Core CS · Computer Networks

Four layers that ship, seven that explain

OSI has seven layers and never shipped as a whole stack. TCP/IP has four and is running on the machine you are reading this on. Learn which OSI layer lands where and you can answer an OSI question about a TCP/IP network, which is exactly what the interview asks you to do.

Your stack has four layers, not seven, and the half of the mapping that costs marks is the top half. Three OSI layers arrive in one application box, which is why HTTPS carries its own encryption and why no packet capture you ever open will show you a session layer.

01 The idea

The stack on your machine has four layers

Open a packet capture on any machine you own and count what is stacked inside one arriving message. You will find a frame, an IP packet inside it, a TCP or UDP header inside that, and then the application’s own bytes. Four things, not seven. The document that says so is RFC 1122, published in 1989 and titled Requirements for Internet Hosts, and it names the four layers directly: link, internet, transport, application. It is worth knowing that it was written to describe what was already running, not to propose something new.

OSI came from the other direction. The seven-layer model is ISO/IEC 7498-1, and the committee wrote the model first and then set about writing protocols to fill it. Some layers got protocols people actually used. The session and presentation layers largely did not, which is the single fact that explains most of the mapping you are about to learn. A layer with no deployed protocol does not disappear from the diagram; it disappears from the wire, and its work reappears inside whatever protocol sits above it.

There is a second version of the TCP/IP model you will meet constantly, and it is not a trap. Many textbooks, and most Indian university syllabi, teach a five-layer model that splits the link layer back into a physical layer and a data link layer. It describes the same stack, and it keeps OSI’s bottom two separate because encoding bits onto a medium and framing them with MAC addresses are two genuinely different jobs to teach. Both versions are legitimate. What is not legitimate is a bare layer number with no model named, because the numbers move underneath you: whichever layer you call number 3 depends entirely on which version you drew.

Count from the bottom and say which model you are counting in. OSI 1 and 2 become link, OSI 3 becomes internet, OSI 4 stays transport, OSI 5, 6 and 7 become application. Every mapping question in this module is that one sentence applied to a protocol.

Reference modelA layered description of what a network has to do, written without reference to any particular product. OSI is one. It is a vocabulary and a division of labour, and nobody ever shipped a complete stack of it.

Protocol stackThe actual set of protocols running on a machine, one or more per layer, such as HTTP over TCP over IPv4 over Ethernet. TCP/IP is a stack first and a model second, which is the reverse of OSI.

PDUProtocol data unit: the name for the chunk a layer hands to the one below. A segment at transport, and a datagram if that transport is UDP. A packet, also called a datagram, at the internet layer. A frame at the link layer. Bits at physical.

02 Worked example

One HTTPS request, four layers deep

A laptop on a wired office network loads https://example.com. This one request is the example for the rest of the lesson, so fix it in your head now: HTTPS over TCP over IPv4 over Ethernet. Read the four boxes left to right and they are the request travelling down the stack, each layer wrapping what the layer above handed it.

ApplicationHTTPS. One layer holds the request format, the TLS encryption and the state that ties requests together. OSI 7, 6 and 5 all land here

→

TransportTCP to port 443. Same name and same job as OSI 4. Header 20 bytes with no options. The PDU is a segment

→

InternetIPv4. Header 20 bytes with no options, best effort, no promise of delivery. OSI 3, renamed. The PDU is a packet

→

LinkEthernet II. Framing, MAC addressing and the copper itself are one layer here. OSI 2 and 1 both land here. The PDU is a frame

The highlighted box is the one that costs marks. Three OSI layers arrive in it and nothing separates them, because there is no protocol boundary to separate them at. The encryption is TLS, which the browser links as a library and runs between HTTP and TCP; TCP has no idea it is there and hands over bytes it cannot read. The content encoding is named by HTTP itself in a header. The state that survives from one request to the next is held by the application too. In OSI’s vocabulary those are three separate layers of work. In the running stack they are three things one process does, which is why TCP/IP draws one box.

Now count the bytes on the way down, because this is the arithmetic interviewers use to check you understand what a layer costs. Ethernet carries an MTU of 1500 bytes, and the MTU is the size of the payload the link will carry, not the size of the frame. IPv4 takes 20 of those bytes for its header when it carries no options, leaving 1500 − 20 = 1480. TCP takes another 20 with no options, leaving 1480 − 20 = 1460 bytes of application data. That 1460 is the maximum segment size you will see quoted for TCP over IPv4 on Ethernet, and now you know it is not a magic constant but two headers subtracted from an MTU.

Two checks on the same sum. Swap TCP for UDP, whose header is a fixed 8 bytes, and the application gets 1500 − 20 − 8 = 1472 bytes instead. And the frame that actually goes on the wire is larger than 1500, because the Ethernet II header of 14 bytes and the 4-byte frame check sequence at the end sit outside the MTU entirely: 14 + 1500 + 4 = 1518 bytes. Subtracting those 14 bytes from the 1500 as well is the standard wrong answer.

03 Mechanics

Every OSI layer, and where it lands

One row per OSI layer, top to bottom. The second column is the answer to the mapping question, the third is the same answer in the five-layer version your syllabus may prefer, and the last is the protocol inventory you should be able to recite. Two rows have no protocol of their own at all, and those two rows are the whole reason the top of the mapping is three-into-one.

OSI layer	TCP/IP, RFC 1122	Five-layer version	PDU	Protocols you can name
7 Application	Application	Application	data	HTTP (port 80), HTTPS (443), DNS (53), SMTP (25), FTP (21 control, 20 data), SSH (22), DHCP (67 server, 68 client)
6 Presentation	Application	Application	data	`no protocol of its own` — TLS does the encryption, MIME types and gzip do the encoding, and both are named by the application protocol
5 Session	Application	Application	data	`no protocol of its own` — the TCP connection covers setup and teardown, and anything beyond that is the application protocol’s problem
4 Transport	Transport	Transport	segment for TCP, datagram for UDP	TCP (IP protocol number 6), UDP (17), SCTP (132)
3 Network	`Internet`	Network	packet, also called a datagram	IPv4, IPv6, ICMP (protocol 1), IGMP (2), OSPF (89)
2 Data link	`Link`	Data link	frame	Ethernet II / IEEE 802.3, Wi-Fi / IEEE 802.11, PPP, and ARP
1 Physical	`Link`	Physical	bit	1000BASE-T over twisted pair, the 802.11 radio, single-mode fibre, RS-232

Why 5, 6 and 7 collapse. Not because the jobs vanished, but because no separately addressable protocol ever took them on. A layer earns its box when something below it can be swapped out without the thing above noticing, and nothing on the wire ever announced “a presentation layer follows”. Encryption is the clearest case: TLS is a library the application links against, and it runs between HTTP and TCP without either of them getting a new field. TCP hands over bytes it cannot read and does not know they are encrypted. So the work happens, and there is still nothing to draw a line around.

Why 1 and 2 collapse. RFC 1122 treats the link layer as “the protocol used to communicate over the physical medium” and deliberately says almost nothing about the medium itself. That silence is a design decision and a famous one: because IP demands nothing of the hardware, the same IP ran over Ethernet, over telephone lines with PPP, over Wi-Fi and over fibre without a single change. The five-layer version splits the two back apart for teaching, and the split is real — encoding a voltage is a different job from writing a destination MAC address — but RFC 1122 has no reason to care which one you are doing.

Designed before the protocols, or after them. This is the difference that generates all the others. OSI’s committee produced the model and then tried to fit protocols to it, so the model contains layers nobody needed and its protocols arrived late and lost. TCP/IP was the other way round: the ARPANET switched over to TCP/IP on 1 January 1983, and RFC 1122 wrote the architecture down in 1989, six years after it was carrying traffic. That is why OSI has a crisp name for all seven layers and two of them, session and presentation, have no protocol you use daily.

Strict separation, or tolerated crossing. OSI insists a layer speaks only to the layers immediately above and below it. TCP/IP does not enforce that, and its own protocols break it in the open. ARP is used by the internet layer to find a MAC address, yet it is not carried inside an IP packet at all — it rides directly in an Ethernet frame with EtherType 0x0806, alongside IPv4’s 0x0800. The TCP checksum is worse: TCP computes it over a pseudo-header containing the source IP address, the destination IP address, the protocol number and the segment length, all of which belong to the layer below it. IPv4’s own checksum covers only the IP header and nothing else, so the transport layer reaches down and protects itself.

Those four notes compress into a table you can reproduce under exam pressure. Learn it as pairs of opposites rather than as two lists.

Question	OSI	TCP/IP
How many layers	7	4 in RFC 1122, 5 in most textbooks
Which came first	the model, then protocols written to fit it	the protocols, then a model written to describe them
The standard document	`ISO/IEC 7498-1`	`RFC 1122`
Layer separation	strict; a layer talks only to its neighbours	`crossing tolerated` — ARP and the TCP pseudo-header both break it
Network layer service	connectionless and connection-oriented, both offered	`connectionless only` — IP is best effort and promises nothing
Transport layer service	`connection-oriented and reliable only`	both; TCP is reliable, and UDP is deliberately not
Ever deployed as a whole stack	`no`	yes, and it is what your machine is running now
What it is used for today	vocabulary, teaching, and the layer number in the question	the actual traffic

The reliability row is the one people get backwards. OSI’s transport layer is defined to provide a reliable end-to-end connection, so an OSI transport is always connection-oriented. TCP/IP looked at that and refused: it standardised UDP alongside TCP precisely so an application could opt out of reliability and keep the latency, which is what DNS lookups, video calls and online games all do. Notice that the network layer row runs the opposite way, with OSI offering two modes and TCP/IP offering one. The two rows are not a pattern of “OSI does more”; they are two independent design choices that happen to point in opposite directions.

04 Cheat sheet

The mapping on one card

What they ask	The answer	The trap
Name the four TCP/IP layers, bottom to top	`link, internet, transport, application`	`saying network for the layer above link` — TCP/IP calls it internet; network is OSI’s word
Which OSI layers collapse into which	`1 and 2 into link, 3 into internet, 4 stays transport, 5 and 6 and 7 into application`	Giving only half the mapping. Almost everyone merges the bottom two and then forgets the top three.
PDU at each layer, bottom to top, in the five-layer stack	`bit, frame, packet, segment, data`	`calling everything a packet` — and forgetting a UDP transport PDU has its own name, datagram
Header sizes with no options	`IPv4 20 B, TCP 20 B, UDP 8 B fixed, Ethernet II 14 B plus a 4 B FCS trailer`	Quoting 20 for IPv4 without the words “without options”. Options take both IPv4 and TCP up to 60.
Most application data in one Ethernet frame over TCP	`1500 − 20 − 20 = 1460 bytes`	Subtracting the 14-byte Ethernet header too. The MTU is the payload the link carries, not the frame.
Where TLS sits	`inside the application layer of TCP/IP`; OSI would call the same work presentation	`the presentation layer of TCP/IP` — a layer that does not exist in the model you were asked about
Which model is your machine running	`TCP/IP, always`	Treating the two as rival stacks you could choose between. Only one of them was ever deployed whole.
Why OSI is still on the syllabus	`it is the shared vocabulary` — layer 2 switch, layer 3 router, layer 7 firewall are all OSI numbers	Calling OSI obsolete and then using an OSI layer number in your very next sentence.

Say which model, then answerOpen with “using the four-layer RFC 1122 model” or “using the five-layer version”. Both are correct and the mark scheme is one of them, so naming yours costs one clause and protects the whole answer.

Every layer number in the industry is an OSI numberA layer 2 switch, a layer 3 router, a layer 4 load balancer, a layer 7 firewall. Not one of those boxes is running an OSI stack; every one of them is forwarding IP. The numbers survived because the protocols they describe needed names.

One identifier per layerA name at the application layer, a port number at transport, an IP address at the internet layer, a MAC address at the link layer. If you can name the identifier a device reads, you can name the layer it works at.

05 Where & why

Where the layer numbers are real product names

This mapping is not a diagram that lives only in exam papers. It is the layout of a packet capture, the reason one wireless standard document covers two OSI layers, and the difference between two numbered ranges of firewall rule on a switch you can buy.

Wireshark

The four layers, drawn by a tool that never mentions OSI

Click one packet and the detail pane stacks collapsible rows: Ethernet II, then Internet Protocol Version 4, then Transmission Control Protocol, then the application protocol, which for the encrypted request from section 02 reads Transport Layer Security. Four protocol rows, in exactly the order it was wrapped. Above them sits one more row, Frame, and that one is Wireshark’s own capture metadata rather than a layer. Nothing is labelled presentation or session, because there is nothing in the bytes to label.

IEEE 802.11ax · Wi-Fi 6

One standard covering both of the layers that collapse

The 802.11 family specifies the radio and the MAC sublayer in the same document: how a symbol is modulated onto a channel, and how a frame is addressed and when a station may transmit. That is OSI 1 and OSI 2 written by one committee, which is a fair hint at why RFC 1122 saw no reason to keep them apart.

OpenSSH

One application protocol doing three layers of OSI work

An ssh session on TCP port 22 negotiates keys, encrypts everything after that, optionally compresses it, and multiplexes several logical channels down the one connection so a file transfer and a shell share it. Encryption and compression are presentation work and channel multiplexing is session work, and all of it is one application-layer protocol.

Cisco IOS

The rule number tells you the layer

A standard access list numbered 1 to 99 can match only the source IP address, so it is a layer 3 filter. An extended list numbered 100 to 199 can also match protocol and port numbers, which makes it layer 3 and 4. Meanwhile show mac address-table is a layer 2 view of the same box. Three OSI numbers, one operating system, and not one packet of an OSI stack passing through it.

Two sentences to have ready. TCP/IP is the stack that is running and OSI is the vocabulary everyone describes it in, which is why a model that shipped nothing is still the first thing on the syllabus. And the interview question is almost always phrased in OSI terms about a TCP/IP network, so the useful skill is not choosing a model but translating between them in one breath.

06 Interview questions

What they actually ask

Layer models are the first two minutes of almost every networking round, because they cost nothing to ask and separate the recited list from the understood one instantly. Expect to be given a protocol and asked to place it, then asked why.

Name the layers of the TCP/IP model, bottom to top.

Link, internet, transport, application, as RFC 1122 defines them. The link layer moves frames over one physical medium, the internet layer moves packets between networks using IP, the transport layer moves segments end to end with TCP or UDP, and the application layer is the protocol itself, such as HTTP or DNS. Say “internet” and not “network” for the layer directly above link, because network is OSI’s word for that layer and using it suggests you have merged the two models.

Map the seven OSI layers onto the TCP/IP ones.

OSI 1 and 2 collapse into the link layer, OSI 3 becomes the internet layer, OSI 4 stays as the transport layer, and OSI 5, 6 and 7 all collapse into the application layer. So the mapping is two-into-one at the bottom, one-to-one in the middle twice, and three-into-one at the top. The top collapse is the half people forget, and it is the more interesting one.

Is the TCP/IP model four layers or five? Which one is right?

Both are used and both are accepted. RFC 1122 defines four, with a single link layer. Most textbooks and most university syllabi teach five, splitting that link layer back into physical and data link because they are different jobs worth teaching separately. Neither is wrong, so name the one you are using in your opening clause; the layer numbers differ between them, and an unlabelled number is what actually loses the mark.

What is the PDU at each layer?

Bits at the physical layer, a frame at the data link layer, a packet at the network or internet layer, and a segment at the transport layer. The exception worth naming unprompted is UDP, whose transport PDU is called a datagram rather than a segment. Calling everything a packet is the habit interviewers listen for.

Which came first, the model or the protocols, and why does it matter?

For OSI the model came first and the protocols were written to fit it afterwards. For TCP/IP the protocols came first: the ARPANET switched to TCP/IP on 1 January 1983 and RFC 1122 described the architecture in 1989. It matters because it explains every other difference between them. OSI has layers no protocol ever needed, while TCP/IP has exactly the layers its working protocols turned out to occupy.

What was the session layer for, and what does that job in TCP/IP?

OSI’s session layer handled dialogue control, checkpointing and resuming a long transfer after a break. In TCP/IP no layer owns that. The TCP connection covers opening and closing the conversation, and anything beyond that is handled inside the application protocol itself, which is why the session layer has no protocol you can name and no field you can point at in a capture. That absence is exactly why it collapses into the application layer.

Give an example of TCP/IP not respecting strict layering.

ARP is the clearest one. The internet layer needs a MAC address before IP can be sent anywhere, so it uses ARP, but ARP is not carried inside an IP packet at all — it rides directly in an Ethernet frame with EtherType 0x0806, while IPv4 uses 0x0800. So a protocol serving layer 3 lives at layer 2. OSI would forbid that; TCP/IP tolerates it because the protocols were already working before anyone drew the diagram.

OSI’s transport layer is always reliable. Is TCP/IP’s?

No, and that is deliberate. OSI defines the transport layer as providing a reliable, connection-oriented end-to-end service, so there is no unreliable option in it. TCP/IP standardised UDP alongside TCP precisely so an application can drop reliability and keep the latency, which is what DNS, voice and video calls and online games do. The network layer runs the opposite way: OSI offers connectionless and connection-oriented service there while IP offers only best-effort delivery.

Why is that layer called internet in TCP/IP rather than network?

Because its job is not to run a network, it is to join networks that already work. Each link layer technology already delivers frames inside one network; IP’s contribution is an address space and a forwarding rule that let a packet cross from one to the next regardless of what those networks are made of. The name is the architecture’s thesis in one word, and the five-layer teaching version quietly renames it back to network, which is worth knowing before you are marked on it.

If OSI was never deployed, why is it still taught?

Hard

OSI reserved a whole layer for encoding and encryption and TCP/IP has no such layer, yet every application on your machine encrypts. Argue what the TCP/IP architecture gained by refusing to standardise that layer and what it paid for the refusal, naming one concrete cost that shows up as the same work being done again in more than one application protocol. Then explain why the same argument does not lead to the same answer for reliability, where TCP/IP did standardise a layer.

Follow-up

Both halves are the same design question asked twice, and TCP/IP answered it in opposite directions. The hard part is naming the property that makes reliability worth standardising and encoding not, without falling back on “because TCP is important”.

Show the hint

Count how many different right answers each of the two questions has: how many reasonable ways there are to make a byte stream reliable, against how many reasonable ways there are to encode and encrypt a payload. Compare the two counts before you write anything.