Core CS · Computer Networks

One impossible problem, split seven ways

Nothing in networking was designed as one thing. Each layer solves one problem, uses only the service under it, and offers only its own service above. Learn which problem each layer owns and every other question in this module turns into a lookup.

Diagnose five real faults, one layer at a time →

Physical is layer 1 and application is layer 7, never the other way round. The unit is a bit at layer 1, a frame at 2, a packet at 3 and a segment at 4. Almost every OSI question you will be asked is one of those two lists, pointed at something concrete.

01 The idea

Why anyone split it into layers at all

Getting a message from a browser in Hyderabad to a server in Frankfurt is not one problem. It is a voltage-on-a-wire problem, a which-device-on-this-cable problem, a which-way-through-the-world problem, a which-program-is-this-for problem, a whose-turn-is-it-to-speak problem, a what-character-set problem and a what-does-this-request-mean problem, all at the same time. Nobody has ever solved that as a single design, and the OSI reference model is the admission of it: the International Organization for Standardization published a model that cuts the whole job into seven layers, each owning exactly one of those problems.

The split buys three things, and they are worth saying out loud because interviewers ask for them by name. First, a layer can be replaced without touching the others. Move an office from copper to fibre and layer 1 changes completely, while the browser, TCP and IP are not recompiled and never find out. Second, seven small problems are solvable where one enormous one is not. Somebody can spend a career on cable specifications without ever reading an HTTP header. Third, two vendors interoperate without agreeing on anything except the boundary. A Cisco router and a Linux laptop share no code at all; they agree on what an IP packet looks like, and that turns out to be enough.

Calling a module a layer does not make it one. Two rules make it one, and everything else in this lesson is downstream of them. It uses only the service offered by the layer directly below it, never reaching around that layer to the one beneath. It offers only its own service to the layer directly above it, hiding entirely how the job gets done. That is why TCP behaves identically over Ethernet, over Wi-Fi and over a dial-up modem link: TCP never learns which of them is underneath, because it is not allowed to ask.

A layer uses only the service of the layer directly below it, and offers only its own service to the layer directly above it. Every other fact about the OSI model is a consequence of those two sentences, so if you remember nothing else, you can rebuild the rest from them.

PDUProtocol data unit: the name for one unit of data at a given layer. Bits at layer 1, a frame at 2, a packet at 3, a segment at 4. Naming the PDU has already named the layer, which is why examiners like asking for it.

EncapsulationEach layer treats what it was handed from above as opaque payload, puts its own header in front of it, and passes the result down. The receiver reverses it exactly, every layer stripping only the header it added.

Peer layersLayer n on this machine is logically in conversation with layer n on the far machine, and with nothing else. TCP talks to TCP. It never talks to the far side’s Ethernet, and never to the local browser’s idea of a request.

02 Worked example

One GET request, on its way down to the wire

A browser on 10.0.0.1 asks a web server on 203.0.113.9 for a page. The request line and its headers come to 100 bytes of text. That is the whole example, and the rest of the lesson reuses it, so hold on to the 100. Follow it left to right, which is downwards through the stack, because that is the direction data travels when you are the one sending.

7 · ApplicationHTTP writes GET /index.html HTTP/1.1 and its headers. 100 bytes of text. It names a resource, never a machine

→

4 · TransportTCP adds 20 bytes: source port 49152, destination port 80, a sequence number, a 16-bit window. A 120-byte segment

→

3 · NetworkIPv4 adds 20 bytes: source 10.0.0.1, destination 203.0.113.9, TTL 64. A 140-byte packet

→

2 · Data linkEthernet II adds 14 bytes in front and a 4-byte FCS behind. A 158-byte frame, for this one hop only

→

1 · Physical158 bytes become a timed voltage pattern on the cable. No header, no address, nothing it understands

Check the arithmetic once and it stays checked: 100 plus 20 is 120, plus 20 is 140, plus 14 and 4 is 158. Fifty-eight of those 158 bytes are wrapper, so just over a third of what goes on the wire is not the message. That ratio is the price of layering, and it is why a network carrying tiny messages is far less efficient than one carrying large ones.

The highlighted node is the one to sit with. TCP was handed 100 bytes and never found out they were HTTP. It handed 120 bytes down and never found out they would travel over Ethernet. It read nothing from above and asked nothing from below. That is rule two and rule one, once each, inside a single step, and it is why the same TCP code runs over a fibre link, a Wi-Fi association and a mobile bearer without a line changing.

Notice which layers did nothing. A plain HTTP GET runs no separate session protocol and converts no representation, so layers 5 and 6 added no bytes at all. That is not a gap in the example; it is the honest state of the internet, and section 03 says why. On the far side the whole thing runs backwards: the card hands 158 bytes up, Ethernet strips its 18 and passes up a packet, IP strips its 20 and passes up a segment, TCP strips its 20 and hands 100 bytes to the web server. Each layer removes only what its own peer put there, which is what makes peer layers more than a slogan.

03 Mechanics

Seven layers, bottom up, and what each one owns

Read the table upwards, from the wire to the user, because that is the order the layers can be justified in: nothing above layer 1 works until layer 1 works. These four columns answer almost any exam question on this topic, and the responsibility column is deliberately one sentence each. If your answer to “what does the network layer do” needs two sentences, one of them belongs to a different layer.

Layer	What it owns, in one sentence	PDU	Addressing	Two real protocols or standards
1 · Physical	Moves raw bits across a medium: voltage levels, timing, connectors, pin assignments and how far the cable may run.	`bit`	`none at all`	1000BASE-T (IEEE 802.3ab), RS-232 (TIA/EIA-232)
2 · Data link	Delivers a frame across one link, from a device to the device at the other end of it, and detects whether it arrived intact.	`frame`	`48-bit MAC address`	Ethernet (IEEE 802.3), PPP (RFC 1661)
3 · Network	Gets a packet from the source machine to the destination machine across any number of intervening networks, choosing a path.	`packet`	`32-bit IPv4 / 128-bit IPv6`	IP, ICMP
4 · Transport	Delivers to the right process on the destination machine rather than merely the right machine, and adds reliability and pacing when the protocol offers them.	`segment (TCP) / datagram (UDP)`	`16-bit port, 0 to 65535`	TCP, UDP (RFC 768)
5 · Session	Opens, manages and closes the dialogue between two applications: whose turn it is to send, and where to restart after a failure.	`data`	`none of its own`	NetBIOS session service, RPC (ONC RPC)
6 · Presentation	Fixes how the data is written down: character encoding, compression, encryption and decryption, so that both ends agree on the representation.	`data`	`none of its own`	SSL/TLS, JPEG (with ASCII and EBCDIC as the encoding half)
7 · Application	Provides the service the user actually asked for, and the interface a program calls in order to reach the network at all.	`data / message`	`none; it names resources`	HTTP, SMTP

The PDU is the fastest way to name the layer. Bits, frame, packet, segment, and then nothing special above layer 4. The trap is the word datagram, which is used at two layers and means two things: an IP datagram is the layer 3 packet, and a UDP datagram is the layer 4 unit. TCP’s unit is a segment and only a segment. If you are asked what a router forwards, the word is packet; if you are asked what a switch forwards, the word is frame. Getting those two the wrong way round costs the mark even when the explanation that follows is correct.

The data link layer has two sublayers, and they get asked for by name. The upper one is LLC, IEEE 802.2: it records which network-layer protocol the frame is carrying, and can offer optional flow and error control to the layer above. The lower one is MAC: it owns the 48-bit hardware addressing and decides who may transmit and when, which is CSMA/CD on classic Ethernet and CSMA/CA on 802.11 wireless. Real deployments differ here in a way worth naming in one clause: Ethernet II frames carry a 2-byte EtherType instead of an 802.2 LLC header, so on almost every modern LAN the LLC sublayer is not on the wire at all. The exam still wants both names.

Four header sizes are fixed, and they are marks. Ethernet II is a 14-byte header, being 6 bytes of destination MAC plus 6 of source plus a 2-byte EtherType, with a 4-byte FCS trailer after the payload. IPv4 is 20 bytes with no options and up to 60 with them. TCP is 20 bytes with no options. UDP is 8 bytes and that is the entire header: source port, destination port, length and checksum, two bytes each. Ethernet also bounds the payload at both ends: at most 1500 bytes, which is the MTU, and at least 46, so a shorter payload is padded up. That padding is what keeps every Ethernet frame at 64 bytes or more once the header and the FCS are counted.

Something has to split a message that will not fit. When what comes down from layer 4 is larger than the 1500 bytes underneath it, there are two places in a real TCP/IP stack where a split happens. IPv4 lets a router fragment the packet and makes the destination reassemble it. TCP instead sizes its own segments so that the result fits in the first place. One of those two is rare in practice and IPv6 removed it from routers entirely, and working out which one, and why, is the hard practice problem at the end of this lesson.

Layers 5 and 6 look thin because in practice they are. Neither has a header of its own on a normal internet connection, which is why a packet capture shows no block for either. The jobs did not disappear: a browser keeps session state in a cookie, and TLS does the presentation job of encryption while running on top of TCP and being called directly by the application. That is precisely why the TCP/IP model has four layers and folds OSI’s 5, 6 and 7 into a single application layer. Say the jobs moved; never say they stopped mattering.

Two mnemonics, one per direction, and say which you are using. Bottom up, 1 to 7: Please Do Not Throw Sausage Pizza Away. Top down, 7 to 1: All People Seem To Need Data Processing. Announce the direction before you start reciting, because the third item counted from the top is the session layer and the third counted from the bottom is the network layer, and an answer that mixes the two collapses entirely.

05 Cheat sheet

The nine they ask, and the trap inside each

Every row here is something you would want to glance at on the morning of an interview. The right-hand column is the version of the answer that loses the mark, and in most cases it is a small slip rather than a wrong idea, which is exactly why it is worth reading twice.

What they ask	The answer	The trap
The seven layers in order	`1 physical, 2 data link, 3 network, 4 transport, 5 session, 6 presentation, 7 application`	`numbering from the top; application is 7, never 1`
The PDU at each layer	`bit, frame, packet, segment; only data at 5, 6 and 7`	`calling a layer 3 unit a segment, or a layer 2 unit a packet`
What makes a layer a layer	`uses only the service below it, offers only its own service above it`	Answering with what the layer does instead of with the two rules.
Which layer has ports	`transport; 16-bit port numbers, 0 to 65535`	`saying network — an IP header has no port in it`
Which layer has MAC addresses	`data link, specifically its MAC sublayer; 48 bits`	Saying physical, because the address is burned into the hardware.
The two data link sublayers	`LLC (IEEE 802.2) above, MAC below`	Naming only one of them, or putting LLC below MAC.
The fixed header sizes	`Ethernet II 14 + 4 FCS, IPv4 20, TCP 20, UDP 8`	`quoting 20 for IPv4 or TCP without the words “no options”`
What TCP/IP leaves out	`session and presentation; their work sits inside the application layer`	Saying those jobs do not exist, rather than that no separate layer does them.
The mnemonics	`Please Do Not Throw Sausage Pizza Away (1 to 7); All People Seem To Need Data Processing (7 to 1)`	Reciting without saying which direction, so layer 3 lands on session.

Two rules, and the rest followsA layer uses only the service directly below it and offers only its own service directly above it. Any claim about OSI that contradicts one of those is wrong, so you can rebuild the whole model from them under pressure.

The PDU names the layerIf you can say which of bit, frame, packet and segment you are holding, you have already named the layer, and the addressing follows immediately from it: none, MAC, IP, port.

Depth is the whole differenceLayer 1 reads nothing, layer 2 reads 12 bytes of MAC addressing, layer 3 opens the IP header, layer 4 opens the ports, layer 7 parses the message. What a device can and cannot do is set entirely by where it stops reading.

06 Where & why

Where the seven numbers are a thing you type

The model describes no shipped stack, and yet its layer numbers turn up in product names, command names and configuration syntax across the industry. Each of these is a place where being unable to say “that is a layer 4 decision” leaves you unable to use the tool.

Wireshark

The detail pane is the stack, one block per layer

Capture the request from section 02 and the middle pane lists Frame, Ethernet II, Internet Protocol Version 4, Transmission Control Protocol, Hypertext Transfer Protocol. That is layers 2, 3, 4 and 7 in the order they were wrapped, and expanding a block shows exactly the header that layer added. The layers with no header of their own get no block at all, which is the clearest evidence you will ever see that 5 and 6 are jobs rather than wrappers.

Cisco IOS · access lists

The rule you are allowed to write depends on the layer

A standard access list can match only on the source IP address, because layer 3 is as deep as it is permitted to look. An extended access list can match the protocol, both addresses and both port numbers, because it opens the transport header as well. Same device, same interface, same traffic: the only difference between the two is how far into the packet the rule may read.

AWS · Elastic Load Balancing

Two products, and the layer number is the product

A Network Load Balancer works at layer 4. It forwards TCP connections on address and port and never opens the payload, which is why it can carry any protocol at all. An Application Load Balancer works at layer 7: it parses the HTTP request, so it can make decisions the layer 4 one is physically unable to make, and it pays for that in cost and in latency. Choosing between them is choosing how deep you need to read.

Linux · ip and ss

One command per layer, and they refuse to overlap

ip link shows layer 2: interfaces, MAC addresses, and whether the link is up. ip addr and ip route show layer 3: which IP networks this host sits on, and where a packet for anywhere else goes. ss -tulpn shows layer 4: which ports are open and which process owns each one. No single command spans two layers, because no layer keeps another layer’s state.

OSI is a reference model. No stack implements it exactly, TCP/IP folds three of its layers into one, and layers 5 and 6 have almost no protocols to their name. It survives anyway, because it is the only vocabulary everyone shares: layer 7 firewall, layer 4 load balancer, layer 2 problem, layer 3 switch. You are learning it in order to argue in it, and the honest sentence to give an interviewer is that OSI is what people say and TCP/IP is what runs.

07 Interview questions

What they actually ask

OSI is almost always the opening question of a networking round, because it takes ten seconds to ask and instantly separates a memorised list from an understood one. Expect to be pushed one level past the list every single time.

What is the OSI model, and why seven layers instead of one design?

It is a reference model published by ISO that splits network communication into seven layers, each owning one problem and each reachable only through the layer under it. The split buys three things: a layer can be replaced without touching the others, so moving from copper to fibre changes layer 1 and nothing above it; seven small problems are solvable where one enormous one is not; and two vendors who agree on a layer boundary interoperate without agreeing on anything else. Add that it is a reference model rather than an implementation, because no shipped stack is built exactly this way.

Name the seven layers in order, and tell me which one is layer 1.

Bottom up: physical, data link, network, transport, session, presentation, application. Physical is layer 1 and application is layer 7, never reversed. The mnemonic going up is Please Do Not Throw Sausage Pizza Away, and going down from 7 it is All People Seem To Need Data Processing. Say which direction you are reciting in before you start, because the third item counted from the top is session and the third from the bottom is network.

What actually makes something a layer, rather than just a module?

Two rules. It uses only the service offered by the layer directly below it, never reaching around that layer, and it offers only its own service to the layer directly above it, hiding how the job gets done. Those two are what make the swap free: TCP behaves identically over Ethernet, Wi-Fi or a modem link because it never learns which is underneath. Break either rule and you still have modules, but you no longer have layers, because replacing one of them has stopped being safe.

What is a PDU, and what is it called at each layer?

A PDU is a protocol data unit, the name for one unit of data at a given layer. Bits at physical, a frame at data link, a packet at network, a segment at transport, except UDP, whose unit is a datagram. At session, presentation and application nobody uses a special word; it is only data, or a message. The trap is the word datagram, which is used at two layers: an IP datagram is the layer 3 packet, and a UDP datagram is the layer 4 unit.

What does the transport layer give you that the network layer does not?

Delivery to a process rather than to a machine. IP gets a packet to the correct host and stops there, but that host is running fifty programs and nothing in the IP header says which of them the bytes are for. Transport adds two 16-bit port numbers so the receiving stack can hand the payload to the right socket. Reliability and flow control come with TCP but they are not the defining difference, because UDP is a transport protocol and offers neither.

The session layer and the transport layer both talk about connections. What separates them?

Transport keeps a connection alive so that bytes arrive in order and none go missing. Session sits above that and manages the dialogue itself: whose turn it is to send, where the conversation restarts after a failure, and when the whole exchange is finished, which can outlive several transport connections. A file transfer that resumes from its last checkpoint after the TCP connection dropped is doing session work, and TCP has no idea the transfer was ever a thing. In real stacks nothing separate does this, and the application holds the state itself.

The data link layer has two sublayers. Name them and say what each owns.

The upper one is LLC, IEEE 802.2: it records which network-layer protocol the frame is carrying, and can offer optional flow and error control upwards. The lower one is MAC: it owns the 48-bit hardware addressing and decides who may transmit and when, which is CSMA/CD on classic Ethernet and CSMA/CA on 802.11. Worth adding the real-world clause: Ethernet II frames carry a 2-byte EtherType instead of an 802.2 LLC header, so on a modern LAN the LLC sublayer is often not on the wire at all.

What is encapsulation? Walk me down the stack.

Each layer takes what it was handed from above, treats it as opaque payload, adds its own header, and passes the result down. The application data becomes TCP’s payload under a 20-byte header and is now a segment; the segment becomes IP’s payload under another 20-byte header and is now a packet; the packet becomes Ethernet’s payload under a 14-byte header with a 4-byte trailer and is now a frame. The receiver reverses it exactly, each layer stripping only the header its own peer added, which is what makes the phrase peer layers mean something.

Why does the TCP/IP model have no session or presentation layer?

Hard

An application hands the stack a 4000-byte message, and the Ethernet payload underneath is capped at 1500 bytes. Decide which layer should own the job of splitting it, argue your choice against the layer above and the layer below using the two rules, and say what each rejected layer would have to be told that it is not allowed to ask for. Then name the two places in a real TCP/IP stack where a split of this kind actually happens, and say which one is preferred.

Follow-up

All three candidate layers could technically do it, and two of them really do. The question is not what is possible but which choice keeps both rules intact, and the option that loses is a real standardised mechanism rather than a mistake, so naming it is not enough on its own.

Show the hint

For each candidate, ask what it would have to learn from a layer it is not permitted to question. Then ask what happens to all the other pieces when exactly one piece goes missing.