OSI Model & TCP/IP

Mental model

The OSI model is a teaching tool. Nobody actually built the internet to OSI’s seven layers — TCP/IP, with its four layers, came first and won. But OSI’s seven-layer breakdown is so good at describing what a network does that everyone in the industry still uses the layer numbers when talking about problems.

When a senior engineer says “that’s a layer-3 issue”, they mean it’s an IP routing problem. “Layer 2” means switching, MAC addresses, VLANs. “Layer 7” means application-level (HTTP, DNS, SSH). Learning the layers gives you that vocabulary.

The seven OSI layers, in plain English

The exam mnemonic: All People Seem To Need Data Processing (top to bottom). Or the cleaner: Please Do Not Throw Sausage Pizza Away (bottom to top).

The four TCP/IP layers — what actually exists

If you’re reading an RFC or vendor doc, you’ll see TCP/IP terms. If you’re talking to a CCNA instructor or troubleshooting a ticket, you’ll hear OSI numbers. Be fluent in both.

How layers actually wrap each other (encapsulation)

When your laptop sends an HTTP request, each lower layer wraps the data from the layer above it. Read the diagram inside-out — HTTP is the payload; each outer layer adds its own header (and Ethernet also adds a trailer).

The receiver unwraps in the reverse order. Each layer reads its own header, strips it, and passes the rest up.

The CCNA-favorite terms for the wrapped unit at each layer:

• Layer 7 payload: data
• Layer 4: segment (TCP) or datagram (UDP)
• Layer 3: packet
• Layer 2: frame
• Layer 1: bits

Practical use — naming problems by layer

When a user says “the internet is down”, the goal is to figure out which layer broke. Top-down or bottom-up, both work — pros usually go bottom-up because lower layers being broken makes higher layers irrelevant.

Common mistakes

1. Mixing up OSI and TCP/IP layer numbers. TCP/IP doesn’t have layer numbers — saying “layer 5 of TCP/IP” is nonsense. Use OSI numbers (1–7) when numbering.

2. Calling ARP a Layer 3 protocol. It uses IP info but operates on MAC addresses — it’s Layer 2 (or 2.5, depending on who you ask).

3. Putting routing at Layer 2. Switches are Layer 2 (MAC). Routers are Layer 3 (IP). A “Layer 3 switch” is a switch with routing capabilities — it does both.

4. Calling everything above Layer 4 “the application”. Strictly, sessions and encryption are 5 and 6. In practice TCP/IP collapses them, but for the CCNA exam know the OSI distinctions.

5. Forgetting the OSI model is descriptive, not prescriptive. Real protocols often span layers or skip them. The model is for thinking, not for strict classification.

Lab to try tonight

1. Open Wireshark and capture traffic on your laptop’s interface.
2. Open a web page — capture for 30 seconds.
3. Pick one HTTP packet. Expand the layers in Wireshark — you’ll see Ethernet (L2), IP (L3), TCP (L4), HTTP (L7).
4. Note the source/destination at each layer: MAC at L2, IP at L3, port at L4, URL at L7.
5. Bonus: open a DNS query packet. Note how DNS uses UDP at L4 (not TCP) and lives at L7.

Cheat strip