The OSI Model

Opening a website involves several separate jobs: requesting the page, protecting the connection, delivering the data, choosing a route and transmitting signals. Layers organise those jobs, and each layer uses the service of the layer below it. By the end of this lesson, you should be able to answer four questions:

• What does each of the seven layers do, and what is its unit of data (PDU)?
• Which protocols and devices work at each layer?
• Where do MAC addresses, IP addresses and ports fit?
• What happens, layer by layer, when a laptop opens a website?

💡 In simple terms: sending data is like sending a parcel. The contents, the packaging, the delivery address and the van each do a different job, and none of them needs to know how the others work.

Why a layered model?

In the 1970s, every computer maker had its own networking system, and systems from different makers could not talk to each other. The OSI (Open Systems Interconnection) model was published by the ISO in 1984 as a common, vendor-neutral way to describe networking. Splitting the work into layers solves several problems:

OSI is a reference model: a way to describe and discuss networking. The protocols that actually run the internet come from the TCP/IP suite.

Learn more: The TCP/IP Model

The seven layers at a glance

OSI is numbered from Physical (1) at the bottom to Application (7) at the top. Data goes down the layers on the sender and up the layers on the receiver.

A PDU (protocol data unit) is the name for a unit of data at a given layer. Using the right name tells people which layer you mean: a frame is layer 2, a packet is layer 3.

💡 Memory trick from layer 7 down: "All People Seem To Need Data Processing". From layer 1 up: "Please Do Not Throw Sausage Pizza Away".

The layers are functional categories. Real protocols don't always fit neatly into one layer, especially at layers 5 to 7.

Each layer in detail

Each card shows the layer's job, its PDU, example protocols, the devices that work at that layer, and what it does when you open a web page.

Layer 7: what “Application” really means

Application-layer protocols define the service being requested: HTTP requests a page, DNS asks for an address, DHCP requests IP settings and SSH provides secure remote access. The browser itself is an application that uses these protocols; it is not “in” layer 7.

Learn more: HTTP: How the Web Talks · DNS · DHCP

Layers 6 and 5: real but blurry

The Presentation and Session layers deal with how information is represented or protected, and how a conversation is managed. In TCP/IP, applications and supporting protocols do these jobs, so don't expect a separate layer 5 or layer 6 header in every packet. TLS, for example, protects many connections, but calling it “only layer 6” oversimplifies its role.

Learn more: HTTPS and TLS

Layer 4: TCP and UDP

The transport layer delivers data between applications on two hosts:

Applications can add their own reliability on top of UDP, so “uses UDP” doesn't always mean “unreliable”.

Learn more: What the Transport Layer Does

Layers 3, 2 and 1: getting there

Layer 3, Network: IP addresses identify interfaces across networks, and routers use the destination IP and their routing table to choose where a packet goes next. Layer 2, Data Link: on an Ethernet LAN, frames carry source and destination MAC addresses, and switches use their MAC address table to forward them. Layer 1, Physical: the frame is sent as signals over copper, fibre or radio. A damaged cable or the wrong optical transceiver stops everything before the higher layers get a chance to work.

Which devices work at which layer?

A device is usually described by the highest layer it reads to make its forwarding decision. Watch how far “up” each device looks:

Real devices often work at several layers at once. A home router, for example, is a switch (L2), a router (L3) and a firewall with NAT (L3/L4) in one box.

Learn more: Comparing Network Devices

MAC address, IP address and port: different jobs

An HTTPS connection might look like this:

The reply reverses the ports: source port 443, destination port 51524. (203.0.113.20 is a documentation address, not a live server.)

Common protocols and ports

Port numbers belong to the transport protocols (TCP and UDP), not to the OSI layers in general.

These are common defaults, not proof of which application sent a packet, because services can run on other ports. ICMP (used by ping) has no ports at all: it is carried directly inside IP.

Learn more: Common Ports to Know

Encapsulation: wrapping data for delivery

On the way down the sender's stack, each protocol adds its own control information, usually a header. This is called encapsulation. On the way up, the receiver removes each header again. This is de-encapsulation (also called decapsulation). Each layer reads only its own header, as if it were talking directly to the same layer on the other device.

The short version, with the name of the data unit at each stage:

Here's what the finished Ethernet frame looks like:

This is simplified: HTTPS also adds TLS protection, and a large message is split across many packets. The encapsulation lesson follows every header as it is added and removed, with real addresses, and shows what changes at a router.

Learn more: Encapsulation and De-encapsulation

OSI compared with TCP/IP

TCP/IP is the protocol suite the internet actually runs on. Its common model has four layers. You can switch the diagram to the five-layer view that many courses use:

Use OSI numbers to talk about problems, and TCP/IP to understand what actually runs.

Learn more: The TCP/IP Model

A laptop opens a website

Assume the laptop already has working IP settings and the site uses HTTPS over TCP. Select any step to see which layers are involved.

In order, the important steps are:

1. Name resolution: get the server's IP address, unless it is already cached.
2. Next-hop choice: is the destination local, or does it need the gateway?
3. Local delivery: find the next hop's MAC address with ARP if needed.
4. Transport setup: open the TCP connection.
5. Security and application: negotiate TLS and send the HTTP request.

A later lesson follows the same request packet by packet.

Learn more: What Happens When You Open a Website?

When a layer fails

Each layer depends on the one below it, so a failure at a low layer breaks everything above it. A failure at a high layer leaves the lower layers working:

Troubleshooting with the layers

Many engineers check from the bottom up: they prove that each layer works before moving to the next one. Useful commands on a Windows PC:

PowerShell's Test-NetConnection tests DNS (layer 7), IP (layer 3) and TCP (layer 4) in one command:

PS C:\> Test-NetConnection example.com -Port 443

ComputerName     : example.com
RemoteAddress    : 203.0.113.20
RemotePort       : 443
InterfaceAlias   : Wi-Fi
SourceAddress    : 192.168.1.20
TcpTestSucceeded : True

A successful ping tests only layers 1 to 3: it doesn't prove that HTTPS on port 443 works.

Learn more: Bottom-Up, Top-Down, Divide and Conquer · A Troubleshooting Method

Common mistakes

• Thinking every packet has seven headers. Real traffic uses TCP/IP, and layers 5 and 6 rarely have a header of their own.
• Calling everything a “packet”. A frame is layer 2, a packet is layer 3 and a segment is layer 4. Using the right word shows which layer you mean.
• Saying a switch works at layer 3. A normal switch forwards frames using MAC addresses (layer 2). Only a Layer 3 (multilayer) switch can also route.
• Placing ports at layer 3. Ports belong to TCP and UDP at layer 4; IP addresses are layer 3.
• Treating the browser as “the application layer”. The browser is an application that uses layer 7 protocols such as HTTP and DNS.
• Forcing every protocol into one layer. ARP sits between layers 2 and 3, and TLS spans layers 5 to 7. The model is a guide, not a strict rule.

Knowledge check: which layer?

Where to go next

Continue with The TCP/IP model to see the four layers that really run the internet, then Encapsulation and de-encapsulation to watch each header being added and removed. For layer 2 details, read Ethernet fundamentals and MAC addresses.