OSI model

From the bottom: 1 physical, 2 data link (frames, MAC addresses), 3 network (IP addresses, routing), 4 transport (ports, TCP and UDP), 5 session, 6 presentation, 7 application. The internet actually runs the simpler TCP/IP model, where 5 to 7 are one application layer, but the numbers stuck: a layer 2 switch, a layer 3 router, a layer 4 or layer 7 load balancer. Sending, each layer puts its header in front of what the layer above gave it (encapsulation); the receiver removes them in reverse.

The seven layers, and what each one does

The OSI reference model (ISO/IEC 7498-1) splits networking into seven layers. Each layer does one job, relies on the layer below and serves the layer above. Real networks run the TCP/IP model (RFC 1122), which merges the top three into one application layer and treats the bottom two as the link, but people still use the OSI numbers.

Devices are named by the highest layer they read: a hub repeats bits (1), a switch forwards frames by MAC address (2), a router forwards packets by IP address (3), a layer 4 load balancer picks a backend by connection, and a layer 7 one reads the HTTP request.

How encapsulation works, step by step

Follow curl http://10.0.2.10/ from a laptop at 10.0.1.10:

1. Layer 7. curl writes GET / HTTP/1.1 and a Host header. It knows nothing about addresses or cables.
2. Layer 4. The kernel's TCP puts a header in front: source port 43273 (ephemeral), destination port 80, sequence and acknowledgement numbers. After a handshake, that segment carries the request.
3. Layer 3. IP puts its header in front: source 10.0.1.10, destination 10.0.2.10, TTL 64, protocol 6 (TCP). The routing table says the destination is reached via the gateway 10.0.1.2.
4. Layer 2. Ethernet puts the frame header in front: the gateway's MAC as destination (found by ARP), the laptop's MAC as source, EtherType 0x0800 (IPv4). A checksum, the FCS, goes at the end.
5. Layer 1. The card sends the frame as signals on the cable.

The router receives the frame, removes the Ethernet header, reads the IP header, lowers the TTL and builds a new frame for its next link. Layers 3 and up travel end to end; layer 2 is rebuilt at every hop. The server removes the headers in reverse until the request reaches the web server's socket.

Every layer on a Linux machine

Each layer has its own tools, and Hack the Route labs use them on real machines:

• Layer 1: ip link shows LOWER_UP when the link is live and NO-CARRIER when it is not; ip -s link counts damaged frames. The interface errors lab reads them.
• Layer 2: the MAC in ip link, the neighbour table in ip neigh, a switch's table in bridge fdb. ARP and MAC addresses and VLANs.
• Layer 3: ip addr, ip route, ping, traceroute. Addresses and subnets.
• Layer 4: ss -tuln for listening ports, nc to open a connection. TCP and UDP.
• Layers 5 to 7: dig, curl, openssl s_client. The DNS tree and TLS certificates.

One tcpdump line shows layers 2, 3 and 4 of a frame at once, the first segment of that request:

$ tcpdump -e -nn -i eth0 tcp port 80
9e:3b:52:c1:07:4a > d2:65:0f:8e:21:b3, ethertype IPv4 (0x0800), length 74: 10.0.1.10.43273 > 10.0.2.10.80: Flags [S], seq 1146127641, win 64240, length 0

MAC addresses and EtherType (2), IP addresses (3), ports and TCP flags (4). Length 74 is 14 bytes of Ethernet header, 20 of IP and 40 of TCP with its options.

Troubleshooting from the bottom up

The layers give an order for finding a fault. Is the link up (NO-CARRIER)? Is the neighbour's MAC known, or is its entry FAILED? Is there an address and a route (ip route get)? Does the port answer, or does the connection get refused or time out? Only then look at the application: DNS, certificates, the HTTP status. Each layer's error looks different: "Network unreachable" is layer 3 on your own machine, "Connection refused" a layer 4 reset, curl's exit code 6 a failed DNS lookup at layer 7. The bare machine lab brings a machine up one layer at a time and reads the error each missing piece gives.

Questions people ask

What is the difference between the OSI model and the TCP/IP model? OSI has seven layers and is a reference. TCP/IP has four (link, internet, transport, application) and is what the internet runs.

Which layer is ARP? It sits between 2 and 3: it travels in Ethernet frames and maps IP addresses to MAC addresses.

Is a switch layer 2 or layer 3? A plain switch is layer 2. A layer 3 switch also routes between VLANs, in hardware.

See it on real machines