Two posts ago I covered the building blocks — IPs, ports, subnets, NAT. Last post was the protocols that actually run on top of those — ARP, DNS, HTTP, TLS. This post is the thing that ties both of those together into one coherent picture: the OSI model, the seven-layer framework for thinking about everything a network does.
The OSI model isn't a protocol or a technology you install — it's a mental map. Every concept from the last two posts lives at a specific layer, and once you can place things on that map, "the network is slow" or "the connection keeps dropping" stops being one vague problem and becomes a specific layer to go check.
The Seven Layers, Bottom to Top
Layer 1 — Physical: Transporting Bits
The goal at Layer 1 is the dumbest possible one, and that's the point: get raw bits — ones and zeros — from one point to another, with zero understanding of what those bits mean.
This is the actual physical stuff: Wi-Fi radio signals, Ethernet and fiber cabling, repeaters that boost a signal over distance, hubs that just repeat electrical signals to every port without any intelligence about where they should go. Layer 1 doesn't know about addresses, doesn't know about devices — it just moves electrical pulses, light pulses, or radio waves and trusts the layers above to make sense of them.
Layer 2 — Data Link: Hop to Hop
Layer 2's job is hop-to-hop delivery — getting data from one Network Interface Card (NIC) to the next NIC directly connected to it, using MAC addresses as the addressing scheme.
This is where the technologies get a little smarter: NICs, Wi-Fi access cards, switches (which read MAC addresses and forward frames only to the port where the destination device actually lives, instead of blasting them everywhere like a hub does), and routers, which also operate here for their local-segment functions. The key word is "hop" — Layer 2 only cares about the next device in line, not the final destination across the internet.
Layer 3 — Network: End to End
Layer 3 zooms out from "the next hop" to end-to-end delivery — making sure data actually gets from the originating host all the way to the destination host, potentially across dozens of intermediate hops. The addressing scheme here is the IP address, and anything with an IP — routers, hosts, servers — operates at this layer.
This is also where the genuinely satisfying "aha" of the OSI model shows up: why do we need both MAC addresses and IP addresses at all? Walking through what actually happens to a packet answers it directly:
- The host adds a Layer 3 IP header to the data, because only the originating host actually knows the final destination it's trying to reach.
- The host's NIC adds a Layer 2 MAC address header pointing to the next hop — typically the default gateway/router, not the final destination.
- Each router along the path strips off the incoming MAC header (its job is done — that packet reached this hop) and adds a new MAC header pointing to the next hop in the path, while leaving the IP header untouched the entire way.
- Once the packet finally arrives at the destination host, both the L2 and L3 headers have done their jobs and get stripped off, leaving just the data.
In short: the MAC address gets data from router to router (or device to device on a local segment), one hop at a time, while the IP address is the thing that stays constant for the entire journey, making sure the data ends up at the right final host regardless of how many hops it took to get there. This is also exactly why ARP exists — it's the protocol that links a known L3 IP address to the L2 MAC address needed for that next hop.
Layer 4 — Transport: Service to Service
Layer 4 solves a different problem entirely: a single host might be running dozens of applications at once, all sharing the same IP address. Layer 4's job is to distinguish between those separate data streams using ports — servers listen on predefined ports, and Layer 4 makes sure incoming data reaches the correct application, not just the correct machine.
The two protocols that live here define very different trade-offs:
- TCP (Transmission Control Protocol) — prioritizes reliability. It establishes a connection (the three-way handshake), guarantees packets arrive, arrive in order, and retransmits anything lost. This is what HTTP, SSH, and most application traffic runs on.
- UDP (User Datagram Protocol) — prioritizes efficiency over reliability. No handshake, no guaranteed delivery, no retransmission — just send it and move on. This is why video calls, live streaming, and DNS queries often use UDP: a dropped frame or a quick retry costs less than the overhead TCP would add.
Layers 5, 6, 7 — Session, Presentation, Application
The top three layers get taught individually in textbooks, but in practice the line between them is genuinely blurry, and most real protocols don't respect the boundaries cleanly:
- Session is theoretically responsible for opening, managing, and closing the conversation between two applications.
- Presentation is theoretically responsible for translating data into a format both ends understand — encoding, encryption, compression.
- Application is the layer actual protocols live at from the user's perspective — HTTP, DNS, SMTP, FTP, all the protocols from the last post.
In modern practice, things like TLS encryption (arguably Presentation) get implemented as part of the application-layer protocol stack, and most working engineers just think of layers 5–7 as one combined "application layer" rather than three distinct ones. It's worth knowing they exist and roughly what they're meant to cover, but don't lose sleep trying to cleanly classify every protocol into exactly one of the three — the people who designed most real-world protocols didn't either.
Watching a Packet Move Through the Stack
The cleanest way to actually internalize this: picture sending an HTTP request.
Going down the stack (encapsulation) — your browser hands data to the Application layer as an HTTP request. Transport wraps it with a TCP header (adding source and destination ports). Network wraps that with an IP header (source and destination IP). Data Link wraps that with a MAC header for the next hop. Physical converts the whole thing into actual bits on the wire or radio waves in the air.
Going up the stack on the receiving end (decapsulation) — the exact reverse. Physical receives raw bits and hands them to Data Link, which strips the MAC header and hands the rest to Network, which strips the IP header and hands the rest to Transport, which strips the TCP header (using the port number to figure out which application should get it) and finally hands clean HTTP data to the Application layer, i.e. the web server.
Every layer only understands its own header, adds or strips exactly that, and trusts everything above and below it to do the same job correctly. That's the entire elegance of the model — each layer is replaceable without the others needing to know or care. You can swap Wi-Fi for Ethernet at Layer 1 and nothing above Layer 2 even notices.
OSI vs. the Model the Internet Actually Runs On
Worth knowing: the internet in practice runs on the simpler four-layer TCP/IP model (Network Access, Internet, Transport, Application), not a strict seven-layer implementation of OSI. OSI is best understood as the teaching and troubleshooting framework — a shared vocabulary for talking precisely about where in the stack a problem lives — rather than a literal blueprint every protocol was built to. And as the note at the bottom of my original reading on this says: these aren't hard rules. Real protocols routinely blur layers, skip layers, or combine responsibilities that OSI draws as separate. The value isn't perfect classification — it's having a shared, precise vocabulary for "where in the stack is this actually broken."
Why This Is the Payoff Post
This is really the reason the last two posts matter as much as they do. Once you can place a concept on this seven-layer map, debugging stops being a guessing game:
- Cable unplugged or Wi-Fi down → Layer 1.
- Two devices on the same network can't see each other → Layer 2, check ARP and switch configuration.
- Traffic can't leave the local network → Layer 3, check routing and the default gateway.
- The right host is reachable but the specific app isn't responding → Layer 4, check the port and whether the service is actually listening.
- Everything below works fine but the response looks wrong or the connection won't encrypt → Layers 5–7, check the application protocol and TLS configuration itself.
"The network is broken" is a useless sentence to debug. "DNS resolves, TCP connects on port 443, but the TLS handshake fails" is a sentence that tells you exactly where to look next. That's what the OSI model is actually for — not memorizing seven names in order, but having a precise enough vocabulary that every networking problem you'll ever hit has an obvious first place to check.
