Step 39. The OSI 7 Layers — A Map for Placing Nine Pieces

Level 0 — Getting Comfortable with Computers | Difficulty ★★☆☆☆ | Estimated time: 2.5 hours

Prerequisites: Steps 31–38 complete; you know IP, MAC, DNS, ports, TCP/UDP, routing, and NAT individually.

• What you need: a notebook and a pen — that’s all. Today is a day of pictures, with almost no commands.
• Caution: this section’s practice is read-only in the stated lab — it all happens on paper. But since this picture becomes the map for the entire book, don’t just skim past it.

So far we’ve learned the pieces of networking one at a time. IP is the address, MAC is neighborhood delivery, DNS is the phone book, ports are room numbers, TCP is the polite telephone, UDP is the throwing delivery, ICMP is the status report, routers are signposts, NAT is the disguise. Nine pieces. But how do these pieces relate to one another? With nine pieces, you need a map. The OSI 7-layer model we learn today is exactly that map — the world’s most famous classification table, dividing everything that happens in a network into seven layers.

1. Learning Objectives

By the end of this unit, you will be able to:

• Recite the OSI 7 layers in order and describe each layer’s role in one line
• Place the pieces learned so far (IP, MAC, ports, TCP, DNS…) into their home layers among the seven
• Explain encapsulation (envelope wrapping) with a picture
• State the correspondence between the OSI 7 layers and the TCP/IP 4 layers
• Sort failures and attacks by the question “which layer’s incident is this?”

2. Background Knowledge — Today’s Tools and Concepts

This section’s Tools at a Glance

2-1. Why Divide into Layers — So Each Does Only Its Own Job

Think of a parcel delivery company. The sender only packs goods into the box, the address writer only writes the address, and the driver only drives. As long as each knows their own job, the company runs. The driver doesn’t need to know what’s inside the box, and the sender doesn’t need to memorize the highway map.

Networks are the same. The giant task called “communication” is divided into layers by role, and each layer does only its own job and delegates to the layer below. Thanks to this, each layer can evolve independently. Even if the cable changes from phone line to fiber broadband (a layer-1 replacement), the web browser (layer 7) doesn’t need to change.

2-2. The Roster of Seven Layers — Ph-Da-Ne-Tr-Se-Pr-Ap

Climbing from the bottom layer up:

1. Physical: wires, electrical signals, light. The road where 0s and 1s actually flow.
2. Data Link: delivery inside the same neighborhood. MAC addresses live here.
3. Network: delivery between neighborhoods. IP addresses and routers live here.
4. Transport: in charge of delivery quality. TCP (polite certified mail) and UDP (fast regular mail), plus port numbers, live here.
5. Session: the start and end of conversations, conversation management. The agreement of “conversation starts now, ends now.”
6. Presentation: the way data is expressed. In charge of “translation” like character encoding, compression, encryption.
7. Application: the protocols of the programs we actually use. HTTP (web), DNS (phone book), SSH (remote access) live here.

One English mnemonic is “Please Do Not Throw Sausage Pizza Away”: Physical, Data Link, Network, Transport, Session, Presentation, Application. Understanding each role matters more than memorizing the phrase.

2-3. Encapsulation — Russian-Doll Packaging

Each time a letter descends from an upper layer to a lower one, one more outer envelope is wrapped around it:

• On the data made at layer 7 (e.g., “search term: cats”),
• layer 4 wraps an envelope with the port number (segment),
• layer 3 wraps a bigger envelope with the IP address (packet),
• layer 2 wraps the outermost envelope with the MAC address (frame).

This is called encapsulation. On the receiving side, it’s the reverse: the envelopes are peeled off one by one from layer 2 upward. The addresses you learned in Steps 31–38 were in fact written on different envelopes — MAC on the outermost envelope, IP on the one inside it, the port on the one deeper still.

2-4. The TCP/IP 4 Layers — The Compressed Edition for Practice

The real internet runs on the TCP/IP 4-layer model, simpler than the OSI 7 layers:

• OSI layers 1–2 → Network Access layer (MAC, cables)
• OSI layer 3 → Internet layer (IP)
• OSI layer 4 → Transport layer (TCP/UDP, ports)
• OSI layers 5–7 → Application layer (HTTP, DNS, etc.)

In other words, OSI’s layers 5, 6, and 7 are often lumped together in practice as the “application layer.” That’s why people say “7 layers for culture, 4 layers for work.” Know both, and the trick is knowing how they correspond to each other.

3. Follow Along

Before you begin. OSI is a reasoning model, not a complete implementation diagram. A successful ping to one address does not validate every lower-layer path. DNS success, TCP success, TLS success, and an application response are separate observations.

3-1. Learning the Incantation — Writing the Seven Layers

In your notebook, write the seven layers from bottom to top, five times. Writing by hand matters:

1 Physical      - wires and signals
2 Data Link     - delivery inside the neighborhood (MAC)
3 Network       - delivery between neighborhoods (IP, routers)
4 Transport     - quality in charge (TCP/UDP, ports)
5 Session       - start and end of conversations
6 Presentation  - translation (encoding, compression, encryption)
7 Application   - program protocols (HTTP, DNS, SSH)

How to read it: as you write, notice that each layer already holds words you know. MAC, IP, TCP, ports, DNS. What you learn today is not new words but a room assignment chart for words you already know.

3-2. Placement Practice — Laying the Pieces on the Layers

Write the list below in your notebook, and next to each, write which layer it lives on. Check the answers in Section 5:

1. MAC address
2. IP address
3. TCP
4. Port number
5. DNS
6. HTTP
7. LAN cable
8. Home router (NAT/routing)

Predict: can you make one more problem yourself? Something like “which layer does the Wi-Fi radio wave belong to?” Predict and state your reason. (Hint: a radio wave is ultimately a signal too.)

3-3. Writing a Travel Diary — The Per-Layer Record of One Search

Write a travelogue, layer by layer, of “the moment you type example.com into the browser address bar and press Enter.” It’s a synthesis of everything so far:

1. Layer 7: the browser makes a DNS question — “tell me example.com’s address.”
2. Layer 4: it wraps that question in a UDP envelope, destination port 53.
3. Layer 3: it wraps an envelope marked with the DNS server’s IP address.
4. Layer 2: it wraps the outer envelope marked with the MAC address of the router, a same-neighborhood neighbor.
5. Layer 1: electrical signals flow over the cable (or radio waves).
6. The router (NAT) swaps the sender (Step 38), and routers hand it along like signposts (Step 37).
7. When the answer returns, layer 7 this time builds an HTTP request, and layer 4 starts with a handshake to TCP port 80 (Step 35).

How to read it: if you can write this diary without stumbling, Steps 31–39 are all yours — every single line is content from a past chapter.

3-4. A Command Map by Layer — Hanging the Learned Commands on Layers

Let’s hang the commands learned so far by layer. Draw it as a table in your notebook:

Use the table to choose the next observation. ICMP, TCP, DNS, TLS, and application requests test different things. A successful ping and failed TCP connection narrow the questions but do not uniquely establish a firewall or service fault.

3-5. Per-Layer Suspicion Training — Three Failure Scenarios

Let’s put the learned map to use right away. Read each scenario and write in your notebook “which layer to suspect first.” The commentary is in Section 5:

Scenario A: the Wi-Fi icon shows an X. No site opens. Even the phone in the same house has no internet.

Scenario B: ping 8.8.8.8 works, but nothing opens by site name.

Scenario C: my server program is running, but a friend can’t connect. From a virtual machine in the same neighborhood, it connects.

How to read it: all three scenarios start as “it just doesn’t work,” but the suspected layer is different in each. That’s the power of the map.

3-6. Cementing with a Quiz — Find-the-Residents in Reverse

This time, backwards. I’ll call out a layer; you name at least two residents of each layer:

1. Physical: ?
2. Data Link: ?
3. Network: ?
4. Transport: ?
5. Session: ?
6. Presentation: ?
7. Application: ?

If there’s a layer for which you can’t name two, that layer is your gap. Just reread that cell. Example answers are in Section 5.

Predict: you placed ARP in layer 2, but given that “it asks for an IP and receives a MAC,” doesn’t it also seem like layer 3? In fact, many people say ARP straddles layers 2 and 3. When you meet such boundary cases, accepting that “there may be no single right answer” is also a skill in using the map.

4. Missions & Exercises

Mission — The Big Picture of 7 Horizontal Cells

This section’s finish is one picture:

1. Turn your notebook sideways and draw seven cells. From bottom to top, layer 1 Physical through layer 7 Application
2. Write the residents living in each cell (MAC, IP/routers, TCP/UDP/ports, DNS/HTTP/SSH…)
3. Draw one letter descending from layer 7 to layer 1, marking with arrows how the envelopes multiply (segment → packet → frame)
4. On the opposite side, draw the receiver and draw arrows peeling the envelopes from layer 1 to layer 7
5. Next to the picture, write this sentence: “Layers are division of labor, envelopes are encapsulation, and diagnosis is per-layer suspicion.”

Exercises

Q1. Write the seven layers in order from the bottom, and name one representative resident of each layer.

Q2. What is encapsulation? Explain in order which envelopes the “search term” data puts on as it descends from layer 7 to layer 1.

Q3. How do the OSI 7 layers and the TCP/IP 4 layers correspond? If someone said “a layer-3 switch,” which model is that based on, and what does that equipment do?

Q4. Scenario: on some computer, ping 8.8.8.8 works but no site opens in the browser. Which layer do you suspect, and with which command will you verify it?

Sending side                                               Receiving side
┌───────────────────────────────────────┐                  ┌────────────────┐
│ 7 Application  HTTP, DNS, SSH         │                  │ 7 Application  │
│ 6 Presentation encoding, crypto       │                  │ 6 Presentation │
│ 5 Session      conversation start/end │                  │ 5 Session      │
│ 4 Transport    TCP/UDP, ports         │                  │ 4 Transport    │
│ 3 Network      IP, routers            │                  │ 3 Network      │
│ 2 Data Link    MAC, switches          │                  │ 2 Data Link    │
│ 1 Physical     cables, radio          │                  │ 1 Physical     │
└───────────────────────────────────────┘                  └────────────────┘
 data ─▶ +port (segment) ─▶ +IP (packet) ─▶ +MAC (frame) ══▶ wire
                                                             │
 wire ══▶ -MAC (frame off) ─▶ -IP (packet off) ─▶ -port ─▶ data

6. Common Pitfalls & Fixes

Wall 1. I memorized the seven layer names but don’t see the use

Symptom: you memorized the chant but think “so what?”
Cause: you learned the classification table as an end in itself. This table’s real use is conversation and diagnosis.
Fix: from today, whenever you meet something that “doesn’t work,” ask which layer’s problem it is. “Does ping work? (layer 3) Is the port open? (layer 4) Does the name resolve? (layer 7 DNS)” The moment this question habit attaches, the classification table becomes a tool.

Wall 2. Layer 5 (Session) and layer 6 (Presentation) don’t click

Symptom: layers 1–4 and 7 make sense, but the middle two feel vague.
Cause: normal. In the modern internet, these two layers’ work has often moved inside layer 7, so real-world examples are scarce.
Fix: grasp the concepts and move on. Layer 5 is “in charge of initiating, maintaining, and terminating conversations”; layer 6 is “in charge of translating representation (encoding, encryption).” It shows up on exams, and the practical feel gets filled in later.

Wall 3. OSI and TCP/IP get confused

Symptom: some books say 7 layers, others say 4, which is confusing.
Cause: both are right. The map of theory (OSI) and the map of actual implementation (TCP/IP) simply differ.
Fix: remember one line of the correspondence table. “OSI 1–2 = access, 3 = internet, 4 = transport, 5–7 = application.” When someone says “layer-3 switch,” just understand it’s OSI-based.

Wall 4. Trying to force every protocol into exactly one layer

Symptom: you try to nail things down, like “SSH is unconditionally layer 7?”
Cause: real protocols often do the work of several layers. For example, TLS (encryption) looks like layer-6 work, but in practice it’s seen somewhere above layer 4 and below layer 7.
Fix: layers are not law but classification convenience. Think in terms of “which layer is its main job?” and if you can say of a boundary-straddling thing that it straddles, that’s knowing it properly.

7. Summary

This section’s Concepts

This section’s Commands (Review Map)

The Instinct That Matters More Than Commands

At last, the map is complete. The nine scattered words have gained coordinates called layers, and from now on, whenever you meet a new protocol, you’ll naturally ask, “Which layer does this fellow live on?” The moment that question comes out, you’ve graduated from the networking fundamentals course.

Layers help organize diagnostic questions. A real failure or attack can involve several layers, so a layer name alone does not establish its cause or determine a complete defense. The mapping between OSI and TCP/IP is a functional approximation. For each new protocol, identify the information it handles and the protocols it uses.

Once every box is checked, Step 39 is complete.