Skip to content
Study Hall
Lesson 2 of 4Networking
Unit 3 · Lesson 2 of 4

The OSI and TCP/IP Models

The layered models that let a browser written by one company talk to a server written by another, over hardware from a third.

4 min read9 practice questionsAsk AI about this →

Key things to remember

  1. 1OSI layers 1–7: Physical, Data link, Network, Transport, Session, Presentation, Application.
  2. 2Encapsulation unit names: data → segment → packet → frame → bits.
  3. 3IP addresses stay the same end to end; MAC addresses are rewritten at every hop.
  4. 4Switch = layer 2 (MAC). Router = layer 3 (IP).
  5. 5TCP is connection-oriented, acknowledged, ordered and retransmitted; UDP is none of those and therefore faster.
  6. 6An IP address identifies a machine; a port number identifies a program on it.
  7. 7Ports to know: 22 SSH, 25 SMTP, 53 DNS, 80 HTTP, 443 HTTPS.

Networking works because nobody tries to solve the whole problem at once. Instead the job is cut into layers, each with one responsibility, each talking only to the layer above and below. The layer that puts bits on a wire does not know or care whether those bits are an email or a video call. The layer sending the email does not know or care whether the wire is copper, fibre or radio. That separation is why you can change your Wi-Fi to Ethernet mid-download and the download continues.

Please Do Not Throw Sausage Pizza Away — layer 1 up to layer 7.7ApplicationHTTP, DNS, SMTP — what the user's program speaks6Presentationencoding, encryption, compression5Sessionopening, keeping and closing conversations4TransportTCP/UDP — ports, reliability, segments3NetworkIP — logical addresses and routing, packets2Data linkMAC addresses, switching, frames1Physicalcable, radio, voltages, bits on the wireA switch works at layer 2, a router at layer 3, a firewall usually at 3–4, and a web proxy at 7.
Fig 1Seven layers, each with exactly one job.

The seven OSI layers

#LayerResponsibilityExamples
7ApplicationThe protocol the user's program speaksHTTP, DNS, SMTP, FTP
6PresentationEncoding, encryption, compressionTLS, JPEG, ASCII/UTF-8
5SessionOpening, maintaining and closing conversationsSession cookies, RPC
4TransportEnd-to-end delivery, ports, reliabilityTCP, UDP
3NetworkLogical addressing and routing between networksIP, ICMP, routers
2Data linkPhysical addressing within one linkEthernet, MAC, switches
1PhysicalBits as voltages, light or radioCables, connectors, radio
Mnemonic
Bottom to top: Please Do Not Throw Sausage Pizza Away — Physical, Data link, Network, Transport, Session, Presentation, Application.

Encapsulation

Data travelling down the stack gets wrapped by each layer in turn, like putting a letter in an envelope, the envelope in a courier bag, and the bag in a truck. Each wrapper carries the addressing that layer needs. At the far end the process runs in reverse, each layer stripping its own header. The name of the wrapped unit changes at each layer, and examiners love to ask for those names.

Going down the stack, every layer wraps what it was given.ApplicationDATAmessageTransportDATAsegmentInternetDATApacketLinkDATAframeThe receiver unwraps in the opposite order. A router rewrites the frame but leaves the IP packet's addresses alone.
Fig 2The same data, wrapped four times. The names matter.
LayerUnit is calledAddressing it adds
ApplicationData / messageNone
TransportSegment (TCP) or datagram (UDP)Source and destination port numbers
NetworkPacketSource and destination IP addresses
Data linkFrameSource and destination MAC addresses, plus an error check
PhysicalBitsNone — just signalling
The addresses that change and the ones that do not
As a packet crosses routers, the source and destination IP addresses stay the same the whole way — they identify the endpoints. The MAC addresses are rewritten at every hop, because they only identify the two devices on one physical link. This single fact explains most of what a router does.

TCP/IP: the model actually in use

OSI is a teaching model. The internet runs on the TCP/IP model, which collapses the same work into four layers: Application (OSI 5–7), Transport (4), Internet (3) and Network Access or Link (1–2). When somebody says "layer 3 switch" or "layer 7 firewall" they are using OSI numbering, so you need both.

TCP versus UDP

ATCP — reliable
  • Three-way handshake establishes a connection first
  • Numbers every segment and acknowledges receipt
  • Retransmits anything lost; delivers in order
  • Flow and congestion control slow down if the network is struggling
  • Web, email, file transfer, SSH
BUDP — fast
  • No handshake — just sends
  • No acknowledgements, no retransmission, no ordering
  • Much lower overhead and latency
  • The application deals with loss, if it matters at all
  • Voice and video calls, live streaming, DNS lookups, online games

The choice is not "reliable is better". In a video call, a packet that arrives late is useless — the moment it described has already passed — so retransmitting it would waste bandwidth and add delay for nothing. Dropping it and moving on gives a brief glitch instead of a growing lag. That is why real-time media uses UDP and a file download uses TCP: a file with one missing byte is corrupt, but a video with one missing frame is still a video.

PortProtocolPurpose
20 / 21FTPFile transfer (data / control)
22SSHSecure remote shell
25SMTPSending email
53DNSName resolution (mostly UDP)
67 / 68DHCPAutomatic IP configuration
80HTTPUnencrypted web
443HTTPSEncrypted web (TLS)
3389RDPWindows remote desktop
What a port number is for
One computer has one IP address but runs many network programs at once. The port number tells the transport layer which program a segment belongs to. An IP address gets data to the right machine; a port gets it to the right program on that machine.

Worked examples

Reveal one step at a time and try to beat it to the next line.

Example 1
Trace what happens at each OSI layer when you type an address into a browser and press Enter, as far as the first bits leaving your computer.
Example 2
A video conferencing app uses UDP. During a poor connection the picture glitches but the call keeps going. Explain why switching to TCP would make the user experience worse.

Where marks get lost

  • Reversing the OSI layer order. Layer 1 is Physical at the bottom; layer 7 is Application at the top.
  • Saying MAC addresses travel end to end. They are rewritten at every hop; only IP addresses persist.
  • Calling every unit a "packet". Segment at layer 4, packet at layer 3, frame at layer 2.
  • Assuming TCP is always the better choice. For real-time media its guarantees actively hurt.
  • Mixing up port and IP. IP finds the machine; the port finds the program on it.
  • Thinking a switch reads IP addresses. A plain switch works at layer 2 and only sees MAC addresses.

Flashcards 10

OSI layers bottom to top
Encapsulation unit names, top down
Which layer does a switch work at?
Which layer does a router work at?
+ 6 more

Practice

1
Order the OSI layers from layer 1 to layer 4.
  1. 1Data link
  2. 2Transport
  3. 3Network
  4. 4Physical
2
At which OSI layer does a router operate?
3
What is the unit of data at the network layer called?
4
Which protocol would a live multiplayer game most likely use for player position updates?
5
Match each port number to its protocol.
22
53
80
443
6
A packet travels from Toronto to Tokyo through eleven routers. What happens to its addresses?
7
Why does a computer need port numbers at all, when it already has an IP address?
8
Order these encapsulation steps as data travels DOWN the stack.
  1. 1A TCP header with port numbers is added
  2. 2An Ethernet frame header with MAC addresses is added
  3. 3An IP header with addresses is added
  4. 4HTTP data is formed
9
TCP's three-way handshake exists to:

Spot a mistake on this page? Let us know