Networking · Fundamentals
OSI Model
A seven layer conceptual model that separates network communication into distinct, independently replaceable functions.
Overview
The Open Systems Interconnection (OSI) model, standardised as ISO/IEC 7498-1, describes networking as seven stacked layers. Each layer provides services to the layer above and consumes services from the layer below, which means a change at one layer, swapping copper for fibre, or HTTP for gRPC, does not require redesigning the others.
Real networks are implemented with the TCP/IP stack, not OSI. The value of OSI today is diagnostic and descriptive: it gives engineers a shared vocabulary for isolating faults ('this is a layer 1 problem', 'the load balancer is layer 7') and for classifying devices and controls.
How it works
- 01Data from an application is encapsulated on the way down the stack: each layer prepends its own header (and sometimes a trailer) to the payload it receives from above.
- 02On the receiving host the process is reversed, each layer strips its own header and passes the remaining payload upward, a process called decapsulation.
- 03Devices operate at the highest layer they need to understand. A hub repeats layer 1 signals, a switch forwards layer 2 frames by MAC address, a router forwards layer 3 packets by IP address, a stateful firewall tracks layer 4 sessions, and a reverse proxy or WAF inspects layer 7 content.
Why it matters
- Troubleshooting becomes systematic instead of intuitive: verify link and addressing before blaming an application.
- Security controls can be mapped to layers, which exposes gaps, segmentation at layer 2/3 does nothing about a malicious HTTP payload at layer 7.
- Vendor claims become comparable. 'Layer 7 load balancing' and 'layer 4 load balancing' are genuinely different capabilities.
Reference table
| Layer | Name | Unit | Responsibility | Examples |
|---|---|---|---|---|
| 7 | Application | Data | Services consumed directly by software | HTTP, SMTP, DNS, SMB |
| 6 | Presentation | Data | Encoding, serialisation, encryption negotiation | TLS, JPEG, ASCII |
| 5 | Session | Data | Session establishment, teardown and recovery | RPC, NetBIOS session |
| 4 | Transport | Segment | End to end delivery, ports, reliability | TCP, UDP, QUIC |
| 3 | Network | Packet | Logical addressing and routing between networks | IPv4, IPv6, ICMP, OSPF |
| 2 | Data Link | Frame | Addressing within a local segment, error detection | Ethernet, 802.1Q, ARP, Wi-Fi |
| 1 | Physical | Bit | Signalling over a medium | Copper, fibre, radio, SFP optics |
Where it is used
- Structured fault isolation during outages, working bottom up from cable and link status.
- Documenting where each security control sits in a reference architecture.
- Onboarding and training: the shared language of nearly every networking certification.
Security considerations
- Each layer has its own attack surface: cable taps (1), ARP and VLAN attacks (2), spoofing and routing hijacks (3), session exhaustion (4), and injection or logic abuse (7).
- Encryption at one layer does not protect metadata at lower layers, TLS hides HTTP content but not the destination IP.
- Defence in depth means deliberately placing controls at several layers rather than relying on a perimeter firewall.
Common misconfigurations
- Assuming a switch provides isolation without VLANs or private VLANs configured.
- Treating layer 3 ACLs as a substitute for application authorisation.
- Debugging application errors before confirming DNS, routing and MTU are healthy.
IT vs OT
Industrial protocols such as Modbus, PROFINET and EtherNet/IP also map onto these layers, but OT designs add determinism and safety requirements that IT networks rarely have. See OT Atlas for industrial network layering.
IT Atlas covers Information Technology. Operational Technology is covered separately at otatlas.ai.
Notes
Prefer TCP/IP's four layers when describing implementation and OSI's seven when describing responsibility. Mixing the two loosely is the most common source of confusion.