CCNA online course

OSI Reference Model: The Seven Networking Layers

Learn the seven OSI model layers, their functions, protocols, addressing, data units, encapsulation process, and CCNA troubleshooting techniques.

The Open Systems Interconnection (OSI) reference model is a seven-layer conceptual framework for describing how network communication works. The International Organization for Standardization (ISO) created the model to organize networking functions into clearly defined layers.

The OSI model is not a complete operational protocol suite. Instead, it is a common vocabulary and design framework. Layering helps equipment from different vendors, applications, operating systems, and networks interoperate because each layer has a defined responsibility and communicates with the layer above and below it.

For example, an application does not need to understand electrical signals on a cable. It requests network services from lower layers, while the lower layers handle transport, addressing, framing, signaling, and media access. This separation is called encapsulation: each layer adds control information needed for its part of communication.

The Seven OSI Layers

From the top, closest to the user, to the bottom, closest to the transmission medium, the layers are:

1. Layer 7 — Application
2. Layer 6 — Presentation
3. Layer 5 — Session
4. Layer 4 — Transport
5. Layer 3 — Network
6. Layer 2 — Data Link
7. Layer 1 — Physical

From bottom to top, the order is Physical, Data Link, Network, Transport, Session, Presentation, and Application. A common mnemonic for the top-to-bottom order is All People Seem To Need Data Processing. Another mnemonic for bottom-to-top order is Please Do Not Throw Sausage Pizza Away.

The upper layers are Application, Presentation, and Session. They focus more on services, data representation, and communication between applications. The lower layers are Transport, Network, Data Link, and Physical. They focus more on delivery, addressing, forwarding, framing, and transmission.

Layer 1: Physical

The Physical layer transmits raw binary bits across a medium. It defines how bits are represented as electrical signals on copper, light pulses in fiber, or radio signals in wireless networks.

Physical-layer characteristics include signaling, timing, voltage or light levels, radio frequencies, connector types, pinouts, cable specifications, transceiver requirements, and interface characteristics. Common Layer 1 components include cables, connectors, transceivers, the physical portion of a network interface, hubs, and repeaters.

Layer 1 does not interpret MAC addresses, IP addresses, frames, packets, or application data. It only carries signals that represent bits. A link light, damaged cable, incompatible transceiver, or incorrect speed setting is therefore commonly a Physical-layer concern.

Layer 2: Data Link

The Data Link layer provides local network delivery. It groups bits into a frame and uses hardware or MAC addresses to identify the source and destination on a local link.

A typical frame header contains a source MAC address and a destination MAC address. A frame trailer commonly contains an FCS (Frame Check Sequence). The FCS helps the receiver detect whether the frame was corrupted during transmission; it does not by itself repair the error.

Data Link functions also include media access control. On a shared medium, devices need rules for deciding when they may transmit. The Data Link layer is commonly described as having two sublayers:

• LLC (Logical Link Control): provides link-control functions and supports the use of different network-layer protocols.
• MAC (Media Access Control): handles hardware addressing, frame access, and access to the transmission medium.

Ethernet, PPP, and HDLC are commonly associated with Layer 2. Switches and bridges inspect frames and MAC addresses to forward traffic within a Layer 2 network. VLAN membership, trunking, MAC learning, and frame errors are also commonly investigated at this layer.

Layer 3: Network

The Network layer provides logical addressing and delivery between different networks. An IP address identifies a host interface within a larger internetwork and provides information used to determine whether a destination is local or remote.

Routing is the process of selecting paths and forwarding packets between IP networks. Routers and multilayer switches perform Layer 3 forwarding decisions. IP provides the addressing and packet-delivery framework, while ICMP supports control and diagnostic messages such as those used by ping.

A Layer 3 IP address is different from a Layer 2 MAC address. An IP address is a logical address used across routed networks. A MAC address is used for delivery on the current local link. When a router forwards traffic, the Layer 2 frame is removed and a new frame is created for the next link, while the end-host IP addresses generally remain the same.

Layer 4: Transport

The Transport layer provides process-to-process delivery between communicating hosts. It uses port numbers to identify a particular application process or service, allowing many applications to use the network simultaneously.

Transport protocols may provide segmentation and reassembly, flow control, error recovery, acknowledgments, and retransmission. Flow control regulates the sending rate so a receiver is not overwhelmed. Error recovery uses mechanisms such as acknowledgments and retransmissions when the protocol supports them.

• TCP: connection-oriented and designed for ordered, reliable delivery. It uses a connection process, acknowledgments, flow control, and retransmission.
• UDP: connectionless and lower overhead. It provides best-effort delivery without TCP's built-in ordering and retransmission behavior, leaving additional reliability to the application when needed.

A TCP Transport-layer PDU is commonly called a segment. A UDP PDU is commonly called a datagram. Both TCP and UDP use port numbers.

Layer 5: Session

The Session layer manages communication sessions between systems or applications. Conceptual Session-layer functions include establishing a session, maintaining and controlling the dialog, coordinating which side communicates, creating checkpoints, and terminating the session.

Checkpoints can help a long exchange resume from a known point rather than restarting the entire operation. NetBIOS is often cited as a session-related technology in introductory OSI discussions.

In modern networks, a single protocol implementation may span several OSI layers. Consequently, the Session layer is useful for understanding communication functions, but real-world protocol boundaries do not always match the seven layers exactly.

Layer 6: Presentation

The Presentation layer handles data representation and syntax. Its conceptual responsibilities include translating formats between systems, encoding and decoding data, encrypting and decrypting information, and compressing and decompressing content.

MIME is a commonly used example related to describing and representing data formats, such as identifying whether content is text, an image, or another media type. In modern systems, presentation functions are commonly distributed across applications, libraries, file formats, and security protocols rather than implemented as one separate layer.

Layer 7: Application

The Application layer provides network services directly to user-facing applications. It is not the graphical user interface itself. Instead, it defines or exposes the services that software uses to request network communication.

For example, a web browser uses HTTP or HTTPS to request web content, and a file-transfer application can use FTP to exchange files. HTTP, FTP, and Telnet are commonly associated with Layer 7. Telnet is useful as a historical and educational example, but it sends traffic without the protections provided by modern encrypted protocols.

Encapsulation and Decapsulation

Encapsulation is the addition of layer-specific headers and trailers as data moves down the sender's protocol stack. Decapsulation is the removal and interpretation of those headers and trailers as the received information moves up the receiver's stack.

1. An application creates data, such as an HTTP request.
2. The Transport layer adds a TCP or UDP header containing source and destination ports. The result is a segment or datagram.
3. The Network layer adds an IP header containing source and destination IP addresses. The result is a packet.
4. The Data Link layer adds a frame header containing MAC addresses and commonly adds an FCS trailer. The result is a frame.
5. The Physical layer converts the frame into bits and transmits signals across the medium.
6. The receiver processes the bits, checks and removes the frame information, processes the IP packet, processes the Transport information, and delivers the data to the appropriate application.

A useful relationship is that a Layer 2 frame carries a Layer 3 packet, and the packet carries a Layer 4 segment or datagram. The term PDU (Protocol Data Unit) describes the data at a particular layer.

Addressing by OSI Layer

Example: Opening a Web Page

When a browser opens a remote web page, the browser uses HTTP or HTTPS at the Application layer. Presentation and Session functions, including data formatting, encryption-related processing, and communication state, may be handled by the application stack and supporting protocols.

TCP uses port numbers and reliability mechanisms when the application requires them. IP addresses identify the source and destination and routers forward packets between networks. On each local link, Data Link protocols create frames with local MAC addresses. Finally, Physical-layer media carry the resulting bits over copper, fiber, or radio.

Example: Sending Traffic to Another Subnet

Suppose a host needs to reach a device on a remote subnet. The sender creates an IP packet addressed to the remote host. Because the destination is remote, the sender places that packet inside a local Ethernet frame addressed to the default gateway's MAC address.

The router removes the incoming frame, examines the Layer 3 destination, selects a route, and creates a new Layer 2 frame for the next link. The source and destination MAC addresses change at each routed hop, while the end-host IP addresses generally identify the communication from beginning to end.

Protocol and Technology Associations

TCP and UDP in Context

TCP is appropriate when ordered, reliable delivery and connection management are important, such as many web and file-transfer sessions. UDP is useful when low overhead, reduced delay, or application-managed reliability is preferred, such as many voice, video, and name-resolution exchanges. Both protocols operate at Layer 4 and use port numbers.

Using the OSI Model for Troubleshooting

The OSI model helps narrow a fault by testing one layer at a time. You can begin at Layer 1 and work upward, or start with the affected application and work downward. A failure at a lower layer often prevents higher-layer tests from succeeding, so verify basic connectivity before investigating application behavior.

Useful Cisco IOS Checks

These commands illustrate how troubleshooting tools correspond to OSI functions:

show interfaces
show interfaces status
show interfaces counters errors

show mac address-table
show vlan brief
show interfaces trunk

show ip interface brief
show ip route
ping <destination-ip>
traceroute <destination-ip>

On a host, the following commands can test name resolution, an HTTP service, and TCP port connectivity:

nslookup <name>
curl -I http://<host-or-ip>
telnet <host-or-ip> <port>

Exam-Relevant Notes

• Layer 1 transmits bits; it does not understand addresses or frames.
• Layer 2 uses frames and MAC addresses for local delivery. The FCS is normally in the frame trailer.
• Layer 3 uses IP addresses and routing to move packets between networks.
• Layer 4 uses port numbers for process-to-process delivery. TCP is reliable and connection-oriented; UDP is best-effort and lower overhead.
• Layer 2 addresses are local and typically change at every routed hop. Layer 3 addresses identify the end hosts across the routed path.
• OSI protocol associations are study aids. Real protocols, especially TLS/SSL and Ethernet, may span or be discussed across multiple layers.
• The OSI model describes functions; it is not the same thing as the operational TCP/IP protocol suite.