Step 39. The OSI 7 Layers — A Map for Placing Nine Pieces

Level 0 — Getting Comfortable with Computers | Difficulty ★★☆☆☆ | Estimated time: 2.5 hours

Prerequisites: Steps 31–38 complete; you know IP, MAC, DNS, ports, TCP/UDP, routing, and NAT individually.

What you need: a notebook and a pen — that’s all. Today is a day of pictures, with almost no commands.
Caution: today’s practice is 100% safe — it all happens on paper. But since this picture becomes the map for the entire book, don’t just skim past it.

So far we’ve learned the pieces of networking one at a time. IP is the address, MAC is neighborhood delivery, DNS is the phone book, ports are room numbers, TCP is the polite telephone, UDP is the throwing delivery, ICMP is the status report, routers are signposts, NAT is the disguise. Nine pieces. But how do these pieces relate to one another? With nine pieces, you need a map. The OSI 7-layer model we learn today is exactly that map — the world’s most famous classification table, dividing everything that happens in a network into seven layers.

1. Learning Objectives

By the end of this chapter, you will be able to:

Recite the OSI 7 layers in order and describe each layer’s role in one line
Place the pieces learned so far (IP, MAC, ports, TCP, DNS…) into their home layers among the seven
Explain encapsulation (envelope wrapping) with a picture
State the correspondence between the OSI 7 layers and the TCP/IP 4 layers
Sort failures and attacks by the question "which layer’s incident is this?"

2. Background Knowledge — Today’s Tools and Concepts

Today’s Tools at a Glance

Category	Details
Language/environment	None — a notebook and pen are today’s practice tools
Today’s commands	No new commands. Instead, we build a map classifying the commands learned so far by layer
Concepts needed	OSI 7 layers, encapsulation, TCP/IP 4 layers, per-layer suspicion (diagnostic order)

2-1. Why Divide into Layers — So Each Does Only Its Own Job

Think of a parcel delivery company. The sender only packs goods into the box, the address writer only writes the address, and the driver only drives. As long as each knows their own job, the company runs. The driver doesn’t need to know what’s inside the box, and the sender doesn’t need to memorize the highway map.

Networks are the same. The giant task called "communication" is divided into layers by role, and each layer does only its own job and delegates to the layer below. Thanks to this, each layer can evolve independently. Even if the cable changes from phone line to fiber broadband (a layer-1 replacement), the web browser (layer 7) doesn’t need to change.

2-2. The Roster of Seven Layers — Ph-Da-Ne-Tr-Se-Pr-Ap

Climbing from the bottom layer up:

Physical: wires, electrical signals, light. The road where 0s and 1s actually flow.
Data Link: delivery inside the same neighborhood. MAC addresses live here.
Network: delivery between neighborhoods. IP addresses and routers live here.
Transport: in charge of delivery quality. TCP (polite certified mail) and UDP (fast regular mail), plus port numbers, live here.
Session: the start and end of conversations, conversation management. The agreement of "conversation starts now, ends now."
Presentation: the way data is expressed. In charge of "translation" like character encoding, compression, encryption.
Application: the protocols of the programs we actually use. HTTP (web), DNS (phone book), SSH (remote access) live here.

Take the first syllables in Korean and you get the chant 물-데-네-전-세-표-응 (Physical–Data Link–Network–Transport–Session–Presentation–Application) — an incantation everyone who studies networking hears at least once.

2-3. Encapsulation — Russian-Doll Packaging

Each time a letter descends from an upper layer to a lower one, one more outer envelope is wrapped around it:

On the data made at layer 7 (e.g., "search term: cats"),
layer 4 wraps an envelope with the port number (segment),
layer 3 wraps a bigger envelope with the IP address (packet),
layer 2 wraps the outermost envelope with the MAC address (frame).

This is called encapsulation. On the receiving side, it’s the reverse: the envelopes are peeled off one by one from layer 2 upward. The addresses you learned in Steps 31–38 were in fact written on different envelopes — MAC on the outermost envelope, IP on the one inside it, the port on the one deeper still.

2-4. The TCP/IP 4 Layers — The Compressed Edition for Practice

The real internet runs on the TCP/IP 4-layer model, simpler than the OSI 7 layers:

OSI layers 1–2 → Network Access layer (MAC, cables)
OSI layer 3 → Internet layer (IP)
OSI layer 4 → Transport layer (TCP/UDP, ports)
OSI layers 5–7 → Application layer (HTTP, DNS, etc.)

In other words, OSI’s layers 5, 6, and 7 are often lumped together in practice as the "application layer." That’s why people say "7 layers for culture, 4 layers for work." Know both, and the trick is knowing how they correspond to each other.

3. Follow Along

3-1. Learning the Incantation — Writing the Seven Layers

In your notebook, write the seven layers from bottom to top, five times. Writing by hand matters:

1 Physical   - wires and signals
2 Data Link  - delivery inside the neighborhood (MAC)
3 Network    - delivery between neighborhoods (IP, routers)
4 Transport  - quality in charge (TCP/UDP, ports)
5 Session    - start and end of conversations
6 Presentation - translation (encoding, compression, encryption)
7 Application  - program protocols (HTTP, DNS, SSH)

How to read it: as you write, notice that each layer already holds words you know. MAC, IP, TCP, ports, DNS. What you learn today is not new words but a room assignment chart for words you already know.

3-2. Placement Practice — Laying the Pieces on the Layers

Write the list below in your notebook, and next to each, write which layer it lives on. Check the answers in section 5:

MAC address
IP address
TCP
Port number
DNS
HTTP
LAN cable
Home router (NAT/routing)

Predict: can you make one more problem yourself? Something like "which layer does the Wi-Fi radio wave belong to?" Predict and state your reason. (Hint: a radio wave is ultimately a signal too.)

3-3. Writing a Travel Diary — The Per-Layer Record of One Search

Write a travelogue, layer by layer, of "the moment you type example.com into the browser address bar and press Enter." It’s a synthesis of everything so far:

Layer 7: the browser makes a DNS question — "tell me example.com’s address."
Layer 4: it wraps that question in a UDP envelope, destination port 53.
Layer 3: it wraps an envelope marked with the DNS server’s IP address.
Layer 2: it wraps the outer envelope marked with the MAC address of the router, a same-neighborhood neighbor.
Layer 1: electrical signals flow over the cable (or radio waves).
The router (NAT) swaps the sender (Step 38), and routers hand it along like signposts (Step 37).
When the answer returns, layer 7 this time builds an HTTP request, and layer 4 starts with a handshake to TCP port 80 (Step 35).

How to read it: if you can write this diary without stumbling, Steps 31–39 are all yours — every single line is content from a past chapter.

3-4. A Command Map by Layer — Hanging the Learned Commands on Layers

Let’s hang the commands learned so far by layer. Draw it as a table in your notebook:

Command	What it looks at	Layer
`ipconfig` / `ip addr`	My IP, gateway	Layer 3
`arp -a` / `ip neigh`	Neighbors’ MACs	Layer 2
`nslookup`	Name ↔ address	Layer 7 (DNS)
`netstat -ano`	Open ports and connections	Layer 4
`Test-NetConnection`	TCP handshake test	Layer 4
`ping`	Survival report	Layer 3 (ICMP)
`tracert` / `traceroute`	Route tracing	Layer 3

How to read it: this table’s real use is failure diagnosis. If "layer 3 works but layer 4 doesn’t" (ping works but the port won’t open), the cause is on the service or firewall side; if "layer 2 doesn’t work" (you can’t even see same-neighborhood neighbors), start with the cable or Wi-Fi. Layers are the order of suspicion.

3-5. Per-Layer Suspicion Training — Three Failure Scenarios

Let’s put the learned map to use right away. Read each scenario and write in your notebook "which layer to suspect first." The commentary is in section 5:

Scenario A: the Wi-Fi icon shows an X. No site opens. Even the phone in the same house has no internet.

Scenario B: ping 8.8.8.8 works, but nothing opens by site name.

Scenario C: my server program is running, but a friend can’t connect. From a virtual machine in the same neighborhood, it connects.

How to read it: all three scenarios start as "it just doesn’t work," but the suspected layer is different in each. That’s the power of the map.

3-6. Cementing with a Quiz — Find-the-Residents in Reverse

This time, backwards. I’ll call out a layer; you name at least two residents of each layer:

Physical: ?
Data Link: ?
Network: ?
Transport: ?
Session: ?
Presentation: ?
Application: ?

If there’s a layer for which you can’t name two, that layer is your gap. Just reread that cell. Example answers are in section 5.

Predict: you placed ARP in layer 2, but given that "it asks for an IP and receives a MAC," doesn’t it also seem like layer 3? In fact, many people say ARP straddles layers 2 and 3. When you meet such boundary cases, accepting that "there may be no single right answer" is also a skill in using the map.

4. Missions & Exercises

Mission — The Big Picture of 7 Horizontal Cells

Today’s finish is one picture:

Turn your notebook sideways and draw seven cells. From bottom to top, layer 1 Physical through layer 7 Application
Write the residents living in each cell (MAC, IP/routers, TCP/UDP/ports, DNS/HTTP/SSH…)
Draw one letter descending from layer 7 to layer 1, marking with arrows how the envelopes multiply (segment → packet → frame)
On the opposite side, draw the receiver and draw arrows peeling the envelopes from layer 1 to layer 7
Next to the picture, write this sentence: "Layers are division of labor, envelopes are encapsulation, and diagnosis is per-layer suspicion."

Exercises

Q1. Write the seven layers in order from the bottom, and name one representative resident of each layer.

Q2. What is encapsulation? Explain in order which envelopes the "search term" data puts on as it descends from layer 7 to layer 1.

Q3. How do the OSI 7 layers and the TCP/IP 4 layers correspond? If someone said "a layer-3 switch," which model is that based on, and what does that equipment do?

Q4. Scenario: on some computer, ping 8.8.8.8 works but no site opens in the browser. Which layer do you suspect, and with which command will you verify it?

5. Model Answers & Completion Criteria

Mission Model Answer

The text version of the completed picture:

Sending side                          Receiving side
┌─────────────┐                  ┌─────────────┐
│ 7 Application  HTTP, DNS, SSH  │ 7 Application   │
│ 6 Presentation encoding, crypto│ 6 Presentation  │
│ 5 Session  conversation start/end│ 5 Session     │
│ 4 Transport  TCP/UDP, ports    │ 4 Transport     │
│ 3 Network  IP, routers         │ 3 Network       │
│ 2 Data Link  MAC, switches     │ 2 Data Link     │
│ 1 Physical  cables, radio      │ 1 Physical      │
└─────────────┘                  └─────────────┘
 data ─▶ +port (segment) ─▶ +IP (packet) ─▶ +MAC (frame) ══▶ wire
                                                             │
 wire ══▶ -MAC (frame off) ─▶ -IP (packet off) ─▶ -port ─▶ data

How to verify: ① Are the seven cells in order, ② does each cell have at least one resident, ③ do envelopes multiply going down and peel off going up, with arrows in opposite directions? If all three check out, this one page becomes the coordinate axis for every protocol you’ll meet.

Answers to the 3-2 placement practice: 1 → layer 2, 2 → layer 3, 3 → layer 4, 4 → layer 4, 5 → layer 7, 6 → layer 7, 7 → layer 1, 8 → layer 3 (because it does routing work).

Commentary on the 3-5 scenarios: A — suspect layers 1–2: multiple devices died simultaneously, so it’s not the devices but the road itself. Start with the router’s power, cables, Wi-Fi signal. B — suspect layer 7 (DNS): since numeric addresses communicate, everything up to layer 3 is alive, and only the phone book resolving names is dead. Verify with nslookup. C — suspect layer 4 or the castle wall: the port is open, but the router’s exception door (port forwarding) is missing, or a firewall is blocking.

Example answers to the 3-6 reverse quiz: 1 Physical (LAN cables, Wi-Fi radio waves), 2 Data Link (MAC addresses, switches, ARP), 3 Network (IP addresses, routers, ICMP), 4 Transport (TCP, UDP, ports), 5 Session (initiation, maintenance, termination of conversations), 6 Presentation (encoding, compression, encryption), 7 Application (HTTP, DNS, SSH).

Exercise Solutions

Q1 solution. 1 Physical (cables), 2 Data Link (MAC), 3 Network (IP), 4 Transport (TCP/ports), 5 Session (conversation management), 6 Presentation (encryption), 7 Application (HTTP/DNS). First-syllable chant: 물-데-네-전-세-표-응.

Q2 solution. Encapsulation is the wrapping of one more envelope — marked with that layer’s information — each time data descends a layer. On layer-7 data, layer 4 wraps the port-number envelope (segment), layer 3 the IP-address envelope (packet), layer 2 the MAC-address envelope (frame). The receiver peels them off in reverse as it climbs.

Q3 solution. The correspondence: OSI 1–2 = Network Access layer, 3 = Internet layer, 4 = Transport layer, 5–7 = Application layer. "Layer-3 switch" is an OSI-based expression, meaning equipment that can read layer 3 (IP) — that is, a switch with routing functionality.

Q4 solution. Suspect layer 7 (DNS). ping working to a numeric address (8.8.8.8) means everything through layer 3 is alive, and failing by name most likely means a problem with name→address conversion — DNS. Verify whether the name resolves with nslookup domainname (Step 33).

Completion Criteria Checklist

[ ] I can recite the seven layers in order (Physical–Data Link–Network–Transport–Session–Presentation–Application)
[ ] I can name at least one representative resident of each layer
[ ] I can explain encapsulation (envelope wrapping) with a picture
[ ] I can say which layer’s envelope segment/packet/frame each is
[ ] I can state the correspondence between OSI and the TCP/IP 4 layers
[ ] I can pose three questions that split a failure by "which layer’s problem is it?"
[ ] Mission: I completed the big picture of 7 horizontal cells

6. Common Pitfalls & Fixes

Wall 1. I memorized the seven layer names but don’t see the use

Symptom: you memorized the chant but think "so what?"
Cause: you learned the classification table as an end in itself. This table’s real use is conversation and diagnosis.
Fix: from today, whenever you meet something that "doesn’t work," ask which layer’s problem it is. "Does ping work? (layer 3) Is the port open? (layer 4) Does the name resolve? (layer 7 DNS)" The moment this question habit attaches, the classification table becomes a tool.

Wall 2. Layer 5 (Session) and layer 6 (Presentation) don’t click

Symptom: layers 1–4 and 7 make sense, but the middle two feel vague.
Cause: normal. In the modern internet, these two layers’ work has often moved inside layer 7, so real-world examples are scarce.
Fix: grasp the concepts and move on. Layer 5 is "in charge of initiating, maintaining, and terminating conversations"; layer 6 is "in charge of translating representation (encoding, encryption)." It shows up on exams, and the practical feel gets filled in later.

Wall 3. OSI and TCP/IP get confused

Symptom: some books say 7 layers, others say 4, which is confusing.
Cause: both are right. The map of theory (OSI) and the map of actual implementation (TCP/IP) simply differ.
Fix: remember one line of the correspondence table. "OSI 1–2 = access, 3 = internet, 4 = transport, 5–7 = application." When someone says "layer-3 switch," just understand it’s OSI-based.

Wall 4. Trying to force every protocol into exactly one layer

Symptom: you try to nail things down, like "SSH is unconditionally layer 7?"
Cause: real protocols often do the work of several layers. For example, TLS (encryption) looks like layer-6 work, but in practice it’s seen somewhere above layer 4 and below layer 7.
Fix: layers are not law but classification convenience. Think in terms of "which layer is its main job?" and if you can say of a boundary-straddling thing that it straddles, that’s knowing it properly.

7. Summary

Today’s Concepts

Concept	One-line description
OSI 7 layers	Physical, Data Link, Network, Transport, Session, Presentation, Application — the division-of-labor map of communication
Encapsulation	Envelopes are wrapped as you descend, and the receiver peels them off in reverse
Segment / packet / frame	The names of the layer-4 / layer-3 / layer-2 envelopes
TCP/IP 4 layers	The compressed edition for practice — access, internet, transport, application
Per-layer suspicion	The diagnostic order that splits failures and attacks by "which layer’s problem is it?"

Today’s Commands (Review Map)

Command	Layer	What it looks at
`ping`	Layer 3	Survival report (ICMP)
`tracert`	Layer 3	Route tracing
`ipconfig`	Layer 3	My IP, gateway
`arp -a`	Layer 2	Neighbors’ MACs
`Test-NetConnection -Port`	Layer 4	TCP handshake test
`nslookup`	Layer 7	Name ↔ address (DNS)

The Instinct That Matters More Than Commands

At last, the map is complete. The nine scattered words have gained coordinates called layers, and from now on, whenever you meet a new protocol, you’ll naturally ask, "Which layer does this fellow live on?" The moment that question comes out, you’ve graduated from the networking fundamentals course.

Remember two more things. First, attacks are classified by layer too. ARP spoofing is a layer-2 incident, IP spoofing layer 3, SYN floods layer 4, phishing mail layer 7. Know which layer an attack is, and the defensive tools are determined per layer as well. Second, OSI was originally an international standard saying "build it this way," but TCP/IP conquered the world first, and what survived is not the specification but the frame of thought called the seven layers. The product failed, yet its blueprint became an immortal masterpiece. And one honest piece of advice — it’s fine if you forget the layer names in a month. But never forget these two sentences: "communication divides into layers, and problems are suspected layer by layer." Name tags fly away; ways of thinking remain.

Once every box is checked, Step 39 is complete.