OSI Layer Functions – All 7 Layers Explained with Protocols, Devices, and Examples

1. What Is the OSI Model?

The OSI (Open Systems Interconnection) model is a conceptual framework developed by the International Organization for Standardization (ISO) in 1984 that divides network communication into seven distinct layers. Each layer has a specific function, communicates only with the layers directly above and below it, and hands off a well-defined unit of data (a PDU — Protocol Data Unit) to the next layer.

The OSI model does not describe any specific protocol or implementation — it is an abstract reference framework used for network design, vendor interoperability, certification exams, and most importantly, troubleshooting. When a network problem occurs, the OSI model provides a structured top-down or bottom-up methodology to isolate which layer is failing.

  Layer 7 │ Application   │ Data          │ HTTP, FTP, SMTP, DNS, DHCP
  Layer 6 │ Presentation  │ Data          │ TLS/SSL, JPEG, ASCII, MPEG
  Layer 5 │ Session       │ Data          │ NetBIOS, RPC, PPTP
  Layer 4 │ Transport     │ Segment       │ TCP, UDP
  Layer 3 │ Network       │ Packet        │ IP, ICMP, OSPF, EIGRP
  Layer 2 │ Data Link     │ Frame         │ Ethernet, Wi-Fi (802.11), PPP
  Layer 1 │ Physical      │ Bits          │ Cables, hubs, repeaters, radio
            

Mnemonic (top to bottom): All People Seem To Need Data Processing
Mnemonic (bottom to top): Please Do Not Throw Sausage Pizza Away

Related pages: MAC Addresses | MAC Address Table | IPv6 | OSPF Overview | EIGRP Overview | RIP Concepts | show ip route | Troubleshooting Methodology

2. Layer 1 — Physical Layer

PDU: Bits  |  Devices: Hubs, repeaters, cables, NICs (physical signalling)

The Physical Layer is responsible for the actual transmission and reception of raw binary data over a physical medium. It defines everything about how bits are converted into signals and transported across the medium — voltages, timing, connector shapes, cable specifications, and modulation schemes. It has no awareness of what the bits mean — it simply moves them from one end to the other.

Key protocols / standards: IEEE 802.3 (Ethernet physical), IEEE 802.11 (Wi-Fi physical), USB, SONET/SDH, DSL, RS-232.

Devices operating at Layer 1: Interfaces, repeaters, cables, connectors, NICs (physical layer portion), media converters, transceivers (SFP modules).

Troubleshooting at Layer 1: Disconnected or damaged cables, incorrect cable type (straight-through vs crossover), speed/duplex mismatch, signal attenuation over long runs, faulty SFP transceiver, interference (EMI on copper, dirty connector on fibre). See also: Cable Testing Tools | End-to-End Troubleshooting

3. Layer 2 — Data Link Layer

PDU: Frame  |  Devices: Switches, bridges, wireless access points

The Data Link Layer provides node-to-node delivery of data frames across a single physical link. It is responsible for packaging raw bits from Layer 1 into structured frames, addressing them with hardware (MAC) addresses, detecting transmission errors, and controlling which device on a shared medium may transmit at any given time.

Two IEEE 802 Sublayers

Key Functions

Key protocols: Ethernet (IEEE 802.3), Wi-Fi (IEEE 802.11), PPP, HDLC, 802.1Q VLAN tagging, STP (802.1D).

Devices: Switches, bridges/VLANs, wireless access points.

Troubleshooting at Layer 2: MAC table issues, broadcast storms, STP loops, VLAN mismatches, duplex mismatches, CRC errors. See: MAC Address Table | Troubleshooting Layer 2 / VLANs

4. Layer 3 — Network Layer

PDU: Packet  |  Devices: Routers, Layer 3 switches, firewalls

The Network Layer provides end-to-end logical addressing and routing of packets across multiple networks. While the Data Link Layer handles delivery on a single link, the Network Layer handles delivery from any source to any destination across an arbitrary number of intermediate networks.

Key protocols: IPv4, IPv6, ICMP, ICMPv6, OSPF, EIGRP, RIP, BGP, ARP (resolves Layer 3 to Layer 2).

Devices: Routers, Layer 3 switches, firewalls.

Troubleshooting at Layer 3: Wrong IP address / subnet mask, missing or incorrect default gateway, routing table errors, ACL blocks. See: show ip route | ACLs | Troubleshooting Layer 3 Routing

5. Layer 4 — Transport Layer

PDU: Segment (TCP) / Datagram (UDP)  |  Devices: Firewalls, load balancers (port-aware)

The Transport Layer provides end-to-end communication services between processes running on different hosts. It is the layer that applications talk to — they do not care how the data travels across the network, only that it arrives correctly and in order (TCP) or quickly without connection overhead (UDP).

TCP vs UDP — The Core Comparison

Other Layer 4 Functions

Troubleshooting at Layer 4: Port blocked by firewall/ACL, TCP session not establishing, retransmissions causing slow throughput, window size too small. See: Ports Reference | ACLs | ACLs Overview

6. Layer 5 — Session Layer

PDU: Data  |  Devices: Application servers (session management is software)

The Session Layer manages the establishment, maintenance, and orderly termination of sessions between two communicating applications. A session is a logical, persistent dialogue between two processes — longer-lived than a single TCP connection and independent of the underlying transport.

Protocols with Session Layer characteristics: NetBIOS, RPC (Remote Procedure Call), PPTP, SIP (Session Initiation Protocol — VoIP), H.323.

Important CCNA note: In the real-world TCP/IP stack, the Session, Presentation, and Application layers are all collapsed into a single Application layer. The OSI distinction between them is conceptual and used for classification and exam questions — not as a strict implementation boundary. For example, TLS could be argued to sit at Layer 5, 6, or 7 depending on context.

7. Layer 6 — Presentation Layer

PDU: Data  |  Devices: Software / protocol libraries (no dedicated hardware)

The Presentation Layer acts as the data translator between the network and the application. It ensures that data sent by one application can be understood by a different application running on a different system, regardless of internal data representation.

Standards / formats at Layer 6: ASCII, Unicode, JPEG, GIF, PNG, MPEG, MP3, SSL/TLS, XDR (External Data Representation), MIME.

See: HTTP & HTTPS | SSH | IPsec

8. Layer 7 — Application Layer

PDU: Data  |  Devices: Servers, clients, application-aware firewalls, load balancers

The Application Layer is the topmost layer — the interface between the network stack and the end-user software. It does not refer to the applications themselves (a web browser, an email client) but to the network protocols and services those applications use to communicate. This is the layer where most protocols you interact with daily operate.

Troubleshooting at Layer 7: Application not responding, DNS name resolution failures, DHCP not assigning addresses, SSH authentication errors. See: How DNS Works | How DHCP Works

9. Encapsulation and Decapsulation

Encapsulation is the process of adding layer-specific headers (and in some cases trailers) to data as it passes down the OSI stack on the sending host. Decapsulation is the reverse — each layer strips its own header as data moves up the stack on the receiving host.

  SENDER — data moves DOWN the stack (encapsulation)
  ───────────────────────────────────────────────────────────────────
  Layer 7 Application:   [ DATA                              ]
  Layer 4 Transport:     [ TCP Header | DATA                 ]  ← Segment
  Layer 3 Network:       [ IP Header  | TCP Hdr | DATA       ]  ← Packet
  Layer 2 Data Link:     [ ETH Hdr | IP Hdr | TCP Hdr | DATA | FCS ]  ← Frame
  Layer 1 Physical:      10101100 11001010 ...  (raw bits on medium)

  RECEIVER — data moves UP the stack (decapsulation)
  ───────────────────────────────────────────────────────────────────
  Layer 1:  Receive bits → reassemble into frame
  Layer 2:  Check FCS → strip Ethernet header/trailer → pass packet up
  Layer 3:  Check destination IP → strip IP header → pass segment up
  Layer 4:  Check port, reassemble segments → strip TCP header → pass data up
  Layer 7:  Application receives original data
            

At Layer 2 the encapsulated unit is called a frame and includes a trailer (FCS) as well as a header — the only PDU with both. At each router hop, the Layer 2 frame is completely removed and rebuilt for the next link (new source and destination MAC addresses), while the Layer 3 packet passes through unchanged (except TTL decrement).

10. OSI vs TCP/IP Model Mapping

The TCP/IP model (also called the Internet model) is the practical protocol suite that powers the modern internet. It has four layers that map onto the seven OSI layers. Understanding the mapping is essential for the CCNA because exam questions use both models interchangeably.

See: Common Port Numbers

11. Devices and the OSI Layers They Operate At

12. Troubleshooting Using the OSI Model

The OSI model's greatest practical value is as a structured troubleshooting framework. Two standard approaches exist — always document what you find at each layer before moving on.

Common Symptoms Mapped to OSI Layers

See: End-to-End Troubleshooting | Troubleshooting Layer 2 | Troubleshooting Layer 3 | End-to-End Troubleshooting Scenario

13. End-to-End Data Flow Scenario

John opens a browser on his laptop and navigates to https://netstuts.com. Here is exactly what happens at each OSI layer on his machine, across the network, and on the web server.

  ── JOHN'S LAPTOP (Sender) — Encapsulation ─────────────────────────

  Layer 7 Application:
    Browser generates an HTTP GET request for https://netstuts.com
    DNS resolves "netstuts.com" → 203.0.113.50  (Layer 7 → Layer 3)

  Layer 6 Presentation:
    TLS handshake negotiated; browser encrypts the HTTP request
    Data is now an opaque TLS record

  Layer 5 Session:
    TLS session established; session state maintained for the
    duration of the HTTPS connection

  Layer 4 Transport:
    TCP 3-way handshake to 203.0.113.50 port 443
    HTTP request segmented; sequence numbers assigned
    PDU: TCP Segment [ Src Port: 52341 | Dst Port: 443 | SEQ | Data ]

  Layer 3 Network:
    IP header added; TTL set to 128
    PDU: IP Packet [ Src: 192.168.1.100 | Dst: 203.0.113.50 | Segment ]

  Layer 2 Data Link:
    ARP resolves gateway IP (192.168.1.1) to MAC AA:BB:CC:DD:EE:FF
    Ethernet frame built
    PDU: Frame [ Dst MAC: AA:BB:CC:DD:EE | Src MAC: 00:0C:29:4B:A8:E3 | Packet | FCS ]

  Layer 1 Physical:
    Frame converted to electrical signals on Cat6 UTP → sent to switch

  ── NETWORK PATH ────────────────────────────────────────────────────

  Switch (Layer 2): Forwards frame to router port (MAC table lookup)

  Router (Layer 3): Strips Layer 2 frame, decrements TTL,
    looks up 203.0.113.50 in routing table, builds new Layer 2 frame
    for next hop toward the internet → repeats at each hop

  ── WEB SERVER (Receiver) — Decapsulation ──────────────────────────

  Layer 1: Receives bits → assembles frame
  Layer 2: Checks FCS → strips Ethernet header → passes packet up
  Layer 3: Checks destination IP (matches) → strips IP header → passes up
  Layer 4: Checks port 443 → reassembles segments → strips TCP header
  Layer 5: TLS session recognised
  Layer 6: TLS decrypts the payload → original HTTP GET exposed
  Layer 7: Web server processes GET request → returns HTTP 200 with page
            

14. Exam Tips & Key Points

• Know the mnemonic: top-down All People Seem To Need Data Processing; bottom-up Please Do Not Throw Sausage Pizza Away.
• Know each layer's PDU name: Bits (L1), Frame (L2), Packet (L3), Segment/Datagram (L4), Data (L5–L7).
• The Data Link frame is the only PDU with both a header and a trailer (the FCS/CRC).
• MAC addresses change at every router hop; IP addresses remain the same end-to-end (unless NAT is involved).
• TCP = reliable, connection-oriented, ordered (use for file transfer, web, SSH); UDP = fast, connectionless, best-effort (use for DNS, DHCP, VoIP, streaming).
• The default gateway is a Layer 3 concept — required for communication beyond the local subnet.
• In the TCP/IP model, OSI Layers 5, 6, and 7 are all mapped to a single Application layer.
• ARP bridges Layer 2 and Layer 3 — it resolves an IP address to a MAC address on the local segment.
• Scenario tip: "Which layer is responsible for error recovery?" → Layer 4 (TCP retransmission). "Which layer detects errors?" → Layer 2 (FCS/CRC) — but only detects; it drops the frame. TCP at Layer 4 performs the actual recovery.
• For troubleshooting: always start with the physical layer (cable, link light) before investigating anything else. A broken cable looks identical to a routing problem until you check L1.

15. Summary Reference Table

OSI Layer Functions Quiz