OSI 7 Layers Explained

The Open Systems Interconnection (OSI) model is a shared vocabulary invented so vendors and operators could talk about "who does what" without pretending one product owned the whole path. It is a reference model: seven jobs stacked so that each layer uses the layer below and serves the layer above. Real packets on the internet are built with TCP/IP (next lesson). OSI still wins the meeting because tickets, RFCs, certifications, and Wireshark trees all point at these floors.

Please Do Not Throw Sausage Pizza Away (Physical, Data Link, Network, Transport, Session, Presentation, Application) is a once-and-done memory hook. Recite it if an exam demands order. Then forget it as a teaching method. A mnemonic does not tell you why a switch cannot fix a missing default route, or why TLS sitting "near" Layer 6 still shows up in a Layer-7 HTTP conversation. Mechanism does.

Encapsulation is the mechanism. When your browser sends a request, application data is the innermost payload. As the message walks down the stack, each layer wraps that payload with its own header (and Layer 2 often a trailer). Layer 4 adds ports and sequence numbers. Layer 3 adds source and destination IP. Layer 2 adds MAC addresses for the next hop on this wire. Layer 1 turns the frame into bits on copper, fiber, or radio. Going up the stack at the receiver is de-encapsulation: peel the header, hand the inside to the layer above. That is why a capture looks like nested dolls — Ethernet contains IP contains TCP contains HTTP.

Names of the PDU (protocol data unit) change with the floor, and analysts use those names on purpose. Bits at Layer 1. Frames at Layer 2 (MAC, local segment). Packets at Layer 3 (IP, routed). Segments or datagrams at Layer 4 (TCP/UDP). Calling an Ethernet frame "a packet" in a bridging incident hides the fact that the IP header never changed — only the MAC wrapper did. Precision here is not pedantry; it is how you pick the right device to debug.

Layer 1 Physical is energy on a medium: voltage, light pulses, radio. No addresses. If the link light is dead, you do not open Wireshark first. Physical access is a different threat class from remote exploitation: someone in the building can unplug, tap, jam, or plant a device. A remote attacker on the internet does not get Layer 1 on your rack unless they already have a foothold or a compromised path. Badge control and cable hygiene are security controls, not "IT plumbing."

Layer 2 Data Link delivers frames on one local network. Ethernet and Wi-Fi live here. Addresses are MACs. Switches forward by destination MAC. ARP (IPv4) asks "who has this IP?" so a host can fill the next-hop MAC. That is why ARP spoofing, MAC flooding, and rogue access points are Layer-2 incidents: they hijack local delivery before IP routing matters. A packet capture that shows the wrong MAC for the gateway is a Layer-2 finding even if the IP looks fine.

Layer 3 Network moves packets between networks using IP addresses. Routers read the destination IP, decrement TTL, and pick a next hop. IP spoofing, rogue routes, and "can reach the internet but not the other VLAN" tickets live here. Layer 4 Transport is end-to-end between processes: TCP or UDP, plus port numbers that name the service (22, 443, 53). Firewalls often match the 5-tuple (src IP, dst IP, proto, src port, dst port) — that is Layer 3 plus Layer 4 working as one control. SYN floods and "port 445 open to the world" are Layer-4 shaped even when the root cause is a bad rule.

Layers 5 Session and 6 Presentation exist in the model — dialogues, encoding, compression, some encryption concepts — but production tickets almost never say "Layer 5." TLS, JSON, and character encoding show up inside application traffic. Layer 7 Application is HTTP, DNS, SMTP, SMB: the protocols users and malware actually speak. Phishing pages, SQL injection, and C2-over-HTTPS are Layer 7. SOC daily language is L2 / L3 / L4 / L7. Learn all seven for exams and for reading docs. Investigate with the four that appear in dashboards.

First, classify on paper. Then prove Layer 2 vs Layer 3 on a machine you own. ip link shows interfaces and MACs (Layer 2). ip addr shows inet/inet6 (Layer 3). Do not add, delete, or flush addresses. Do not scan the LAN.

ip link
ip addr
ip -br addr

Read the output:

cat /etc/os-release

You now treat OSI as a location language: encapsulation wraps going down, SOC lives mostly at L2/L3/L4/L7, and physical access is a different door from remote IP. Next up — TCP/IP Model — the four-layer stack that real packets actually wear, mapped onto these seven names so you can read both the textbook and the capture.