The OSI Model: 7 Layers of Networking [Under the Hood]

hafeez@unixshadow: ~/packet.bin
hafeez@unixshadow:~$ ping -c1 203.0.113.7 # then: what each layer added on the way down

The OSI Model
7 Layers of Networking

every packet you have ever sent walked down this stack — the reply walked back up it.

L7 APPLICATION — user-facing protocols
Where your apps live: HTTP DNS SMTP FTP SSH — authentication, resource sharing, data formats.
travels as: Data

L6 PRESENTATION — translation · encryption · compression
Translates between app and network formats: charsets, serialization, compression.
Encryption lives here — TLS wraps your traffic before it descends.
travels as: Data

L5 SESSION — connections · dialogs
Opens, manages and tears down sessions — who talks to whom, for how long.
Checkpoints and recovery: a dropped transfer resumes instead of restarting.
travels as: Data  ·  e.g. NetBIOS RPC

L4 TRANSPORT — end-to-end delivery
TCP: reliable, ordered, acknowledged — retransmits what gets lost. UDP: fast, fire-and-forget.
Ports multiplex everything: 443=HTTPS, 22=SSH, 53=DNS. Segmentation and flow control live here.
travels as: Segments (TCP) / Datagrams (UDP)

L3 NETWORK — routing · addressing
IP addressing and routing: how a packet crosses networks it has never seen.
Routers live here — so do ICMP (ping) and routing protocols (OSPF, BGP).
travels as: Packets  ·  device: Router

L2 DATA LINK — local delivery
Ethernet + MAC addresses: delivery within one local segment.
Switches forward frames by MAC table; VLANs carve one switch into many logical networks.
travels as: Frames  ·  device: Switch

L1 PHYSICAL — the wire itself
Cables, connectors, radio waves — raw bits as electrical, optical or radio signals.
No addresses, no reliability, no mercy: cable unplugged, nothing above matters.
travels as: Bits  ·  device: Hub / cabling

# encapsulation — the packet as it hits the wire:
ETH HDRL2
IP HDRL3
TCP HDRL4
DATAL5–7
CRCtrailer

Each layer wraps the payload from above with its own header (plus a trailer at L2). The receiving host strips them back off in reverse — de-encapsulation on the way up.

# troubleshooting: work bottom-up
L1 first — plugged in? link light on? Then ping (L3), then ports via ss -tlnp / nc -vz (L4), then the app itself (L7). Most “network” problems are physical.
# remember the order, top-down
All People Seem To Need Data Processing — Application, Presentation, Session, Transport, Network, Data Link, Physical.
unixshadow.com  ·  VPS & hosting from the shadowshafeez@unixshadow:~$

Scroll to Top