Handbooks / Computer Networks / Chapter 1

OSI and TCP/IP Models

7 pages · ~5 min✓ Reviewed

Start here. Next up: IP Addressing and Subnetting.

Computer NetworksPage 1

Layered Model Mental Map

1. What Layering Does

  • Networking is split into stacked jobs, one per layer
  • Each layer serves the layer above it
  • Each layer talks to the same layer on the peer host

2. OSI: 7 Layers, Top to Bottom

  1. L7 Application
  2. L6 Presentation
  3. L5 Session
  4. L4 Transport
  5. L3 Network
  6. L2 Data Link
  7. L1 Physical
  • Mnemonic: All People Seem To Need Data Processing
  • Application, Presentation, Session, Transport, Network, Data Link, Physical

3. OSI vs TCP/IP

OSI layersTCP/IP layer
L5-L7 Session, Presentation, ApplicationApplication
L4 TransportTransport
L3 NetworkInternet
L2 Data Link + L1 PhysicalLink (Network Access)
Which model is which

OSI = reference model for reasoning and troubleshooting. TCP/IP = what is actually implemented.

Computer NetworksPage 2

What Each OSI Layer Does

1. Upper Layers: L7-L5

  • L7 Application: network services for apps; HTTP, DNS, SMTP
  • L6 Presentation: encoding, encryption, compression; TLS, JPEG, ASCII/UTF-8
  • L5 Session: opens, maintains, closes dialogues; checkpointing, RPC sessions

2. L4 Transport

  • End-to-end delivery between processes, using ports
TCPUDP
Reliableyesno
Orderedyesno
Flow controlyesno

3. Lower Layers: L3-L1

LayerJobScope
L3 Networklogical IP addressing, routingbetween networks
L2 Data LinkMAC addressing, framing, FCS error detectionone link
L1 Physicalbits as signals: cable, fibre, radiothe medium
Scope

L3 crosses networks; L2 stays within one link; L1 only carries bits.

Computer NetworksPage 3

PDUs and Encapsulation

1. PDU Names and Header Fields

LayerPDUHeader fields
L7-L5data / messagenone to know
L4segment (TCP), datagram (UDP)source/destination port
L3packetsource/destination IP, TTL
L2framesource/destination MAC, EtherType
L1bitssignals only

2. Encapsulation and De-encapsulation

  1. DataL7-L5
  2. + TCP headersegment
  3. + IP headerpacket
  4. + Eth header + FCSframe
  • Sender encapsulates downward, each layer wraps the payload from above
  • Receiver de-encapsulates upward: each layer strips and reads its own header, then hands the payload up
  • Only Data Link adds a trailer (FCS); all other layers add headers only
Trailer

Only the frame has a trailer: the FCS at the end. Segments and packets have headers only.

3. Interview Point

  • Which layer adds a trailer? Data Link only, the FCS.
  • What does a receiver do with a frame? Each layer strips and reads its header, then passes the payload up.
  • Segment vs datagram? Segment is TCP, datagram is UDP; both are L4.
  • Which fields does L3 read? Source/destination IP and TTL.
Computer NetworksPage 4

Protocols and Addresses by Layer

1. Protocols per Layer

LayerProtocols
L7HTTP/HTTPS, DNS, SMTP, FTP, SSH, DHCP
L6TLS/SSL (L5-L6, not L7)
L4TCP reliable; UDP connectionless, low overhead
L3IP, ICMP (ping, traceroute), IPsec, OSPF, BGP
L2Ethernet, ARP (IP to MAC, "L2.5"), VLAN 802.1Q, PPP
  • TCP 3-way handshake: client SYN, server SYN-ACK, client ACK, then connected
  1. SYNclient
  2. SYN-ACKserver
  3. ACKclient

2. Addresses

LayerAddressIdentifies
L4Portthe process
L3IPhost and network
L2MACNIC on the local link
  • MAC: rewritten at every hop
  • IP: stays end to end
  • NAT rewrites the IP at the boundary

3. TCP or UDP

  • TCP: web, email, file transfer
  • UDP: DNS lookups, VoIP, streaming, games
Common slips

TLS sits at L5-L6, not only L7. Ping is ICMP at L3, not TCP.

Computer NetworksPage 5

Devices, Hubs vs Switches vs Routers, Troubleshooting

1. Hub vs Switch vs Router

  • Collision domain: devices whose frames can collide
  • Broadcast domain: devices receiving an L2 broadcast
  • Switch learns source MACs into the CAM table
  • Switch forwards only to the destination port
Hub (L1)Switch (L2)Router (L3)
Forwardsevery bit, all other portsdest MACdest IP, routing table
Duplexhalffullfull
Collision domains1 shared1 per port1 per interface
Broadcast domains11 (unless VLANs)1 per interface
Joinsone segmentone networkdifferent networks

2. Smarter Boxes

  • L3 switch routes between VLANs at hardware speed
  • Firewall: stateful at L3/L4, application-aware up to L7
  • Load balancer: L4 or L7

3. Troubleshoot Bottom-Up

  1. 1L1cable, link light
  2. 2L2ARP/MAC, VLAN
  3. 3L3ping, routes
  4. 4L4port, firewall
  5. 5L7app logs
  • Routing is a router's job, not a switch's
  • ping is ICMP at L3, not a TCP test
  • TLS is not only L7: often placed at L5-L6
Computer NetworksPage 6

OSI and TCP/IP Cheat Sheet

1. Layer to PDU, address, protocol, device

LayerPDUAddressProtocolsDevice
L7/6/5data—HTTP, DNS, SMTP, SSHfirewall, load balancer
L4segmentportTCP, UDPfirewall, load balancer
L3packetIPIP, ICMProuter
L2frameMACEthernet, ARPswitch, bridge
L1bits——hub, repeater
  • TCP/IP: L7-L5 = Application, L4 = Transport, L3 = Internet, L2-L1 = Link
  • Firewalls and load balancers work from L4 up to L7

2. Collision and broadcast domains

DeviceCollision domainsBroadcast domains
Hub1 shared1
Switch1 per port1 (unless VLANs)
Router1 per interface1 per interface
Remember

A switch splits collision domains; only a router splits broadcast domains.

Computer NetworksPage 7

Check yourself

A host sends a packet through one router to a server on another network, with no NAT. Which of MAC, IP and port change?
  • Only the MAC addresses change: each L2 header spans one link
  • IP and port stay end to end
  • TTL also drops by 1, but it was not one of the three
Ping to a server succeeds, but its website times out. Where do you look next?
  • Ping is ICMP at L3, so IP and routing work
  • Check L4 next: port 443 open, firewall rules
  • Then L7: app logs
PC A sends a frame to PC B. Who else sees it on a hub, and on a switch?
  • Hub: every other port, since it repeats all bits
  • Switch: only B's port once it has learned B's MAC
  • Unknown destination MAC: the switch floods it