The OSI and TCP/IP Models

Why layered models exist

Sending a message across a network involves many separate problems: turning bits into electrical or light signals, getting a frame to the next device on the same cable, finding a path across many networks, making sure nothing is lost, and presenting the data to the right application. Solving all of that in one piece of software would be unmanageable.

A layered model splits the work into layers stacked on top of each other. Each layer does one job, uses the services of the layer below and offers services to the layer above. The benefits are practical:

• Interchangeable parts: a web browser works the same over Ethernet, Wi-Fi or a mobile network, because only the lower layers change.
• Interoperability: devices from different vendors work together because they implement the same layers the same way.
• A shared vocabulary: "a layer 2 problem" tells a colleague exactly where to look.

Protocols: agreed rules

A protocol is a set of rules that two or more devices agree on for exchanging data: the format of a message, what each field means, the order in which messages are sent and what to do when something goes wrong. Just as two people need a shared language and conventions (who speaks first, how to say "I didn't catch that"), two computers need a shared protocol.

Each protocol belongs to a layer. Ethernet works at the data link layer, the Internet Protocol (IP) at the network layer, the Transmission Control Protocol (TCP) at the transport layer and the Hypertext Transfer Protocol (HTTP) at the application layer. Most protocols are open standards, published by the Institute of Electrical and Electronics Engineers (IEEE) for LAN technologies and by the Internet Engineering Task Force (IETF) as Requests for Comments (RFCs) for internet protocols.

The seven OSI layers

The Open Systems Interconnection (OSI) model was published by the International Organization for Standardization (ISO) in 1984. The OSI protocols themselves mostly never caught on (the routing protocol IS-IS, Intermediate System to Intermediate System, is the notable survivor), but the model did: it is the reference everyone uses to talk about networks. Layers are numbered from the bottom up.

Abbreviations in the table: PDU, protocol data unit; DNS, Domain Name System; SMTP, Simple Mail Transfer Protocol; SSH, Secure Shell; DHCP, Dynamic Host Configuration Protocol; TLS, Transport Layer Security; JPEG, Joint Photographic Experts Group (an image format); UTF-8, Unicode Transformation Format, 8-bit; RPC, remote procedure call; NetBIOS, Network Basic Input/Output System; UDP, User Datagram Protocol; ICMP, Internet Control Message Protocol; OSPF, Open Shortest Path First; PPP, Point-to-Point Protocol; NIC, network interface card.

A common mnemonic from layer 1 up is "Please Do Not Throw Sausage Pizza Away" (Physical, Data link, Network, Transport, Session, Presentation, Application). From layer 7 down: "All People Seem To Need Data Processing".

The data link layer is sometimes split into two sublayers: Media Access Control (MAC), which handles addressing and access to the medium, and Logical Link Control (LLC), which talks to the network layer. Layers 5 and 6 rarely come up in day-to-day network work, because in practice the application handles them itself.

The TCP/IP model

The TCP/IP model (also called the internet protocol suite) describes the protocols the internet actually runs on. It was developed alongside those protocols and is defined in RFC 1122 with four layers:

• Application: everything the OSI model places in layers 5, 6 and 7 — HTTP, DNS, SSH, SMTP.
• Transport: TCP and UDP, as in OSI layer 4.
• Internet: IP, with ICMP alongside it, as in OSI layer 3.
• Link (also called network access): the local network technology, covering OSI layers 1 and 2.

Many textbooks, including Cisco's course material, use an updated five-layer version that splits Link back into Data link and Physical. That version lines up with OSI layers 1–4 exactly, which is why engineers mix the two models freely: they say "layer 3" in the OSI sense while working with TCP/IP protocols.

Encapsulation and decapsulation

When an application sends data, the data travels down the layers of the sender. Each layer adds its own control information in front of the data, a header, and the data link layer also adds a trailer at the end. This wrapping is called encapsulation: each layer treats everything it receives from the layer above as payload and puts its own envelope around it, without looking inside.

• The transport layer adds a TCP or UDP header with the source and destination port numbers, so the right application receives the data.
• The network layer adds an IP header with the source and destination IP addresses, so routers can forward it toward the right network.
• The data link layer adds an Ethernet header with the source and destination MAC addresses for the next hop, and a trailer with a checksum, the Frame Check Sequence (FCS).
• The physical layer sends the whole frame as a stream of bits.

The receiver does the reverse, decapsulation: each layer reads and removes its own header and passes the rest up. Routers along the way decapsulate only up to layer 3 — they strip the frame, read the IP header, and build a new frame for the next link. That is why MAC addresses change at every hop while IP addresses stay the same.

A small Python model of the same idea: each layer adds its part around the PDU it receives, and the receiver removes the parts in reverse order.

payload = "GET / HTTP/1.1"

segment = ["TCP hdr", payload]            # layer 4 adds a header
packet = ["IP hdr"] + segment             # layer 3 adds a header
frame = ["Eth hdr"] + packet + ["FCS"]    # layer 2 adds a header and a trailer

for name, pdu in [("Data", [payload]), ("Segment", segment),
                  ("Packet", packet), ("Frame", frame)]:
    print(f"{name:<8}[" + "][".join(pdu) + "]")

received = frame[1:-1]    # layer 2 removes its header and trailer
received = received[1:]   # layer 3 removes the IP header
received = received[1:]   # layer 4 removes the TCP header
print("Delivered:", received[0])

Data    [GET / HTTP/1.1]
Segment [TCP hdr][GET / HTTP/1.1]
Packet  [IP hdr][TCP hdr][GET / HTTP/1.1]
Frame   [Eth hdr][IP hdr][TCP hdr][GET / HTTP/1.1][FCS]
Delivered: GET / HTTP/1.1

Protocol data units

A protocol data unit (PDU) is the unit of data at a given layer: that layer's header (and trailer, if any) plus its payload. Each layer's PDU has its own name, and using the right name tells a colleague which layer you mean.

• Bits (layer 1): the ones and zeros as signals on the medium.
• A frame (layer 2) is the PDU of the data link layer: a header with MAC addresses, the packet as payload, and a trailer with an error check. A frame only travels across one link, to the next device.
• A packet (layer 3) is the PDU of the network layer: an IP header with source and destination IP addresses, plus the segment as payload. A packet travels from the original sender to the final destination, across many links.
• A segment (layer 4) is the PDU of TCP: a TCP header with port numbers and sequence numbers, plus application data. The layer 4 PDU of UDP is called a datagram.
• Data (layers 5–7): the application's own message, such as an HTTP request.

How engineers use the layers

Layers are everyday vocabulary in a network operations (NetOps) team:

• "It's a layer 1 problem": a cable, a port, a transceiver or power. The link light is off or the interface shows errors.
• "Layer 2": switching, virtual LANs (VLANs), MAC addresses and Spanning Tree. The link is up but the device ends up in the wrong VLAN.
• "Layer 3": IP addresses, subnets, gateways and routing. The device has a wrong gateway or a route is missing.
• "Layer 7": the application itself. The network is fine; the server or the application is not.
• Devices by layer: a layer 2 switch forwards frames by MAC address; a layer 3 switch can also route packets between VLANs by IP address. A layer 4 load balancer decides by IP address and port; a layer 7 load balancer can look at the HTTP request itself.

Troubleshooting often works bottom-up: first check that the link is physically up, then that layer 2 works, then IP, then the application — because each layer depends on all the layers below it. A Cisco router shows the first two layers side by side:

R1# show ip interface brief
Interface              IP-Address      OK? Method Status                Protocol
GigabitEthernet0/0     192.0.2.1       YES manual up                    up
GigabitEthernet0/1     198.51.100.1    YES manual down                  down
GigabitEthernet0/2     unassigned      YES unset  administratively down down

• Status is layer 1: is there a signal on the interface? Protocol (line protocol) is layer 2: is the data link working?
• up / up on Gi0/0: layers 1 and 2 work; if something still fails, look at layer 3 and above.
• down / down on Gi0/1: a layer 1 problem — a cable is unplugged or broken, or the device at the other end is off.
• administratively down on Gi0/2: someone disabled the interface with the shutdown command.

show ip interface brief is one of the first commands to learn for the CCNA. The full method, including top-down and divide-and-conquer, is on Troubleshooting Tools and Method.