Free lesson · Computer Networking

The Osi Model All Seven Layers Explained

Easy12 min readnetworkingcomputer-networkstcp-ip

The Origin of the OSI Model

In 1984, the International Organization for Standardization (ISO) published a framework that would become the default vocabulary of networking: the Open Systems Interconnection (OSI) model. The word "open" was deliberate - this was designed to be a vendor-neutral standard that any manufacturer could implement, ending the era where IBM machines could only talk to IBM machines and DEC machines could only talk to DEC machines.

The OSI model divides network communication into seven layers, each with a specific responsibility. Data flows down through all seven layers on the sending machine, crosses the physical network, and flows back up through all seven layers on the receiving machine. Each layer adds its own header information on the way down and strips it off on the way up.

The model was designed as a theoretical reference framework - a way to think about networking, not necessarily a blueprint to build from. The actual internet was built on the TCP/IP model (covered in the next topic), which is simpler. But the OSI model's vocabulary stuck, and engineers everywhere use terms like "Layer 4" and "Layer 7" that come directly from this framework.

Tip: A popular mnemonic for remembering the seven layers from bottom to top is: "Please Do Not Throw Sausage Pizza Away" - Physical, Data Link, Network, Transport, Session, Presentation, Application. From the top down: "All People Seem To Need Data Processing." Pick whichever one sticks.

The Seven Layers - Visual Overview

Before diving into each layer individually, here is the full stack with the data unit name at each layer. As data moves down the stack, each layer wraps the data from the layer above in its own header - a process called encapsulation. We will explore encapsulation in detail in Topic 5 of this module.

graph TD
    L7["Layer 7: Application<br/>📧 Data<br/>HTTP, DNS, SMTP, FTP"]
    L6["Layer 6: Presentation<br/>📦 Data<br/>SSL/TLS, JPEG, ASCII, Encryption"]
    L5["Layer 5: Session<br/>🔗 Data<br/>NetBIOS, RPC, PPTP"]
    L4["Layer 4: Transport<br/>📬 Segment<br/>TCP, UDP"]
    L3["Layer 3: Network<br/>📍 Packet<br/>IP, ICMP, OSPF, BGP"]
    L2["Layer 2: Data Link<br/>🔲 Frame<br/>Ethernet, Wi-Fi, ARP"]
    L1["Layer 1: Physical<br/>⚡ Bits<br/>Cables, Signals, Hubs"]

    L7 --> L6
    L6 --> L5
    L5 --> L4
    L4 --> L3
    L3 --> L2
    L2 --> L1

    style L7 fill:#4f46e5,stroke:#4338ca,color:#fff
    style L6 fill:#5b52f0,stroke:#4f46e5,color:#fff
    style L5 fill:#6366f1,stroke:#5b52f0,color:#fff
    style L4 fill:#7c3aed,stroke:#6d28d9,color:#fff
    style L3 fill:#8b5cf6,stroke:#7c3aed,color:#fff
    style L2 fill:#a78bfa,stroke:#8b5cf6,color:#fff
    style L1 fill:#c4b5fd,stroke:#a78bfa,color:#000

This diagram shows the seven layers of the OSI model stacked vertically from Layer 7 at the top to Layer 1 at the bottom, connected by arrows flowing downward. Each layer shows its number, name, data unit name, and example protocols. Layer 7 Application handles Data using protocols like HTTP and DNS. Layer 6 Presentation handles Data with encryption and encoding. Layer 5 Session manages sessions with protocols like RPC. Layer 4 Transport handles Segments using TCP and UDP. Layer 3 Network handles Packets using IP. Layer 2 Data Link handles Frames using Ethernet. Layer 1 Physical handles raw Bits as electrical or optical signals.

Now let us walk through each layer from the bottom up - the order in which data actually travels when leaving your machine.

Layer 1 - Physical

What it does: Transmits raw bits - ones and zeros - as physical signals over a transmission medium.

Analogy: The roads and trucks of the postal system. The physical layer does not know what is in the packages. It just moves signals from point A to point B.

The physical layer deals with the tangible, real-world aspects of networking: copper cables carrying electrical voltages, fiber optic cables carrying light pulses, and wireless antennas carrying radio waves. When your computer sends data, the physical layer converts the digital bits (1s and 0s) into whatever signal form the medium requires.

Key concepts at this layer include bandwidth (how many bits per second the medium can carry), signaling (how bits are represented as physical signals), and connectors (RJ-45 for Ethernet, optical connectors for fiber). Devices that operate purely at the physical layer include hubs and repeaters - they receive signals and retransmit them without understanding any of the data those signals carry.

Protocols and standards: Ethernet physical specifications (10BASE-T, 100BASE-TX, 1000BASE-T), fiber optic standards, DSL, USB (when used for networking), Bluetooth radio specifications.

Layer 2 - Data Link

What it does: Provides reliable data transfer between two devices on the same local network. Handles framing, physical addressing (MAC addresses), and error detection.

Analogy: The local mail carrier who delivers within your neighborhood. The data link layer knows how to get data from one device to the next device on the same network segment - but it has no idea how to reach a device on a different network.

The data link layer takes the raw bits from the physical layer and organizes them into frames - structured chunks of data with a header (containing source and destination MAC addresses), a payload (the actual data from the layer above), and a trailer (containing an error-detection checksum). If a frame arrives with bit errors, this layer detects the problem.

This layer is often split into two sublayers in detailed discussions: the LLC (Logical Link Control) sublayer, which handles flow control and error detection, and the MAC (Media Access Control) sublayer, which handles addressing and controls access to the physical medium (deciding who gets to transmit when).

Key devices: Switches operate at Layer 2. They read the destination MAC address in each frame and forward it only to the correct port, rather than broadcasting it to every device like a hub would.

Protocols and standards: Ethernet (IEEE 802.3), Wi-Fi (IEEE 802.11), ARP (Address Resolution Protocol - translates IP addresses to MAC addresses), PPP (Point-to-Point Protocol).

Layer 3 - Network

What it does: Handles routing - finding a path for data to travel from the source machine to the destination machine, potentially across multiple intermediate networks.

Analogy: The national postal routing system. Layer 2 delivers within your city. Layer 3 figures out how to get a package from New York to San Francisco - which sorting centers it should pass through, which highways to take, which intermediate stops are needed.

The network layer introduces logical addressing - IP addresses - which, unlike MAC addresses, are hierarchical and routable. An IP address tells routers not just who the destination is, but roughly where it is in the network topology, allowing routers to make forwarding decisions.

The data unit at this layer is called a packet. Each packet has a header containing the source IP address, the destination IP address, a time-to-live (TTL) counter, and other control information. Routers - the key devices at this layer - examine the destination IP in each packet and consult their routing tables to decide where to forward it next.

Protocols: IP (IPv4 and IPv6), ICMP (used by ping and traceroute), OSPF and BGP (routing protocols that routers use to learn about network topology).

Important: The distinction between Layer 2 (local delivery using MAC addresses) and Layer 3 (global routing using IP addresses) is one of the most important concepts in networking. A MAC address gets data to the next device on the same network. An IP address gets data to the final destination across any number of networks. Both are needed, and they work together - at every hop along the route, the Layer 3 IP address stays the same (final destination), but the Layer 2 MAC address changes (pointing to the next hop).

Layer 4 - Transport

What it does: Provides end-to-end communication between applications running on different machines. Handles reliability, flow control, and multiplexing (allowing multiple applications to share the same network connection).

Analogy: The delivery guarantee system. Layer 3 gets the package to the right building. Layer 4 makes sure it gets to the right apartment (port number), arrives in the right order, and arrives completely - or deliberately chooses to skip those guarantees when speed matters more.

The transport layer introduces port numbers, which identify specific applications on a machine. Your computer might have a web browser, an email client, and an SSH session all running simultaneously, all receiving data from the network. Port numbers are how the transport layer routes incoming data to the correct application - web traffic to port 80 or 443, email to port 25, SSH to port 22.

The data unit at this layer is called a segment (for TCP) or a datagram (for UDP).

The two primary transport protocols define fundamentally different approaches:

TCP (Transmission Control Protocol): Connection-oriented. Establishes a connection before sending data (three-way handshake). Guarantees delivery, correct ordering, and error-free data. Slower but reliable. Used for web pages, file transfers, email, APIs.
UDP (User Datagram Protocol): Connectionless. Sends data immediately with no connection setup. No delivery guarantee, no ordering guarantee. Faster but unreliable. Used for video streaming, online gaming, DNS queries, voice calls.

Protocols: TCP, UDP, QUIC (a modern protocol built on UDP that provides TCP-like reliability with better performance - used by HTTP/3).

Layer 5 - Session

What it does: Manages sessions - establishing, maintaining, and terminating connections between applications. Handles dialog control (who talks when) and synchronization (checkpointing so a long transfer can resume from where it left off instead of restarting).

Analogy: A phone call coordinator. Layer 5 is the person who dials the number, keeps the line open, makes sure both parties take turns talking, and hangs up when the conversation is over.

The session layer is the first of the three "upper layers" that deal with application-level concerns rather than network-level concerns. In practice, the session layer is the most controversial layer in the OSI model because the modern internet largely handles its responsibilities within the application or transport layers. TCP's connection management (handshake, teardown) does much of what the session layer describes, and application frameworks handle session management through cookies, tokens, and session IDs.

Protocols: NetBIOS, RPC (Remote Procedure Call), PPTP (Point-to-Point Tunneling Protocol). In modern web architecture, session management through HTTP cookies and OAuth tokens is effectively Layer 5 functionality implemented at Layer 7.

Layer 6 - Presentation

What it does: Translates data between the format used by the network and the format used by the application. Handles encryption/decryption, compression/decompression, and character encoding (ensuring that a text file created on a Mac looks the same when opened on a Windows machine).

Analogy: A translator at an international conference. The presentation layer makes sure that the data the sender produces is readable by the receiver, even if they use different internal representations.

Like the session layer, the presentation layer's responsibilities in modern practice are mostly absorbed by the application layer. TLS encryption is technically a presentation-layer function, but it operates so closely with the transport and application layers that calling it "Layer 6" is more of a classification convenience than an architectural reality. Image encoding (JPEG, PNG), character sets (UTF-8, ASCII), and data serialization (JSON, XML, Protocol Buffers) all fall under what the OSI model considers presentation-layer concerns.

Protocols and standards: SSL/TLS (encryption), JPEG, GIF, PNG (image formats), ASCII, Unicode/UTF-8 (character encoding), MIME (email content types).

Layer 7 - Application

What it does: The layer closest to the end user. Provides network services directly to applications - not the application itself, but the network interface that applications use to communicate.

Analogy: The language you speak when talking to someone. Layer 7 is the actual content of the conversation - the words, the grammar, the meaning. Everything below Layer 7 is about getting the words delivered. Layer 7 is about what the words say.

A critical distinction: the application layer is not your web browser or email client. It is the protocol that your browser or client uses to communicate over the network. Chrome is not Layer 7. HTTP - the protocol Chrome uses to request web pages - is Layer 7. Outlook is not Layer 7. SMTP - the protocol Outlook uses to send email - is Layer 7.

This is the layer where most software engineers spend their working time. Every API you call, every web page you load, every DNS query that resolves a domain name - all of these happen at Layer 7.

Protocols: HTTP/HTTPS (web), DNS (name resolution), SMTP (email sending), IMAP/POP3 (email retrieval), FTP (file transfer), SSH (secure remote access), DHCP (IP address assignment), SNMP (network monitoring).

A Quick Reference Table

Layer	Name	Data Unit	Key Function	Example Protocols	Key Devices
7	Application	Data	User-facing network services	HTTP, DNS, SMTP, FTP	Firewalls (L7), Proxies
6	Presentation	Data	Encoding, encryption, compression	TLS, JPEG, UTF-8	-
5	Session	Data	Session management	NetBIOS, RPC	-
4	Transport	Segment/Datagram	End-to-end delivery, ports	TCP, UDP, QUIC	Load Balancers (L4)
3	Network	Packet	Routing across networks	IP, ICMP, BGP, OSPF	Routers
2	Data Link	Frame	Local network delivery	Ethernet, Wi-Fi, ARP	Switches
1	Physical	Bits	Signal transmission	Ethernet cables, fiber	Hubs, Repeaters

Warning: The OSI model is a reference framework, not a strict architectural blueprint. Real-world protocols do not always fit neatly into a single layer. TLS spans Layers 5 and 6. ARP sits between Layers 2 and 3. The model is useful for organizing your thinking, not for rigidly classifying every protocol.

The Layers That Matter Most for Software Engineers

Not all seven layers are equally important for a software engineer's daily work or interview preparation. Here is an honest assessment:

Layers you must deeply understand:

Layer 7 (Application): You work here every day - HTTP, DNS, APIs
Layer 4 (Transport): TCP vs UDP decisions affect every system you build
Layer 3 (Network): IP addressing and routing are fundamental to distributed systems

Layers worth understanding conceptually:

Layer 2 (Data Link): Knowing that MAC addresses and switches exist prevents confusion about local vs wide-area networking

Layers you can treat as historical context:

Layers 5 and 6 (Session, Presentation): Their functions are real, but in practice they are absorbed into Layer 7 and Layer 4. You will rarely need to reference these layers explicitly.
Layer 1 (Physical): Unless you are a network infrastructure engineer, you can understand this at a conceptual level without memorizing cable specifications.

graph LR
    subgraph Critical["Must Know Deeply"]
        L7C["Layer 7<br/>Application"]
        L4C["Layer 4<br/>Transport"]
        L3C["Layer 3<br/>Network"]
    end
    subgraph Useful["Worth Understanding"]
        L2U["Layer 2<br/>Data Link"]
    end
    subgraph Context["Historical Context"]
        L6H["Layer 6<br/>Presentation"]
        L5H["Layer 5<br/>Session"]
        L1H["Layer 1<br/>Physical"]
    end

    style L7C fill:#4f46e5,stroke:#4338ca,color:#fff
    style L4C fill:#4f46e5,stroke:#4338ca,color:#fff
    style L3C fill:#4f46e5,stroke:#4338ca,color:#fff
    style L2U fill:#7c3aed,stroke:#6d28d9,color:#fff
    style L6H fill:#a78bfa,stroke:#8b5cf6,color:#fff
    style L5H fill:#a78bfa,stroke:#8b5cf6,color:#fff
    style L1H fill:#a78bfa,stroke:#8b5cf6,color:#fff

This diagram groups the seven OSI layers into three priority categories for software engineers. The "Must Know Deeply" group contains Layer 7 Application, Layer 4 Transport, and Layer 3 Network. The "Worth Understanding" group contains Layer 2 Data Link. The "Historical Context" group contains Layer 6 Presentation, Layer 5 Session, and Layer 1 Physical.

Interview: Interviewers almost never ask you to list all seven OSI layers. What they do ask is questions that require you to know which layer specific technologies operate at. Here are the most common ones:

Q: "What's the difference between a Layer 4 and Layer 7 load balancer?" Layer 4 load balancers route based on TCP/UDP information (IP address, port number) - fast but cannot see HTTP content. Layer 7 load balancers can inspect HTTP headers, URLs, and cookies - slower but can make smarter routing decisions.

Q: "At which layer does DNS operate?" DNS is a Layer 7 (Application) protocol. It uses UDP at Layer 4 (port 53) for most queries, and TCP for zone transfers or large responses.

Q: "Where does encryption happen?" TLS encryption is typically described as Layer 5/6, but in practice it operates between Layer 4 (TCP) and Layer 7 (HTTP), which is why HTTPS is often described as "HTTP over TLS over TCP."

What Comes Next

Now that you have the full OSI picture, the next topic covers the TCP/IP model - the simpler, four-layer model that the actual internet is built on. You will see how the TCP/IP model collapses the upper three OSI layers into one and combines the lower two, and why this simpler model won in practice.

Exercise: Starter: Open any website in your browser, then open the browser's developer tools (usually <kbd>F12</kbd>) and look at the Network tab. Click on any request and examine the headers. Can you identify which OSI layer each piece of information belongs to? The URL relates to which layer? The Content-Type header relates to which layer? The IP address shown in the connection relates to which layer?

Intermediate: Consider a video call application like Zoom. Which OSI layers are involved in transmitting video from your camera to the other participant's screen? Think about the encoding (presentation), the session management (session), the choice of UDP for speed (transport), the routing across the internet (network), and the physical Wi-Fi or Ethernet connection (physical and data link).

Advanced: Research the concept of "layer violations" - situations where a protocol at one layer directly interacts with a non-adjacent layer, bypassing the strict layered architecture. Can you find a real-world example where strict layer separation breaks down? Why does this happen, and what are the trade-offs?

Back to Computer Networking