OSI & TCP/IP Models

Seven-layer OSI model, four-layer TCP/IP stack, encapsulation, and how HTTP maps to each layer.

Overview

The OSI model is a conceptual framework dividing network communication into seven layers: - Layer 1 — Physical: bits and signals (cables, radio, fiber) - Layer 2 — Data Link: MAC addressing, Ethernet frames, switches - Layer 3 — Network: IP addressing and routing (routers, VPC route tables) - Layer 4 — Transport: TCP (reliable, ordered) and UDP (connectionless) - Layer 5 — Session: session establishment and teardown - Layer 6 — Presentation: encoding, encryption (TLS spans L4-L6) - Layer 7 — Application: HTTP, HTTPS, DNS, SMTP, gRPC

The TCP/IP model (the actual Internet stack) collapses OSI into four layers: Link (OSI 1-2), Internet (OSI 3), Transport (OSI 4), Application (OSI 5-7).

Encapsulation means each layer wraps the payload above with its own header as data travels down the stack, and strips headers traveling up (decapsulation). An HTTP request becomes: Application HTTP payload wrapped in Transport TCP segment wrapped in Network IP packet wrapped in Link Ethernet frame.

Layers that matter most for DevOps

Understanding which layer a problem lives at determines the right tools and fixes: - Layer 3 — IP routing, VPC routing tables, Security Groups (stateful packet filter), ICMP - Layer 4 — TCP ports, NACLs (stateless L4 rules), TCP load balancers, connection tracking - Layer 7 — HTTP, ALB (application load balancer), WAF rules, application authentication

"Cannot reach the server" at Layer 3 (routing) requires different tools than "SSL handshake failed" at Layer 6 (TLS) or "authentication rejected" at Layer 7.

Key concepts

Encapsulation: Each layer wraps the payload from the layer above with its own header (and sometimes trailer). TCP adds source/dest port; IP adds source/dest IP; Ethernet adds MAC addresses.
Layer 3 (Network): IP addressing and routing. Routers operate here. AWS VPC routing tables, Security Groups (stateful packet filter), and ICMP all operate at Layer 3.
Layer 4 (Transport): TCP (reliable, ordered, connection-oriented) and UDP (unreliable, connectionless). NACLs, NLB, and connection tracking operate here. TCP state machine lives here.
Layer 7 (Application): HTTP, HTTPS, DNS, SMTP, gRPC. ALB, WAF, API Gateway, and application authentication all operate here. Payloads are protocol-specific and require parsing.
PDU names by layer: Layer 7: message/data; Layer 4: segment (TCP) / datagram (UDP); Layer 3: packet; Layer 2: frame; Layer 1: bit/signal.

When to use it

Structuring a network debugging session — start at Layer 1/2/3 and work up
Explaining the difference between ALB (L7) and NLB (L4) in AWS
Explaining why NACLs are stateless (Layer 4) and Security Groups are stateful
Justifying tool choice: ping for L3, nc for L4, curl for L7

Interview questions

What happens at each layer when you type a URL in a browser and press Enter?
What is the difference between AWS ALB and NLB? When do you choose each?