Networks

Learning the basics of the OSI model

The 7 layers of the OSI model explained one by one: data unit, protocols, devices, common mistakes, the journey of an HTTP request, and a TCP/IP comparison.

· 16 min read · level: beginner

1. Introduction to the OSI model

In the early days of networked computing, no common set of rules governed communication between machines. Each vendor had its own proprietary solution. The problem was that one vendor's solution was not compatible with another's.

The OSI model addresses this problem by dividing communication into seven layers.

An open model, published and accepted by all manufacturers, makes it possible to build networks that are compatible with one another.

2. What the OSI model describes, and what it does not

OSI stands for Open Systems Interconnection. It is a reference model published by the ISO (International Organization for Standardization): the reference model appeared in 1984 under the reference ISO 7498, and the current edition dates from 1994, under the reference ISO/IEC 7498-1, co-signed with the IEC (International Electrotechnical Commission). This document provides no software and no cable: it divides the work required to make two machines communicate into seven distinct functions, numbered from 1 (the closest to the physical medium) to 7 (the closest to the user program).

The operating principle can be stated in two sentences. Each layer provides a specific service to the layer above it, and relies on the service of the layer below it. Each layer logically communicates with the layer of the same rank on the machine at the other end, adding to the data it receives a header, sometimes completed by a trailer such as the checksum of an Ethernet frame, intended for that peer layer.

  • Layer: a set of network functions grouped together because they deal with the same type of problem.
  • Protocol: the set of rules that two layers of the same rank apply in order to understand each other (message format, order of exchanges, allowed values).
  • Header: the control bytes added in front of the data by a layer, intended for the peer layer.
  • PDU (Protocol Data Unit): the generic name for what a layer handles. Each layer gives it a common name: bit at layer 1, frame at layer 2, packet at layer 3, segment (TCP) or datagram (UDP) at layer 4; above that, one simply speaks of data, and of message for layer 7.
  • Encapsulation: the action of wrapping the data of the upper layer in a new unit, moving down from layer 7 to layer 1.

A useful clarification from the start: the OSI model is a description framework, not the software stack that makes the Internet work. A complete OSI protocol stack did exist, but it was not adopted in practice. It is the protocols of the TCP/IP family that actually travel over networks, and they do not always fit neatly into an OSI box. The model is still taught and used because it provides a common vocabulary and an orderly diagnostic method.

3. The lower layers: from signal to end-to-end dialogue

Layers 1 to 4 carry the data. They do not interpret the content of what they transport: their job is to make a sequence of bytes arrive from one point to another, with no detected error and in the correct order when the chosen protocol guarantees it.

Layer 1 — Physical

The physical layer transports bits, that is, 0s and 1s turned into a real signal: an electrical voltage on copper, a light pulse in an optical fiber, a radio wave. Its data unit is the bit. It also defines the connector and its pinout, the signal encoding, the maximum length of the medium, and the data rate. This is where you find twisted-pair cables, RJ45 connectors, pluggable optical modules, repeaters, and hubs, which copy a signal to all their other ports without making any decision. The 1000BASE-T standard (Ethernet over twisted pair) or the radio part of the IEEE 802.11 standard describe this level.

A common mistake at this level: looking for a configuration problem when the fault is hardware. A link reported as active by the operating system only proves that a signal is detected, not that the medium is healthy. A pinched cable, a dirty optical module, or a failed rate negotiation produces error counters that climb, with a service that works "some of the time." The first thing to check on a misbehaving network remains the medium.

The data link layer transports frames between two devices connected to the same local network. Its data unit is the frame. It introduces addressing: the MAC address (Media Access Control), encoded on 48 bits and written in hexadecimal, embedded in the network interface. It is traditionally split into two sublayers, MAC for access to the medium and LLC (Logical Link Control) for the link with the upper layer. The representative protocols are Ethernet (IEEE 802.3), Wi-Fi (IEEE 802.11), and PPP (Point-to-Point Protocol). The representative device is the switch, which learns which MAC address is behind which port and sends the frame only to that port; broadcast frames and those whose destination address is not yet learned are, for their part, copied to all the other ports. The end of the frame contains an FCS (Frame Check Sequence), a checksum: if it does not match, the frame is discarded, not repaired. The 802.1Q tag added inside the frame makes it possible for several virtual networks (VLANs) to coexist on the same cable.

A common mistake at this level: believing that the destination MAC address is that of the remote server. When the destination is outside the local network, the destination MAC address is that of the exit router, the default gateway. The MAC address is rewritten at each router hop, whereas the IP addresses stay the same from end to end, except when address translation is applied. The mapping between IP address and MAC address is established by the ARP protocol (Address Resolution Protocol) in IPv4, and by NDP (Neighbor Discovery Protocol) in IPv6.

# état des interfaces et de leurs adresses MAC
ip link show

# table des correspondances IP vers MAC apprises sur le réseau local
ip neigh show

Layer 3 — Network

The network layer transports packets from one network to another: this is the routing level. Its data unit is the packet. The representative protocol is IP (Internet Protocol), in its versions 4 and 6. A machine is identified there by an IP address together with a subnet mask, which indicates which part of the address designates the network and which part designates the machine. Each machine consults a routing table to decide where to send a packet, and uses its default gateway for anything that is not local. The TTL field (Time To Live) is decremented by each router traversed, which prevents a packet from circulating indefinitely. ICMP (Internet Control Message Protocol) is used to report errors encountered by packets; it is also the protocol used by the ping command, by means of its echo messages. The representative devices are the router and the firewall; the routing protocols OSPF (Open Shortest Path First) and BGP (Border Gateway Protocol) are used to build routing tables automatically.

A common mistake at this level: drawing too broad a conclusion from a ping. A reply proves that a path exists to the machine and that it answers ICMP; it says nothing about the application service. Conversely, a lack of reply does not prove a failure, because ICMP is often filtered on purpose. A second classic mistake: a badly set subnet mask. The machine then believes the destination is on its own network, attempts an ARP resolution instead of going through the gateway, and never gets a reply.

# adresses et masques configurés sur les interfaces
ip address show

# table de routage, dont la route par défaut
ip route show

Layer 4 — Transport

The transport layer provides end-to-end dialogue between two programs, no longer between two machines. Its data unit is called a segment with TCP and a datagram with UDP. It introduces the notion of a port, a number between 0 and 65535 that identifies the destination process on the machine: this is what allows a single server to host several services at the same time. TCP (Transmission Control Protocol) establishes a connection through a three-way handshake (SYN, SYN-ACK, ACK), numbers the bytes, acknowledges what is received, retransmits what is missing, reorders the data, and regulates the throughput. UDP (User Datagram Protocol) does not establish a connection, retransmits nothing, and makes do with a short header: it is used in particular by DNS, by real-time voice and video, and serves as the basis for the QUIC protocol.

A common mistake at this level: concluding from an open port that the service is working. A port that accepts a connection indicates that a process is listening and that the network path is not blocked; the application may nonetheless return an error, or return nothing at all. Another common confusion: taking the usual port numbers as a requirement. A service can listen on any free port; the usual number is only a convention. Finally, UDP is not a "lower-quality" protocol: for a real-time stream, retransmitting a packet that arrived too late is pointless, and the absence of retransmission becomes an advantage.

# ports en écoute, en TCP et en UDP, affichés en numérique (option -n : aucune résolution des noms de services)
ss -tuln

4. The upper layers: formatting and application dialogue

Layer 5 — Session

The session layer opens, maintains, synchronizes, and closes the dialogue between two applications. It decides who speaks, sets recovery points to restart an interrupted transfer without starting over, and releases resources at the end of the exchange. Its data unit is simply referred to as data. Few protocols fit neatly here; the ones usually cited are remote procedure calls RPC (Remote Procedure Call) and the NetBIOS session service. No network device works specifically at this level.

A common mistake at this level: confusing the session in the OSI sense with the "user session" of a website, the one that relies on a cookie or a token. That mechanism is entirely managed by the application and belongs to layer 7. Another pitfall: insisting on naming a layer 5 protocol in a TCP/IP stack. In practice, the session functions there are provided either by TCP or directly by the application.

Layer 6 — Presentation

The presentation layer deals with the form of the data, so that what the sender writes is interpreted the same way by the receiver, even if the two machines do not represent the data identically. It covers character encoding (ASCII, UTF-8), file formats such as JPEG, serialization rules such as ASN.1 (Abstract Syntax Notation One), compression, and encryption. Its data unit is also referred to as data.

A common mistake at this level: believing that encryption belongs to this layer and to it alone. Encryption exists at several levels: WPA (Wi-Fi Protected Access) protects the radio link at layer 2, IPsec (Internet Protocol Security) protects packets at layer 3, TLS (Transport Layer Security) protects a stream above the transport. The exact placement of TLS in the OSI model is debated depending on the author, between layers 5, 6, and 7, because TLS was designed for the TCP/IP stack and not for OSI. It is more useful to know what TLS protects than to assign it a number.

Layer 7 — Application

The application layer provides programs with their interface for accessing the network, and carries the useful data. Its data unit is the message. The representative protocols are HTTP (HyperText Transfer Protocol) for the web, DNS (Domain Name System) for translating names into IP addresses, SMTP (Simple Mail Transfer Protocol) for sending email, IMAP (Internet Message Access Protocol) for reading it, SSH (Secure Shell) for remote administration, and FTP (File Transfer Protocol) for file transfer.

A common mistake at this level: confusing layer 7 with the software itself. A browser is not layer 7: layer 7 is the protocol that this browser speaks, in this case HTTP. The distinction has a direct practical consequence. A so-called "layer 7" firewall reads the content of the application protocol, for example the requested hostname or the HTTP method used, whereas layer 4 filtering only sees addresses and port numbers.

5. The journey of an HTTP request through the seven layers

Take the case of a workstation requesting a web page from a remote server. Even before the request, a first complete communication takes place: DNS resolution, which translates the site name into an IP address and also travels through the seven layers, generally over UDP. Once the address is known, the transport layer establishes the TCP connection, then the request departs.

The outbound path: encapsulation

  1. Layer 7: the browser composes an HTTP request, with a method, a path, and headers, including the Host header that indicates the requested site.
  2. Layer 6: the characters are encoded according to an agreed character set and, in HTTPS, the content is encrypted by TLS.
  3. Layer 5: the dialogue is attached to the current connection, which serves as the context for the exchange.
  4. Layer 4: TCP splits the data into segments and places in front of each one a header containing the source port, freely chosen by the system among the ephemeral ports, the destination port, a sequence number, and flags.
  5. Layer 3: IP adds the source address, the destination address, and a TTL. The routing table is consulted: since the destination is not local, the packet is directed to the default gateway.
  6. Layer 2: Ethernet adds the MAC address of the local interface as source, the MAC address of the gateway as destination — obtained by ARP —, and closes the frame with the FCS checksum.
  7. Layer 1: the frame is converted into a signal and sent onto the medium.

Along the way, each device only goes up to the level it needs. A switch reads the layer 2 header, consults its MAC address table, and forwards the frame on the right port, without touching the rest. A router goes up to layer 3: it decrements the TTL, chooses the exit interface based on its routing table, then destroys the old frame and builds a new one, with new MAC addresses suited to the next link. The IP addresses, for their part, stay unchanged, except when address translation is applied. This cycle repeats at each hop until the server's network.

Arrival and return: decapsulation

On the server, the movement is reversed and goes up from layer 1 to layer 7. The signal becomes a sequence of bits again. The interface checks the checksum and the destination MAC address, then removes the Ethernet header. Layer 3 checks that the destination IP address is indeed its own, then removes the IP header. TCP reorders the segments, acknowledges what it has received, requests what is missing, and hands the reconstituted stream to the process listening on the requested port. TLS decrypts, then the web server finally reads the HTTP request exactly as the browser had written it.

The response follows exactly the same mechanism in reverse: the server produces an HTTP message containing a status code and the requested content, this message is encapsulated from layer 7 to layer 1, with the source and destination ports swapped, then decapsulated on the workstation. A traffic capture shows this result as nested headers, from the outermost, Ethernet, to the innermost, HTTP.

# afficher le détail d’un échange HTTP, en-têtes compris
curl -v https://example.com

# observer les paquets échangés sur le port 443
sudo tcpdump -n -i any port 443

6. OSI and TCP/IP: two models, two uses

The TCP/IP model, described in particular by RFC 1122, divides the same work into four layers instead of seven: network access, Internet, transport, application. It was built from protocols that were already working, whereas OSI was designed as a prior theoretical framework. The approximate correspondence between the two is as follows.

  • Network access (TCP/IP) corresponds to layers 1 and 2 of OSI: physical medium and frames.
  • Internet corresponds to layer 3: IP addressing and routing.
  • Transport corresponds to layer 4: TCP and UDP, ports.
  • Application groups together layers 5, 6, and 7: session, data format, and application protocol.

In practice, the two models do not compete and serve different purposes. TCP/IP describes what actually works: it is its protocols that are implemented in operating systems and equipment. OSI provides the shared vocabulary and the numbering used every day in professional exchanges and in vendor documentation: a "layer 3 switch," a "layer 4 or layer 7 load balancer," a "layer 2 incident" designate precise realities that the other party immediately understands. Network certification frameworks also rely on OSI numbering.

The correspondence does, however, have its limits, and it is more honest to name them than to force the classification. TCP/IP does not separate the session, the presentation, and the application. Widely used protocols such as TLS or QUIC have no OSI box that commands consensus. Some books moreover teach a hybrid five-layer model, where OSI layers 5 to 7 are merged into a single application layer. Spending a lot of time settling the number of a given protocol brings little; knowing which problem it solves brings more.

7. Summary and diagnostic method

  • Layer 1 — Physical: bits — cable, fiber, optical module, repeater.
  • Layer 2 — Data Link: frames — Ethernet, Wi-Fi, MAC addresses, switch.
  • Layer 3 — Network: packets — IP, ICMP, router, routing table.
  • Layer 4 — Transport: segments (TCP) or datagrams (UDP) — ports, connections.
  • Layer 5 — Session: data — opening, maintaining, and closing the dialogue.
  • Layer 6 — Presentation: data — encoding, formats, compression, encryption.
  • Layer 7 — Application: messages — HTTP, DNS, SMTP, SSH, FTP.

The main value of the model in operations is that it provides an order of verification. Faced with an inaccessible service, the approach is to go up the layers one by one rather than test at random: each layer can only work if those below it already work.

  1. Check the medium and the state of the link: cable, port, active interface, error counters.
  2. Check the local neighborhood: does the machine see its gateway, is the IP-to-MAC mapping learned, is the VLAN the right one.
  3. Check the addressing and routing: address, mask, default route, response from a remote device.
  4. Check the transport: is a process listening on the expected port, does the connection establish, is filtering blocking it.
  5. Check the application: does the protocol respond, with what status code, what error message, what log on the server side.

8. Points to watch and next steps

  • The boundaries between layers are a description tool, not a physical rule: several protocols used daily straddle them.
  • A layer that responds never guarantees that the upper layers work; the reverse is true, an upper layer that works proves that all those below it work.
  • MAC addresses change at each router hop, IP addresses remain stable from end to end, apart from address translation.
  • Security functions are found at several levels: port filtering at layer 4, protocol inspection at layer 7, encryption at layers 2, 3, or above the transport. Naming the level concerned avoids misunderstandings during an incident analysis.

The logical continuation of this material is to go deeper into the lower layers, the ones that produce the most incidents: IP addressing and subnetting for layer 3, switching and VLANs for layer 2, then the observation of a real TCP connection by means of a traffic capture, in order to find in the bytes the headers described here.

The original text of this article was not preserved by the web archives: the page capture stops before the body. Only its introduction remains, reused here as the opening. The rest was rewritten on September 9, 2026, then reviewed and corrected point by point.