4 Transport — process-to-process. Ports, segments/datagrams, reliability and congestion control (TCP) or not (UDP).
• Layer 3 Network — host-to-host across hops. IP packets, logical addresses, routing, ICMP.
• Layer 2 Data Link — hop-to-hop frames. MAC addresses, Ethernet, switches, error detection.
• Layer 1 Physical — bits on a medium. Connectors, signaling, fiber, copper, radio.
• A layer should not need the internals of the layers below — only their service. That is the point of the split.

Steps

• A browser wants https://example.com/index.html.
• Application: HTTP request bytes. Presentation/session (in practice, TLS + HTTP): encrypt and frame a record.
• Transport: TCP wraps a segment, source and dest ports, sequence numbers.
• Network: IP wraps a packet, source and dest IP, TTL.
• Data link: Ethernet wraps a frame, source and dest MAC, EtherType 0x0800.
• Physical: the frame is serialized onto the wire as bits.
• Each hop on the path strips L2, looks at L3, wraps a new L2 for the next hop. Only the endpoints unwrap L4–L7.

Implementation

Nothing in the kernel is literally 'the OSI module'. Linux has sockets (L4 interface), an IP stack (L3), netdevices and qdiscs (L2/L1). Wireshark’s packet view is the closest everyday OSI diagram: Frame / Ethernet / IP / TCP / TLS / HTTP stacked on one capture.

Complexity and trade-offs

Real-world usage

• Troubleshooting: 'ping works, TCP does not' is an L3 vs L4 split.
• Certification and interviews: name the PDU, address, and device at each layer.
• Design: decide whether a feature belongs in the app, the transport, or the network.

Common mistakes

• Treating OSI as what the internet runs. It is not. TCP/IP is.
• Putting TLS exclusively in layer 6 as if the RFCs agreed. TLS is an application-layer protocol over TCP (or a transport in QUIC).
• Saying a router 'works at layer 3' and stopping. A router has L1 ports, L2 encapsulations, and often L4 ACLs.
• Confusing PDU names: data / segment / packet / frame / bits.

Interview questions

Prerequisites

• What is Networking?

Related concepts

• TCP/IP Model
• Layer 7 — Application
• Layer 1 — Physical

Continue learning

• Layer 7 — Application