The OSI Model — Notes

The one idea to hold onto

The OSI model is a reference model: a way to think and talk about networking by splitting it into 7 jobs. Each layer does one job and only talks to the layer directly above and below it.

Sending = data travels down 7 → 1, and each layer wraps it with its own header. This is encapsulation.
Receiving = data travels up 1 → 7, and each layer unwraps its own header. This is de-encapsulation.
Think of a letter put in an envelope, then a box, then a shipping crate. Each handler only reads its own label.

Reality check: the internet actually runs on the TCP/IP model (4 layers: Application, Transport, Internet, Link). OSI layers 5–7 are squashed into one "Application" layer there. OSI is the vocabulary; TCP/IP is what's running.

The layers at a glance

#	Layer	Question it answers	Data unit (PDU)	Addressing	Typical devices / examples
7	Application	What does the user want to do?	Data	Names / URLs	HTTP, FTP, DNS, SMTP, browsers, email clients
6	Presentation	What format is the data in?	Data	—	Encoding (ASCII/UTF-8), compression, encryption, JPEG/PNG
5	Session	Is the conversation open, and who's in it?	Data	—	Opening, maintaining, closing sessions; checkpoints
4	Transport	Did it arrive complete and to the right program?	Segment (TCP) / Datagram (UDP)	Port numbers	TCP, UDP
3	Network	Which route reaches the destination?	Packet	IP address	Routers, IP, OSPF, RIP
2	Data Link	Which device is next on this local link?	Frame	MAC address	Switches, NICs, Ethernet, Wi-Fi
1	Physical	How are bits physically moved?	Bits	—	Cables, fibre, radio, hubs, voltages, light

Addresses get more "local" as you go down: Port (which program) → IP (which machine, anywhere in the world) → MAC (which device on this wire).

Layer 1 — Physical

Job: turn 1s and 0s into something physical and back again.

Electrical voltage on copper, pulses of light on fibre, radio waves on Wi-Fi.
Knows nothing about addresses or meaning. It just moves bits.
Examples: Ethernet cables (RJ45 connectors), fibre, hubs, repeaters.

Picture it: a pipe. It doesn't know what's flowing through it.

Layer 2 — Data Link

Job: deliver a frame to the next device on the same local network, identified by MAC address.

Takes the packet from Layer 3 and wraps it in a frame with source and destination MAC.
Every NIC (Network Interface Card) has a MAC address assigned by the manufacturer.
Also adds error detection (a checksum at the end of the frame) so corrupted frames are dropped.
Device: switch (forwards frames by MAC).

Corrections to the course:

The destination MAC is the next hop (often your router), not the final remote computer. MAC addresses only matter within one local network. They get rewritten at every router; IP addresses do not.
"MAC can't be changed": the burned-in value is fixed, but the OS can override it in software trivially. That's spoofing, and it's routine. Never treat a MAC as proof of identity.

Picture it: IP is the destination city on the parcel; MAC is "hand it to the next van."

Layer 3 — Network

Job: get packets from source to destination across multiple networks, using IP addresses (e.g. 192.168.1.100).

Routing = choosing the path through routers.
Routers are Layer 3 devices: they read IP addresses to decide where to forward.
Routing protocols build the routing tables:
- RIP (Routing Information Protocol): picks the path with the fewest hops (routers crossed). Simple, but ignores link speed.
- OSPF (Open Shortest Path First): picks the lowest cost, where cost is usually based on link bandwidth. Smarter than RIP.
Factors in path choice: number of hops, link speed/bandwidth, and administrative policy.

Corrections to the course:

"Has the path lost packets before?" is not how RIP or OSPF choose paths. They use hop count or cost.
Putting data back in order is mainly TCP's job (Layer 4). IP can reassemble fragmented packets, but that's a narrower thing.

Picture it: a GPS choosing a route between cities.

Layer 4 — Transport

Job: deliver data between programs (via port numbers) and decide how carefully.

TCP — Transmission Control Protocol: "reliable, ordered, checked"

Connection-oriented: sets up a connection first with the 3-way handshake (SYN → SYN-ACK → ACK).
Numbers every segment, acknowledges receipt, re-sends anything lost, and reorders at the destination.
Flow control: stops a fast sender overwhelming a slow receiver.

TCP pros	TCP cons
Guarantees complete, in-order data	More overhead → slower
Flow control prevents flooding	A lost segment stalls everything after it until it's resent
Error recovery built in	Keeps connection state on both ends

Use when every byte matters: web pages (HTTP/HTTPS), email, file transfer, SSH.

UDP — User Datagram Protocol: "fire and forget"

Connectionless: no handshake, no acknowledgements, no resending, no ordering.
Lost data stays lost unless the application handles it.

UDP pros	UDP cons
Fast, minimal overhead	No delivery guarantee
No connection to set up or hold open	No ordering
Application decides its own pacing and recovery	Unstable networks show up directly as glitches

Course error: its UDP table lists "flexible to software developers" as a disadvantage. That's an advantage; the table rows are misaligned.

Use when speed beats perfection: DNS lookups, DHCP, live voice/video calls, online games.

Correction on "video streaming": live calls and gaming use UDP. But Netflix/YouTube-style streaming mostly runs over TCP (or QUIC, a reliable protocol built on top of UDP). Missing UDP data in a live call shows up as glitches or artifacts, not literally "missing pixels."

The cat picture example:

TCP: packets 1, 2, 3 all arrive and are reassembled in order → whole cat.
UDP: packet 2 is lost and never re-sent → cat with a hole in it.

Layer 5 — Session

Job: open, manage, and close the conversation between two applications.

Creates a session when a connection starts; keeps it alive while in use; closes it when idle or lost.
Checkpoints: if a transfer breaks, resume from the last checkpoint instead of starting over.
Sessions are separate: data in one session doesn't leak into another.

Reality check: in TCP/IP there's no separate session layer. This job is done by applications themselves (e.g. login sessions, cookies) and by TCP's connection handling. Layer 5 is the most "theoretical" layer.

Picture it: a phone call. Dial, talk, hang up.

Layer 6 — Presentation

Job: make sure both sides understand the data's format. It's the translator.

Encoding: character sets like ASCII or UTF-8.
Compression: shrinking data.
Encryption / decryption.
File formats: JPEG, PNG, MP4.
Example: you send an email from Outlook, the recipient opens it in Gmail. Same content, displayed the same way.

Reality check: the course puts HTTPS encryption here. TLS (the "S" in HTTPS) doesn't fit cleanly into one OSI layer. It's often taught as Layer 6, but in practice it sits between the application and TCP. Fine for exams; don't argue it in an interview without that caveat.

Layer 7 — Application

Job: the protocols that applications use to talk over the network.

This is the layer you interact with most.
Protocols: HTTP/HTTPS (web), FTP (file transfer), SMTP/IMAP/POP3 (email), DNS (turns names like tbfc.net into IP addresses).

Common misconception: the application program (Firefox, FileZilla) is not Layer 7. The protocol it uses (HTTP, FTP) is. The GUI is just how you see it.

Security note from the screenshot: that FTP listing shows passwords.txt sitting in a browsable directory. Plain FTP sends everything, including logins, unencrypted. Exposed FTP is a classic finding in security work.

Encapsulation walkthrough (sending a web request)

L7 Browser makes an HTTP request → data
L6 Data encoded / encrypted
L5 Session established / tracked
L4 TCP adds source & destination ports → segment
L3 IP adds source & destination IP addresses → packet
L2 Ethernet adds source & next-hop MAC addresses + checksum → frame
L1 Frame sent as bits on the wire

The receiver does the same in reverse, peeling one header per layer.

Quick self-test

Which layer uses MAC addresses? → 2
Which layer do routers work at? → 3
Which layer decides between TCP and UDP? → 4
What's a Layer 4 TCP unit called? → Segment
Which protocol guarantees ordered delivery? → TCP
Which layer handles encryption and formatting (in OSI terms)? → 6
Which layer opens, maintains and closes conversations? → 5
DNS lives at which layer? → 7 (usually over UDP port 53)
Does a MAC address survive across routers? → No. It's rewritten at every hop. The IP address stays.
Is a web browser itself Layer 7? → No. HTTP is. The browser just uses it.