The OSI model explained: the 7 layers and encapsulation
What the OSI model is, what each of its 7 layers is for, and how a piece of data gets encapsulated into segments, packets, frames and bits as it travels across the network.
The OSI model describes how data travels across a network by splitting it into 7 independent layers. Each layer solves one concrete problem and talks only to the layer above and below it, so you can change one without touching the rest.
What is the OSI model?
The OSI model (Open Systems Interconnection) is a seven-layer reference framework that standardizes how two machines communicate over a network. It is used to design protocols, diagnose failures and reason about which level a problem lives at. It is not software you install: it is a shared mental map.
What is each layer for?
Think of a crew of seven workers. Each has a trade and none does the other’s job: the one at the top speaks the program’s language, the one at the bottom moves electricity down a cable, and in between are the ones who translate, encrypt, order and choose the route.
- 7 ApplicationSpeaks the program’s languageHTTP, DNS, SMTP. It is the only layer that matters to whoever writes the application, and the only one the user sees.
- 6 PresentationTranslates and encryptsDecides how the data is represented: text encoding, compression, and the encryption that turns the message into noise for anyone watching.
- 5 SessionOpens and closes the conversationEstablishes that two ends are talking to each other, and that they can pick up where they left off. In practice TLS covers this layer and the previous one at once.
- 4 TransportDelivers complete and in orderTCP splits the message into numbered pieces, resends them if they were lost and reassembles them on arrival. UDP does the same without guarantees, in exchange for going faster.
- 3 NetworkChooses the path between networksIP addresses and routing. This is the layer that gets a packet out of your house and to a server on another continent, hopping from router to router.
- 2 Data LinkPasses the ball to the one next doorMAC addresses inside the same physical network. It does not know what the Internet is: it only knows how to hand the frame to the next device on the wire.
- 1 PhysicalTurns bits into signalVoltage over copper, light through fibre, radio through the air. There is no data left here, there is physics: if the cable is bad, everything above it is pointless.
They are read top to bottom when the data leaves your machine, and bottom to top when it reaches the other one.
How does data get encapsulated?
Encapsulation is the model’s central mechanism. On the way down through the layers, the data accumulates a header at each level: first it becomes a segment (with TCP and the port), then a packet (with the destination IP), then a frame (with the MAC) and finally bits on the wire. At the receiver the process runs in reverse: each layer strips its header until the original data comes back.
A real packet, layer by layer
Up to here it is the theory that is everywhere. What follows is not: I captured with tcpdump the handshake my machine sends to this very site and opened it byte by byte. Six of the seven layers leave their bytes there, from 2 to 7. The only one that does not show up is the physical one, and its absence teaches something too: below layer 2 there is no data left to look at, there is voltage, and to see it you have to ask the network card rather than the packet.
tcpdump. Switch on a unit in the rack and see which part of the packet belongs to it.Physical Turns bits into signal
This layer does not appear in the dump, and that is the point: there are no bytes left here, there is an electrical signal over a pair of wires. Its data does not come from tcpdump, it comes from asking the network card.
- 100 Mb/s
- negotiated link speed
- Full duplex
- can send and receive at once
- Twisted pair
- copper, not fibre or radio
- Link detected: yes
- there is someone on the other side
Data Link Passes the ball to the one next door
MAC addresses: who hands to whom inside the same physical network. It knows nothing about the Internet, only about the cable in front of it.
- 34 0a 33 8a 8e 1f
- destination: my router, the next hop
- 08 bf b8 3e 19 a1
- source: my machine’s network card
- 08 00
- what comes inside is IPv4
Network Chooses the path between networks
IP addresses and the hop between networks. This is the layer that makes this work across continents and not only inside your house.
- 45
- version 4, 20-byte header
- 02 39
- total packet length: 569 bytes
- 40
- TTL 64: it has 64 hops left before being dropped
- 06
- what comes above is TCP
- c0 a8 00 65
- source 192.168.0.101, my machine on the home network
- 4c 0d e7 b4
- destination 76.13.231.180, this site’s server
Transport Delivers complete and in order
Chooses the machine’s door and takes charge of nothing being lost or arriving out of order. It is the one that retries when something did not make it.
- a2 72
- source port 41586, picked at random by my system
- 01 bb
- destination port 443: HTTPS
- e4 a4 2b 63
- sequence number, for reordering on arrival
- 80 18
- PSH and ACK flags: data is going and I confirm the previous
- 01 f6
- window 502: how much can be sent to me without waiting
Session Opens and closes the conversation
Establishes that two ends are talking to each other. The TLS record starts here, which in practice covers this layer and the next at once.
- 16
- TLS record of type handshake
- 03 01
- announced version, for compatibility
Presentation Translates and encrypts
Decides how the data is represented and negotiates the encryption. It sits glued to the previous one because the same protocol does both things.
- 02 00
- length of the handshake that follows
- 01
- ClientHello message: I greet first
Application Speaks the program’s language
What you care about: which site you are going to and what language you speak with it. Everything below exists to carry this from one side to the other.
- 65 66 72 61 69 6e …
- in plain text it reads efraingaray.com
- 02 68 32
- I can speak h2, that is HTTP/2
- 68 74 74 70 2f 31 2e 31
- and http/1.1 too
Three things that dump teaches better than any diagram:
Layers are not folders, they are an onion. The first 14 bytes are layer 2 and say which device on the wire to hand it to. The next 20 are layer 3 and say which machine in the world. The 32 after that are layer 4 and say which door of that machine. Only then does what the program wanted to send begin. Each layer wraps the previous one without opening it.
The site name travels in the clear, even though the connection is encrypted. There, at byte 229, efraingaray.com reads as legible text. That is the SNI, and it goes unencrypted because the server needs to know which certificate to present before encryption exists. Whoever watches your traffic does not see what you ask for, but does see who you ask.
In the TCP handshake the upper layers are empty. The first three packets of a connection carry not a single application byte: they are pure layer 4 control getting into agreement. That is why a site that is “slow to connect” and one that is “slow to load” are problems in different layers.
Where each layer breaks, in practice
Thinking in layers is good for one concrete thing: narrowing down where to look when something fails.
| Symptom | Likely layer | What to check |
|---|---|---|
| No link, the cable gives no signal | 1 · Physical | Cable, port, signal strength |
| You see the network but cannot reach the router | 2 · Data Link | MAC address, VLAN, ARP table |
| You reach the router but not the Internet | 3 · Network | Default route, routing table, TTL exhausted |
| It connects but drops or crawls | 4 · Transport | Closed port, retransmissions, window |
| The browser says the certificate is invalid | 5 and 6 · Session | System date, chain of trust, SNI |
| It loads but returns a server error | 7 · Application | The application, its logs, the query |
The rule I use: start from the bottom. If layer 3 does not answer, debugging layer 7 makes no sense. A working ping rules out the first three layers in one go.
Questions that always come up
Is the OSI model actually used, or did TCP/IP replace it? Both. What runs on the network is TCP/IP, which has four layers. OSI is still used as shared vocabulary: when someone says “it is a layer 2 problem”, everyone in the room understands what they mean, even though the real packet does not have seven separate layers.
Why seven and not five? Because OSI is a reference model from 1984, designed to describe any possible network. In practice layers 5, 6 and 7 blur together: in the packet above, TLS acts as session and presentation, and HTTP as application, but they travel glued together in the same stretch of bytes.
How do I see this on my own machine? With tcpdump -i any -X "host whatever and tcp port 443" on Linux or macOS, or with Wireshark if you prefer it in colour. The command I used for the capture above is exactly that one.
Where all this comes from
The model is not tutorial folklore: it has a standard and a founding paper, and both can be read for free.
The standard. ITU-T X.200 (07/1994), which is the identical text of ISO/IEC 7498-1. It is the primary source and it is published at no cost, as a 419 KB PDF. Two parts are worth it:
- Clause 6.2 explains why there are seven and not some other number: it lists the principles the committee used to decide where to cut each layer. It is the answer to the question everyone asks and almost nobody answers.
- Clause 7 describes each layer, one per subsection, from 7.1 Application to 7.7 Physical. Note the order: the standard numbers them top to bottom, the opposite of how they are drawn.
The paper. Zimmermann, H. (1980). OSI Reference Model — The ISO Model of Architecture for Open Systems Interconnection. IEEE Transactions on Communications, vol. COM-28, no. 4, April 1980, pp. 425–432. DOI 10.1109/TCOM.1980.1094702. There is a free PDF copy. It is eight pages and explains the model back when it was still a proposal, without the layer of myth that grew on top of it.
The book. Tanenbaum, A. S. and Wetherall, D. J. Computer Networks, 5th edition, section 1.4.1 “The OSI Reference Model”, page 41. The comparison with TCP/IP is in the next section, 1.4.2, which is where you understand why the seven-layer model describes and the four-layer one is what runs.
Everything else in this article — the packet, the bytes, the link speed — came from my own machine, not from those sources.
In the end it is a shared mental map
No machine “runs OSI”. What runs down there is TCP/IP, with four layers, and the packet you saw does not carry seven separate labels. So why do we keep teaching it?
Because when someone says “it is a layer 2 problem”, everyone in the room knows where to look without another word of explanation. That is the real value: it is not a blueprint of the system, it is the vocabulary that lets two people debug the same failure without talking about different things.
That is why it is worth learning even though the packet does not follow it to the letter.
Why does it matter in practice?
Thinking in layers narrows down where to look when something fails. A name-resolution problem lives at L7; a dead route, at L3; a noisy cable or Wi-Fi, at L1. Separating responsibilities is also why the Internet scales: TCP does not need to know whether it travels over fibre or Wi-Fi, and Ethernet does not need to understand HTTP.
Comments
No comments yet. The first one is yours.