The seven layers of OSI

The reference model everyone quotes

The OSI model (Open Systems Interconnection) is a seven layer reference model published by the ISO in 1984. Almost no software implements it literally. Everyone still uses its vocabulary, because saying "that is a layer 3 problem" is faster than describing the problem.

Each layer has a PDU, a protocol data unit, which is just the name for one chunk of data at that layer. Learn the table, then read the walkthrough.

Two habits help. Count upward when you troubleshoot, because a broken layer 1 makes every layer above it look broken. Count downward when you follow data being sent, because that is the order the headers get added.

Layers 1 to 4, the ones that carry data

Layer 1, physical. Turns a 1 or a 0 into something a medium can carry, a voltage on copper, a light pulse on fiber, a modulated radio wave on Wi-Fi. It also covers connectors, pinouts, and cable lengths. It has no addresses and no idea what a byte means. A crushed cable, a wrong optic, or a dead port is a layer 1 fault, and it is the first thing to check.

Layer 2, data link. Groups bits into frames and delivers them between interfaces on one link. Its address is the MAC address, burned into the NIC. Layer 2 can also detect corrupted frames with a checksum and control who transmits when. Its scope is strictly local, one hop. It has no idea the internet exists.

Layer 3, network. Delivers packets between hosts on different networks. Its address is the IP address, and its job is choosing the next hop, which is what routing means. Layer 3 promises nothing about order or delivery, it only tries. That single design decision, called best effort, is why the internet scales.

Layer 4, transport. Delivers to the right program on the host, using a port number, and optionally adds reliability. TCP numbers every byte, retransmits losses, and puts data back in order. UDP does none of that and just sends. Layer 4 is where "the network is unreliable" becomes "my socket read returned the right bytes in the right order".

Layers 5 to 7, the ones that carry meaning

Layer 5, session. Manages the lifetime of a conversation, including opening, checkpointing, and closing it. Modern stacks mostly fold this into layer 4 or into the application, which is why it feels like the vaguest layer. Its clearest survivors are remote procedure call frameworks and the resumable upload.

Layer 6, presentation. Converts between the application's idea of data and the bytes on the wire, which covers character encoding, compression, and encryption. In practice TLS sits here in the model, even though it is implemented as a library the application calls.

Layer 7, application. The protocol that means something to a person or a program. HTTP for pages and APIs, SMTP for mail, DNS for names, SSH for shells. When a page loads but shows an error, layers 1 to 6 worked and layer 7 said no.

A mnemonic for the order, bottom to top: Please Do Not Throw Sausage Pizza Away, for Physical, Data link, Network, Transport, Session, Presentation, Application.

Using the model instead of reciting it

The model earns its keep as a checklist. Something is broken, so walk up:

1. Layer 1: does the interface show a carrier? ip link says UP or DOWN.
2. Layer 2: can you reach anything on the local link? Check the ARP table.
3. Layer 3: does a route exist, and does ping of the gateway answer?
4. Layer 4: is the port open, and does a TCP connection complete?
5. Layer 7: does the application answer correctly on that port?

Lesson 9-4 turns this into a full diagnostic ladder with commands. For now, notice that the layers give you an order, and the order stops you guessing.

One honest caveat. Real protocols do not respect the boundaries. TLS spans layers 5 and 6 and is called layer 7 by most load balancers. QUIC puts reliability and encryption together on top of UDP, so it is layer 4 and 6 at once. VPNs put IP inside IP, so layer 3 rides on layer 3. Treat the seven layers as a shared language, not a law.