VMware ESXi and vSphere Cluster Management

OSI Reference Model: The Seven Networking Layers Explained

Learn the seven OSI networking layers, their protocols, devices, addressing, PDUs, encapsulation, troubleshooting uses, and relationship to TCP/IP.

What Is the OSI Reference Model?

OSI means Open Systems Interconnection. It is a seven-layer reference model developed by the International Organization for Standardization (ISO) to describe how network communication can be organized.

The OSI model is a conceptual framework, not one protocol suite. Real networks commonly use the TCP/IP protocol suite, and many modern protocols combine responsibilities from multiple OSI layers. The model is still valuable because it gives engineers a shared vocabulary for design, documentation, learning, and troubleshooting.

When an application on one computer communicates with an application on another, the OSI model represents that communication as a sequence of responsibilities. Each layer serves the layer above it and uses the services of the layer below it.

Why Layering Matters

• Interoperability: Different vendors can build compatible components when responsibilities and interfaces are understood.
• Standardization: A change in one function does not require redesigning every other function.
• Modular design: Ethernet, Wi-Fi, IP, TCP, and application protocols can evolve independently.
• Clear responsibilities: Each layer provides a manageable area of functionality.
• Troubleshooting: A fault can be narrowed to physical connectivity, local delivery, routing, transport, or application services.

The Seven OSI Layers in Order

From the bottom of the stack upward, the layers are:

1. Layer 1 — Physical
2. Layer 2 — Data Link
3. Layer 3 — Network
4. Layer 4 — Transport
5. Layer 5 — Session
6. Layer 6 — Presentation
7. Layer 7 — Application

Layer 1 transmits signals. Layer 7 provides network services to application processes. A mnemonic is only a memorization aid, not a technical rule. One bottom-to-top mnemonic is Please Do Not Throw Sausage Pizza Away: Physical, Data Link, Network, Transport, Session, Presentation, Application.

Encapsulation and Decapsulation

Encapsulation is the addition of layer-specific control information as data moves down the sender's protocol stack. Decapsulation is the interpretation and removal of that information as received data moves up the receiver's stack.

1. An application creates data, such as an HTTP request.
2. The Transport layer adds transport information. TCP produces a segment; UDP produces a datagram. Port numbers identify communicating processes.
3. The Network layer adds logical addressing, producing an IP packet.
4. The Data Link layer places the packet inside a frame with local-link addressing and control fields.
5. The Physical layer transmits the frame as electrical, optical, or radio signals represented as bits.

At the destination, the process is reversed. The receiver interprets the physical signal, checks the frame, processes the IP packet, delivers the transport data to the correct port, and passes application data to the appropriate software.

Terminology varies by protocol and vendor. “Segment,” “datagram,” “packet,” and “data” are useful common terms, but encapsulation names are not identical in every technology.

Packet, Frame, and Signal

A Layer 3 IP packet may travel inside several different Layer 2 frames during its journey. On each link, Layer 1 carries the current Layer 2 frame as signals. A router generally removes the incoming frame, examines the IP packet, and builds a new Layer 2 frame for the next link. The IP addresses normally describe the end hosts, while the MAC addresses change at each routed hop.

Layer 1: Physical

The Physical layer transmits raw bits through a medium. A bit is represented by an electrical, optical, or radio signal according to the technology in use.

Physical-layer concerns include copper and fiber cables, wireless radio, connectors, pinouts, interface specifications, signal levels, modulation, timing, data rates, and physical topology. A problem here can prevent every higher-layer operation from working.

Common Layer 1 components include cables, connectors, fiber transceivers, hubs, repeaters, and the physical media portions of network interface cards. The Physical layer does not provide IP addresses, routing, or frame handling.

Layer 2: Data Link

The Data Link layer provides delivery across one local link or network segment. It groups bits into frames and commonly uses MAC addresses to identify local interfaces.

An Ethernet frame commonly includes source and destination MAC addresses in its header and an error-detection value called the Frame Check Sequence (FCS) in its trailer. The FCS helps detect corruption. Detection is not the same as correction: a receiver may discard a damaged frame, while recovery may be handled by a higher-layer protocol such as TCP.

Data Link functions also include media access control: deciding how devices share or access a medium. IEEE 802 networking describes two related sublayers:

• Logical Link Control (LLC): Provides a logical interface to upper-layer protocols.
• Media Access Control (MAC): Handles media access and link-level hardware addressing.

Switches and bridges primarily forward frames using MAC-address information. A multilayer switch or router can also perform functions associated with higher layers. Ethernet, PPP, and HDLC are examples of Layer 2 technologies or protocols, although Ethernet also includes important Physical-layer specifications.

Layer 3: Network

The Network layer provides logical addressing and communication between different networks. IPv4 and IPv6 addresses are examples of logical addresses. Unlike a MAC address, an IP address is used to identify a location in an internetwork and support routing.

Routing is the process of selecting and forwarding traffic along a path between networks. Routers are the primary Layer 3 forwarding devices. A router examines a packet's destination IP address, consults its routing information, and forwards the packet toward the next network.

At each routed hop, the router normally removes the incoming Layer 2 frame and creates a new frame appropriate for the outgoing link. The Layer 3 packet is forwarded, subject to changes such as a hop-limit or time-to-live value. IP provides addressing and delivery, while ICMP supports IP operations and diagnostics, including many ping and traceroute functions. ICMP is not a replacement for IP; it operates in support of IP communication.

Layer 4: Transport

The Transport layer provides end-to-end delivery between application processes. A port number identifies a service or process, allowing one host to run multiple network conversations. Multiplexing combines traffic from multiple applications, and demultiplexing delivers received traffic to the correct application.

TCP

Transmission Control Protocol (TCP) is connection-oriented and provides reliable delivery. Its functions include sequence numbers, acknowledgments, retransmission, flow control, and connection establishment and termination. A TCP transport PDU is commonly called a segment.

UDP

User Datagram Protocol (UDP) is connectionless and has minimal overhead. It does not provide TCP-style sequencing, acknowledgments, retransmission, or connection management. A UDP PDU is commonly called a datagram. Applications may choose UDP when low overhead, speed, or application-managed timing is more important than built-in recovery. Reliability is not exclusively a TCP concept; an application or another layer can provide its own reliability mechanisms.

Layer 5: Session

The Session layer is a conceptual description of functions that establish, manage, synchronize, and end dialogs between communicating applications. Examples include dialog control and checkpoints that allow a long exchange to be coordinated or resumed.

In modern TCP/IP systems, Session-layer responsibilities are often implemented inside application protocols, libraries, or operating systems rather than by a distinct standalone protocol layer. This is one reason the OSI model should be treated as a reference framework rather than a precise diagram of every implementation.

Layer 6: Presentation

The Presentation layer describes how data is represented and translated between application formats. Conceptual functions include character encoding, serialization, compression, and encryption.

Examples include converting text with a character encoding, representing images or audio using a media format, compressing data, and applying cryptographic protection. TLS-based encryption is often discussed alongside Presentation and Session functions, although real stacks commonly place TLS between an application protocol and TCP. Modern software frequently combines Presentation and Application behavior.

Layer 7: Application

The Application layer provides network services to application processes. It is not the same as the complete user interface or end-user program; instead, applications use Layer 7 protocols and services to communicate.

Representative protocols include HTTP for web communication, FTP for file transfer, Telnet for remote terminal access, DNS for name resolution, SMTP for email transfer, and DHCP for automatic network configuration. HTTPS combines HTTP behavior with TLS security and lower-layer TCP/IP services.

Representative Protocols and Technologies

These classifications are primary associations, not absolute boundaries. A protocol may span functions associated with multiple OSI layers.

Practical Example: Opening an HTTPS Website

1. The browser creates an HTTP request at the Application layer.
2. TLS negotiates security and encrypts application data. These functions are commonly discussed using Presentation and Session concepts.
3. TCP provides a reliable connection and uses source and destination ports.
4. IP adds source and destination logical addresses and selects a routed path.
5. Ethernet or Wi-Fi supplies local framing and MAC-based delivery.
6. Copper, fiber, or radio carries the resulting signals as bits.

Practical Example: A Laptop Reaching Another Subnet

Suppose a laptop sends data to a server on a different IP subnet. The laptop creates transport information and an IP packet addressed to the remote server. Because the server is remote, the first Ethernet frame uses the default gateway's MAC address as its immediate destination, not the server's MAC address.

The router receives the frame, removes its local framing, forwards the IP packet, and creates a new Layer 2 frame for the next link. The IP addresses generally remain the laptop and server addresses, while the Layer 2 addresses are replaced at every routed hop.

Switch Versus Router

• A switch primarily forwards Layer 2 frames within a LAN using learned MAC-address information.
• A router primarily forwards Layer 3 packets between IP networks using routing information.

Real products may perform additional functions, but this distinction is useful for first-pass analysis.

OSI and TCP/IP Compared

Modern Internet networking is commonly implemented with the TCP/IP model and protocol suite. TCP/IP uses fewer broad layers, so several OSI responsibilities are combined.

The OSI model remains useful even when a network uses TCP/IP because it separates concepts clearly and helps explain where a failure or responsibility belongs.

Using the OSI Model for Troubleshooting

Troubleshooting often starts with physical connectivity and moves upward through local delivery, addressing, routing, transport, security, and application services. This is a useful organizing method, but it is not mandatory to inspect every layer in order. A known DNS symptom, for example, may justify starting at the Application layer.

Useful Diagnostic Commands

Commands do not map perfectly to one OSI layer; each provides evidence about several layers.

Windows     ipconfig /all              # Addressing, gateway, DNS, adapter details
Windows     ping <destination>         # IP reachability and ICMP behavior
Windows     tracert <destination>      # Routed path
Windows     nslookup <name>            # DNS resolution

Linux       ip addr                    # Interface and IP information
Linux       ip route                   # Routing table and default route
Linux       ping <destination>         # IP reachability
Linux       traceroute <destination>  # Routed hops
Linux       dig <name>                 # DNS query

Cisco IOS   show interfaces            # Link, errors, speed, and duplex
Cisco IOS   show ip interface brief    # Interface state and IPv4 addresses
Cisco IOS   show mac address-table     # Learned MAC addresses
Cisco IOS   show ip route              # IPv4 routing table
Cisco IOS   ping <address>             # Device-originated reachability test
Cisco IOS   traceroute <address>      # Device-originated path trace

Key Takeaways

• OSI is a seven-layer conceptual model created in association with ISO.
• Layer 1 handles signals and bits; Layer 2 handles local frames and MAC addresses; Layer 3 handles IP packets and routing.
• Layer 4 handles process-to-process delivery, ports, and protocols such as TCP and UDP.
• Session and Presentation are useful conceptual categories, but modern TCP/IP software often combines them with Application-layer behavior.
• Encapsulation adds information as data moves down the sender's stack; decapsulation removes and interprets it at the receiver.
• Ethernet spans Data Link and Physical functions, and TLS does not fit perfectly into one OSI layer.
• The OSI model is a framework for understanding and troubleshooting real networks, not a claim that every implementation has seven separate protocol layers.

For a consolidated reference, see the OSI Reference Model reference.