PlayInfoBox

Home /Network /The OSI 7-Layer Model, Explained

The OSI 7-Layer Model, Explained

Every network engineer eventually has to speak in layers. Here is what each of the seven actually does, which protocols and devices live there, and how to use the model to find a fault quickly.

What is the OSI model?

The OSI (Open Systems Interconnection) model, standardized by the ISO in 1984, splits network communication into seven layers so that equipment and software from different vendors can interoperate. It is less a protocol stack implemented exactly as drawn and more a conceptual map for understanding and troubleshooting how data moves. As data travels down through the sending device's layers, each layer adds its own header (encapsulation); on the receiving end, each layer is stripped off in reverse (decapsulation) as the data climbs back up to layer 7.

Layer 1: Physical

Layer 1 covers how bits (0s and 1s) become an actual signal: electrical voltage over copper, light pulses over fiber, or radio waves over Wi-Fi. Cables, connectors, hubs, repeaters and the network card's transceiver live here. The data unit is the bit. This layer moves signals but has no concept of addresses or meaning. Typical faults are an unplugged or damaged cable, a bad connector, excessive cable length, electrical interference and weak wireless signal.

Layer 3: Network

Layer 3 finds a path across different networks using IP addresses, moving data in units called packets. IP itself and routers are the classic Layer 3 building blocks: a router reads the destination IP address, checks its routing table, and decides where to forward the packet next. ICMP, the protocol behind ping and traceroute, also lives here. IPv4 addresses are 32 bits long and IPv6 addresses are 128 bits. Typical faults are a wrong subnet mask, a missing default gateway, a missing route and an address conflict.

Layer 4: Transport

Layer 4 is where TCP and UDP operate, using port numbers to let several applications on one device communicate independently and taking responsibility for end-to-end delivery. TCP sets up a connection with a three-way handshake, guarantees ordering and retransmits lost data. UDP trades away that reliability for speed and low overhead, which suits DNS lookups, voice and video calls and many games. The data unit is called a segment for TCP and a datagram for UDP. Typical faults are a firewall blocking a port or a service that is not listening.

Layer 5: Session

Layer 5 is responsible for opening, maintaining and closing a conversation between two devices, including checkpoints and resuming an interrupted exchange. In modern internet protocols this role has largely been absorbed into application-level session management such as cookies and session tokens, or into protocols like TLS session resumption, so it rarely appears as its own distinct implementation anymore. Remote procedure call frameworks and older protocols such as NetBIOS are the classic examples used in textbooks.

Layer 6: Presentation

Layer 6 formats, encrypts and compresses data into a form the application can use. Character encoding conversion (for example UTF-8), image and video formats such as JPEG and MP4, and the concept of SSL/TLS encryption are usually listed here. In practice modern stacks do not implement it as a clean separate layer. TLS, for instance, sits just above the transport layer and is called from the application, which is why people disagree about whether it belongs to layer 5, 6 or 4.

Layer 7: Application

Layer 7 is the top layer, where the software people actually use, such as browsers, email clients and messaging apps, interacts with the network. HTTP and HTTPS, SMTP and IMAP, FTP, SSH and DNS all operate here. Because it is the layer closest to the user, everyday complaints like 'it is slow' often trace back to a problem several layers lower, such as routing at Layer 3 or signal quality at Layer 1. Note that the application layer is the protocol the app speaks, not the app's user interface.

Data units and devices at a glance

A quick reference: layers 5 to 7 handle data, layer 4 handles segments or datagrams, layer 3 handles packets, layer 2 handles frames, and layer 1 handles bits. By device, a hub or repeater works at layer 1, a switch or bridge at layer 2, a router at layer 3, and a firewall or load balancer can work at layers 3 to 7 depending on how deeply it inspects traffic. A 'Layer 3 switch' is a switch that also routes.

OSI vs. TCP/IP

The actual internet runs on the simpler four-layer TCP/IP model rather than a literal seven-layer OSI stack: network access (roughly layers 1 and 2), internet (layer 3), transport (layer 4), and application (layers 5 to 7 combined). Standards documents mostly describe TCP/IP's layers, but OSI's finer breakdown is still widely used in education and troubleshooting.

Following one web request down the stack

Suppose you open https://example.com in a browser. At layer 7 the browser builds an HTTP request, and DNS is used to turn the name into an IP address. TLS wraps the request in encryption, which is the part loosely assigned to layers 5 and 6. At layer 4 TCP splits the data into segments, adds the destination port 443 and a source port chosen by your computer. At layer 3 each segment is placed in a packet with your IP address and the server's. At layer 2 the packet is put into a frame addressed to the MAC address of your router, since the server is not on your local network. At layer 1 the frame becomes electrical, optical or radio signals. Each router along the way strips off and rebuilds the layer 2 frame but leaves the layer 3 packet largely intact, while the server reverses the whole process. Seeing the path once makes the terms 'encapsulation' and 'hop' far less abstract.

Why the model still matters for troubleshooting

Thinking in OSI layers gives you a systematic way to isolate a problem. Start at the bottom: is the cable plugged in and the link light on (Layer 1)? Is the device on the right VLAN and is its MAC address visible on the switch (Layer 2)? Can it reach the default gateway and get a reply to ping (Layer 3)? Is the right port open on the firewall and is the service listening (Layer 4)? Is the application itself returning errors, such as an expired certificate or an HTTP 500 response (Layers 5 to 7)? Some engineers work from the top down instead, starting with the symptom the user sees. Either way, ruling out one layer at a time stops you from changing settings at random.

Frequently Asked Questions

Is the OSI model actually used in real networks?

Not as a literal seven-layer protocol stack. Real-world networking runs on the TCP/IP model. OSI survives as the standard teaching and troubleshooting framework because it breaks concepts down more precisely, even though a few of its layers, 5 and 6 especially, do not map cleanly onto anything actually implemented today.

What is the easiest way to remember the seven layers in order?

A common mnemonic is 'Please Do Not Throw Sausage Pizza Away' for Physical, Data Link, Network, Transport, Session, Presentation, Application, from layer 1 to layer 7. For the top-down order, 'All People Seem To Need Data Processing' is often used.

At which layer does a router, a switch, or a firewall work?

A switch normally works at layer 2 using MAC addresses, and a router at layer 3 using IP addresses. A firewall can work at layer 3 and 4 if it filters by address and port, or up to layer 7 if it inspects application content, so the answer depends on the type of firewall.

Where do HTTPS and TLS fit in the OSI model?

HTTP is a layer 7 protocol. TLS encrypts the connection and is commonly assigned to layers 5 and 6 in the OSI model, although in the TCP/IP model it simply sits between the transport and application layers. Different textbooks place it differently, which is a good sign that the OSI layers are a teaching tool.

If ping works but a website does not load, which layer should I suspect?

A successful ping shows that layers 1 to 3 are working between the two hosts. The fault is then likely higher up: a blocked or closed port at layer 4, a DNS problem or a misbehaving web server at layer 7, or a firewall that allows ICMP but not HTTP.