Training · Networking basics
The OSI model: the 7 layers of a network
How does a message leave your phone and reach a server far away? The OSI model explains that journey in 7 layers. Here you will see it step by step, with animations.
What is OSI?
OSI (Open Systems Interconnection) is a reference model published by ISO in 1984, so that devices from different makers could talk to each other. Today it is the standard ISO/IEC 7498-1, which is why people also call it “the ISO layers”.
The model splits network communication into 7 layers. Each layer has one job and talks only to the layer right below and right above it. That is why moving from Wi-Fi to fibre does not mean changing your browser: only the lower layer changes, the ones above stay the same.
The internet itself runs on TCP/IP, but network people still speak OSI's language. Phrases like “a layer 2 problem” or “a layer 7 firewall” come from this map. Going layer by layer is also the fastest way to find a fault.
To remember them
From 1 to 7: “Please Do Not Throw Sausage Pizza Away” → Physical, Data link, Network, Transport, Session, Presentation, Application.
From 7 to 1: “All People Seem To Need Data Processing” → Application, Presentation, Session, Transport, Network, Data link, Physical.
The 7 layers
Tap a layer to see its job, the name of its data, and the protocols and devices that live in it.
Where the program you use talks to the network: the web, e-mail, name lookups.
- Its data is called
- Data
- What lives in it
- HTTP and HTTPS, DNS, SMTP and IMAP (e-mail), SSH, FTP and SFTP, DHCP
- Devices
- Server software, web application firewall (WAF), proxy
The shape of the data: character encoding, compression and encryption.
- Its data is called
- Data
- What lives in it
- UTF-8, JSON, JPEG and PNG, gzip, encryption with TLS
- Devices
- No device of its own; programs and the operating system do this
Opens, keeps and closes the conversation between two sides.
- Its data is called
- Data
- What lives in it
- Signing in and out, checkpoints, RPC, NetBIOS, SMB sessions
- Devices
- No device of its own; today it usually lives inside the application
Splits data into pieces, delivers them to the right program (port), asks again for lost ones.
- Its data is called
- Segment
- What lives in it
- TCP (reliable, in order), UDP (fast, unchecked; its piece is a datagram), port numbers (443, 53, 22), QUIC
- Devices
- Firewalls (port rules), load balancers
Routes packets from one network to another by their IP address.
- Its data is called
- Packet
- What lives in it
- IPv4, IPv6, ICMP (ping and traceroute), routing, NAT
- Devices
- Router, layer 3 switch
Carries frames between two devices on the same network, uses MAC addresses, catches damaged frames.
- Its data is called
- Frame
- What lives in it
- Ethernet, Wi-Fi (802.11), MAC address, ARP, VLAN
- Devices
- Switch, wireless access point, network card
Carries bits as electrical, light or radio signals.
- Its data is called
- Bit
- What lives in it
- Copper cable (RJ45), fibre, radio waves, connectors, signal speed
- Devices
- Cable, hub, repeater, the signal part of a modem
A message's journey
You type “Hello” to a web site on your phone. On the sending side the message goes down from 7 to 1, and each layer adds its own label (header). On the other side it goes up from 1 to 7, and each layer reads its label and takes it off. This is called encapsulation.
Your phone
- 7Application
- 6Presentation
- 5Session
- 4Transport
- 3Network
- 2Data link
- 1Physical
Server
- 7Application
- 6Presentation
- 5Session
- 4Transport
- 3Network
- 2Data link
- 1Physical
7. Application: your browser puts “Hello” inside an HTTP request.
Read all the steps as text
- 7. Application: your browser puts “Hello” inside an HTTP request.
- 6. Presentation: TLS encrypts the message. Anyone listening on the way now sees only meaningless bytes. With HTTPS the HTTP header is encrypted too.
- 5. Session: the message belongs to the conversation (session) that is open with the server. On today's internet this layer has no label of its own; TLS and the application do this job together.
- 4. Transport: a TCP header is added: source port 51514, destination port 443 (HTTPS) and a sequence number. It is now called a segment.
- 3. Network: an IP header is added: source address 192.168.1.20, destination address 203.0.113.10. It is now called a packet.
- 2. Data link: an Ethernet or Wi-Fi header goes in front and an error check (FCS) at the end. The destination MAC address is not the server's but your home router's: that is the first stop. It is now called a frame.
- 1. Physical: the frame becomes 0s and 1s, then electricity on copper, light in fibre, or radio waves on Wi-Fi.
- On the way: every router takes off the layer 2 header, looks at the IP address and sends the packet to the next stop with a new layer 2 header. The destination IP address stays the same all the way. (Your home router changes the source address to its own public one with NAT.)
- 1. Physical: the server's network card turns the signal back into 0s and 1s.
- 2. Data link: the FCS is checked; a frame damaged on the way is dropped. If it is intact, the Ethernet header and the FCS are taken off.
- 3. Network: is the destination IP this server's? Yes. The IP header is taken off.
- 4. Transport: destination port 443 tells which program gets the data: the web server. If a piece is missing, TCP asks for it again and puts the pieces in order.
- 5. Session: the data joins the right connection and the right conversation.
- 6. Presentation: TLS decrypts it. The HTTP request and “Hello” can be read again.
- 7. Application: the web server reads the HTTP request and gets “Hello”. Its answer travels back to your phone the same way, in reverse.
OSI and TCP/IP
The model the internet really uses is TCP/IP, with 4 layers (RFC 1122). OSI's top three layers fold into one “Application” layer there, and its bottom two into the “Link” layer.
OSI is a map for teaching and talking: when someone says “a layer 3 problem”, everyone knows where to look. Some books use a 5-layer model in between, which splits Link back into Data link and Physical.
OSI (7 layers)
TCP/IP (4 layers)
7 Application
6 Presentation
5 Session
4 Transport
3 Network
2 Data link
1 Physical
Application
Transport
Internet
Link (network access)
The parcel comparison
Think of sending a letter to another city by courier. Each layer takes one part of the job.
7 Application
Writing the letter: deciding what to say.
6 Presentation
Translating the letter into the reader's language and sealing the envelope.
5 Session
Giving the correspondence a file number, so it can go on where it stopped.
4 Transport
Packing the shipment into numbered boxes, and sending a lost box again.
3 Network
Writing the full address, and the depots choosing the route.
2 Data link
Handing over from one depot to the next: a new delivery note at every stop.
1 Physical
The road and the truck: what physically carries the shipment.
Troubleshooting: from the bottom up
If the internet does not work, start at layer 1 and go up. Most faults are in the lower layers: an unplugged cable or the wrong Wi-Fi.
- 1Physical: Is the cable plugged in and undamaged? Is the Wi-Fi signal strong enough?
- 2Data link: Is it on Wi-Fi, the right network? Is the switch port's light on?
- 3Network: Did the device get an IP address? Does a ping to the router work?
- 4Transport: Is the port you need open (for example 443)? Is a firewall blocking it?
- 5Session: Does the connection drop now and then? Does the site keep asking you to sign in?
- 6Presentation: Do letters show up garbled? Does the browser warn about the certificate?
- 7Application: Does the site open? Which error do you see (404, 500)? Do other sites open?
What comes next?
Each layer is getting its own page: its protocols and devices, its own animation, common faults, attacks and defences. A short quiz comes at the end.
← Back to the blog