1.5.2 OSI & TCP/IP Models
Use layers to understand network communication and troubleshooting
The previous page covered network scope, topology, addressing, and device identity. The OSI and TCP/IP models give you a clean way to organize those pieces into layers, so troubleshooting and security analysis feel less random.
1. Why Networking Models?
Networking models provide a standardized framework for understanding how data moves through networks.
Purpose of Networking Models
- Interoperability: Devices from different vendors can communicate
- Troubleshooting: Isolate problems to specific layers
- Design: Standardize network architecture and protocols
- Education: Common language for networking concepts
Brief History
- OSI Model (1984): Developed by ISO as theoretical reference
- TCP/IP Model (1970s): Developed by DARPA/DoD for ARPANET - practical implementation
2. OSI Model (7 Layers)
The Open Systems Interconnection model divides networking into 7 distinct layers.
| Layer | Name | PDU | Key Protocols | Devices | Common Attacks |
|---|---|---|---|---|---|
| 7 | Application | Data | HTTP, FTP, SMTP, DNS, SSH | N/A | Phishing, SQLi, XSS |
| 6 | Presentation | Data | SSL/TLS, JPEG, ASCII, MPEG | N/A | SSL stripping |
| 5 | Session | Data | NetBIOS, RPC, PPTP, SIP | N/A | Session hijacking |
| 4 | Transport | Segment | TCP, UDP | N/A | SYN flood, UDP flood |
| 3 | Network | Packet | IP, ICMP, ARP, OSPF | Router, L3 Switch | IP spoofing, MITM |
| 2 | Data Link | Frame | Ethernet, PPP, MAC | Switch, Bridge, NIC | MAC spoofing, ARP poison |
| 1 | Physical | Bits | Cables, Fiber, Radio | Hub, Repeater, Cables | Wiretapping, jamming |
Layer 7 - Application
Function: User interface to network services (browsers, email clients)
Analogy: The person writing and reading the letter
Layer 6 - Presentation
Function: Data translation, encryption/decryption, compression
Analogy: Translator between different languages
Layer 5 - Session
Function: Establishes, manages, terminates sessions between applications
Analogy: Phone call setup - dialing, talking, hanging up
Layer 4 - Transport
Function: End-to-end delivery, flow control, error recovery
Analogy: Postal tracking system ensuring delivery
Layer 3 - Network
Function: Logical addressing (IP), routing between networks
Analogy: GPS navigation choosing the best route
Layer 2 - Data Link
Function: Physical addressing (MAC), local delivery, error detection
Analogy: Street addresses within a neighborhood
Layer 1 - Physical
Function: Transmits raw bits over physical medium
Analogy: The actual roads and highways
3. OSI Memory Aids
"Please Do Not Throw Sausage Pizza Away"
Physical -> Data Link -> Network -> Transport -> Session -> Presentation -> Application
"All People Seem To Need Data Processing"
Application -> Presentation -> Session -> Transport -> Network -> Data Link -> Physical
4. TCP/IP Model (4 Layers)
The TCP/IP model is the practical model used by real internet communication. It groups some OSI layers together, which makes it simpler to map to actual protocols.
| TCP/IP Layer | Name | OSI Equivalent | Key Protocols |
|---|---|---|---|
| 4 | Application | 5, 6, 7 | HTTP, FTP, SMTP, DNS, SSH, TLS |
| 3 | Transport | 4 | TCP, UDP |
| 2 | Internet | 3 | IP, ICMP, ARP, RARP |
| 1 | Network Access | 1, 2 | Ethernet, WiFi, MAC, PPP |
5. OSI vs TCP/IP Comparison
Use OSI when you need a detailed troubleshooting language. Use TCP/IP when you want to match the model to the protocols that are running on real networks.
| Aspect | OSI Model | TCP/IP Model |
|---|---|---|
| Layers | 7 | 4 |
| Developed By | ISO (1984) | DARPA/DoD (1970s) |
| Type | Theoretical/Reference | Practical/Implementation |
| Usage | Teaching, troubleshooting | Real internet traffic |
| Protocol Dependency | Protocol-independent | Protocol-dependent |
| Approach | Layer-by-layer strict | Flexible, merged layers |
6. Data Flow Walkthrough
Step-by-step Journey
1. Application Layer
- Browser creates HTTP GET request for "/"
- HTTPS means TLS handshake will be initiated
2. DNS Resolution
- Browser checks cache -> OS cache -> Router cache
- DNS query sent (UDP port 53)
- Returns IP: 142.250.190.46
3. Transport Layer
- TCP 3-way handshake: SYN -> SYN-ACK -> ACK
- Connection to port 443 (HTTPS)
- Data segmented with sequence numbers
4. Network Layer
- IP packet created with source/destination IPs
- Routing table consulted for next hop
- TTL set to prevent infinite loops
5. Data Link Layer
- ARP resolves gateway's MAC address
- Ethernet frame created with MAC addresses
6. Physical Layer
- Bits transmitted as electrical/optical/radio signals
7. At Destination (Reverse)
- Each layer removes its header (decapsulation)
- Response travels back the same way
ENCAPSULATION (Sending) DECAPSULATION (Receiving)
Sending side Receiving side
Application: [DATA] [DATA]
Transport: [TCP | DATA] [TCP | DATA]
Network: [IP | TCP | DATA] [IP | TCP | DATA]
Data Link: [ETH | IP | TCP | DATA] [ETH | IP | TCP | DATA]
Physical: bits on the medium bits received from the medium
7. Encapsulation & Decapsulation
Encapsulation: Each layer adds its header to the data from the layer above.
Decapsulation: Each layer removes its header when receiving.
| Layer | PDU Name | Added Header |
|---|---|---|
| Application/Presentation/Session | Data | Application-specific |
| Transport | Segment | TCP/UDP header (ports, seq#) |
| Network | Packet | IP header (src/dst IP) |
| Data Link | Frame | Ethernet header + trailer (MAC) |
| Physical | Bits | N/A |
8. Useful Commands
# Trace route (see Layer 3 hops)
traceroute google.com # Linux
tracert google.com # Windows
# Capture packets (see all layers)
sudo tcpdump -i eth0 -n
# View what layer 4 connections are active
netstat -an
ss -tuln # Linux modern
# Filter by protocol (Layer 7)
http
dns
# Filter by port (Layer 4)
tcp.port == 443
udp.port == 53
# Filter by IP (Layer 3)
ip.addr == 192.168.1.1
# Filter by MAC (Layer 2)
eth.addr == aa:bb:cc:dd:ee:ff
9. Seeing Layers in Wireshark
When you capture a packet in Wireshark, you'll see layers displayed:
- Frame: Layer 1-2 info (timing, size)
- Ethernet II: Layer 2 (src/dst MAC)
- Internet Protocol: Layer 3 (src/dst IP, TTL)
- TCP/UDP: Layer 4 (ports, flags, seq#)
- HTTP/TLS: Layer 7 (application data)
10. Security Corner
- Layer 7 (Application): SQLi, XSS, phishing, and other application attacks
- Layer 4 (Transport): SYN floods, port scanning
- Layer 3 (Network): IP spoofing, routing attacks
- Layer 2 (Data Link): ARP poisoning, MAC spoofing
Defense in Depth
Protect every layer. One control is rarely enough on its own:
| Layer | Defense Examples |
|---|---|
| 7 - Application | WAF, input validation, secure coding |
| 4 - Transport | TLS encryption, rate limiting |
| 3 - Network | Firewalls, ACLs, IDS/IPS |
| 2 - Data Link | Port security, 802.1X, VLAN segmentation |
| 1 - Physical | Locked server rooms, cable protection |