In a nutshell When two computers talk over a network, a great many things happen at once: electrical signals run down a wire, somewhere the recipient's address is worked out, somewhere it's checked that everything arrived, somewhere the data is encrypted. To make sense of that mess, all of the network's work is split into layers. Each layer does exactly one job and doesn't meddle in anyone else's. The OSI model and the TCP/IP model are two ways of doing that split.
Why you need a model at all if the network already works
Imagine you post a paper letter to a friend in another city. A whole crowd of people and services take part: you write the text, put it in an envelope, address it, carry it to the post office, it's sorted, loaded into a van, the van drives, in the other city it's sorted again, and a postman brings it to the door. Everyone at their stage does only their own job: the postman doesn't read the letter, and you don't drive the van.
A network is built the same way. And this "division of labour" has three very practical upsides — the models were invented for their sake:
- You can fix it in parts. If the letter didn't arrive, you work out at which stage it got stuck: the postman didn't deliver it, it was lost in sorting, or you wrote the address wrong. You don't need to re-check everything. It's the same in a network: "ping goes through but the site won't open" immediately tells you the lower stages work and something broke higher up.
- Layers can be swapped independently. It doesn't matter whether the letter travels by van, train or plane — the text of the letter doesn't change. Same in a network: a site works identically over Wi-Fi, over cable, or over mobile data, because the upper layers don't know what's underneath.
- Everyone speaks one language. An engineer doesn't have to explain "well, somewhere addresses aren't being found" — they say "it's a layer 3 problem" and are understood at once.
A layer is exactly one such "stage of work" with a clear zone of responsibility. A layer talks only to its neighbours above and below, and offers them a simple service while hiding its own inner kitchen.
The OSI model — 7 layers (the detailed, teaching one)
OSI (Open Systems Interconnection) is the "ideal", detailed model. In its pure form it isn't used in real life, but everyone talks in its language, because it breaks everything down into 7 clear pieces. We go through it bottom to top — from the wires to what a human sees.
Layer 1 — Physical
The lowest, most "hardware" layer. There are no addresses and no programs here — only raw bits: zeros and ones turned into a physical signal. Over copper it's voltage swings, over fibre — flashes of light, over Wi-Fi — radio waves. Analogy: the sheet of paper itself and the ink the letter is written in. Just the physical carrier. What belongs here: cables, connectors, radio frequencies, network cards at the "hardware" level. Where it breaks: a cable pulled out, a severed wire, a weak Wi-Fi signal.
Layer 2 — Data Link
Responsible for moving data within one segment of the network — for example, between your laptop and the Wi-Fi router, or between devices on one local network. The first address appears here — the MAC address: a unique number burned into every network card at the factory (looks like A4:B1:C2:D3:E4:F5).
Analogy: handing a letter from person to person inside one building — "give it to that person in office 5." A MAC address is like "office 5" — it only means anything inside that building.
Unit of data: the frame.
Example technologies: Ethernet (cable), Wi-Fi, ARP (maps an IP address to a MAC address).
Attacks at this layer: ARP spoofing (an attacker passes off their MAC as someone else's and intercepts traffic on the local network).
Layer 3 — Network
This is delivery between different networks, across the whole internet. The IP address lives here (e.g. 142.250.185.78) — a global address that finds you from anywhere in the world. And routing works here — choosing the path: which routers to push the packet through so it reaches the right network.
Analogy: the ordinary postal address on an envelope — "city, street, house." A letter reaches it from any country, and the postal services themselves decide the route.
Unit of data: the packet.
Examples: IP (the addresses themselves), ICMP (service messages — ping runs on it).
Where it breaks: "wrong route", another network unreachable, IP-addressing problems.
Layer 4 — Transport
Makes sure data reaches the right program, intact. A single computer runs a pile of programs at once (browser, mail, a game), and they all reach for the network. So the replies don't get mixed up, each program has its own port — a "door" number. A browser over HTTPS listens on port 443, mail on its own ports, and so on. This layer also decides between reliable and fast:
- TCP — reliable delivery. It sets up a connection, checks that each piece arrived, re-asks for anything lost, and reassembles everything in order. Sites, files and mail load this way — where you can't lose a single byte.
- UDP — fast delivery with no guarantees. Fire and forget, no re-asking. Calls, video and games work this way — better to drop a frame than to wait and stutter.
Analogy: TCP is a registered letter with delivery confirmation (you get proof it arrived). UDP is an ordinary postcard dropped in the box (it'll probably arrive, but nobody guarantees it). And a port is the apartment number: the address got you to the building, the port says which exact door to knock on.
Unit of data: the segment.
Attacks/recon: port scanning (
nmap) is work at exactly this layer — checking which "doors" are open.
Layer 5 — Session
Opens, maintains and cleanly closes the session between two sides. It keeps the conversation continuous: started, talked, said goodbye. If the connection dropped, this layer is responsible for being able to resume from the right place. Analogy: the phone call itself as an event — "picked up → talked → hung up." Not the words, but the fact that the line is open and holding.
Layer 6 — Presentation
Brings data to a form both sides understand: encoding (so letters don't turn into gibberish), compression (to fit more lightly) and, most important for us, encryption. This is usually where TLS/SSL sits — the thing that turns http into https and makes the exchange unreadable to outsiders.
Analogy: a translator and a cipher clerk. You speak Russian, the other end speaks Japanese — someone in the middle translates. Or: the letter is written in a secret cipher only the sender and recipient understand.
Layer 7 — Application
The topmost — what a human or a program deals with directly. These are the protocols of specific tasks: HTTP/HTTPS (web pages), DNS (turns a site name into an IP), FTP (files), SMTP (sending mail). Analogy: the meaning of the letter itself — the whole point of the exercise. The text you read. Important: this is NOT the application itself (not "Google Chrome") but the rules by which the application talks over the network. Chrome is a program; HTTP is the language it speaks to a site. Attacks at this layer: most web vulnerabilities (SQL injection, XSS, and so on) live right here.
How to remember the order
Bottom to top — Physical, Data Link, Network, Transport, Session, Presentation, Application. The classic mnemonic: Please Do Not Throw Sausage Pizza Away. The first letters = the layers bottom to top.
The TCP/IP model — 4 layers (the one that actually runs)
OSI is great for study, but the real internet is built on a simpler model — TCP/IP. Same idea of layers, but there are four: several OSI layers are simply merged, because in practice they aren't separated.
| TCP/IP layer | What it does | Which OSI layers it absorbed |
|---|---|---|
| Application | everything a program sees: web, DNS, mail, encryption | 7 + 6 + 5 |
| Transport | delivery to the right program, TCP/UDP, ports | 4 |
| Internet | IP addresses and the route between networks | 3 |
| Network Access | physical transfer + the local network, MAC | 2 + 1 |
Same meaning, just broader strokes. When people talk in practice about "the TCP/IP stack," this working model is what they mean. OSI is kept in mind when you need to point at a layer precisely.
Encapsulation — how a letter gathers envelopes
This is the key idea the layers exist for. As data goes down the layers (from your program toward the wire), each layer adds its own header — a service note with what that layer needs. It ends up like a nesting doll, or a letter stuffed into ever more envelopes:
You wrote: "Hello" ← data (L7)
Transport added a port: [port | Hello] ← segment (L4)
Network added an IP: [IP | port | Hello] ← packet (L3)
Data Link added a MAC: [MAC | IP | port | Hello] ← frame (L2)
Physical: 010110101110... ← bits (L1)
At the other end everything happens in reverse — decapsulation: each layer strips its own header, reads it, and passes the "filling" to the layer above. Data Link strips the MAC, hands it to Network; Network strips the IP, hands it to Transport; and so on all the way to the top, where the program receives a clean "Hello".
Why this matters to us, not just to theorists. When you analyse traffic (in Wireshark, say) or pick apart an attack, you know exactly which layer to look on for which information:
- MAC address → Data Link layer (L2)
- IP address → Network layer (L3)
- Port number → Transport layer (L4)
- The contents of a request to a site → Application layer (L7)
Each "note" sits on its own level, and you know at once where to look.
Why this matters to you in practice
- Fast diagnosis. "Ping to the site goes through but the page won't load" → layers 1–3 are alive (signal, local network, route are fine), so dig higher — DNS, the web server, the application. The model instantly cuts half the options.
- Knowing where you're attacking. Every layer has its own arsenal: ARP spoofing is L2, port scanning with
nmapis L4, breaking a web form is L7. When you understand the layer, you understand the class of techniques. - A shared language. "It's a problem at layer 4" is a short, precise phrase any network person understands, unlike "something's wrong with the internet."