Layers: the OSI and TCP/IP models and encapsulation
Lesson 2 of 4
2Layers: the OSI and TCP/IP models and encapsulation
The big pictureSending a photo to a friend is a big problem: the image format, cutting it up, the address, the road, the cable. Instead of solving it at once we split it into layers; each layer solves one part and hands over to the one above or below. That is how a Wi-Fi engineer can work without knowing anything about HTTP.
What the picture shows: The request goes down the sender's layers, each adding a header, crosses the wire as bits, then climbs the receiver's layers, each removing its header.
Map of this part
The concepts in order, click any one to jump to it:
Two ways into the same idea
Think of posting a book to a friend in another city: you write the content (application), cut it into numbered pages so the order is not lost (transport), write the city and street on every envelope (network), the courier takes it only to the next depot and hands it to another (data link), and the road and the truck (physical). On arrival the envelopes are opened in reverse.
OSI, from ISO, is a seven-layer reference model; the internet actually runs on the TCP/IP model with four (or five) layers. Each layer adds a header (PDU: data, segment, packet, frame, bits) and talks to its peer on the other side through the layer below. OSI's value today is vocabulary and troubleshooting: "a layer 2 problem" is a sentence every engineer understands.
Before You Start
🕸️What is a network?
You know a network is devices, links and protocols.
✉️The idea of a packet
Data is cut into small pieces carrying addresses.
The Core Idea
1Why layers?
Layers separate problems: each layer serves the one above and does not care how the others work. That is why you can switch from cable to Wi-Fi without your browser changing, and move from HTTP/1.1 to HTTP/3 without changing your router.
OSI layer explorer
Press any layer to see its job, its unit of data, its best-known protocols, and what you see when it breaks.
7 · Application
Plainly: The program you see: the browser asks for a page, mail sends a message.
Technically: The protocols an application speaks directly; they define what a request and a reply look like.
- Unit of data
Data- Protocols
HTTP · HTTPS · DNS · SSH · SMTP · DHCP- Devices
- No special device; servers and smart firewalls read it
- When it breaks
- The site answers with error 500, or the domain name does not resolve.
6 · Presentation
Plainly: Translates how data looks: characters, images, encryption.
Technically: Encoding (UTF-8), compression and encryption. In TCP/IP it melts into the application layer; TLS is the best-known example.
- Unit of data
Data- Protocols
TLS · UTF-8 · JPEG · gzip- Devices
- No special device
- When it breaks
- Arabic text shows as garbage, or the browser warns about a certificate.
5 · Session
Plainly: Opens a conversation, keeps it going and closes it.
Technically: Managing and resuming sessions. In practice the application or TLS handles it; you rarely see it as a separate layer.
- Unit of data
Data- Protocols
sockets · RPC · NetBIOS- Devices
- No special device
- When it breaks
- You are logged out every minute because the session expires.
4 · Transport
Plainly: Numbers the pieces, makes sure they all arrived, and hands them to the right program by port.
Technically: TCP is reliable and ordered through a handshake and acknowledgements; UDP is fast with no guarantees. Ports pick the program.
- Unit of data
Segment- Protocols
TCP · UDP · QUIC · ports- Devices
- Firewalls and load balancers
- When it breaks
- Port 443 is blocked by a firewall, so the connection times out.
3 · Network
Plainly: Writes the city and street address and picks the road between networks.
Technically: IP addressing and routing between networks, plus ICMP for error messages (ping and traceroute).
- Unit of data
Packet- Protocols
IPv4 · IPv6 · ICMP · OSPF · BGP- Devices
- Routers and layer 3 switches
- When it breaks
- Your device got 169.254.x.x, or there is no route to the destination.
2 · Data link
Plainly: Delivers the frame to the next device only, inside the local network.
Technically: MAC addresses, frames, the FCS error check, VLANs and ARP. It works one hop at a time.
- Unit of data
Frame- Protocols
Ethernet · Wi-Fi 802.11 · ARP · 802.1Q · STP- Devices
- Switches, access points and network cards
- When it breaks
- The port is in the wrong VLAN, so the device sees no one.
1 · Physical
Plainly: The cable, the fibre, the radio waves: the bits themselves as a signal.
Technically: Voltage, light and radio, the cables (Cat6, fibre), connectors and speeds.
- Unit of data
Bits- Protocols
Cat6 · fibre · 802.11 radio · RJ45- Devices
- Cables, hubs and repeaters
- When it breaks
- A cut or unplugged cable, or a weak Wi-Fi signal.
2OSI against TCP/IP
TCP/IP folds OSI's top three layers (application, presentation, session) into one "application" layer, and the bottom two into "link". When someone says "layer 7" they mean the application, "layer 3" means IP, and "layer 2" means MAC and switches, even when working with TCP/IP.
The layers in their colours; each layer keeps its colour in every drawing of this track.
3Encapsulation: header on header
When sending, each layer takes what the layer above handed it and adds a header with what it needs: transport adds ports, network adds IP addresses, data link adds MAC addresses and a trailer to check for errors. When receiving, each layer strips its header and hands the rest up.
Build the packet yourself
Press "Next" and watch each layer wrap its header around the request on its way from the browser to the wire.
01001000 01010100 01010100 01010000 00101111 00110001 00101110 00110001 …
Layer 7, application: the browser writes the request GET /index.html. The unit is called data.
Layer 4, transport: TCP adds the source port (a temporary 51514), the destination port 443 and a sequence number. Now it is a segment.
Layer 3, network: IP adds your address, the server's address and a TTL. Now it is a packet, and this header stays until arrival (NAT aside).
Layer 2, data link: Ethernet adds your MAC and the gateway's, plus an FCS trailer to catch errors. Now it is a frame, rewritten at every hop.
Layer 1, physical: the frame becomes bits: electrical pulses in the cable or radio waves over Wi-Fi. At the server the headers come off in reverse.
Notice the most practical difference: the IP header stays from your device to the server, while the Ethernet header is replaced at every router on the way, because a MAC is only good for one hop.
4Troubleshooting by layer
When something breaks, start at the bottom: is the cable in (1)? Is the device on the right network (2)? Does it have an IP address and reach the gateway (3)? Is the port open (4)? Does the service answer (7)? The first layer that fails is where the problem is.
Change the check results (True and False) and see where the diagnosis stops.
layers = [
(1, "Physical", "cable or Wi-Fi connected?", True),
(2, "Data link", "right network, gateway in ARP?", True),
(3, "Network", "has an IP, can ping the gateway?", False),
(4, "Transport", "port open?", None),
(7, "App", "service answering?", None),
]
for number, name, question, ok in layers:
if ok is None:
continue
print(f"L{number} {name:<9} {question:<34} {'ok' if ok else 'FAIL'}")
if not ok:
print(f"-> start fixing at layer {number}; the layers above cannot work yet")
breakWorked example
The task: a colleague says "the internet is down" and their machine has the address 169.254.12.7. Which layer? The answer: a 169.254.x.x address is one a device gives itself when no DHCP server answers. So layers 1 and 2 are probably fine (it is connected) and the problem is at layer 3: it never got a proper address. Check the DHCP server or the VLAN the port is in.
Myth vs Reality
| Myth | Reality |
|---|---|
| The internet runs on the OSI model. | It runs on TCP/IP. OSI is a reference for teaching, troubleshooting and vocabulary. |
| Every device opens the whole packet. | A switch reads up to layer 2, a router up to 3. Only the two ends open every layer. |
| HTTPS is at layer 4. | HTTP is at 7 and the TLS encryption at presentation (6), both on top of TCP at layer 4. |
Where you meet it at work
🩺Troubleshooting
"The port light is off" is layer 1, "wrong IP" layer 3, "error 500" layer 7.
🛡️Security
A classic firewall checks 3 and 4; a next-generation firewall understands 7.
🧪Wireshark
Shows every packet split by layer exactly like the packet builder.
Test your understanding
What is the unit of data called at layer 3?
Layer 3 (network) adds the IP header, so the unit is a packet.
Which header is replaced at every router on the way?
A MAC is good for one hop, so each router builds a new frame for the next hop.
In TCP/IP, OSI layers 5, 6 and 7 are folded into:
TCP/IP does not separate presentation and session; the application handles them.
A cut cable is a problem at which layer?
The cable and the signal are the physical layer.
At which OSI layer does a router work?
A router reads the IP address, and IP lives at the network layer.
What is the unit of data at layer 2 called?
Layer 4 segment, 3 packet, 2 frame, 1 bit.
Quick review cards
Check Your Understanding
Explain encapsulation in one sentence to a non-technical person.
Your message goes into an envelope inside an envelope inside an envelope; each post office department writes what it needs, and the receiver opens them in reverse.
Why does a router read the IP header but not HTTP?
Because it only needs the destination to pick the road, and that sits at layer 3. Opening anything above is not its job.
What does 169.254.x.x mean when troubleshooting?
The device found no DHCP server and gave itself an address: a layer 3 or VLAN problem.
Resources for this lesson
Grouped by type. Start with the official docs for precision, or an article or video for the explanation.
Done with this lesson?
Sign in to save your progress.