OSI Model
The seven layers and what each one does
Ask where a problem lives and the OSI model gives you seven precise places to look. The Open Systems Interconnection (OSI) model breaks one end-to-end conversation into seven layers stacked from the wire up to the application, and Network+ uses these layer numbers as its shared vocabulary, so internalize the order and the one-line job of each.
The canonical order, top (Layer 7) to bottom (Layer 1), is Application, Presentation, Session, Transport, Network, Data Link, Physical. The two classic mnemonics are All People Seem To Need Data Processing (Layer 7 down) and Please Do Not Throw Sausage Pizza Away (Layer 1 up). Each layer on one host communicates logically with the same layer on the other host, and leans on the layer directly beneath it to actually move the data.
Bottom-up: the seven jobs
- Layer 1 Physical moves raw bits as electrical, optical, or radio signals over the medium. It defines cabling, connectors, pinouts, and voltage or light levels. Hubs and repeaters operate here. No addressing exists yet, only signal.
- Layer 2 Data Link packages bits into frames and delivers them across a single local link using physical hardware addresses, the 48-bit MAC (media access control) address. IEEE 802[1] standards live here: 802.3 Ethernet and 802.11 Wi-Fi. Switches, bridges, and NICs are Layer 2 devices. The data link layer is often split into the LLC and MAC sublayers.
- Layer 3 Network adds logical addressing (IP) and chooses a path across multiple networks, which is routing. The PDU is the packet. Routers and Layer 3 switches act here; IP and ICMP are Layer 3 protocols.
- Layer 4 Transport provides end-to-end delivery between processes using port numbers, and chooses reliability: TCP is connection-oriented with acknowledgements and retransmission, UDP is connectionless and best-effort. Port-aware firewalls and load balancers act at this layer.
- Layer 5 Session opens, manages, and tears down the dialog between two endpoints, tracking which side may transmit and re-establishing a dropped conversation.
- Layer 6 Presentation translates data into a form the application can use: character encoding (ASCII, Unicode), compression, and encryption such as TLS are presentation-layer concerns.
- Layer 7 Application is the layer the user's software touches, providing network services like web (HTTP), file transfer (FTP), email (SMTP), and name resolution (DNS). A content-aware firewall or web application firewall (WAF) inspects traffic here.
The single most testable habit is mapping a device or protocol to its layer: MAC address and switch mean Layer 2, IP address and router mean Layer 3, port number and stateful firewall mean Layer 4, and reading the actual payload (a URL, a SQL string) means Layer 7.
Encapsulation: how data moves down and back up the stack
A single web request becomes signals on a cable through a strict wrapping process. As data passes down the sending stack, each layer adds its own header (and the data link layer also adds a trailer) around the unit it received from the layer above. This nesting is encapsulation, and the receiving host undoes it in reverse as de-encapsulation, peeling exactly one header per layer on the way up.
The PDU name changes at each step because each layer's header is what defines that PDU. Application data is handed to Transport, which prepends a TCP or UDP header (adding source and destination ports) to form a segment. The Network layer wraps that in an IP header (adding source and destination IP addresses) to form a packet. The Data Link layer wraps that in a frame header plus a trailer (adding source and destination MAC addresses and a frame check sequence) to form a frame. The Physical layer then transmits the frame as bits on the medium.
Why the order matters
The addresses ride at different layers on purpose. The MAC addresses in the Layer 2 frame change at every hop (each router rewrites them for the next link), while the IP addresses in the Layer 3 packet stay the same end to end. That is why a packet capture shows the same source and destination IP across a route but different MACs on each segment, and it is a favorite exam distinction.
Encapsulation overhead also explains real limits. Every header consumes bytes, so the maximum transmission unit (MTU), the largest frame payload a link will carry (1500 bytes for standard Ethernet), caps how much application data fits in one packet. When a packet exceeds the next link's MTU, Layer 3 fragments it or, with the don't-fragment bit set, drops it and signals back. Jumbo frames raise the MTU to about 9000 bytes to cut per-frame overhead on links that support it.
Mapping the TCP/IP model onto OSI
OSI is the reference map, but the running internet implements the four-layer TCP/IP (Internet) model defined for hosts in RFC 1122[2]. Network+ expects you to translate between the two, because a question may name a TCP/IP layer and ask for the OSI equivalent, or vice versa.
TCP/IP collapses several OSI layers. Its Application layer covers OSI Layers 5, 6, and 7 together, so session control, encoding, and the application itself all sit in one TCP/IP layer (HTTP, DNS, SMTP). Its Transport layer lines up exactly with OSI Layer 4, carrying TCP and UDP. Its Internet layer lines up with OSI Layer 3 and runs IP. Its Link layer (also called Network Access or Network Interface) covers OSI Layers 1 and 2 together, combining framing and physical signaling.
The mappings worth memorizing
The clean one-to-one pairings are Transport-to-Layer 4 and Internet-to-Layer 3. The lossy collapses are at the top (one TCP/IP Application layer for three OSI layers) and the bottom (one TCP/IP Link layer for two OSI layers). RFC 1122 itself states that the application layer is the top layer and that all Internet transport protocols use IP to carry data between hosts, which anchors the Transport-over-Internet relationship. When a stem mixes the models, translate by layer number rather than assuming both stacks have the same count.
Exam-pattern recognition
Network+ questions on the OSI model almost always test placement: given a device, protocol, address, or symptom, name the layer. Train the reflexes below.
Device-to-layer reflexes
- A hub or repeater regenerates signal with no addressing, so it is Layer 1.
- A switch or bridge forwards by MAC address, so it is Layer 2. A managed switch that also routes is a Layer 3 switch.
- A router forwards by IP address between networks, so it is Layer 3.
- A firewall's layer depends on what it inspects: a packet-filtering or stateful firewall acts on IP and port (Layer 3 to 4), while a next-generation firewall, proxy, or WAF reads application content (Layer 7).
- A load balancer is Layer 4 when it balances by IP and port, Layer 7 when it routes by URL, host header, or cookie.
Address- and PDU-to-layer reflexes
- MAC address means Layer 2; IP address means Layer 3; port number means Layer 4.
- The PDU names the layer: frame is Layer 2, packet is Layer 3, segment or datagram is Layer 4, bits is Layer 1.
Symptom-to-layer reflexes
- A dead link light or wrong cable is Layer 1.
- A VLAN, switch loop, or MAC table problem is Layer 2.
- A wrong default gateway, subnet mask, or routing issue is Layer 3.
- A blocked port or firewall rule is Layer 4.
- A certificate, encryption, or application error points to Layer 6 or 7.
A frequent trap is collapsing the TCP/IP model onto OSI one-to-one. When a stem says the TCP/IP "Application layer," remember it spans OSI Layers 5, 6, and 7, and the TCP/IP "Link layer" spans OSI Layers 1 and 2. Another common miss is calling a port number a Layer 3 concept; ports live at Layer 4 (Transport), while IP addresses live at Layer 3 (Network).
The seven OSI layers: job, PDU, and what lives there
| Layer | Primary job | PDU | Example protocols / devices |
|---|---|---|---|
| 7 Application | Network services to the app (requests, transfers) | Data | HTTP, FTP, SMTP, DNS; L7 firewall, proxy |
| 6 Presentation | Format, encrypt, compress data for the app | Data | TLS, ASCII/Unicode, JPEG, MIME |
| 5 Session | Open, manage, and tear down sessions | Data | RPC, NetBIOS, control of dialogs |
| 4 Transport | End-to-end delivery, ports, reliability | Segment / datagram | TCP, UDP; L4 firewall, load balancer |
| 3 Network | Logical addressing and routing between networks | Packet | IP, ICMP; router, L3 switch |
| 2 Data Link | Framing and local delivery by MAC address | Frame | Ethernet/802.3, 802.11; switch, NIC, bridge |
| 1 Physical | Transmit raw bits over the medium | Bit | Cabling, connectors, hubs, repeaters |
Decision tree
Sharp facts the exam loves — give these one last read before exam day.
Cheat sheet
Sharp facts the exam loves — scan these before test day.
- Know the seven OSI layers in order, top to bottom
The OSI model stacks seven layers: Application (7), Presentation (6), Session (5), Transport (4), Network (3), Data Link (2), Physical (1). Each layer communicates logically with its peer on the other host and relies on the layer below to deliver. The mnemonics All People Seem To Need Data Processing (7 to 1) and Please Do Not Throw Sausage Pizza Away (1 to 7) fix the order, which is what most OSI questions hinge on.
- Name the PDU and you have pinned the layer
The protocol data unit (PDU) name changes down the stack and identifies the layer outright: bits at Layer 1 Physical, frame at Layer 2 Data Link, packet at Layer 3 Network, segment (TCP) or datagram (UDP) at Layer 4 Transport, and data at Layers 5 to 7. When a stem mentions a frame it is asking about Layer 2; a packet means Layer 3; a segment means Layer 4.
Trap Calling a Layer 3 unit a frame; the frame is the Layer 2 PDU, while Layer 3 carries the packet that the frame wraps.
- Physical (Layer 1) moves raw bits, with no addressing
Layer 1 transmits and receives raw bits as electrical, optical, or radio signals and defines cabling, connectors, pinouts, and signal levels. It has no concept of an address, so devices that only regenerate signal, like hubs and repeaters, are Layer 1 devices. A dead link light, a bad cable, or a wrong connector is a Layer 1 problem.
- Data Link (Layer 2) frames data and uses MAC addresses
Layer 2 packages bits into frames and delivers them across one local link using the 48-bit MAC (media access control) hardware address. Switches, bridges, and NICs operate here, and IEEE 802 standards such as 802.3 Ethernet and 802.11 Wi-Fi define this layer. Layer 2 is commonly split into the LLC and MAC sublayers.
Trap Placing a switch at Layer 3; a standard switch forwards by MAC address at Layer 2, and only a Layer 3 switch additionally routes by IP.
- Network (Layer 3) adds logical IP addressing and routing
Layer 3 assigns logical addresses (IP) and selects a path across multiple networks, which is routing. Its PDU is the packet, and routers and Layer 3 switches operate here, alongside protocols like IP and ICMP. When a question involves an IP address, a default gateway, a subnet mask, or moving between networks, it is testing Layer 3.
Trap Assigning routing to Layer 2; switching forwards within one local link at Layer 2, while routing between separate IP networks is a Layer 3 function.
- Transport (Layer 4) uses ports and picks TCP or UDP
Layer 4 provides end-to-end delivery between processes using port numbers and chooses the reliability model: TCP is connection-oriented with acknowledgements and retransmission, while UDP is connectionless and best-effort with lower overhead. Port-aware firewalls and Layer 4 load balancers act here. A clue that names a port number or a blocked service points to Layer 4.
Trap Treating a port number as a Layer 3 concept; ports live at Layer 4 Transport, while IP addresses are the Layer 3 identifier.
- Session (Layer 5) sets up, manages, and tears down dialogs
Layer 5 opens, maintains, and closes the session between two endpoints, tracking which side may transmit and re-establishing a conversation that drops. It governs the dialog itself rather than the data's format or its routing. On the exam it is the layer associated with establishing and terminating connections at the session level.
- Presentation (Layer 6) handles encoding, compression, and encryption
Layer 6 translates data into a form the application can use: character encoding such as ASCII and Unicode, data compression, and encryption. TLS is commonly placed at the Presentation layer because it encrypts the application data before transport. A question about data format conversion or encryption of the payload points here.
- Application (Layer 7) is the service the user's software touches
Layer 7 provides network services directly to applications: web (HTTP), file transfer (FTP), email (SMTP), and name resolution (DNS) are Layer 7 protocols. Content-aware controls that read the actual payload, such as a next-generation firewall, a proxy, or a web application firewall (WAF), operate here. A clue that inspects a URL, a host header, or a SQL string is Layer 7.
- Encapsulation adds a header per layer on the way down
Sending data runs top-down, and each layer wraps the unit from above in its own header (the Data Link layer also adds a trailer): application data becomes a segment, then a packet, then a frame, then bits. The receiver reverses this as de-encapsulation, stripping exactly one header per layer on the way up until the application reads the original data.
- The header a layer adds is what defines its PDU
Each PDU name corresponds to the header just added: the TCP/UDP header makes a segment at Layer 4, the IP header makes a packet at Layer 3, and the frame header plus trailer makes a frame at Layer 2. Because the headers nest, a packet capture shows them as concentric wrappers around the original application data, outermost being the Layer 2 frame.
- MAC addresses change every hop; IP addresses stay end to end
The Layer 2 frame's source and destination MAC addresses are rewritten by each router for the next link, so they change at every hop, while the Layer 3 packet's source and destination IP addresses remain the same from origin to final destination. This is why a capture along a path shows constant IPs but different MACs on each segment.
Trap Assuming the source MAC stays constant across a routed path; routers rewrite the Layer 2 MAC addresses at every hop, unlike the end-to-end Layer 3 IP addresses.
- Encapsulation overhead is why MTU caps payload size
Every layer's header consumes bytes, so the maximum transmission unit (MTU), the largest payload a link will carry, limits how much application data fits in one packet; standard Ethernet MTU is 1500 bytes. Jumbo frames raise the MTU to about 9000 bytes to reduce per-frame overhead on links that support it. When a packet exceeds the next link's MTU, Layer 3 either fragments it or, with the don't-fragment bit set, drops it and signals back.
- The internet runs the four-layer TCP/IP model, not OSI's seven
OSI is the teaching and troubleshooting reference, but real hosts implement the four-layer TCP/IP (Internet) model defined in RFC 1122: Application, Transport, Internet, and Link (Network Access). IP runs at the Internet layer and TCP or UDP at the Transport layer. Expect to translate a question between the two models rather than assuming they line up layer for layer.
- TCP/IP Application spans OSI Layers 5 to 7
The TCP/IP Application layer collapses the OSI Session, Presentation, and Application layers into one, so session control, encoding, and the application itself all sit together (HTTP, DNS, SMTP). When a stem names the TCP/IP Application layer and asks for the OSI equivalent, the answer is Layers 5 through 7, not Layer 7 alone.
Trap Mapping the TCP/IP Application layer to OSI Layer 7 only; it covers OSI Layers 5, 6, and 7 together.
- TCP/IP Transport equals OSI 4; Internet equals OSI 3
The two clean one-to-one mappings between the models are TCP/IP Transport to OSI Layer 4 (TCP and UDP) and TCP/IP Internet to OSI Layer 3 (IP). These are the pairings most likely to be tested directly because they line up exactly, unlike the collapsed Application and Link layers.
- TCP/IP Link layer spans OSI Layers 1 and 2
The TCP/IP Link layer (also called Network Access or Network Interface) combines the OSI Physical and Data Link layers, covering both framing and physical signaling in one layer with technologies like Ethernet and Wi-Fi. Asked for the OSI equivalent of the TCP/IP Link layer, the answer is Layers 1 and 2 together.
- A firewall's OSI layer depends on what it inspects
Place a firewall by what it examines, not by the word firewall: a packet-filtering or stateful firewall acts on IP addresses and ports at Layers 3 to 4, while a next-generation firewall, proxy, or WAF reads the application payload at Layer 7. The same logic applies to load balancers: Layer 4 when balancing by IP and port, Layer 7 when routing by URL, host header, or cookie.
Trap Calling every firewall a Layer 7 device; a basic packet-filtering or stateful firewall operates only at Layers 3 to 4 and never reads application content.
- Troubleshoot bottom-up, mapping each symptom to a layer
Working the stack from Layer 1 upward isolates a fault to one layer: a cable or link-light fault is Layer 1, a VLAN or switch-loop or MAC-table issue is Layer 2, a wrong gateway or subnet mask or routing problem is Layer 3, a blocked port or firewall rule is Layer 4, and a certificate, encryption, or application error points to Layer 6 or 7. Naming the layer first narrows the tools you reach for.