The OSI Model, Actually Explained

Every time you open a browser tab, stream a video, send a message, or ping a server, data travels through seven conceptual layers. The OSI model is the map. Most people have heard of it. Most people couldn't tell you what Layer 4 is without Googling it. By the time you finish this, you'll own it.

We're not going surface level here. I want you to understand this model well enough to use it — to debug a network problem, to explain it in a job interview, to know why your VPN slows you down or why a firewall lives where it does. Let's go.

Why a Layered Model at All?

In the 1970s, every networking vendor had their own proprietary stack. IBM had SNA. DEC had DECnet. You couldn't easily connect an IBM machine to a DEC machine. The International Organization for Standardization (ISO) decided that was a problem worth solving. In 1984 they published the Open Systems Interconnection model — OSI.

The big idea: break the complex problem of "how do two computers talk to each other?" into discrete, independent concerns. Each layer handles one job. Each layer only talks to the layer directly above it and directly below it. You can swap out implementations at one layer without touching the others.

The Mnemonic

There are two directions you can read the model, and two mnemonics to match. Pick the one that sticks:

Bottom-up: Please Do Not Throw Sausage Pizza Away. Top-down: All People Seem To Need Data Processing. Doesn't matter which. Pick one and burn it in.

The Seven Layers

We'll go bottom-up, because that's the direction data travels as it's built up for transmission. Think of it as wrapping a gift: each layer adds its own packaging before handing it down.

Encapsulation: How a Packet Is Actually Built

This is the concept that makes the model click from theory into something real. When you send data, it travels down the stack on the sender's machine — each layer wraps the data from the layer above in its own header (and sometimes a trailer). This is called encapsulation.

On the receiving end, it travels up the stack, with each layer stripping off its own header and passing the payload up to the next layer. This is de-encapsulation.

Each layer adds its own header. The data unit name changes at each layer:

A Real-World Trace: You Type a URL

Let's make this concrete. You type https://thedaddyproject.org and hit Enter. Here's what happens, layer by layer:

1. Layer 7 — Application: Your browser constructs an HTTP GET request. Before that can go anywhere, it needs an IP address for the hostname. A DNS query is fired — also Layer 7, also UDP — to resolve thedaddyproject.org to an IP.
2. Layer 6 — Presentation: TLS negotiation kicks off. Your browser and the server exchange certificates, agree on a cipher suite, and establish an encrypted channel. From this point forward, the HTTP data is encrypted.
3. Layer 5 — Session: A session is established and maintained. TLS session tickets may allow resumption if you visit again soon.
4. Layer 4 — Transport: TCP wraps the data. A three-way handshake (SYN → SYN-ACK → ACK) establishes the connection. The HTTP GET is segmented, each segment gets a source port (some ephemeral high port on your machine) and destination port 443. TCP will guarantee these arrive and reassemble correctly.
5. Layer 3 — Network: The TCP segment becomes the payload of an IP packet. Source IP: your machine. Destination IP: the server. Your OS hands this to your router, which looks up the best path toward the destination and forwards it. Every router along the way reads the Layer 3 header only.
6. Layer 2 — Data Link: On your local network, the packet gets wrapped in an Ethernet frame addressed to your router's MAC address (found via ARP). At each hop, frames are stripped and rebuilt — the MAC addresses change at every router, but the IP addresses stay the same.
7. Layer 1 — Physical: Electrical signals on your Ethernet cable or radio waves on your Wi-Fi carry the bits out of your house. Fiber carries them across the backbone at the speed of light.

The server receives the bits, de-encapsulates up through all seven layers, processes the HTTP GET, and sends a response down its own stack. Your browser gets the HTML, renders the page, and you see what you came for.

Devices and Where They Live

One of the most useful applications of the OSI model is understanding which network device operates at which layer. This tells you exactly what each device can and can't see, and what kind of decisions it can make.

TCP/IP vs OSI: What Actually Runs the Internet

Here's the honest truth: TCP/IP predates OSI and doesn't map perfectly to it. The internet runs on the TCP/IP model (also called the Internet model or DoD model), which has four layers. Knowing how they map helps you translate between the two:

The OSI model collapses when you try to map TLS to it precisely — TLS overlaps L4, L5, and L6 depending on which functionality you're looking at. That's fine. The model is a thinking tool, not a law of physics.

The Protocols You Actually Need to Know

This is the reference table I wish I'd had. Sorted by layer, with the stuff that actually matters in real life.

The Three-Way Handshake (TCP Connection Establishment)

TCP is reliable because it establishes a connection before sending data. That process is three steps and it's worth knowing cold:

1. SYN — Client sends a synchronize packet to the server: "I want to talk. Here's my starting sequence number: X."
2. SYN-ACK — Server responds: "Got it. Acknowledged (X+1). Here's my starting sequence number: Y."
3. ACK — Client acknowledges: "Got your Y. We're connected." Data can now flow.

Closing a TCP connection requires a four-way FIN process (FIN → ACK → FIN → ACK), because each direction of the connection closes independently.

IP Addresses: A Quick But Necessary Detour

The OSI model relies on logical addressing at Layer 3. You need to understand the basics of IPv4 to use this model in practice.

An IPv4 address is 32 bits written as four decimal octets: 192.168.1.100. Each octet is 0–255. The address has two parts: the network portion and the host portion, determined by the subnet mask.

IPv4 is running out — the last large blocks were allocated around 2011. IPv6 uses 128-bit addresses written in hexadecimal (2001:0db8:85a3::8a2e:0370:7334), providing an essentially inexhaustible address space. The internet is slowly migrating.

Subnetting in Plain English

A subnet mask tells you which part of an IP address identifies the network and which part identifies the host. /24 means the first 24 bits are the network — leaving 8 bits for hosts, which gives you 254 usable addresses (256 - 2, subtracting the network address and broadcast address).

How Encryption Fits the Model

People get confused about where TLS/HTTPS "lives." The honest answer is: it spans multiple layers, which is part of why OSI-to-TCP/IP mapping gets messy. Here's how to think about it:

• TLS handshake (key exchange): Operates mostly at the Session/Presentation boundary (L5/L6). Certificates are exchanged, keys negotiated, cipher suite agreed.
• TLS record layer (actual encryption): Wraps the application data before it hits TCP — conceptually L6 (Presentation), but implemented below L7.
• TCP (the underlying transport): TLS runs over TCP, so the encrypted data is still a TCP payload at L4.

The key takeaway: HTTPS means the HTTP data (URL, headers, body) is encrypted. The IP addresses of source and destination are not encrypted — they're in the L3 header which must be readable by routers. A network observer can see that you're talking to a server, but not what you said. (SNI leaks the hostname too, unless you use Encrypted Client Hello — but that's another deep dive.)

Quick Reference: Troubleshooting by Layer

Bookmark this. When something breaks on the network, here's the systematic approach:

The Stuff Worth Memorizing Cold

If you're studying for CompTIA Network+, a job interview, or just want the model to live in your head instead of on a flash card, here's the minimum:

• The layer names, numbers, and mnemonics (both directions)
• Data unit names: bits → frames → packets → segments → data
• Where routers, switches, and firewalls live
• TCP vs UDP tradeoffs and where ports live (L4)
• MAC addresses at L2, IP addresses at L3
• The TCP three-way handshake: SYN → SYN-ACK → ACK
• Common protocol port numbers (80, 443, 22, 25, 53, 443)
• Private IP ranges: 10.x, 172.16–31.x, 192.168.x

The OSI model is a simplification of reality. TCP/IP doesn't follow it perfectly. TLS doesn't map cleanly to a single layer. Real network stacks are messier than seven clean boxes. But the model gives you a shared vocabulary and a thinking framework that has stood for over 40 years. That's not nothing — that's everything when you're trying to debug why your VPN is routing weird at 2am.

You own this now. Go break something on purpose and trace it down from Layer 7 to Layer 1. That's how it becomes reflexive.