Computer Networking Cheatsheet
Models and Layers
Use this Computer Networking reference while you build software engineering projects, review code, or refresh the syntax you reach for most.
OSI seven layers
The reference model everyone quotes in interviews. Data moves down the stack on send (each layer adds a header) and up on receive.
| # | Layer | Unit | Job | Real examples |
|---|---|---|---|---|
| 7 | Application | data | What the app means | HTTP, DNS, SMTP, SSH, FTP |
| 6 | Presentation | data | Encoding, encryption | TLS, JPEG, UTF-8, ASN.1 |
| 5 | Session | data | Dialog, sync | RPC, NetBIOS, SOCKS |
| 4 | Transport | segment · datagram | End-to-end delivery, ports | TCP, UDP, QUIC, SCTP |
| 3 | Network | packet | Logical addressing, routing | IP, ICMP, IPsec, OSPF, BGP |
| 2 | Data link | frame | Local delivery on one link | Ethernet, 802.11, ARP, VLAN, PPP |
| 1 | Physical | bit · symbol | Signals on the medium | copper, fiber, radio, RJ45, SFP |
Mnemonic top down: All People Seem To Need Data Processing.
TCP/IP four layers
The model the internet actually implements. OSI 5-6-7 collapse into one application layer, and 1-2 collapse into link.
| TCP/IP layer | OSI equivalent | Address it uses | Devices that act here |
|---|---|---|---|
| Application | 5, 6, 7 | URL, hostname | clients, servers, proxies |
| Transport | 4 | port number (0-65535) | load balancers (L4), NAT |
| Internet | 3 | IP address | routers, L3 switches |
| Link | 1, 2 | MAC address | switches, bridges, NICs, hubs |
Encapsulation on the wire
A single HTTP GET leaving your laptop over Ethernet, outermost header first.
+--------------+-----------+------------+---------------------+-----+ | Ethernet hdr | IPv4 hdr | TCP hdr | HTTP request bytes | FCS | | 14 bytes | 20+ bytes | 20+ bytes | payload | 4 | +--------------+-----------+------------+---------------------+-----+ dst/src MAC dst/src IP dst/src port EtherType proto=6 seq/ack, flags
Overhead math that matters: a 1500-byte MTU minus 20 (IPv4) minus 20 (TCP) leaves an MSS of 1460. With IPv6 (40-byte header) it is 1440. Add a VPN or tunnel header and the payload shrinks again, which is why tunnels need MSS clamping.
What each layer means when something breaks
Diagnose bottom up. The layer that fails tells you which tool to reach for.
| Symptom | Failing layer | Prove it with |
|---|---|---|
| No link light, NIC shows DOWN | 1 physical | ip link show |
| ARP resolves nothing on the LAN | 2 link | ip neigh, arping |
| Ping the gateway fails | 3 network | ping, ip route |
| Ping works, port refused | 4 transport | ss -lntp, nc -vz |
| Port open, request hangs or 500s | 7 application | curl -v, server logs |
| Works by IP, fails by name | 7 (DNS) | dig, resolvectl status |
MTU, fragmentation, and PMTUD
MTU is the largest frame payload a link will carry. Ethernet defaults to 1500 bytes, jumbo frames go to 9000.
- IPv4 routers may fragment a packet unless the DF (Don't Fragment) bit is set. IPv6 routers never fragment, only the sender may. - Path MTU Discovery sends DF packets and expects ICMP type 3 code 4 (fragmentation needed) back with the smaller MTU. Firewalls that blackhole all ICMP break PMTUD, and the classic symptom is that small requests succeed while large POSTs or TLS handshakes hang forever. - Test the real path MTU by shrinking payload until it stops dropping. On Linux the size is payload only, so add 28 bytes of IP plus ICMP header.
ping -M do -s 1472 8.8.8.8 # 1472 + 28 = 1500, largest on stock Ethernet ping -M do -s 1473 8.8.8.8 # expect "Frag needed and DF set" tracepath 8.8.8.8 # per-hop MTU discovery ip link set dev eth0 mtu 1400 # clamp for a tunnel
Unicast, broadcast, multicast, anycast
| Mode | Recipients | IPv4 form | Typical use |
|---|---|---|---|
| Unicast | exactly one | any host address | normal traffic |
| Broadcast | every host on the link | 255.255.255.255, x.y.z.255 | DHCP discover, ARP |
| Multicast | a subscribed group | 224.0.0.0/4 | OSPF 224.0.0.5, mDNS 224.0.0.251 |
| Anycast | nearest of many | same prefix advertised from many sites | 8.8.8.8, root DNS, CDNs |
IPv6 drops broadcast entirely and replaces it with multicast scopes, for example
ff02::1 for all nodes on the link and ff02::2 for all routers.