The OSI Model Explained: The Seven Layers from Cable to Application

Each time you open a website, send a message or stream a video, data passes through several stages before it reaches your screen. It travels from electrical signals in an Ethernet cable or radio waves over Wi-Fi up to the program you are using. Understanding this sequence gives you a clear picture of how networks work and helps you troubleshoot internet problems in an orderly way. The model most often used to describe this sequence is the OSI Model, a reference framework that divides network communication into seven layers. This article explains where the model came from, what each layer does, how data moves through the layers, how it compares with TCP/IP, and how to use it to solve real problems.

What the OSI Model is

OSI stands for Open Systems Interconnection. It is a reference model that describes how communication between computers should be divided into layers. Each layer has its own job and talks to the layers directly above and below it through defined interfaces. This lets manufacturers develop equipment or software for one layer without needing to know the internal details of the others.

The key point is that OSI is a model, not a protocol suite used directly on the internet. The protocols that actually run the internet, such as TCP and IP, belong to a different model. Still, the OSI layering idea remains a common language that network engineers around the world use to explain and diagnose problems.

Where the model came from

In the late 1970s, computer networks were still isolated islands. Each manufacturer used its own protocols, so a machine from IBM could not talk to one from DEC, and equipment from one vendor depended on that same vendor's products. The International Organization for Standardization (ISO) began developing a common model in 1977 so that networks from different manufacturers could interoperate.

The result was the standard ISO 7498, published in 1984 and known as the OSI Reference Model. Although the model became widely respected as a concept, the protocols built to match it, such as X.400 for email and X.500 for directories, did not win the adoption that was expected. TCP/IP, developed under DARPA in the United States, was deployed on ARPANET and later became the foundation of the internet, and it spread far more widely.

An overview of the seven layers

The layers are numbered from the bottom up. Layer 1 sits closest to the physical medium, and Layer 7 sits closest to the user.

1. Physical Layer

2. Data Link Layer

3. Network Layer

4. Transport Layer

5. Session Layer

6. Presentation Layer

7. Application Layer

A common English mnemonic for the order is "Please Do Not Throw Sausage Pizza Away", which runs from Layer 1 to Layer 7. Once you remember it, you can work out which layer a piece of equipment or a protocol belongs to.

Layer 1: Physical Layer

This layer is concerned with sending raw bits across a physical medium, such as electrical voltage on copper wire, light in fibre optics, or radio waves for Wi-Fi. It defines how a 1 and a 0 are represented as voltage levels, frequencies or light intensity, along with connector shapes, signal speeds and voltage limits.

Equipment at this layer includes Ethernet cables such as Cat 6, fibre-optic cables, hubs that repeat signals, and transceivers. Common problems include loose or broken cables, poor connectors, cable runs longer than the standard allows, and electromagnetic interference.

Layer 2: Data Link Layer

The data link layer handles delivery between devices on the same local network or directly connected to each other. It groups bits into frames, each containing a destination address, a source address, the data, and an error-checking value such as a CRC. The address used at this layer is the MAC address, a 48-bit identifier assigned to a network card by its manufacturer and usually written in hexadecimal, for example 00-1A-2B-3C-4D-5E.

This layer also controls how devices share the medium. Ethernet uses rules to avoid simultaneous transmissions on a cable, and Wi-Fi uses CSMA/CA to reduce collisions in the air. The main device here is the switch, which learns which MAC addresses are on which port and forwards each frame only to the correct port. VLANs, defined by the 802.1Q standard, divide a single switch into separate virtual networks.

Layer 3: Network Layer

The network layer moves packets across many networks. It uses IP addresses to identify the destination. IPv4 addresses are 32 bits long, such as 192.168.1.10, while IPv6 addresses are 128 bits long to provide a much larger address space. Its main job is routing: choosing the best path for a packet, which routers do by consulting their routing tables.

This layer also includes ICMP, which carries diagnostic messages. The ping and traceroute commands use ICMP to check whether a destination responds and to see how many hops a path takes. Common problems at this layer include incorrect IP settings, such as a wrong subnet mask or default gateway, and routes that do not exist.

Layer 4: Transport Layer

The transport layer delivers data from a program on one machine to a program on another. It uses port numbers to identify services: port 80 for HTTP, port 443 for HTTPS, and port 53 for DNS.

The two main protocols here are TCP and UDP. TCP is reliable: it performs a handshake before sending, confirms receipt with acknowledgements, resends lost data and controls the flow so the receiver is not overwhelmed. UDP is simpler and faster but offers no delivery guarantee, which makes it suitable for live video, online games and DNS. At this layer, the data unit is called a segment for TCP and a datagram for UDP.

Layer 5: Session Layer

The session layer opens, manages and closes conversations between two programs, which are called sessions. Its functions include creating checkpoints so that a transfer can resume after a failure, coordinating which side may speak at a given time, and keeping a connection alive during use.

Real-world examples include NetBIOS and RPC, which allow a program to call functions on another machine. In practice, session functions are often built into applications or libraries rather than existing as a distinct layer, which makes this the layer that is hardest to pin down in exam questions.

Layer 6: Presentation Layer

The presentation layer converts data into a form that both sides can understand. It covers character encoding, compression and encryption. Examples include interpreting text encoded in UTF-8, handling image formats such as JPEG and PNG, compressing files with gzip, and encrypting data with TLS, which keeps HTTPS websites safe from eavesdropping.

In practice, TLS is classed as part of the session or presentation layer in different textbooks, and in the TCP/IP model it sits between TCP and HTTP. This is worth keeping in mind when explaining the model to others.

Layer 7: Application Layer

The application layer is the one users interact with most directly. Programs such as web browsers, email clients and chat apps use protocols at this layer to communicate with other machines. Examples include HTTP and HTTPS for the web, SMTP, IMAP and POP3 for email, FTP for file transfer, DNS for turning domain names into IP addresses, and DHCP for automatically assigning IP addresses.

It is important to understand that the application layer refers to the protocols an application uses, not the application itself. For example, Chrome and Firefox both use the same HTTP protocol.

How data moves through the layers

When a program sends data, the data travels from Layer 7 down to Layer 1. Each layer adds its own header, a process called encapsulation. The transport layer adds port numbers, the network layer adds IP addresses, and the data link layer adds MAC addresses and a CRC. The physical layer then converts everything into electrical, optical or radio signals.

The receiving side reverses this, called decapsulation. Each layer reads its own header, checks it, and passes the rest up to the next layer. When the data reaches Layer 7, the destination program receives the original message.

The data unit also has a different name at each layer. Layer 1 deals in bits, Layer 2 in frames, Layer 3 in packets, Layer 4 in segments or datagrams, and Layers 5 to 7 are often grouped together as data.

Example: loading one web page

Here is how loading the page at example.com would pass through the model.

1. Application layer: the browser needs the HTML of the page, so it builds an HTTP GET request. First it needs the IP address of example.com, so it asks DNS.

2. Presentation layer: for HTTPS, the request is encrypted with TLS before it is sent.

3. Session layer: the connection is opened and kept alive during the exchange.

4. Transport layer: TCP divides the data into segments, adds destination port 443, and performs a handshake with the server.

5. Network layer: the packet receives the source and destination IP addresses. The home router chooses the path out to the internet.

6. Data link layer: the frame receives the MAC address of the next device on the local network, which is the router.

7. Physical layer: the frame is sent as signals through the cable or over Wi-Fi to the router.

When the server replies, the data travels back in the reverse direction, and each layer strips off its header in turn.

Comparing OSI with TCP/IP

The TCP/IP model has four layers: Network Access, Internet, Transport and Application. In this model, the Network Access layer combines OSI's physical and data link layers. The Internet layer corresponds to the network layer, and the Transport layer matches OSI's transport layer. The Application layer combines OSI's session, presentation and application layers.

The comparison shows that the two models describe the same thing at different levels of detail. OSI is more detailed and works well for teaching and conceptual explanation, while TCP/IP reflects the way the internet actually operates.

Using OSI to solve real problems

Thinking in layers lets you find a fault step by step, starting from the bottom or the top. Typical checks include:

• **Layer 1:** Check that cables are firmly connected and that link lights are on. If a link light is off, the problem may be the cable or the port.
• **Layer 2:** Check MAC addresses and ARP to confirm that devices can see each other on the same network, and verify VLAN settings.
• **Layer 3:** Use ping to test reachability to an IP address and traceroute to see the path. Confirm the IP address, subnet mask and default gateway.
• **Layer 4:** Use telnet or nc to test whether a port is open. A firewall may be blocking it.
• **Layers 5 and 6:** Check the TLS handshake and whether a certificate has expired.
• **Layer 7:** Use nslookup or dig to check DNS, and look at HTTP status codes such as 404 or 500 to tell whether the problem lies with the server.

This approach avoids guesswork. When the lower layers work correctly, the fault is usually higher up, and the reverse is also true.

Network equipment by layer

Knowing which devices work at which layers makes the model easier to remember.

• **Layer 1:** hubs, Ethernet cables and repeaters
• **Layer 2:** switches, bridges and network interface cards
• **Layer 3:** routers and Layer 3 switches
• **Layer 4:** some firewalls and load balancers that work with TCP and UDP
• **Layer 7:** proxy servers, application firewalls and WAFs that inspect HTTP content

Some devices operate at several layers at once. A Layer 3 switch, for example, combines the functions of a switch and a router in one unit.

Why OSI matters in practice

Although OSI is not used directly as a protocol, it is valuable in several ways. It gives engineers a shared vocabulary, separates the responsibilities of equipment and software, supports step-by-step troubleshooting, and provides the foundation for learning networking. Certifications such as CompTIA Network+ and Cisco CCNA still use the seven-layer model to explain concepts.

Security at each layer

The OSI model also shows where network attacks can occur and how to defend against them. Good security has to cover every layer, because protecting one layer alone can be bypassed.

• **Physical layer:** Access to server rooms and cabinets should be restricted to authorised staff. Cables that can easily be tapped and unused ports should be disabled or removed.
• **Data link layer:** ARP spoofing lets a machine impersonate another on the local network. Port Security and Dynamic ARP Inspection on switches reduce this risk.
• **Network layer:** IP spoofing and ICMP-based floods can overwhelm a system. Access control lists (ACLs) that filter packets and checks on the true origin of traffic help prevent them.
• **Transport layer:** SYN floods exploit the TCP handshake, and port scans reveal which services are listening. Stateful firewalls and connection rate limits help defend against both.
• **Session layer:** Attackers may hijack an authenticated session, for example by stealing a cookie. Long-lived tokens and unnecessary session renewal are risks to manage.
• **Presentation layer:** Use current TLS versions, disable weak ciphers, and check that certificates are valid and not expired.
• **Application layer:** The most common vulnerabilities are found here, including SQL injection, cross-site scripting and phishing. A web application firewall (WAF) can inspect incoming input, and software should always be kept up to date.

The key principle is defence in depth: layering several controls so that an attacker has to overcome many obstacles before reaching sensitive data.

Seeing real packets with Wireshark

The clearest way to see the OSI model at work is to inspect real packets with an analyser such as Wireshark. It breaks each packet into its layers, from the frame (layers 1 and 2) through Ethernet II (layer 2), IPv4 (layer 3), TCP or UDP (layer 4), and HTTP (layer 7). Selecting a layer highlights the matching bytes.

A simple exercise is to start a capture on your own computer, open a plain HTTP test site that does not use HTTPS, stop the capture and find an HTTP GET packet. You will see the application request, the port numbers at the transport layer, the IP addresses at the network layer and the MAC addresses at the data link layer, just as this article describes. Seeing the real data turns the model from a diagram into something concrete.

Only capture traffic on networks you are authorised to use, such as your home network or a lab you control. Intercepting other people's traffic without permission is illegal in most places.

Lessons from the OSI Model

• Dividing a complex system into layers makes it easier to understand and to repair.
• A standard that many parties accept can matter more than a perfect one. TCP/IP, which was imperfect but workable, won the market.
• Real understanding comes from connecting the concepts to practical tests such as ping, traceroute and log inspection.

Conclusion

The OSI Model is more than a table to memorise. It is a way of thinking about network communication, from electrical signals on a cable and IP addresses, through reliable delivery of data, up to the applications users see. Once you understand which layer data is passing through and what each layer does, you can diagnose network problems systematically and understand device documentation far better.