Study Guide
OSI and TCP/IP Models
Why networking is divided into layers, the seven OSI layers and the four-layer TCP/IP model, and how encapsulation and MTU work.
Lesson 3.2 Networking Fundamentals
Sending a web page across the world involves dozens of separate jobs. This lesson is about how networking organises those jobs, and why the way they are organised matters for security.
Stage: Think
Dozens of jobs
Think it through
Think about everything that has to happen for a web page to reach your phone from a server in another country. List as many separate jobs as you can.
- Hint 1: Something has to find the right device among millions.
- Hint 2: Something has to turn data into electrical or radio signals.
Show what happens
Finding the right device, splitting the data into pieces, checking that every piece arrived, turning it into signals, carrying it, and putting it back together. Too many jobs to think about at once, so networking sorts them.
Think it through
Show the answer
Answer: B. No: it hands the request on and lets other parts deliver it.
No. The browser does its own job and trusts other parts to deliver the request. Sorting the jobs so that each relies on the one below it is the idea of layers.
Stage: Explain
Why networking is divided into layers
Each layer has one responsibility and relies on the layer below it. A browser does not need to know whether a laptop is on Wi-Fi or Ethernet; it hands its request down and trusts the lower layers to deliver it. Layers also give people a shared vocabulary. Saying “this is a Layer 2 problem” or “this control works at Layer 7” tells a colleague a great deal in a few words.
The cybersecurity value is this: understanding the layers helps identify where networking failures, security controls and attacks occur.
The same idea in the post
Posting a letter is layered in the same way.
- You write the letter. Only its content matters to you.
- You put it in an envelope and write the address. The envelope does not care what the letter says.
- The post office puts the envelope in a sack for the right town. The sack does not care which house it is for.
- A van carries the sack. The driver does not care what is in it.
Each step wraps what came before and adds only what the next carrier needs. At the other end the steps are undone in reverse: the sack is opened, the envelope is delivered, the letter is read. Networks do exactly this, with more steps.
Where the comparison stops. A letter travels as one object. Network data is usually cut into many small pieces that travel separately and are put back together on arrival.
Stage: Explain
The seven OSI layers
The OSI model names seven layers, numbered from the cable upwards. Start with the job each one does, put as a question. Read from the top, the way data travels when it is sent.
| Layer | The question it answers | What that means |
|---|---|---|
| 7 · Application | What does the program want to say? | The request itself, such as “send me this web page”. |
| 6 · Presentation | What form is it in? | How the data is written down, and whether it is scrambled for privacy. |
| 5 · Session | Is this part of a conversation already going on? | Starting, keeping track of and ending an exchange. |
| 4 · Transport | Which program is it for, and did all of it arrive? | Getting data to the right program on a device, complete and in order. |
| 3 · Network | Which device, on which network, is it for? | Addresses that work across the world. Routers work here. |
| 2 · Data Link | Which device on this cable or Wi-Fi gets it next? | Delivery within one local network. Switches work here. |
| 1 · Physical | How are the ones and zeros actually sent? | Electrical signals, light or radio. |
A sentence helps to remember the order. The Baldur’s Gate 3-inspired mnemonic, from Layer 7 down to Layer 1, is:
All Players Should Take New Defensive Positions.
Check your understanding
Show the answer
Answer: C. Layer 3, Network.
Layer 3, Network: addresses that work across networks, used by routers. Switches work at Layer 2, within one local network.
The next table is the same seven layers as a reference, with the protocols usually placed at each. Most of those names are taught in the lessons that follow, so there is no need to know them yet. Come back to this table as each one is introduced.
| Layer | Mnemonic | Responsibility and examples |
|---|---|---|
| 7 · Application | All | Network services used by applications: HTTP, DNS, DHCP and SMTP |
| 6 · Presentation | Players | Representation, encoding and encryption; TLS is often associated here in teaching |
| 5 · Session | Should | Establishment and management of communication sessions; NetBIOS session service is a traditional example |
| 4 · Transport | Take | End-to-end transport and logical ports: TCP and UDP |
| 3 · Network | New | Logical addressing and routing: IP; control messages such as ICMP |
| 2 · Data Link | Defensive | Frames and local link-layer addressing: Ethernet MAC; ARP is commonly associated |
| 1 · Physical | Positions | Bits carried as signals over copper, fibre or radio |
OSI is a model for thinking, not a description of how any one product is built. Real technologies do not always fit one layer: Ethernet and Wi-Fi cover both Layer 1 and Layer 2, and many modern connections have nothing separate at Layers 5 and 6. The layers a beginner uses most are 1 to 4 and 7.
Typical examples help fix those layers in memory: web pages (HTTP) and email (SMTP) at Layer 7, TCP and UDP at Layer 4, IP addresses and the router at Layer 3, MAC addresses and the switch at Layer 2, and cable and radio at Layer 1.
Applying the model to a web request
Think it through
Before reading on: using the table of questions, which layer would handle each of these for a secure web page? Writing the request; getting it to the right program; addressing the right computer; reaching the next device; sending the signals.
- Hint 1: Match each job to the question in the first table.
Show what happens
Application (with TLS protecting it), Transport, Network, Data Link and Physical. The list below names the protocol doing each job.
Take loading a secure web page, from the top layer down.
- The browser writes the request. HTTP is the set of rules for asking for web pages, and TLS scrambles the request so that only the website can read it.
- TCP makes sure the whole request reaches the right program on the website’s computer, complete and in order.
- IP carries the address of that computer, wherever in the world it is.
- Ethernet or Wi-Fi gets each piece to the next device on the way.
- The cable or the radio carries the signals.
On the way down, each layer that takes part wraps the data and adds its own information, as the envelope and the sack did. This is called encapsulation. The receiving computer unwraps it in reverse, which is decapsulation. The HTTPS walkthrough follows the whole journey.
Stage: Predict
The TCP/IP model
OSI is the model most courses teach, but the internet is actually built on the TCP/IP protocol suite, which is usually described with four layers. The two models describe the same work in different amounts of detail.
Think it through
OSI has seven layers. If you had to merge some of them to make a simpler model, which would you combine?
- Hint 1: Which layers are hardest to tell apart in a real connection?
- Hint 2: Which two layers do Ethernet and Wi-Fi both cover?
Show what happens
The TCP/IP model does exactly that: the top three become one Application layer, and the bottom two become one Link layer, leaving four. The diagram below lines the two models up.
Each TCP/IP layer covers one or more OSI layers: Application covers OSI 7 to 5, Transport covers 4, Internet covers 3, and Link covers 2 and 1.
OSI model
TCP/IP model
7Application
6Presentation
5Session
4Transport
3Network
2Data Link
1Physical
ApplicationHTTP, DNS, DHCP, TLS
TransportTCP, UDP
InternetIPv4, IPv6, ICMP
Link (network access)Ethernet, Wi-Fi
The TCP/IP model matters because many references and tools use its layer names. Some books describe five layers by splitting Link into Data Link and Physical. Either way, the key idea is the same as OSI: each layer relies on the one below it.
Stage: Predict
Encapsulation: wrapping data layer by layer
Encapsulation is the letter going into the envelope and the envelope into the sack. Each layer that takes part adds its own information around the data on the way down; the receiver removes it on the way up.
Each wrapping has a name. TCP places the data in a segment with port numbers. IP places the segment in a packet with IP addresses. Ethernet places the packet in a frame with MAC addresses for the local link.
A simplified HTTPS request over TCP and Ethernet. Reading outwards: the protected application data sits inside a TCP segment, which sits inside an IP packet, which sits inside an Ethernet frame.
Ethernet frame · Layer 2 · added last on the way out
IP packet · Layer 3
TCP segment · Layer 4
On a typical Ethernet link the IP packet can be up to 1,500 bytes (the MTU). The Ethernet header and trailer are added around it and are not counted in that figure.
Think it through
Show the answer
Answer: B. The destination address on the IP packet.
The destination address on the IP packet. The router unwraps only as far as the packet, as the sixth step of the walkthrough that follows shows.
A laptop requests a secure web page from a server on the internet. Seven steps, one at a time: down the laptop’s layers, across the routers, and back up the server’s layers.
Application
Step 1 of 7: The request is written
The browser creates an HTTP request, and TLS protects it.
Transport
Step 2 of 7: A segment
TCP puts the protected data in a segment, adding the source port and destination port 443.
Network
Step 3 of 7: A packet
IP puts the segment in a packet, adding the laptop’s IP address and the server’s IP address.
Data Link
Step 4 of 7: A frame
Ethernet or Wi-Fi puts the packet in a frame addressed to the next device on the local link, usually the router.
Physical
Step 5 of 7: Signals
The NIC sends the frame as signals.
Each router on the way
Step 6 of 7: Unwrap, decide, rewrap
Each router unwraps the frame to read the packet, decides where to send it, and wraps it in a new frame for the next link. The packet’s destination IP address stays the same in this example, which involves no address translation.
The server
Step 7 of 7: Decapsulation
Each layer removes its wrapping in reverse until the web server reads the request.
Stage: Predict
MTU: how big can a packet be?
A figure worth remembering is MTU = 1500 bytes. The maximum transmission unit is the largest packet a link can carry in one go. On a typical Ethernet link it is 1,500 bytes, and that figure refers to the IP packet: the Ethernet frame’s own header and trailer are added around it.
Think it through
A link can carry packets of at most 1,500 bytes. How does a 10-megabyte file get across it?
- Hint 1: Think of moving house in a car that holds only a few boxes at a time.
Show what happens
In thousands of smaller pieces, each small enough to fit, put back together at the other end. The box below explains who does the splitting.
Data larger than the MTU must be sent in smaller pieces. TCP normally sizes its segments so that packets fit, and IPv4 can also split an oversized packet into fragments. 1,500 bytes is common but not universal: some links, such as those carrying a VPN (a protected connection wrapped inside ordinary traffic), have smaller effective MTUs, and a mismatch can cause connections that start but then stall.
The layers give a structured way to troubleshoot, often from the bottom up. Is the cable connected or the Wi-Fi joined (Layer 1)? Does the device have a link and a MAC address (Layer 2)? Does it have a valid IP address and gateway (Layer 3)? Is the service’s port reachable (Layer 4)? Only then is it worth blaming the application (Layer 7).
Stage: Apply
Apply it in a new situation
These questions use the lesson in situations it has not shown. For the strongest test of your understanding, come back to them on another day and answer each one at the first attempt.
Apply it
- Hint 1: Start where the problem is most basic: is there a connection at all?
Show the answer
Answer: A. Layer 1, Physical: is there a link at all?
Start at Layer 1: with no link at all, nothing above it can work. Troubleshooting often runs from the bottom up.
Stage: Check
Check your understanding
These questions come from the approved revision bank. Choose an answer and check it; the explanation and its sources follow. The last one returns to hosts, nodes and network interface cards from What Is a Network?, now that you can name the layers a network interface card works at.
Show answer
Answer: Layer 4 — Transport
Transport uses TCP/UDP ports to distinguish endpoints. Network handles IP addressing and routing; Data Link handles frames and local addresses. Applications use network services but the port identifiers belong to transport.
Revision sources: Session 5: Networking Fundamentals — Part 1 (Classroom session record)
Show answer
Answer: False
False. OSI is a reference model. Ethernet and Wi-Fi include Physical and Data Link functions; TLS is often associated with Presentation in teaching but does not implement the complete OSI Presentation layer.
Revision sources: Session 5: Networking Fundamentals — Part 1 (Classroom session record)
Show answer
Answer: Applicable layers add their control information.
Encapsulation adds applicable layer information. Corresponding receiving layers process it during decapsulation. Neither encryption at every layer nor conversion of all logical addresses into permanent MAC addresses is implied.
Revision sources: Session 5: Networking Fundamentals — Part 1 (Classroom session record)
Show answer
Answer: A host is a node that can send or receive data.; A NIC provides Physical and Data Link functions.
Hosts are nodes, but switches and other nodes need not be end hosts. A NIC provides the hardware network interface, primarily at Layers 1 and 2; the application is a separate element.
Revision sources: Session 5: Networking Fundamentals — Part 1 (Classroom session record)
Study and revision
Practise the OSI questions and flashcards through the Networking & Protocols topic.
Stage: Consolidate
What to remember
- Layers divide networking into jobs, each relying on the one below, which helps locate failures, controls and attacks.
- OSI has seven layers: All Players Should Take New Defensive Positions, from Application down to Physical.
- TCP/IP describes the same work in four layers; OSI is a model for thinking, not how products are built.
- Encapsulation wraps data at each layer on the way down: segment, then packet, then frame.
- The MTU is the largest packet a link carries, commonly 1,500 bytes on Ethernet.
Key terms
- OSI model (OSI: Open Systems Interconnection)
A conceptual seven-layer reference model for describing networking functions: Application, Presentation, Session, Transport, Network, Data Link and Physical.
- TCP/IP model
A four-layer model of how internet communication is organised: Link, Internet, Transport and Application.
- Encapsulation
Adding control information at the applicable layers as data moves down the stack for transmission. The receiver processes that information in reverse, which is called decapsulation.
- MTU (Maximum Transmission Unit)
The largest packet a link can carry without splitting it up. A typical Ethernet MTU is 1,500 bytes, not counting the Ethernet header and trailer.
Common misunderstandings
The model is a reference. Ethernet spans the Physical and Data Link layers, ARP sits at the boundary of Layers 2 and 3, and TLS is only loosely associated with Layer 6.
Encapsulation happens at the applicable layers. A modern connection may have no separately identifiable Session or Presentation layer protocol.
The internet uses the TCP/IP protocol suite. OSI is a teaching and reference model that describes the same work in seven layers.
Lesson sources and acknowledgements
Sources and scope
- Taught in Session 5 (see the Session 5 Learning Log): the seven OSI layers, the mnemonic, the reference-model caveats and encapsulation.
- From the Study Buddy session on 23 September (see the entry): the whiteboard’s layer examples, the encapsulation sketches and
MTU = 1500. - Moved from an earlier lesson: “The seven OSI layers” and “Applying the model to a web request” were previously part of What Is a Network? and keep their headings and anchors here; their wording was simplified on 13 October 2026. They develop the additional educational explanations from my ChatGPT note-taking discussion.
- Supplementary explanation: the letter comparison, the table of the question each layer answers, the TCP/IP model and its mapping to OSI, segment, packet and frame, the encapsulation diagram, the MTU detail, the worked request and the misunderstandings.
Guided version (published 1 November 2026, awaiting the site owner’s editorial review): the opening questions about the jobs of delivering a web page, every question asked in the lesson with its feedback and hints, the router, file-size, Wi-Fi and TLS examples and the closing summary are supplementary explanation written for the Study Guide. The settings are fictional. The questions in the lesson’s steps are not revision-bank items; those in “Check your understanding” are, unchanged.
A protocol that finds the MAC address for an IPv4 address on the local network, using a broadcast request and a normally unicast reply.
A measure intended to modify risk, for example by restricting access, detecting misuse or supporting recovery.
An application-layer protocol that automatically provides IP configuration, such as an address, subnet mask, default gateway and DNS server information.
The system that translates domain names into IP addresses. It commonly uses port 53 over UDP and TCP.
Adding control information at the applicable layers as data moves down the stack for transmission. The receiver processes that information in reverse, which is called decapsulation.
Transforming data with a cipher and a key so that it cannot be read without the right key. Decryption reverses it.
The standard way devices on a wired local network send data to each other, in units called frames that carry the MAC address of the sender and of the intended receiver.
The unit of data at the Data Link layer, such as an Ethernet frame. It is addressed with MAC addresses for delivery across one local link.
An endpoint that sends or receives data on a network. Hosts are nodes, but not every node is an end host.
The set of rules a web browser and a website use to ask for and send pages. A browser sends a request; the website sends a response.
The protocol network devices use to send each other short status and error messages, such as “that destination cannot be reached”. The ping command uses it to test whether a device answers.
A logical network-layer address identifying an interface for delivery across networks. IPv4 addresses are 32 bits; IPv6 addresses are 128 bits.
A link-layer address used for local frame delivery, conventionally 48 bits written in hexadecimal. It may be randomised or spoofed, so it is not proof of identity.
The largest packet a link can carry without splitting it up. A typical Ethernet MTU is 1,500 bytes, not counting the Ethernet header and trailer.
The principle that a person should access particular information only where their role gives a legitimate requirement for it.
A program or function that can be reached over the network, listening for and responding to requests on an address and port.
Hardware that connects a device to a network medium and provides Physical and Data Link layer functions.
Any device or connection point that participates in a network.
A conceptual seven-layer reference model for describing networking functions: Application, Presentation, Session, Transport, Network, Data Link and Physical.
The unit of data at the Network layer, such as an IP packet. It carries source and destination IP addresses between networks.
A 16-bit logical number that identifies a service or endpoint for TCP or UDP. It is different from a physical switch port.
An agreed set of rules for how data is formatted, transmitted and interpreted so that devices can communicate.
A device that forwards traffic between networks, for example between a private local network and the internet.
The unit of data TCP creates at the Transport layer, carrying source and destination port numbers. The Network layer then places it in a packet.
A device that connects devices within a local network and forwards Ethernet frames using the MAC addresses it has learned.
A connection-oriented transport protocol that starts connections with a SYN, SYN-ACK, ACK handshake and provides reliable, ordered delivery.
A four-layer model of how internet communication is organised: Link, Internet, Transport and Application.
A protocol that protects data in transit with encryption for confidentiality and with integrity protection, and authenticates the server when certificate validation succeeds. HTTPS uses it to secure web traffic.
A connectionless transport protocol that sends datagrams without first establishing a connection or guaranteeing delivery.
A protected connection across a network that is not trusted, usually the internet. Organisations use one to let a computer outside the building reach the internal network as if it were inside.
Your progress on this lesson
Saved in this browser only. It is not sent anywhere, does not follow you to another device, and is lost if you clear this site’s data.
This browser is not allowing the site to save progress, so it will be forgotten when you leave the page.