Skip to content
Knowledge Hub/Article
Article

What Are the OSI Layers? The 7-Layer OSI Model and the TCP/IP Difference

The OSI model splits network communication into seven layers. The layers, their protocols, how it differs from TCP/IP and its place in troubleshooting.

Oğuzhan Gerçek··6 min read
What Are the OSI Layers? The 7-Layer OSI Model and the TCP/IP Difference

Short answer: The OSI (Open Systems Interconnection) model is a conceptual reference model that divides network communication between two devices into seven layers: physical, data link, network, transport, session, presentation and application. Published by ISO in 1984, it does not map one-to-one onto the TCP/IP protocol suite that today's internet runs on, yet it remains the networking world's shared vocabulary: "layer 2 switch", "layer 3 routing" and "layer 7 attack" all refer to it. Its practical value is in troubleshooting: once you narrow a connectivity problem down to a layer, it becomes clear which device, and which team, owns it.

What is the OSI model?

In Cloudflare's definition, the OSI model is a conceptual model created by the International Organization for Standardization that lets diverse communication systems interoperate using standard protocols; it splits network communication into seven stacked abstract layers. According to Wikipedia, the model was published in 1984 by ISO as ISO 7498 and by CCITT (today's ITU-T) as X.200; the current standard is ISO/IEC 7498-1.

The idea is simple: each layer serves only the layer above it, uses the layer below it, and talks to its peer on the other device. On the way out, each layer adds its own header (encapsulation); on the receiving side the same layers strip those headers in order. The units each layer carries have names too: bits at the physical layer, frames at the data link layer, packets at the network layer, segments at the transport layer.

The 7 layers of OSI

From the bottom up, using Cloudflare's descriptions of each layer:

  1. Physical layer: Cables, fiber, radio signals and connection hardware; it converts data into a bitstream of ones and zeros. Hubs, cabling and SFP modules live here.
  2. Data link layer: Moves data between two devices on the same network; it breaks packets into frames and handles flow and error control within that network. MAC addresses, Ethernet and Wi-Fi belong here, and so do switches and VLANs.
  3. Network layer: Moves data between different networks; it breaks segments into packets and finds the route to the destination. IP, ICMP and IPsec live here, and so do routers and gateways.
  4. Transport layer: Handles end-to-end communication; it splits data into segments, reassembles them on the other side and performs flow and error control. TCP and UDP, together with port numbers, sit at this layer.
  5. Session layer: Opens, maintains and closes the communication between two devices, and sets checkpoints so that a long transfer can resume after a disconnect.
  6. Presentation layer: Makes data usable by the application layer: translation, encryption and compression. Textbooks usually place TLS encryption at this layer.
  7. Application layer: The only layer that directly handles user data; it manages the protocols that software relies on. HTTP, SMTP and DNS live here.

The difference between OSI and TCP/IP

The internet does not run the OSI protocols; it runs the TCP/IP protocol suite. In Cloudflare's words, the modern internet does not strictly follow the OSI model but more closely follows the simpler Internet protocol suite. The TCP/IP model as defined in RFC 1122 has four layers: application, transport, internet and link. The mapping is roughly this: TCP/IP's application layer covers OSI's application, presentation and session layers; its transport layer corresponds to OSI's transport layer, its internet layer to the network layer, and its link layer to the data link and physical layers.

That is also why OSI survives: not as a protocol but, as Wikipedia puts it, as a reference for teaching and documentation. The layer numbers in product names and security reports are always OSI numbers.

Layer numbers in everyday use: L2, L3, L4, L7

  • L2 switch: Switches frames by MAC address; an L3 switch also routes between VLANs in the same box.
  • L3/L4 firewall: Decides by IP address, protocol and port; details in the firewall article.
  • L4 and L7 load balancers: L4 distributes TCP connections; L7 distributes by the content of the HTTP request (path, headers). See the load balancer article.
  • L7 attacks and the WAF: According to Cloudflare, DDoS attacks target specific layers of a network connection: application-layer attacks target layer 7 and protocol attacks target layers 3 and 4. A WAF works at layer 7; DDoS protection works mostly at layers 3 and 4.

Troubleshooting: narrowing a fault down to a layer

As Cloudflare notes, the model's real benefit is breaking a problem down and isolating its source; narrowing the problem to one layer avoids unnecessary work. The practical bottom-up sequence:

  1. Physical: Is the cable plugged in, is the link light on, is the fiber module faulty?
  2. Data link: Is the device in the right VLAN, is the switch port shut, has the MAC address been learned?
  3. Network: Are the IP address and subnet mask correct, does the default gateway answer a ping, is there a route?
  4. Transport: Is the destination port open, is a firewall dropping the TCP connection?
  5. Application: Does DNS resolve, which HTTP status code does the server return, what does the application log say?

The same sequence marks the boundary of responsibility: the first three layers belong to the network team, the fourth mostly to the security team, the seventh to the application team.

On the enterprise side

Layer 2 and 3 design, redundancy and change management are the subject of our network and traffic engineering service; layer-based segmentation and firewall policy are on the network security page.

Frequently asked questions

What does OSI stand for? Open Systems Interconnection: the name of the reference model ISO published in 1984 to standardize how different systems communicate with each other.

What are the OSI layers? Seven layers from the bottom up: physical, data link, network, transport, session, presentation and application.

Is the OSI model still used? Not as a protocol; the internet runs on TCP/IP. As a concept, yes: device classes (L2/L3 switches), security products (L7 WAF) and troubleshooting steps are all described with OSI layer numbers.

How many layers does TCP/IP have? Four, according to RFC 1122: application, transport, internet and link. OSI's seven layers are spread across those four.

What is the difference between a layer 2 and a layer 3 switch? A layer 2 switch only switches frames by MAC address; a layer 3 switch also routes between VLANs by IP address.

What does layer 7 mean? The application layer: the layer of protocols such as HTTP, SMTP and DNS that the software people use talks directly. A "layer 7 attack" is one aimed at the application itself, a website for example.

Sources