OSI Model Explained: The 7 Layers of Networking (2025)

The OSI model (Open Systems Interconnection) is a conceptual framework that divides network communication into 7 distinct layers. Created by ISO in 1984, it gives engineers a universal language to describe how data travels from an application on one computer to an application on another — regardless of the underlying hardware or software.

You'll encounter it in every networking exam, job interview, and troubleshooting scenario. This guide explains every layer with real-world examples, protocols, and the data unit (PDU) at each stage.

OSI model quick reference

Mnemonic (top→bottom): All People Seem To Need Data Processing
Mnemonic (bottom→top): Please Do Not Throw Sausage Pizza Away

Why the OSI model matters

Before OSI, network vendors used proprietary, incompatible protocols. A device from Vendor A couldn't talk to one from Vendor B. The OSI model solved this by:

• Standardising interfaces between layers so you can swap implementations
• Isolating troubleshooting — a Layer 3 problem (routing) is separate from a Layer 1 problem (broken cable)
• Enabling specialisation — switch engineers focus on Layers 1–2; application developers focus on Layers 5–7
• Defining PDUs — the precise data unit each layer handles (bits → frames → packets → segments)

In practice, the real Internet runs on the TCP/IP model (4 layers), but OSI is the gold standard for analysis and education.

Layer 1 — Physical

PDU: Bit

The Physical layer deals with raw bit transmission — electrical signals, light pulses, or radio waves over a physical medium. It defines:

• Voltage levels (how a 1 differs from a 0)
• Cable types (Cat5e, Cat6, fibre optic, coaxial)
• Connector shapes (RJ45, BNC, LC/SC fibre)
• Modulation (how bits are encoded on radio waves)
• Transmission speed (baud rate)

Real-world examples:

Devices: Hubs, repeaters, network cables, access points (radio element), modems.

Troubleshooting: Flashing link lights on a NIC, checking cable integrity with a cable tester, ethtool eth0 to inspect speed/duplex.

Layer 2 — Data Link

PDU: Frame

The Data Link layer takes raw bits from Layer 1 and groups them into frames — adding MAC addresses, error detection (CRC), and flow control. It splits into two sub-layers:

• LLC (Logical Link Control) — multiplexing protocols, flow control
• MAC (Media Access Control) — addressing and media access (who can transmit when)

Frame structure (Ethernet II):

| Preamble | Dest MAC | Src MAC | EtherType | Payload | FCS (CRC) |

Key responsibilities:

Protocols: Ethernet (802.3), Wi-Fi (802.11), PPP, ARP (maps IP → MAC), VLAN (802.1Q), STP (Spanning Tree).

Devices: Switches (Layer 2), bridges. Switches use MAC address tables to forward frames only to the correct port.

# View MAC address table on a Linux bridge
bridge fdb show

# ARP table (Layer 2 ↔ Layer 3 mapping)
arp -n
ip neigh show

Layer 3 — Network

PDU: Packet

The Network layer handles logical addressing and routing — deciding the best path for a packet to travel across multiple networks. Unlike Layer 2 (local delivery within one network), Layer 3 enables inter-network communication (the Internet).

IP address structure (IPv4):

192.168.1.100 / 24
│             │
└─ Host part  └─ Network prefix (subnet mask 255.255.255.0)

Key responsibilities:

Routing protocols:

Devices: Routers, Layer 3 switches, firewalls (packet filtering), NAT devices.

# View routing table
ip route show

# Trace the Layer 3 path to a destination
traceroute google.com          # Linux/macOS
tracert google.com             # Windows

# ICMP ping (Layer 3 protocol)
ping -c 4 8.8.8.8

Layer 4 — Transport

PDU: Segment (TCP) / Datagram (UDP)

The Transport layer provides end-to-end communication between processes (identified by port numbers). It handles reliability, flow control, and multiplexing.

TCP vs UDP:

TCP 3-way handshake:

Client                    Server
  │── SYN ──────────────────►│
  │◄── SYN-ACK ──────────────│
  │── ACK ──────────────────►│
  │    [Connection established]

Common port numbers:

# View active connections and listening ports
ss -tlnp          # Linux
netstat -ano      # Windows

# Check if a port is open
nc -zv google.com 443

Layer 5 — Session

PDU: Data

The Session layer establishes, manages, and terminates sessions (logical connections) between applications. It handles:

Protocols: NetBIOS (Windows file sharing session), RPC (Remote Procedure Call), PPTP (VPN sessions), SQL sessions, SIP (VoIP session initiation).

In practice, modern protocols like HTTP/1.1 (keep-alive), HTTP/2 (multiplexed streams), and WebSockets implement session-layer concepts directly in the Application layer. The Session layer is the most abstract and least distinctly implemented of the seven.

Layer 6 — Presentation

PDU: Data

The Presentation layer translates data between the format the network uses and the format the application needs. Think of it as the "translator" or "serialiser" of the stack.

Key functions:

Common formats at Layer 6:

Like Layer 5, the Presentation layer's functions are often handled by the Application layer in TCP/IP implementations (TLS lives conceptually here but is implemented at Layer 7 in practice).

Layer 7 — Application

PDU: Data

The Application layer is the user-facing interface to the network — it provides the protocols that applications directly use to send and receive data. This is the layer you interact with every time you browse the web, send an email, or query a DNS server.

Common Layer 7 protocols:

What Layer 7 does NOT do: It doesn't know about cables, IP addresses, or routing. It hands data to Layer 6 (Presentation) and trusts the lower layers to deliver it.

Data encapsulation — how data travels down (and up) the stack

When you send an HTTP request, each layer wraps the data from the layer above with its own header (and sometimes trailer). This process is called encapsulation.

Layer 7 (App)     HTTP Request
                      │ add HTTP headers
Layer 6 (Pres)    [HTTP data] (possibly encrypted by TLS)
                      │ TLS record
Layer 5 (Session) [TLS data]
                      │ session metadata
Layer 4 (Trans)   [TCP header | HTTP data]    ← Segment
                      │ add source/dest port
Layer 3 (Network) [IP header | TCP | HTTP]    ← Packet
                      │ add source/dest IP
Layer 2 (Data)    [ETH hdr | IP | TCP | HTTP | FCS] ← Frame
                      │ add MAC addresses + CRC
Layer 1 (Phys)    101001110101...             ← Bits

On the receiving end, each layer decapsulates (strips) its header and passes the remainder upward.

OSI model vs TCP/IP model

The Internet runs on the TCP/IP model (also called the Internet model or DoD model). Here's how the two map:

Key differences:

When to use which: Use OSI to analyse, describe, and troubleshoot networks. Use TCP/IP to implement and configure systems.

OSI model in troubleshooting

Working from bottom to top is the systematic approach:

Layer 1 — Is the cable plugged in? Link lights on?
Layer 2 — Is the switch seeing the MAC address? Any broadcast storm?
Layer 3 — Can you ping the default gateway? Is there a route?
Layer 4 — Is the port open? Is the service listening? (ss -tlnp)
Layer 5 — Is the session being established and maintained?
Layer 6 — Is there a TLS certificate error? Encoding mismatch?
Layer 7 — Is the application returning an error? Check app logs.

Practical commands per layer:

OSI model and network security

Understanding layers is essential for placing security controls correctly:

DDoS attacks by layer:

Common OSI model interview questions

Common mistakes

OSI vs TCP/IP vs other models

Frequently asked questions

Do I need to memorise all 7 layers?
Yes, especially in networking and sysadmin roles. Use the mnemonic "Please Do Not Throw Sausage Pizza Away" (Physical, Data Link, Network, Transport, Session, Presentation, Application — bottom to top). Most interviews expect you to name them in order and describe each.

Does the OSI model apply to Wi-Fi?
Yes. Wi-Fi (802.11) maps to Layer 1 (radio transmission / physical signals) and Layer 2 (MAC addressing, CSMA/CA, framing). The upper layers are identical for wired and wireless traffic.

Where does ARP fit in the OSI model?
ARP (Address Resolution Protocol) operates at the boundary between Layer 2 and Layer 3. It takes an IP address (Layer 3) and resolves it to a MAC address (Layer 2). Some references classify it as Layer 2, others as 2.5.

Why does the TCP/IP model have only 4 layers instead of 7?
TCP/IP was designed pragmatically for the ARPANET before OSI existed. It merges OSI Layers 5–7 into "Application" because real protocols (HTTP, SSH, etc.) handle session and presentation functions themselves. It also merges Layers 1–2 into "Network Access."

Is OSI still relevant in 2025?
Absolutely. It's the universal vocabulary for discussing networks — used in certifications (CompTIA Network+, CCNA, CCNP), security frameworks (NIST, MITRE ATT&CK), and troubleshooting. Every network engineer needs to understand it.

What layer does a firewall operate at?
It depends on the firewall type. Packet-filtering firewalls operate at Layer 3–4 (IP/port rules). Stateful firewalls track TCP state at Layer 4. Next-generation firewalls (NGFW) with deep packet inspection operate at Layer 7 (Application) to identify applications regardless of port.