The OSI and TCP/IP models

The sticky note on Jordan's monitor says 'which layer?', but in the first week Jordan admits to Dev that the layers themselves are still a blur. Dev pulls a chair over, takes a marker and draws seven stacked boxes on the whiteboard beside the service desk. He says that every network technician in the world uses this drawing as a shared language. When a colleague says a problem is 'a layer 1 issue', everyone knows to check cables, connectors and power. When a provider says 'layer 3 is fine', everyone knows routing and IP addressing have been checked. The models are not rules that networks obey; they are maps that help people talk about networks and find faults.

This lesson covers the two models the CCST Networking exam uses: the seven-layer OSI reference model and the four-layer TCP/IP model. It explains what each layer does, which protocols and devices belong where, how data is wrapped and unwrapped as it moves through the layers, and how technicians use the layers to troubleshoot.

Why networks are described in layers

Sending a web page from a server in another country to a phone on a café's Wi-Fi involves dozens of separate jobs. The page has to be formatted, the connection has to be reliable, the data has to be addressed to the right device, it has to find a path across many networks, it has to be turned into electrical signals, light or radio waves, and it has to be checked for errors at every step. Layering divides these jobs so that each layer only has to do its own work and trust the layers above and below it to do theirs.

Layering has practical benefits. A web browser does not care whether the phone is on Wi-Fi or a cellular network, because the lower layers hide that detail. A cable manufacturer can make better copper or fibre without changing the applications that run over it. A technician can test one layer at a time: if a laptop has a valid IP address and can reach its gateway, the cable and the switch are almost certainly fine, and the search can move up. Layering also lets different vendors' equipment work together, because each layer's job is defined by open standards.

The OSI reference model

The Open Systems Interconnection model was published by the International Organization for Standardization in the 1980s. It divides communication into seven layers, numbered from the bottom. Layer 1, the physical layer, carries raw bits as signals over a medium: voltages on copper, pulses of light in fibre, or radio waves. Layer 2, the data link layer, moves frames between devices on the same local network, using hardware addresses such as Ethernet MAC addresses, and detects errors in each frame. Layer 3, the network layer, moves packets between networks, using logical addresses such as IP addresses, and chooses paths through routers. Layer 4, the transport layer, delivers data between applications on two hosts, using port numbers, and can provide reliability, ordering and flow control.

The upper three layers deal with the application's data. Layer 5, the session layer, sets up, manages and ends conversations between applications. Layer 6, the presentation layer, handles formatting, character encoding, compression and encryption, so that data sent by one system can be understood by another. Layer 7, the application layer, is where network services meet the programs people use: web browsing, email, file transfer and name lookups. In practice, many modern protocols combine the work of layers 5, 6 and 7, which is one reason the simpler TCP/IP model is used to describe real networks.

Technicians remember the layers with a phrase. From layer 1 upward, 'Please Do Not Throw Sausage Pizza Away' gives physical, data link, network, transport, session, presentation and application. From layer 7 downward, 'All People Seem To Need Data Processing' works the other way. Pick one and practise it until you can write the seven layers in order without thinking.

The TCP/IP model

The protocols that run the internet were developed in the 1970s and 1980s alongside, and partly before, the OSI model. They are described by a simpler model, usually called the TCP/IP model or internet model. In its common four-layer form it has a link layer at the bottom, also called the network access layer, which covers what OSI calls the physical and data link layers. Above it is the internet layer, matching OSI layer 3, where IP lives. Above that is the transport layer, where TCP and UDP live. At the top is the application layer, which covers the work of OSI layers 5, 6 and 7.

Some textbooks and Cisco materials show a five-layer version that splits the link layer into separate physical and data link layers. Both versions describe the same protocols; the five-layer version simply lines up more neatly with OSI layers 1 to 4. On the exam, read each question carefully to see which model it is asking about. A question that asks which TCP/IP layer IP belongs to wants 'internet', while the same question about OSI wants 'network' or 'layer 3'.

Where devices sit

Devices are often described by the highest layer they work at. A hub, now mostly obsolete, is a layer 1 device: it repeats every signal it receives out of every other port, without reading any addresses. A switch is a layer 2 device: it reads the destination MAC address in each frame and forwards the frame only out of the port where that address lives. A router is a layer 3 device: it reads the destination IP address in each packet and forwards it towards the right network. Many modern switches can also route, and these are called layer 3 switches or multilayer switches.

Other devices work higher up. A traditional firewall filters traffic using layer 3 and layer 4 information, such as addresses and port numbers. A next-generation firewall also inspects application data at layer 7. A wireless access point bridges between the radio network and the wired Ethernet network, working mainly at layers 1 and 2. A computer or phone, which runs applications, works at every layer. Lesson 9 looks at these devices in more detail.

Encapsulation: wrapping data on the way down

When an application sends data, each layer adds its own information before passing the data down. This is called encapsulation. Suppose Jordan's browser requests a web page. The application layer creates an HTTP request. The transport layer adds a TCP header with the source and destination port numbers, a sequence number and other control information, making a segment. The network layer adds an IP header with the source and destination IP addresses, making a packet. The data link layer adds an Ethernet header with the source and destination MAC addresses, and a trailer with an error check, making a frame. The physical layer turns the frame into signals on the cable.

On the receiving side, each layer reads and removes its own header and passes the rest upward. This is called de-encapsulation. The receiving network card checks the frame for errors and confirms that it is addressed to this device, the IP layer checks that the packet is for this host, the TCP layer puts the segments back in order and passes the data to the right application by port number, and the web server reads the HTTP request. Routers along the way de-encapsulate only as far as layer 3: they remove the Ethernet frame, read the IP header, choose the next hop, and then wrap the packet in a new frame for the next link.

The names for the data at each stage are called protocol data units, or PDUs. The exam expects you to know them: bits at layer 1, frames at layer 2, packets at layer 3, and segments at layer 4 for TCP. UDP's unit is usually called a datagram. Above layer 4, the PDU is simply called data.

Using the layers to troubleshoot

The layers give technicians an order in which to test. The bottom-up approach starts at layer 1 and works upward: Is the device powered and the link light on? Does the network adapter show a connection? Does the device have a valid IP address and gateway? Can it ping the gateway? Can it resolve names? Can the application connect? Each answer either finds the fault or rules out a layer. Bottom-up is thorough and is a good default for new technicians, because physical problems are common and quick to check.

Two other approaches are useful. Top-down starts at the application and works down, which suits problems where only one program fails. Divide and conquer starts in the middle, usually with a ping test at layer 3: if a ping to a remote server works, layers 1 to 3 are fine and the problem is higher up; if it fails, the problem is at layer 3 or below. Experienced technicians often begin with divide and conquer because it halves the search immediately. CSCO-112 covers troubleshooting methods in detail; for now, the goal is to connect each symptom with the layer it points to.

Jordan copies the whiteboard drawing into the notebook and adds a column for 'what I would check'. Dev says the habit will pay off for years. In the next lesson they look closely at layer 2, where Ethernet frames and MAC addresses do the local work of every wired network.