OSI Model – All 7 Layers Explained
1. What Is the OSI Model?
The OSI (Open Systems Interconnection) Model is a conceptual framework developed by the ISO (International Organization for Standardization) in 1984 that divides network communication into seven distinct layers. Each layer has a specific role, communicates only with the layers directly above and below it, and hands off a well-defined unit of data (a PDU — Protocol Data Unit) as it passes through the stack.
The OSI model does not define specific protocols — it is a reference model used to understand, design, and troubleshoot network systems. Real-world networking is governed by the TCP/IP model, but the OSI model remains the universal language network engineers use when diagnosing problems.
OSI Layer Stack Data Unit (PDU) Direction
-------------------------------- ---------------- ---------
Layer 7 | Application | Data ^
Layer 6 | Presentation | Data | Decapsulation
Layer 5 | Session | Data | (receiving)
Layer 4 | Transport | Segment |
Layer 3 | Network | Packet |
Layer 2 | Data Link | Frame |
Layer 1 | Physical | Bits v Encapsulation (sending)
Mnemonic (top to bottom): "All People Seem To Need Data Processing" (Application, Presentation, Session, Transport, Network, Data Link, Physical)
Mnemonic (bottom to top): "Please Do Not Throw Sausage Pizza Away" (Physical, Data Link, Network, Transport, Session, Presentation, Application)
Related pages: TCP/IP Model | Layer Functions | MAC Addresses | IP Addressing | Frame Forwarding (L2) | Ethernet Standards (L1) | VLANs (L2) | STP (L2) | Ping | Traceroute
2. Why the OSI Model Matters
- Interoperability: Defines standard interfaces so hardware and software from different vendors can communicate — a Cisco router can talk to a Juniper router because they both implement the same Layer 3 standards
- Troubleshooting: Lets engineers isolate problems to a specific layer — a cable fault is a Layer 1 issue, a MAC address conflict is Layer 2, a routing problem is Layer 3
- Protocol design: Protocols are written to operate at specific layers with defined inputs and outputs, making them modular and replaceable
- Exam currency: The OSI model is referenced throughout CCNA and all other networking certifications as the common framework for discussing network behaviour
3. Quick-Reference: All 7 Layers
| Layer | # | PDU Name | Key Functions | Key Protocols | Key Devices |
|---|---|---|---|---|---|
| Application | 7 | Data | Network services to end-user applications | HTTP, HTTPS, FTP, SMTP, DNS, DHCP, SNMP, Telnet, SSH | Application servers, browsers, email clients |
| Presentation | 6 | Data | Data translation, encryption, compression | SSL/TLS, JPEG, MPEG, ASCII, Unicode, GIF | Encryption/decryption engines (software) |
| Session | 5 | Data | Session setup, management, termination, checkpoints | NetBIOS, RPC, SMB, NFS, SIP (session component) | APIs, session management software |
| Transport | 4 | Segment (TCP) / Datagram (UDP) | End-to-end delivery, segmentation, flow control, error recovery | TCP, UDP, SCTP | Firewalls (stateful), load balancers |
| Network | 3 | Packet | Logical addressing, routing between networks | IPv4, IPv6, ICMP, OSPF, EIGRP, RIP, BGP, ARP* | Routers, Layer 3 switches, firewalls |
| Data Link | 2 | Frame | Node-to-node delivery, MAC addressing, error detection | Ethernet (802.3), Wi-Fi (802.11), PPP, VLAN (802.1Q), STP | Switches, bridges, NICs, WAPs |
| Physical | 1 | Bit | Transmission of raw bits over a physical medium | Ethernet physical (1000BASE-T), DSL, USB, Bluetooth (physical) | Cables, hubs, repeaters, transceivers, NICs (physical) |
4. Layer-by-Layer Deep Dive
Layer 1 — Physical Layer
The Physical Layer is responsible for the actual transmission of raw binary data (bits) across a physical medium. It defines the electrical, optical, radio, and mechanical characteristics of the transmission medium — voltage levels, cable types, connector pinouts, bit timing, and signal encoding.
| Attribute | Details |
|---|---|
| PDU | Bit (1s and 0s) |
| Responsibilities | Signal encoding/decoding, bit synchronisation, physical topology (bus/star/ring), duplex settings (half/full) |
| Technologies | Ethernet copper (Cat5e/Cat6/Cat6a), fibre optic (single-mode/multi-mode), Wi-Fi radio (2.4/5/6 GHz), DSL, coaxial — see Ethernet Standards |
| Devices | Cables, connectors (RJ-45), hubs, repeaters, transceivers (SFP/QSFP), signal amplifiers |
| Troubleshooting | Broken/bent cable, wrong cable type (straight vs crossover), bad SFP transceiver, duplex mismatch, incorrect cable distance |
Layer 2 — Data Link Layer
The Data Link Layer packages raw bits into frames and manages node-to-node delivery within a single network segment. It uses MAC addresses (hardware addresses burned into NICs) to identify source and destination on the local network, and provides error detection via the FCS (Frame Check Sequence) trailer.
| Attribute | Details |
|---|---|
| PDU | Frame |
| Sub-layers | LLC (Logical Link Control) — error checking, flow control; MAC (Media Access Control) — addressing, media access |
| Addressing | MAC addresses (48-bit / 6-byte hardware addresses, e.g., AA:BB:CC:11:22:33) |
| Protocols | Ethernet (IEEE 802.3), Wi-Fi (802.11), PPP, VLAN tagging (802.1Q), STP (802.1D), LACP (802.3ad) |
| Devices | Switches (build MAC address tables), bridges, wireless access points, network interface cards |
| Troubleshooting | MAC address conflicts, duplicate MACs, STP loop, VLAN mismatch, native VLAN mismatch, CRC errors in frame — see Port Security |
Layer 3 — Network Layer
The Network Layer provides logical addressing (IP addresses) and routing — the ability to deliver packets between devices on different networks. While Layer 2 handles delivery within a single LAN segment, Layer 3 handles delivery across multiple networks (inter-network routing).
| Attribute | Details |
|---|---|
| PDU | Packet |
| Addressing | IPv4 (32-bit, e.g., 192.168.1.1) and IPv6 (128-bit, e.g., 2001:db8::1) |
| Protocols | IPv4, IPv6, ICMP (ping/traceroute), OSPF, EIGRP, RIP, BGP |
| Devices | Routers, Layer 3 switches, firewalls (packet filtering) |
| Key concept | Routers make forwarding decisions based on the destination IP address and their routing table (longest-prefix match) |
| Troubleshooting | Missing routes, incorrect subnet masks, routing protocol failures, wrong default gateway |
Layer 4 — Transport Layer
The Transport Layer provides end-to-end communication between applications on different hosts. It segments large data into smaller pieces, manages flow control, provides error recovery (TCP), and uses port numbers to identify which application process should receive each segment.
| Attribute | Details |
|---|---|
| PDU | Segment (TCP) or Datagram (UDP) |
| Protocols | TCP (Transmission Control Protocol) — reliable, connection-oriented; UDP (User Datagram Protocol) — fast, connectionless |
| Addressing | Port numbers (0–65535): well-known (0–1023), registered (1024–49151), ephemeral/dynamic (49152–65535) — see Common Port Numbers |
| TCP features | 3-way handshake (SYN/SYN-ACK/ACK), sequencing, acknowledgements, retransmission, flow control (sliding window), congestion control |
| UDP features | No connection setup, no acknowledgement, no retransmission — low overhead, ideal for real-time traffic |
| Troubleshooting | Port blocked by firewall, TCP retransmission storms, UDP packet loss in VoIP, wrong source/destination ports |
Layer 5 — Session Layer
The Session Layer manages sessions — the logical connections (dialogues) between two applications. It establishes, maintains, and terminates communication sessions, and can insert checkpoints into data streams so a session can be resumed from the last checkpoint if interrupted rather than restarting from scratch.
| Attribute | Details |
|---|---|
| PDU | Data |
| Protocols | NetBIOS, RPC (Remote Procedure Call), SMB (Server Message Block), NFS, SIP (session establishment), H.323 |
| Key functions | Session establishment (before data exchange), session maintenance (ongoing), session termination (graceful close), checkpointing (resuming after failure) |
| Real-world note | In modern TCP/IP implementations, session functionality is largely handled by TCP (Layer 4) and application protocols. The Session Layer is less distinct in practice. |
Layer 6 — Presentation Layer
The Presentation Layer is the translator of the OSI model. It converts data between the format used by the application and a standardised network format, ensuring that data produced by one system can be understood by another. It also handles encryption/decryption and compression/decompression.
| Attribute | Details |
|---|---|
| PDU | Data |
| Data translation | Character encoding (ASCII, Unicode, EBCDIC), data format conversion (JSON ↔ XML) |
| Encryption | SSL/TLS (encrypts data before it leaves the application — HTTPS uses TLS at this layer) |
| Compression | JPEG (images), MPEG (video), MP3 (audio), gzip (HTTP compression) |
| Real-world note | Like Session, the Presentation Layer's functions are often embedded directly in application-layer protocols in real TCP/IP stacks. |
Layer 7 — Application Layer
The Application Layer is the topmost layer and the one users interact with directly — it provides the interface between network services and user applications. It does not include the application software itself (e.g., Chrome is not an OSI layer), but rather the protocols those applications use to communicate over the network.
| Attribute | Details |
|---|---|
| PDU | Data |
| Web | HTTP (port 80), HTTPS (port 443) |
| SMTP (port 25/587), IMAP (port 143/993), POP3 (port 110/995) | |
| File transfer | FTP (ports 20/21), SFTP (port 22), TFTP (port 69) |
| Name resolution | DNS (port 53 UDP/TCP) |
| Network management | SNMP (ports 161/162 UDP), SSH (port 22), Telnet (port 23) |
| Address assignment | DHCP (ports 67/68 UDP) |
netstuts.com in your browser, DNS (Layer 7) resolves the name to an IP address, then HTTP/HTTPS (Layer 7) requests the web page. All of this happens before a single byte of actual web content travels over the network.5. Encapsulation and Decapsulation
Encapsulation is the process by which each layer adds its own header (and sometimes trailer) as data travels down the OSI stack on the sending device. Decapsulation is the reverse — each layer removes its header as data travels up the stack on the receiving device.
Encapsulation — Sending a Web Page Request
Layer 7 Application HTTP request: "GET /index.html HTTP/1.1"
|
[HTTP Header | Data]
|
Layer 4 Transport TCP adds: source port 49152, dest port 80, seq/ack
[TCP Header | HTTP Header | Data] = Segment
|
Layer 3 Network IP adds: src IP 192.168.1.10, dst IP 93.184.216.34
[IP Header | TCP Header | HTTP Header | Data] = Packet
|
Layer 2 Data Link Ethernet adds: src MAC, dst MAC, FCS trailer
[Eth Header | IP Header | TCP Header | HTTP Header | Data | FCS] = Frame
|
Layer 1 Physical Convert frame to electrical/optical/radio signal
10101001 01101101 ... (Bits transmitted on wire)
Decapsulation — Receiving the Frame
At the destination server, the process reverses:
- Layer 1: Physical signal received and converted back to bits
- Layer 2: Ethernet header examined — destination MAC matches, FCS checked for errors, Ethernet header stripped → passes Packet to Layer 3
- Layer 3: IP header examined — destination IP matches, IP header stripped → passes Segment to Layer 4
- Layer 4: TCP header examined — port 80 directs to the web server process, TCP header stripped → passes Data to Layer 7
- Layer 7: HTTP data delivered to the web server application
PDU Names at Each Layer
| OSI Layer | PDU Name | What's Been Added |
|---|---|---|
| 7 – Application | Data | Application payload (HTTP, DNS query, etc.) |
| 6 – Presentation | Data | Format/encryption applied to data |
| 5 – Session | Data | Session context information |
| 4 – Transport | Segment (TCP) / Datagram (UDP) | + Source/destination port numbers, seq/ack (TCP) |
| 3 – Network | Packet | + Source/destination IP addresses, TTL |
| 2 – Data Link | Frame | + Source/destination MAC addresses, FCS trailer |
| 1 – Physical | Bits | Bits transmitted as electrical/optical/radio signals |
6. OSI Model vs TCP/IP Model
The TCP/IP model is the practical model actually used by the internet and modern networks. It was developed before the OSI model and collapses several OSI layers into four (or five, depending on the version used).
| OSI Layer | TCP/IP Layer (4-layer) | TCP/IP Layer (5-layer) | Key Protocols |
|---|---|---|---|
| 7 – Application | Application | Application | HTTP, HTTPS, FTP, DNS, DHCP, SMTP, SSH, Telnet, SNMP |
| 6 – Presentation | SSL/TLS, JPEG, MPEG, ASCII | ||
| 5 – Session | NetBIOS, RPC, SMB | ||
| 4 – Transport | Transport | Transport | TCP, UDP |
| 3 – Network | Internet | Internet | IPv4, IPv6, ICMP, OSPF, BGP |
| 2 – Data Link | Network Access / Link | Data Link | Ethernet, 802.11 Wi-Fi, PPP, 802.1Q |
| 1 – Physical | Physical | Cables, hubs, radio signals |
The key differences: TCP/IP collapses OSI Layers 5, 6, and 7 into a single Application layer. TCP/IP merges (or separately identifies) Layers 1 and 2 as Network Access / Link / Physical. TCP/IP is a working model; OSI is a theoretical reference model.
7. Troubleshooting by OSI Layer
The OSI model's greatest practical value is in systematic troubleshooting. Engineers typically work from Layer 1 upward (bottom-up approach) or from Layer 7 downward (top-down approach), isolating the problem at its exact layer.
| Layer | Common Problems | Diagnostic Tools & Commands |
|---|---|---|
| L1 Physical | Cable unplugged, damaged cable, wrong cable type, duplex mismatch, bad SFP | Check link LEDs, cable tester, show interfaces (check for errors/input errors) |
| L2 Data Link | MAC address conflict, STP loop, VLAN mismatch, native VLAN mismatch, CRC errors | show mac address-table, show interfaces trunk, show spanning-tree |
| L3 Network | Missing route, wrong default gateway, incorrect subnet mask, routing protocol failure | ping, traceroute, show ip route, show ip ospf neighbor |
| L4 Transport | Port blocked by firewall/ACL, TCP handshake failure, wrong port number in application config | telnet <ip> <port> (test TCP connectivity), show access-lists, packet capture |
| L5 Session | Session timeout, session limit exceeded, authentication failure | Application logs, session table on firewall |
| L6 Presentation | TLS certificate expired, SSL version mismatch, character encoding error | Browser security warnings, openssl s_client, application error logs |
| L7 Application | Web server down, DNS resolution failure, incorrect URL, application misconfiguration | nslookup, dig, curl -v, browser developer tools |
1. Can you ping the server's IP? → Yes = Layers 1–3 are OK
2. Can you
telnet <server-ip> 443? → Yes = Layer 4 TCP port is open3. Does the browser show a certificate error? → Layer 6 TLS/certificate issue
4. Does the browser show "404 Not Found"? → Layer 7 application issue (wrong URL / server config)
8. End-to-End Example: Sending an Email
John sends an email from his laptop to a colleague. Here is the full OSI journey:
| Layer | What Happens |
|---|---|
| 7 Application | John's email client uses SMTP to compose the message and connect to the mail server on port 587 |
| 6 Presentation | The message body is encoded (UTF-8), attachments are Base64-encoded; TLS encrypts the connection |
| 5 Session | An SMTP session is established between John's client and the mail server — the session manages the command/response dialogue |
| 4 Transport | TCP segments the email data; source port (e.g., 51234) and destination port 587 identify the SMTP process; TCP ensures reliable delivery |
| 3 Network | IPv4 packet created with John's IP (192.168.1.10) as source and the mail server's IP as destination; router forwards toward destination |
| 2 Data Link | Ethernet frame created with source and destination MAC addresses; switch forwards frame based on MAC address table |
| 1 Physical | Frame converted to electrical signals (Cat6 cable) or radio waves (Wi-Fi) and physically transmitted to the next hop |