The OSI Model: Seven Layers and What Each One Owns

OSI and TCP/IP Models · 30 min

Core CS · Computer Networks

One impossible problem, split seven ways

Each layer solves one problem, uses only the service under it, and offers only its own service above. Learn which problem each layer owns and the rest of this module turns into a lookup.

Diagnose five real faults, one layer at a time →
Physical is layer 1 and application is layer 7, never the other way round. The unit is a bit at 1, a frame at 2, a packet at 3, a segment at 4. Almost every OSI question is one of those two lists, pointed at something concrete.

01 The idea

Why anyone split it into layers at all

Getting a browser in Hyderabad talking to a server in Frankfurt is not one problem. It is a voltage problem, a which-device-on-this-cable problem, a which-way-through-the-world problem and a which-program-is-this-for problem, all at once. Nobody has solved that as a single design. The OSI reference model, published by ISO, is the admission of it.

Calling a module a layer does not make it one. Two rules make it one, and everything else in this lesson follows from them.

✕ NEVER REACHES AROUND Layer n + 1 Layer n hides entirely how it does the job Layer n − 1 offers only its own service to the layer directly above uses only the service of the layer directly below

Two arrows allowed, one forbidden. This is why TCP behaves identically over Ethernet, Wi-Fi and a modem link: it never learns which is underneath, because it is not allowed to ask.

A layer uses only the service of the layer directly below it, and offers only its own service to the layer directly above it. Every other fact about the OSI model is a consequence of those two sentences.
Swap one, keep the restMove an office from copper to fibre and layer 1 changes completely. The browser, TCP and IP are not recompiled and never find out.
Seven small problemsSomebody can spend a career on cable specifications without ever reading an HTTP header.
Interoperation for freeA Cisco router and a Linux laptop share no code. They agree on what an IP packet looks like, and that is enough.
PDUProtocol data unit: one unit of data at a given layer. Naming the PDU has already named the layer, which is why examiners ask for it.
EncapsulationEach layer treats what it was handed as opaque payload, puts its own header in front, and passes it down. The receiver reverses it exactly.
Peer layersLayer n here is logically in conversation with layer n on the far machine, and with nothing else. TCP talks to TCP.

02 Worked example

One GET request, on its way down to the wire

A browser on 10.0.0.1 asks a server on 203.0.113.9 for a page. The request line and its headers come to 100 bytes. That is the whole example, and the rest of the lesson reuses it, so hold on to the 100.

HTTP request · 100 B 7 · Application 100 B · data TCP 20 HTTP request · 100 B 4 · Transport 120 B · segment IPv4 20 TCP 20 HTTP request · 100 B 3 · Network 140 B · packet ETH 14 IPv4 20 TCP 20 HTTP request · 100 B 2 · Data link 158 B · frame FCS 4 1 · Physical  158 bytes become a timed voltage pattern. It adds no header and reads nothing.

100 + 20 = 120, + 20 = 140, + 14 + 4 = 158. Fifty-eight of those 158 bytes are wrapper — just over a third of the wire is not the message. That ratio is the price of layering.

Sit with the transport row. TCP was handed 100 bytes and never found out they were HTTP. It handed 120 bytes down and never found out they would travel over Ethernet. Rule two and rule one, once each, inside a single step.

Notice which layers did nothing: a plain GET runs no session protocol and converts no representation, so layers 5 and 6 added no bytes. That is the honest state of the internet, not a gap in the example. On the far side the whole thing runs backwards, each layer stripping only the header its own peer added.

03 Mechanics

Seven layers, and what each one owns

Read it bottom up, from the wire to the user, because nothing above layer 1 works until layer 1 works. Each responsibility is deliberately one line. If your answer to “what does the network layer do” needs two, one of them belongs to a different layer.

PDU ADDRESSING WHAT THE BYTES MEAN HOW THEY GET THERE 7 Application the service the user actually asked for data names resources 6 Presentation how the data is written down — encoding, encryption data none of its own 5 Session the dialogue, and where to restart it after a failure data none of its own 4 Transport process to process, not just machine to machine segment 16-bit port 3 Network host to host across networks, choosing a path packet 32-bit IPv4 2 Data link one link, one hop, and whether it arrived intact frame 48-bit MAC 1 Physical bits, voltages, timing, connectors, cable distance bit none at all

The four layers with a PDU of their own are the four that put bytes on the wire. Layers 5 and 6 carry no header on a normal connection, which is why they look thin.

LayerTwo real protocols or standards you can name
1 · Physical1000BASE-T (IEEE 802.3ab), RS-232
2 · Data linkEthernet (IEEE 802.3), PPP
3 · NetworkIP, ICMP
4 · TransportTCP, UDP
5 · SessionNetBIOS session service, ONC RPC
6 · PresentationSSL/TLS, JPEG (with ASCII as the encoding half)
7 · ApplicationHTTP, SMTP

The PDU is the fastest way to name the layer. The trap is datagram, which is used at two layers: an IP datagram is the layer 3 packet, a UDP datagram is the layer 4 unit. TCP’s unit is a segment and only a segment. A router forwards packets; a switch forwards frames. Swapping those two costs the mark even when the explanation is right.

Layer 2 has two sublayers, and they get asked for by name. LLC (IEEE 802.2) on top records which network-layer protocol the frame carries. MAC below owns the 48-bit addressing and decides who may transmit — CSMA/CD on classic Ethernet, CSMA/CA on 802.11. In practice Ethernet II carries a 2-byte EtherType instead of an LLC header, so LLC is often not on the wire at all.

Only three header sizes are worth memorising. Section 02 already showed all three: Ethernet II is 14 bytes plus a 4-byte FCS, IPv4 is 20 without options, TCP is 20 without options. UDP is 8, and that is the entire header.

Layers 5 and 6 look thin because in practice they are. Neither has a header of its own on a normal internet connection. The jobs did not disappear — a browser keeps session state in a cookie, and TLS does the presentation job while running on top of TCP. That is exactly why TCP/IP folds them away.

OSI · 7 LAYERS · THE MODEL TCP/IP · 4 LAYERS · WHAT RUNS 7 · Application 6 · Presentation 5 · Session 4 · Transport 3 · Network 2 · Data link 1 · Physical Application 7, 6 and 5 folded into one Transport Internet Link

TCP/IP came out of running code, and nobody built separate protocols for 5 and 6. Say the jobs moved into the application layer; never say they stopped mattering.

Two mnemonics, one per direction — say which you are using. Bottom up, 1 to 7: Please Do Not Throw Sausage Pizza Away. Top down, 7 to 1: All People Seem To Need Data Processing. Announce the direction first: the third item from the top is session, the third from the bottom is network.

05 Cheat sheet

The nine they ask, and the trap inside each

Every row is something to glance at on the morning of an interview. The right-hand column is the version that loses the mark, and it is usually a small slip rather than a wrong idea.

What they askThe answerThe trap
The seven layers in order1 physical, 2 data link, 3 network, 4 transport, 5 session, 6 presentation, 7 applicationnumbering from the top
The PDU at each layerbit, frame, packet, segment; only data at 5, 6 and 7a layer 3 unit called a segment
What makes a layer a layeruses only the service below, offers only its own service aboveAnswering with what the layer does instead of the two rules.
Which layer has portstransport; 16-bit, 0 to 65535saying network
Which layer has MAC addressesdata link, its MAC sublayer; 48 bitsSaying physical, because the address is burned into hardware.
The two data link sublayersLLC (IEEE 802.2) above, MAC belowNaming one, or putting LLC below MAC.
The fixed header sizesEthernet II 14 + 4 FCS, IPv4 20, TCP 20, UDP 8quoting 20 without “no options”
What TCP/IP leaves outsession and presentation; their work sits in the application layerSaying those jobs do not exist.
The mnemonicsPlease Do Not Throw Sausage Pizza Away (1–7); All People Seem To Need Data Processing (7–1)Reciting without naming the direction.
Two rules, and the rest followsAny claim about OSI that contradicts either rule is wrong, so you can rebuild the model from them under pressure.
The PDU names the layerSay which of bit, frame, packet or segment you are holding and the addressing follows immediately: none, MAC, IP, port.
Depth is the whole differenceWhat a device can and cannot do is set entirely by where it stops reading — which is the next section.

06 Where & why

Where the seven numbers are a thing you type

The model describes no shipped stack, and yet its numbers turn up in product names and configuration syntax across the industry. Every one of them is really a statement about how far into the packet something is allowed to read.

THE FRAME ON THE WIRE Ethernet IPv4 TCP HTTP payload Hub · layer 1 repeats every bit out of every port — reads nothing at all Switch · layer 2 stops at the destination MAC Router · layer 3 opens IP to choose an interface NLB, L4 firewall matches on ports, not the payload ALB, L7 proxy parses the request itself — and pays for it in cost and latency

Same frame, five devices, five stopping points. Every layer number you will ever type into a config is a choice about where to stop.

Wireshark
The detail pane is the stack

Capture the request from section 02 and the middle pane lists Frame, Ethernet II, IPv4, TCP, HTTP — layers 2, 3, 4 and 7, in the order they were wrapped. Layers with no header of their own get no block, which is the clearest evidence you will see that 5 and 6 are jobs rather than wrappers.

Cisco IOS · access lists
The rule you may write depends on the layer

A standard access list matches only the source IP, because layer 3 is as deep as it may look. An extended list matches protocol, both addresses and both ports, because it opens the transport header too. Same device, same traffic; only the reading depth differs.

AWS · Elastic Load Balancing
The layer number is the product

A Network Load Balancer works at layer 4: it forwards TCP on address and port and never opens the payload, which is why it carries any protocol at all. An Application Load Balancer works at layer 7 and parses HTTP, so it makes decisions the layer 4 one physically cannot.

Linux · ip and ss
One command per layer, and they refuse to overlap

ip link is layer 2: interfaces and MAC addresses. ip addr and ip route are layer 3. ss -tulpn is layer 4: which ports are open and which process owns each. No command spans two layers, because no layer keeps another’s state.

OSI is a reference model. No stack implements it exactly, TCP/IP folds three layers into one, and 5 and 6 have almost no protocols to their name. It survives because it is the only vocabulary everyone shares. The honest sentence to give an interviewer: OSI is what people say, TCP/IP is what runs.

07 Interview questions

What they actually ask

OSI is almost always the opening question of a networking round: it takes ten seconds to ask and instantly separates a memorised list from an understood one. Expect to be pushed one level past the list every time.

What is the OSI model, and why seven layers instead of one design?
A reference model published by ISO that splits network communication into seven layers, each owning one problem and each reachable only through the layer under it. The split buys three things: a layer can be swapped without touching the others, seven small problems are tractable where one is not, and two vendors interoperate by agreeing only on a boundary. Say reference model, not implementation.
Name the seven layers in order, and tell me which one is layer 1.
Bottom up: physical, data link, network, transport, session, presentation, application. Physical is layer 1, application is layer 7, never reversed. Up the stack the mnemonic is Please Do Not Throw Sausage Pizza Away; down from 7 it is All People Seem To Need Data Processing. Announce your direction first — third from the top is session, third from the bottom is network.
What actually makes something a layer, rather than just a module?
Two rules. It uses only the service of the layer directly below it, never reaching around it, and it offers only its own service to the layer above, hiding how the job is done. That is what makes a swap free: TCP behaves identically over Ethernet, Wi-Fi or a modem because it never learns which is underneath. Break either rule and you have modules, not layers.
What is a PDU, and what is it called at each layer?
A protocol data unit — the name for one unit of data at a given layer. Bits at physical, a frame at data link, a packet at network, a segment at transport, except UDP, whose unit is a datagram. Above layer 4 there is no special word; it is just data. The trap is datagram: an IP datagram is the layer 3 packet, a UDP datagram is the layer 4 unit.
What does the transport layer give you that the network layer does not?
Delivery to a process rather than to a machine. IP gets the packet to the right host and stops; that host runs fifty programs and nothing in the IP header says which one the bytes are for. Transport adds two 16-bit ports so the stack can hand the payload to the right socket. Reliability and pacing come with TCP but are not the defining difference — UDP is transport and offers neither.
The session layer and the transport layer both talk about connections. What separates them?
Transport keeps a connection alive so bytes arrive in order and none go missing. Session sits above it and runs the dialogue: whose turn it is to send, where to restart after a failure, and when the exchange is finished — which can outlive several transport connections. A file transfer that resumes from its last checkpoint after TCP dropped is doing session work. In real stacks the application holds that state itself.
The data link layer has two sublayers. Name them and say what each owns.
The upper one is LLC, IEEE 802.2: it records which network-layer protocol the frame carries and can offer optional flow and error control upward. The lower one is MAC: it owns the 48-bit hardware addressing and decides who may transmit and when — CSMA/CD on classic Ethernet, CSMA/CA on 802.11. Worth adding: Ethernet II carries a 2-byte EtherType instead of an LLC header, so on a modern LAN LLC is often not on the wire.
What is encapsulation? Walk me down the stack.
Each layer takes what it was handed, treats it as opaque payload, adds its own header and passes it down. 100 bytes of HTTP become a 120-byte TCP segment, then a 140-byte IP packet, then a 158-byte Ethernet frame once the 14-byte header and 4-byte FCS are on. The receiver reverses it exactly, each layer stripping only what its own peer added — which is what peer layers actually means.
Why does the TCP/IP model have no session or presentation layer?
Because nobody built separate protocols for them. TCP/IP came out of running code and has four layers, folding OSI’s 5, 6 and 7 into one application layer. The jobs did not disappear: a browser keeps session state in a cookie, and TLS does the presentation job of encryption while running on top of TCP and being called by the application directly. Say the jobs moved, never that they stopped existing.
Nobody implements OSI. So why am I being asked about it?
Because it is the vocabulary the industry argues in, even though it describes no shipped stack. Layer 7 firewall, layer 4 load balancer, layer 2 problem, layer 3 switch — engineers say these daily and every one means the OSI numbers. The honest answer is that OSI is the reference model and TCP/IP is what runs, and OSI is how you state precisely how deep a device or a rule reads.

08 Practice problems

Six to reason through, not recall

Write down the two rules before anything else, and name the PDU you are holding before you name a layer. Reaching for a layer number first is how a correct fact gets attached to the wrong layer.

Add up the wire

Easy
A 29-byte DNS query goes over UDP, over IPv4 with no options, over Ethernet II. Counting the FCS, how many bytes does the card put on the wire? Then answer again for a 12-byte query.
Follow-up
The two answers are not the 17 bytes apart that the queries are, because one of the frames is not allowed to be as small as its own contents.
Show the hint
Work out the Ethernet payload for each case first and compare it against the smallest payload a frame may carry, before adding the header and the trailer.

One rule, broken on purpose

Easy
A program opens a raw socket, builds the IPv4 header itself and sets the TTL by hand, because the transport library will not expose it. Name which of the two rules this breaks, the two layers involved, and what stops working the day the operating system changes how it builds IP headers.
Follow-up
Nothing here is a bug. The program is correct and will run for years. The cost lands on exactly the property layering was bought for, and it lands later rather than now.
Show the hint
Write the two rules out separately and test the program against each one on its own. Only one of them is broken.

Three faults, one order

Medium
Three faults land at once. A switch counter shows rising frames with a bad FCS. Users reach hosts on their own subnet but nothing beyond it. A web application returns a 500. Put them in the order you would investigate, give the layer of each, and say why that order is not a preference.
Follow-up
Two of the three could be a symptom of one of the others, and one cannot be a symptom of anything else on the list. The layer numbers alone will not tell you which.
Show the hint
A layer can only work when the layer beneath it works. For each pair, ask whether the higher fault would disappear on its own once the lower one was fixed.

Name the field, not just the layer

Medium
For each decision, name the layer and the exact field or trailer that has to be read. One: discard a frame damaged in transit on one link. Two: choose which of a router’s three interfaces to send a packet out of. Three: hand arriving bytes to the mail server rather than the web server. Four: reject a message because the sender address is on a blocklist.
Follow-up
Four decisions, four different layers, and only three of them read something sitting at a fixed offset. The fourth is why the device that makes it costs more and runs slower than the other three.
Show the hint
Ask what the device needs to know that it does not already have, then find the shallowest wrapper that contains it and stop there.

Where does the request line start?

Medium
A frame carries Ethernet II, then IPv4, then TCP, then an HTTP request, and no header uses options. Counting the first byte of the destination MAC as byte 1, give the byte number at which each of those four begins. Then redo the whole thing with 12 bytes of IPv4 options present.
Follow-up
Two of those four numbers cannot move whatever the headers do. The other two are hostage to a single field, which is exactly why each header has to carry its own length somewhere.
Show the hint
Add the header sizes in the order the sender added them, and treat “without options” as part of the number 20 rather than as a footnote to it.

Who gets to do the splitting

Hard
An application hands the stack a 4000-byte message, and the Ethernet payload underneath is capped at 1500 bytes. Decide which layer should own the split, argue your choice against the layer above and the layer below using the two rules, and say what each rejected layer would have to be told that it is not allowed to ask for. Then name the two places in a real TCP/IP stack where a split actually happens, and which is preferred.
Follow-up
All three candidate layers could technically do it, and two of them really do. The question is which choice keeps both rules intact, and the option that loses is a real standardised mechanism rather than a mistake.
Show the hint
For each candidate, ask what it would have to learn from a layer it is not permitted to question. Then ask what happens to all the other pieces when exactly one piece goes missing.