OSI model: what each of the seven layers does

The OSI (Open Systems Interconnection) model splits network communication into seven layers, from physical signals at layer 1 to application protocols at layer 7. Each layer does one job, relies on the layer below it and serves the layer above it.

ISO published it in 1984 alongside a family of OSI protocols that never caught on. The internet runs on the TCP/IP protocols instead, but the OSI layer numbers stuck as the shared vocabulary engineers use to say where something happens.

When data is sent, each layer wraps what it receives from above in its own header, a process called encapsulation. An HTTP request goes inside a TCP segment, which goes inside an IP packet, which goes inside an Ethernet or Wi-Fi frame. The receiver unwraps them in reverse order.

From the bottom up (a common mnemonic is "Please Do Not Throw Sausage Pizza Away"):

The internet's protocols were designed around a simpler model. RFC 1122 describes four layers: link, internet, transport and application.

The mapping to OSI is rough. Layers 1 and 2 match the link layer, layer 3 is the internet layer (IP) and layer 4 is transport (TCP and UDP). Layers 5 to 7 fold into a single application layer, and many textbooks use a five-layer version that keeps physical and data link apart.

Real protocols do not always fit either model. TLS sits between TCP and HTTP, and QUIC is a transport protocol carried inside UDP, which is itself a transport protocol. ARP links layer 2 addresses to layer 3 ones, and VPNs carry whole IP packets inside other packets.

Treat the models as maps rather than rules. Arguing over which layer a protocol belongs to rarely fixes anything.

Engineers use layer numbers as shorthand, and the terms appear in product names and documentation. A layer 4 load balancer forwards connections by IP address and port without reading their contents. A layer 7 load balancer reads the HTTP request, so it can route by hostname, path or header.

Firewalls follow the same split. A network firewall filters by address, protocol and port (layers 3 and 4), while a web application firewall inspects HTTP requests at layer 7. Calling something "a layer 2 problem" tells a colleague to look at the local network before the application.

When something cannot connect, check the layers in order. A fault low in the stack breaks everything above it, so start at the bottom and stop at the first layer that fails.