The Open Systems Interconnection (OSI) model, standardised by ISO in 1984, splits the job of moving data between two applications into seven stacked layers. Each layer provides a service to the layer above it and consumes a service from the layer below it, communicating logically with its peer layer on the remote system. No real protocol suite implements OSI exactly — TCP/IP won that war — but the model survives because it gives engineers a precise, vendor-neutral vocabulary for where in the stack a function, or a fault, lives.
From the bottom up, the layers are: Physical (1), Data Link (2), Network (3), Transport (4), Session (5), Presentation (6) and Application (7). The classic mnemonic runs bottom-up: Please Do Not Throw Sausage Pizza Away.
Layers 1–2: getting bits onto the wire
The Physical layer defines the electrical, optical and radio characteristics of the medium — voltages, connector pinouts, fibre wavelengths, encoding schemes and bit timing. Its unit of data is the bit. Cables, transceivers, repeaters and hubs live here; so do most 'network down' tickets that end with a reseated SFP.
The Data Link layer moves frames between directly connected devices and is where MAC addressing lives. Ethernet dominates this layer today. It is split into two sublayers: MAC (media access, addressing) and LLC (multiplexing to the network layer). Switches make forwarding decisions here by learning source MAC addresses, and the layer also handles error detection through the frame check sequence — a CRC computed over the frame.
Layers 3–4: addressing and end-to-end delivery
The Network layer provides logical addressing and path selection between networks — this is where IP, and therefore routing, lives. Routers strip the layer-2 frame, examine the destination IP address in the packet, consult a routing table and forward the packet out of a new interface inside a fresh frame. ICMP, OSPF, EIGRP and BGP are all layer-3 residents.
The Transport layer delivers data end-to-end between processes, identified by port numbers. TCP provides connection-oriented, reliable, ordered delivery with flow control through windowing; UDP provides connectionless, best-effort delivery with far less overhead — the right choice for DNS queries, voice and video where retransmitting a late packet is pointless.
Layers 5–7: the application side
The upper three layers are where the host's software stack takes over. The Session layer establishes, maintains and tears down dialogues between applications. The Presentation layer handles data formats — character encoding, compression and encryption (TLS is usually described here). The Application layer is the protocol the user's software actually speaks: HTTP, SMTP, DNS, SSH, SNMP. In the TCP/IP model these three collapse into a single Application layer, which is why real packet captures show HTTP riding directly on TCP.
Why the model still matters
- Troubleshooting discipline: work layer by layer — check the cable and interface counters (L1), the MAC table and VLAN (L2), IP addressing and routing (L3), then ports and firewalls (L4) before blaming the application.
- Precise communication: 'it's a layer-2 loop' or 'that's blocked at layer 4' conveys an exact diagnosis to any engineer worldwide.
- Device classification: hubs operate at L1, switches at L2, routers at L3, load balancers and firewalls at L4–L7.
- Design separation: you can swap the physical medium (copper to fibre) or the routing protocol without touching the layers above.
Master the model until placing any protocol, device or failure on the correct layer is reflexive. Every topic that follows in this library — switching at layer 2, routing protocols at layer 3, ACLs at layers 3–4 — assumes this map is second nature.