Lesson 1.1 – OSI & TCP/IP Models

Domain 1.0 | Networking Concepts — 23% of exam

Learning Objectives

By the end of this lesson, you will be able to:

• Describe the purpose of layered networking models and why the industry uses them instead of treating networking as one monolithic process
• List all seven layers of the OSI model in order, state the function of each, and identify the Protocol Data Unit (PDU) associated with each layer
• List the four (or five) layers of the TCP/IP model and map them accurately onto their corresponding OSI layers
• Explain encapsulation and de-encapsulation, and trace how a single unit of application data is transformed as it moves down and back up the stack
• Identify which network devices and protocols typically operate at each layer, and use that mapping to reason about troubleshooting and traffic flow

Key Terms

Explanation

Why Networking Uses Layered Models at All

Imagine trying to design, troubleshoot, and manufacture networking equipment if every vendor built devices that handled “networking” as one giant, undivided blob of logic. A change to how cables carry electrical signals would force a redesign of the software that renders a web page. A bug in an application would be indistinguishable from a bug in the cabling. Nobody could specialize, interoperate, or troubleshoot efficiently.

Layered models solve this by breaking the overall problem of “get data from Application A on Host 1 to Application B on Host 2” into a stack of smaller, well-defined jobs. Each layer:

• Performs one specific function (e.g., “get bits onto the wire” or “choose the best path across networks”)
• Only needs to know how to talk to the layers directly above and below it
• Can be developed, replaced, or troubleshot independently, as long as it honors the interface contract with its neighboring layers

This is the same principle used throughout engineering: a car’s electrical system doesn’t need to know how the transmission shifts gears, but the two systems still work together through well-defined interfaces. Networking’s two dominant layered models are the OSI model (mostly theoretical/reference today, but essential shared vocabulary) and the TCP/IP model (what actually runs the modern Internet).

Network+ candidates are expected to know both models cold — not because you’ll type “OSI” into a router, but because every troubleshooting conversation, every vendor datasheet, and every exam scenario question uses layer numbers as shorthand (“that’s a Layer 2 problem,” “check Layer 3 connectivity first”).

The OSI Model: Seven Layers

The Open Systems Interconnection (OSI) model was developed by the International Organization for Standardization to provide a vendor-neutral reference for describing network communication. It has seven layers. A widely used mnemonic to memorize them from Layer 7 down to Layer 1 is “All People Seem To Need Data Processing”, and from Layer 1 up is “Please Do Not Throw Sausage Pizza Away.” Pick whichever direction sticks better — the exam will test you both ways.

Layer 7 — Application This is the layer closest to the end user — but it is not the application program itself (like a web browser). Instead, it’s the layer that provides network services to applications: the protocols that let a browser request a web page, an email client send a message, or a file transfer utility move a document. Common protocols living here include HTTP/HTTPS, FTP, SMTP, DNS (functionally), and DHCP (functionally). PDU: Data.

Layer 6 — Presentation Responsible for translating, formatting, encrypting, and compressing data so that the Application layer on the receiving end can interpret it correctly. This layer handles character encoding (ASCII, Unicode), data formatting (JPEG, MP4, ASCII vs. EBCDIC), and encryption/decryption (SSL/TLS is often described as straddling Presentation and Session). Think of it as the “translator” — it makes sure two systems that might represent data differently internally can still understand one another. PDU: Data.

Layer 5 — Session Establishes, manages, and terminates the communication session (dialogue) between two hosts. It handles things like session checkpoints, dialogue control (who talks when — full-duplex vs. half-duplex), and session recovery after an interruption. Protocols and APIs like NetBIOS, RPC (Remote Procedure Call), and PPTP tunnel-session-establishment logic are commonly cited examples. PDU: Data.

Layer 4 — Transport This is where end-to-end communication reliability decisions are made. The Transport layer is responsible for segmenting data from the upper layers into manageable chunks, adding port numbers to identify the correct application/service, and — critically — choosing between connection-oriented delivery (TCP) with error recovery, sequencing, and flow control, versus connectionless delivery (UDP) with no such guarantees but far lower overhead. This is one of the single most heavily tested concepts on the exam. PDU: Segment (TCP) or Datagram (UDP).

Layer 3 — Network Responsible for logical addressing and path determination — in other words, routing. This is where IP addresses live, and where routers make forwarding decisions based on destination network addresses rather than physical hardware addresses. Protocols here include IPv4, IPv6, ICMP, and routing protocols like OSPF and BGP (their control-plane traffic operates using Layer 3 addressing even though the protocols themselves have their own logic). PDU: Packet.

Layer 2 — Data Link Handles node-to-node data transfer on the same physical/logical segment, using physical (MAC) addressing rather than logical (IP) addressing. This layer is commonly split conceptually into two sublayers: LLC (Logical Link Control), which interfaces with Layer 3 and handles flow control/error checking, and MAC (Media Access Control), which handles physical addressing and controls how devices access the shared medium. Switches operate primarily at this layer, forwarding frames based on MAC address tables. Protocols/technologies here include Ethernet, 802.1Q VLAN tagging, and ARP (functionally bridges Layer 2/3). PDU: Frame.

Layer 1 — Physical The lowest layer, dealing with the actual transmission of raw bits over a physical medium — electrical voltages on copper cabling, light pulses over fiber, or radio waves over wireless. This layer defines cable types, connectors, pinouts, voltage levels, and the physical/electrical/mechanical specifications for network hardware. Hubs and repeaters, along with cabling itself, operate here. PDU: Bits.

The TCP/IP Model

While the OSI model is the standard reference framework used for teaching and discussing networking, the protocol suite that actually powers real-world networks — including the Internet — is the TCP/IP model. It predates the OSI model’s formalization and was built pragmatically around the protocols DARPA needed for early internetworking, which is why it has fewer, broader layers.

The classic TCP/IP model has four layers:

1. Application — combines the functions of OSI’s Application, Presentation, and Session layers into one. Protocols: HTTP/HTTPS, FTP, SMTP, DNS, DHCP, SSH, Telnet.
2. Transport — functionally identical in purpose to OSI’s Transport layer. Protocols: TCP, UDP.
3. Internet — maps to OSI’s Network layer. Protocols: IPv4, IPv6, ICMP.
4. Network Access (also called Link or Network Interface) — combines OSI’s Data Link and Physical layers into one. Covers Ethernet, Wi-Fi, and the physical media itself.

Some newer textbooks (and some exam objectives) describe a five-layer TCP/IP model that splits Network Access back into separate Data Link and Physical layers, producing a model that lines up one-to-one with OSI Layers 1 through 4, while still merging OSI Layers 5–7 into a single Application layer. Either representation is valid — know both, because exam questions sometimes reference “the TCP/IP model” without specifying which version, and the correct answer usually depends on context (e.g., a question mentioning “cabling issues” implies the five-layer view where Physical is distinct from Data Link).

Side-by-Side Comparison

A key exam-relevant takeaway: the OSI model’s Layers 5–7 (Session, Presentation, Application) don’t correspond to three cleanly separate real-world protocols the way Layers 1–4 do. In practice, protocols like HTTP handle what OSI would split across all three upper layers. This is precisely why OSI is described as a reference/teaching model rather than a model that maps one-to-one onto how software is actually built.

Encapsulation and De-Encapsulation

Encapsulation is the process by which data is wrapped in progressively more header (and, at Layer 2, trailer) information as it travels down the stack on the sending device, and de-encapsulation is the reverse process of stripping those headers off, one layer at a time, as data travels up the stack on the receiving device.

Walk through a concrete example — a user’s web browser requesting a page over HTTPS:

1. Application/Presentation/Session (Layers 7-5): The browser generates the HTTP request and hands it, along with any TLS encryption applied at the Presentation-layer boundary, down as Data.
2. Transport (Layer 4): TCP adds a header containing source and destination port numbers (destination 443 for HTTPS), sequence numbers, and flags. The data + TCP header is now called a Segment.
3. Network (Layer 3): IP adds a header containing the source and destination IP addresses. The segment + IP header is now called a Packet.
4. Data Link (Layer 2): Ethernet adds a header containing source and destination MAC addresses, plus a trailer (Frame Check Sequence, used for error detection). The packet + Ethernet header/trailer is now called a Frame.
5. Physical (Layer 1): The frame is converted into bits — electrical signals, light pulses, or radio waves — and transmitted onto the medium.

On the receiving end, this process runs in exact reverse: bits are reassembled into a frame, the Layer 2 header/trailer is stripped and the MAC address is checked, the frame’s payload (now a packet) is passed up to Layer 3 where the IP header is examined and stripped, the resulting segment goes up to Layer 4 where the TCP header is examined (port number tells the OS which application/socket to deliver to) and stripped, and finally the raw Data reaches the receiving application.

Understanding this sequence is essential for troubleshooting, because it tells you exactly what information is available — and what could be going wrong — at each stage. A switch cannot make a Layer 3 routing decision because it never looks past the Layer 2 header; a router cannot forward based on MAC address alone because its job starts at Layer 3, examining the IP header inside the packet.

Devices and Troubleshooting by Layer

One of the most exam-relevant (and real-world-relevant) reasons to know the model cold is that it gives you a systematic way to isolate problems. Network+’s troubleshooting methodology (covered fully in Lesson 5.1) explicitly encourages a layered approach — often informally called the “bottom-up” or “top-down” method.

This table is worth internalizing rather than memorizing verbatim, because scenario-based exam questions frequently describe a symptom and ask you to identify which layer is the most likely culprit, or which device to check first.

Recognition-Level Command References

Domain 1.1 is conceptual rather than hands-on — you won’t be asked to configure anything here — but you should be able to recognize which layer a given diagnostic command primarily operates at, since this connects directly into Domain 5’s troubleshooting content:

• ping — operates using ICMP at Layer 3, but its success/failure also implicitly depends on Layers 1-2 functioning correctly beneath it
• arp -a (or ip neigh on Linux) — displays the Layer 2-to-Layer 3 mapping table (MAC-to-IP)
• netstat — shows active Layer 4 connections (TCP/UDP) and the ports/sockets in use
• traceroute / tracert — reveals the Layer 3 path (hop-by-hop) a packet takes to a destination
• nslookup / dig — operate at Layer 7, resolving names via DNS

You’ll work with all of these hands-on later in Domain 5 (Lessons 5.5.1 and 5.5.2). For now, the goal is simply to associate each tool with the layer(s) it primarily reveals information about.

Common Exam Traps

• Don’t confuse “layer” with “device.” A firewall can inspect and act at multiple layers simultaneously (Layer 3 for IP filtering, Layer 4 for port filtering, and even Layer 7 for application-aware inspection on next-gen firewalls). Questions sometimes test whether you understand that modern devices aren’t strictly confined to one layer.
• Know the PDU names cold — Data, Segment/Datagram, Packet, Frame, Bits — because exhibit-based questions often show you a diagram or packet capture and ask “what is this unit of data called at this point in the process?”
• TCP/IP model layer counts vary by source — don’t panic if you see both 4-layer and 5-layer descriptions; understand what each version represents rather than memorizing a single “correct” number.
• Encapsulation direction matters — sending host encapsulates (adds headers going down); receiving host de-encapsulates (removes headers going up). Exam questions sometimes flip the scenario (e.g., “at the router, is the packet being encapsulated or de-encapsulated as it moves from the LAN interface toward the Network layer?”).