OSI Model

What is the OSI model?

The OSI (Open Systems Interconnection) model is a reference model that splits network communication into seven layers, from the physical signal on a wire up to the application a person uses. Each layer has one job and talks only to the layers directly above and below it. It was published as ISO/IEC 7498-1, which is the same text as ITU-T X.200. Today it is mainly a shared vocabulary for explaining where a problem or a protocol sits.

The seven layers

1. Application (7): the protocols applications use to talk to each other, such as HTTP, DNS or SMTP.
2. Presentation (6): data format, encoding and encryption. TLS is usually drawn here or at the transport layer; it fits neither cleanly.
3. Session (5): opening, keeping and closing a conversation between two endpoints.
4. Transport (4): end-to-end delivery between processes. TCP adds ordering and retransmission, UDP does not. Data units are called segments (TCP) or datagrams (UDP).
5. Network (3): addressing and routing between networks. IP lives here, and the unit is the packet.
6. Data link (2): delivery between two directly connected devices, with MAC addresses and frames. Ethernet and Wi-Fi sit here.
7. Physical (1): bits as electrical, optical or radio signals, cables and connectors.

When data is sent, each layer wraps what it receives from above with its own header (encapsulation); the receiver unwraps them in reverse order.

OSI versus the TCP/IP model

The internet was built on the TCP/IP model, which RFC 1122 describes with four layers: link, internet, transport and application. Roughly, the TCP/IP application layer covers OSI layers 5 to 7, transport matches layer 4, internet matches layer 3, and link covers layers 1 and 2. The match is approximate: real protocols do not follow the OSI boundaries strictly, so placing HTTP at layer 7 or TLS at layer 6 is a convention, not a rule. Treat the numbers as labels, not as an exact map of what a packet does.

Example: a slow page, layer by layer

A page loads slowly. Working through the layers narrows the cause quickly:

• Layers 1 and 2: packet loss on Wi-Fi or a faulty link. Other sites feel slow too.
• Layer 3: a bad route or a far-away server adds latency to every request.
• Layer 4: connections are refused or time out, or TCP handshakes are slow.
• Layer 7: the network is fine, but the server answers slowly or returns errors.

Engineers say "a layer 7 problem" for the last case and "a network problem" for the first three.

Why it matters for security

Controls are often named after the layer they work on. A packet filter works at layers 3 and 4, a web application firewall at layer 7, and encryption protects data in transit at the transport or application level. Attacks are described the same way: a SYN flood targets layer 4 and an HTTP flood targets layer 7, which is why defenses differ. See distributed denial of service (DDoS) for the defensive side and cyber security threats for the wider picture.

Common mistakes

• Treating OSI as how the internet is implemented. It is a teaching and diagnostic model; the internet runs on TCP/IP.
• Arguing about exactly which layer a protocol belongs to. Several protocols, TLS among them, straddle two.
• Assuming a fix at one layer helps another. More bandwidth does not fix a slow database query.
• Testing only one layer. A working ping proves layer 3 only, not that the application answers.

OSI, testing and monitoring

The model helps you choose the right check. LoadFocus load testing sends HTTP(S) requests, so it exercises layer 7 and shows what users feel when the server is busy. API monitoring adds checks lower in the stack: TCP monitors for port availability, DNS monitors for record resolution and SSL certificate checks, alongside HTTP checks. For protocols that load testers meet in practice, see top network protocols for performance testing, and for the general practice see network monitoring.

FAQ

How many layers does the OSI model have?

Seven: physical, data link, network, transport, session, presentation and application. The TCP/IP model that the internet uses has four.

Is the OSI model still used?

Yes, as a common language. People say layer 2 switch, layer 4 load balancer or layer 7 attack. The internet itself is built on TCP/IP, not on OSI protocols.

Which layer are HTTP, TCP and IP?

By convention HTTP is layer 7, TCP is layer 4 and IP is layer 3. The boundaries are approximate, and TLS is the usual example of a protocol that does not fit one layer.

What is the difference between OSI and TCP/IP?

OSI is a seven-layer reference model. TCP/IP is a four-layer model that describes the protocols actually used on the internet. TCP/IP merges OSI layers 5 to 7 into one application layer and layers 1 and 2 into one link layer.

Why does the layer matter for security?

Different defenses work at different layers. A packet filter cannot read an HTTP request, and a web application firewall cannot stop a flood of raw packets. Knowing the layer tells you which control applies.