What you'll learn

  1. Quick answer
  2. Why layers exist at all
  3. The seven layers and what each one addresses by
  4. One HTTPS request, all the way down and back up
  5. Encapsulation, headers and the MTU bug
  6. Mapping OSI to the stack that actually runs
  7. FAQ

Quick Answer

The OSI model is a seven-layer reference model: physical, data link, network, transport, session, presentation, application. Real networks run the four-layer TCP/IP stack, so layers 5 and 6 have no separate implementation. Its value is vocabulary and troubleshooting. When someone says a layer 4 load balancer or a layer 2 problem, the number tells you exactly how much of the packet is being inspected and which tool to reach for.

Why layers exist at all

Layering exists so that each part of the network can be replaced without rewriting the others. When you carry your laptop from a hostel Wi-Fi network to an Ethernet port in a lab, layers 1 and 2 change completely. The radio becomes copper, the frame format changes, the addressing changes. Your browser, your HTTP request and your TCP connection do not know and do not care.

The rule that makes this work is that each layer only communicates with the same layer on the other machine. TCP on your laptop has a conversation with TCP on the server. IP on your laptop has a conversation with IP on the server. Every layer treats what it receives from above as an opaque blob of bytes, wraps it in its own header, and hands it down.

That opacity is the whole design. IP does not know whether the payload is TCP or UDP beyond one number in the header. Ethernet does not know what IP is doing. This is why the internet could add TLS, then HTTP/2, then QUIC, without replacing a single router.

The practical payoff is debugging. When a page will not load, the layer tells you which tool to use. No link light is layer 1. Cannot reach the gateway is layer 2 or 3. Ping works but the port refuses is layer 4. Connection succeeds but the response is a 502 is layer 7. Guessing at random is what people do when they have not internalised the model, and it wastes hours.

The seven layers and what each one addresses by

Learn each layer by its addressing scheme and the name of its data unit. That is what questions actually test.

  • 1 Physical. Bits on a medium: voltage, light, radio. No addressing. Cables, connectors, repeaters.
  • 2 Data link. Frames, addressed by MAC address, delivered within one local link. Ethernet, Wi-Fi, ARP, switches, VLANs. Error detection with a frame check sequence.
  • 3 Network. Packets, addressed by IP address, routed across networks. IP, ICMP, routers, NAT. This is where end-to-end reachability is decided.
  • 4 Transport. Segments for TCP or datagrams for UDP, addressed by port number. This is the layer that identifies which application on a host gets the data.
  • 5 Session. Establishing, maintaining and ending a dialogue. In the real stack this is handled inside applications and libraries, not by a separate component.
  • 6 Presentation. Encoding, character sets, compression and encryption. Again, no separate implementation. Your JSON serialiser and TLS live here conceptually.
  • 7 Application. Protocols users and programs speak directly: HTTP, DNS, SMTP, SSH, FTP.

Two clarifications save marks. First, layer 7 is the protocol, not the browser. Chrome is an application that speaks an application-layer protocol. Second, a firewall has no fixed layer. A packet filter that only checks IP and port operates at layers 3 and 4. A web application firewall reading request bodies operates at layer 7. The correct answer depends on what it inspects.

One HTTPS request, all the way down and back up

Take a laptop on a home Wi-Fi network in Pune with the address 192.168.1.7, opening an HTTPS page. Follow it downwards.

Layer 7. The browser needs an IP address first, so it makes a DNS query, which is itself an application-layer protocol. Once it has an address it builds the request text: a request line, a Host header, cookies, an Accept header.

Layer 6, informally. TLS encrypts that request into a record. From here on, everything below sees ciphertext. The Host header, the path and the cookies are now unreadable to anything in between.

Layer 4. TCP wraps the encrypted bytes in a segment with a source port chosen by the operating system, say 51514, and destination port 443, plus a sequence number. This is the layer that decided, one round trip earlier, that a connection exists at all.

Layer 3. IP wraps the segment in a packet with source 192.168.1.7 and the destination server address, plus a TTL.

Layer 2. The laptop checks whether the destination is on the local subnet. It is not, so the frame is addressed to the MAC address of the home router, learned earlier through ARP. Note the split: the IP destination is the far-away server, but the MAC destination is a box three metres away.

Layer 1. The frame becomes a radio signal.

At the router, NAT rewrites the source IP and port. At every hop, the layer 2 frame is discarded and rebuilt with new MAC addresses while the IP header survives, minus one from the TTL. At the server, the whole thing unwraps in reverse: frame, packet, segment, TLS record, HTTP request. The response takes the same journey backwards.

[ Ethernet header | IP header | TCP header | TLS record | HTTP bytes ]
   14 bytes         20 bytes     20+ bytes    ~5+ bytes    your data

Encapsulation, headers and the MTU bug

Every layer adds a header, and headers cost space inside a fixed limit. That limit is the MTU, the maximum transmission unit, which is 1500 bytes on ordinary Ethernet. Subtract 20 bytes of IP header and 20 bytes of TCP header and you have roughly 1460 bytes of payload per segment, less if TCP options are present.

This produces one of the strangest bugs a beginner meets: small pages load, large pages hang. SSH connects and shows a prompt, then freezes the moment output gets long. A site works on mobile data but not over the office VPN.

The cause is a path with a smaller MTU than 1500, which is common with VPN tunnels and PPPoE broadband because the tunnel adds its own headers. Normally the router in the middle sends back an ICMP message saying the packet is too big and must not be fragmented, and the sender reduces its segment size. If a firewall along the path drops all ICMP, that message never arrives. Small packets pass, full-size packets vanish silently, and the connection hangs forever. This is called a path MTU black hole, and it is a direct consequence of blocking ICMP without thinking.

You can test the path yourself. The flags differ by operating system and getting that right is part of the answer.

Linux:    ping -M do -s 1472 example.com
macOS:    ping -D -s 1472 example.com
Windows:  ping -f -l 1472 example.com

1472 payload + 8 ICMP header + 20 IP header = 1500 bytes

If 1472 fails but 1400 succeeds, the path MTU is smaller than 1500. Check what your interface believes with ip link show on Linux or netsh interface ipv4 show subinterfaces on Windows.

Mapping OSI to the stack that actually runs

The TCP/IP model has four layers and describes reality. OSI has seven and describes a committee's idea of reality. Both are worth knowing because the industry uses OSI numbers as slang while running TCP/IP.

TCP/IP layer     Absorbs OSI      Protocols
Application      5, 6, 7          HTTP, DNS, SMTP, SSH
Transport        4                TCP, UDP
Internet         3                IP, ICMP
Link             1, 2             Ethernet, Wi-Fi, ARP

The most useful place these numbers appear in real work is infrastructure. A layer 4 load balancer sees only IP addresses and ports. It can distribute connections and it can be very fast, but it cannot route by URL path, cannot read the Host header, and cannot add an X-Forwarded-For header, because all of that is encrypted or simply not visible at that layer. A layer 7 load balancer terminates TLS, parses HTTP, and can do path-based routing, header rewriting and per-URL rate limiting. When a cloud console asks you to choose between a network load balancer and an application load balancer, this is the choice being made.

The same vocabulary shows up in switching. A layer 2 switch forwards by MAC address inside one broadcast domain. A layer 3 switch also routes between VLANs using IP. A DDoS described as a layer 3 or 4 attack is trying to exhaust bandwidth or connection tables. A layer 7 attack sends valid-looking HTTP requests to exhaust your application, which is why it is harder to filter.

Where does TLS sit? Honestly, between layers. It runs above TCP and below HTTP. Calling it presentation-layer is accepted in exams; explaining the ordering is what convinces an interviewer you understand it.

Frequently Asked Questions

If nothing implements OSI, why is it still taught? Because it gives everyone a shared vocabulary for where a problem or a device operates. Saying a layer 2 issue instantly narrows the search to switches, MAC addresses and ARP. It also separates concerns cleanly enough that you can reason about one layer at a time, which is exactly what makes debugging tractable.
Which layer does a router work at, and which does a switch work at? A router works at layer 3 because it forwards using IP addresses and a routing table, and it separates broadcast domains. A traditional switch works at layer 2, forwarding by MAC address within a single broadcast domain. A layer 3 switch blurs the line by doing both, which is worth mentioning if the interviewer pushes.
What is the difference between a frame, a packet and a segment? They are the names of the data unit at each layer. A segment is a TCP unit at layer 4, a packet is an IP unit at layer 3, and a frame is a link-layer unit at layer 2. Each one contains the layer above it, so a frame contains a packet which contains a segment. Using the right word signals you understand encapsulation.
Where does HTTPS fit in the seven layers? HTTPS is not a separate protocol, it is HTTP carried inside TLS. HTTP is layer 7. TLS sits above TCP and below HTTP, so it is commonly placed at layer 6. The important part is the ordering: TCP connects first, TLS negotiates keys second, and only then does the HTTP request travel, already encrypted.
Do I need to memorise a mnemonic for the layers? A mnemonic helps you recall the order under pressure, but it will not help you answer any follow-up. Learn each layer by what it addresses by instead: MAC at layer 2, IP at layer 3, port at layer 4. That framing answers most questions directly, including where any given device or protocol belongs.