VMware ESXi and vSphere Cluster Management

OSI Model: The Seven Network Layers for Nmap Beginners

Learn the seven OSI model layers, encapsulation, common protocols, TCP versus UDP, troubleshooting, and how the model helps interpret Nmap scans.

The OSI model is the Open Systems Interconnection model: a seven-layer conceptual framework for describing how network communication works. It helps beginners organize protocols, devices, data units, and troubleshooting questions.

The model is associated with the International Organization for Standardization (ISO). OSI is a reference model, not a literal description of every modern network. Most real networks use the TCP/IP protocol suite, whose boundaries do not match the seven OSI layers perfectly.

Standardized layers still provide a useful vocabulary. Hardware manufacturers, operating systems, applications, and network operators can implement different technologies while agreeing on common functions such as addressing, routing, transport, and application communication.

The Seven OSI Layers

OSI layers are conventionally numbered from Layer 7 at the top to Layer 1 at the bottom:

1. Layer 7 — Application: Network services used by applications.
2. Layer 6 — Presentation: Data representation, format translation, compression, and encryption-related functions.
3. Layer 5 — Session: Establishing, coordinating, maintaining, and ending communication sessions.
4. Layer 4 — Transport: End-to-end delivery between processes, commonly using TCP or UDP.
5. Layer 3 — Network: Logical addressing and routing between networks.
6. Layer 2 — Data Link: Local-link delivery using frames and link-layer addresses.
7. Layer 1 — Physical: Transmission of raw bits as electrical, optical, or radio signals.

Layering and Encapsulation

Each layer performs a distinct function and provides services to the layer above it. As data moves down a sender's stack, each layer can add control information such as addresses, sequencing fields, or error checks. This process is called encapsulation.

At the receiving system, the corresponding layers inspect and remove that information as the data moves upward. This reverse process is called decapsulation.

A simplified sequence is:

1. An application creates data, such as an HTTP request.
2. TCP or UDP adds transport information, including source and destination ports. The result is commonly called a TCP segment or UDP datagram.
3. IP adds logical addressing, producing a Network-layer packet.
4. Ethernet or another Data Link technology adds local addresses and error-detection information, producing a frame.
5. The Physical layer transmits the frame as bits.

These names are useful conventions. Actual protocol stacks can combine or cross OSI functions, but the sequence explains how layered communication is commonly analyzed.

Layer 1: Physical

The Physical layer transmits raw binary data as signals through a medium. It concerns how signals travel, not IP addresses, ports, or application protocols.

Physical-layer characteristics include cabling, connectors, pin assignments, voltage or light signaling, radio frequencies, modulation, link speed, and the capabilities of network interface hardware. Examples include electrical signals over Ethernet copper, light through fiber-optic cable, and radio signals used by Wi-Fi. A network interface card provides hardware that sends and receives these signals.

If a cable is disconnected, a radio link is unavailable, or an interface has failed, higher-layer communication may not begin. A port scan cannot produce useful results if the scanner's physical link is down.

Layer 2: Data Link

The Data Link layer provides delivery across a local link or broadcast domain. It packages Network-layer packets into frames.

An Ethernet frame normally contains a header with source and destination MAC addresses, a payload, and a trailer containing a Frame Check Sequence (FCS). The FCS helps detect transmission errors; it does not repair the frame. A receiver that detects an invalid frame can discard it, leaving recovery to another mechanism when appropriate.

A MAC address is a Layer 2 hardware or link-layer address used for local delivery. It is different from an IP address, which identifies a logical destination across routed networks.

Data Link functions are often described using two sublayers:

• Logical Link Control (LLC): Coordinates link-layer control and related error or protocol-identification functions.
• Media Access Control (MAC): Handles hardware addressing and rules for accessing the shared medium.

A switch commonly operates at Layer 2. It learns MAC addresses and forwards Ethernet frames toward the appropriate local port instead of sending every frame everywhere. Ethernet, Point-to-Point Protocol (PPP), and High-Level Data Link Control (HDLC) are representative Data Link technologies or protocols.

Layer 3: Network

The Network layer provides logical addressing and moves packets between different networks. An IP address identifies a host interface within a logical addressing system and helps determine which network contains the destination.

Routing is the process of selecting a path between networks. A router commonly examines Layer 3 information and forwards packets toward their destination. Each routed link can use a different Layer 2 frame, while the IP destination remains the basis for end-to-end routing.

IP is the main example of a Layer 3 protocol. ICMP is an IP-related control and diagnostic protocol commonly associated with this layer. A failed route, incorrect subnet configuration, or blocked network path can prevent a target from being reached before transport ports are considered.

Layer 4: Transport

The Transport layer provides communication between processes or services running on hosts. A port is a transport-layer endpoint identifier used to direct traffic to the intended service or process.

TCP is connection-oriented and provides reliable, ordered delivery. It can use sequence numbers, acknowledgments, retransmission, flow control, and error recovery to manage a stream of data.

UDP is connectionless and has lower protocol overhead. It sends datagrams without a built-in guarantee that they will arrive, arrive once, or arrive in order. Applications can add their own reliability when needed.

Nmap uses transport-layer behavior when scanning ports. A TCP port can appear open, closed, or filtered based on responses and filtering. UDP scanning has different expectations because an absence of a response does not necessarily mean that no service exists.

Layer 5: Session

The Session layer describes establishing, maintaining, coordinating, and terminating a communication session between systems. A session can include checkpoints, dialog coordination, and rules for resuming or ending an exchange.

In modern TCP/IP networking, session functions are often implemented together with Transport- or Application-layer behavior rather than as a separate protocol layer. NetBIOS session services are a historical or illustrative association with this layer.

Layer 6: Presentation

The Presentation layer concerns how data is represented so that communicating systems can interpret it consistently. Its functions can include character encoding, serialization, format translation, compression, and encryption-related processing.

MIME provides labels for media types and message content formats, such as identifying whether content is HTML, plain text, or an image. This helps software choose how to interpret data.

TLS and SSL are often placed in Presentation or Session discussions for teaching purposes, but real implementations cross traditional OSI boundaries. TLS provides protected communication over an existing transport connection and can involve several practical stack layers. It should not be treated as belonging exclusively to one OSI layer.

Layer 7: Application

The Application layer provides network services used by end-user applications. It does not mean the graphical interface itself; it means protocols through which software exchanges network data.

Examples include HTTP for web communication, FTP for file transfer, and Telnet for interactive remote terminal communication. An application protocol commonly uses a transport protocol and a port, but a protocol is not permanently limited to one fixed port. Administrators can configure services to listen on different ports, and one application can use different transports or connections for different purposes.

Example: Opening a Website

1. A browser creates an HTTP request at the Application layer.
2. If protected, TLS processes the communication and provides encryption-related functions.
3. TCP creates a connection to the destination service port and provides ordered delivery.
4. IP supplies source and destination addresses and enables routing.
5. Ethernet or Wi-Fi carries the packet in a local frame using MAC addresses.
6. Copper, fiber, or radio hardware transmits the frame as bits.

At the destination, the process is reversed. Each layer interprets the information intended for it and passes the remaining data upward.

Protocol-to-Layer Associations

The following mappings are common teaching associations. Real protocols and technologies can span layers, and the boundaries in a TCP/IP implementation may differ from the OSI reference model.

Local MAC Delivery Versus Routed IP Delivery

Suppose a host communicates through a switch and then a router with a remote host. The sender uses a MAC address for the next local hop, often the router's local interface. The IP destination identifies the remote host across networks.

When the router forwards the packet onto the next link, it creates a new Layer 2 frame for that link. The MAC addresses change from link to link, while the Layer 3 destination remains relevant to the routed path. This is why a remote host's MAC address is generally not used directly by the original sender.

Using the OSI Model with Nmap and Troubleshooting

When a scan does not produce the expected result, ask which layer is most likely involved. Scanning and diagnosis require more than knowing a port number: the local interface must transmit, local delivery must work, routing must reach the target, transport packets must receive a response, and the service must speak an identifiable application protocol.

For a TCP probe, Nmap communicates toward a target IP at Layer 3 and evaluates behavior from a target TCP port at Layer 4. If a service is discovered, service detection can inspect Application-layer protocol behavior, banners, or responses. Layer 2 address resolution and Layer 1 connectivity may be required before the probe can leave the scanner's local network.

Memory Aid

From Layer 7 down to Layer 1, use: “All People Seem To Need Data Processing”.

• All — Application
• People — Presentation
• Seem — Session
• To — Transport
• Need — Network
• Data — Data Link
• Processing — Physical

Summary

• OSI is a seven-layer conceptual model associated with ISO.
• Encapsulation adds layer-specific information as data moves downward; decapsulation removes and interprets it as data moves upward.
• Bits belong to the Physical layer, frames to Data Link, packets to Network, and segments or datagrams to Transport.
• Layer 2 handles local delivery and MAC addresses; Layer 3 handles logical addressing and routing; Layer 4 handles ports and process-to-process delivery.
• Nmap port results primarily involve Transport-layer behavior, while reachability often involves Physical through Network layers and service identification involves the Application layer.
• OSI associations are useful approximations, not rigid descriptions of every modern protocol stack.

Continue with the OSI model reference as a quick review of the layer order and terminology.