OSI Model and TCP/IP Protocol Suite

Overview

• What you’ll learn: The OSI 7-layer reference model, the TCP/IP 4-layer model, encapsulation and decapsulation, and the protocols operating at each layer.
• Prerequisites: Module 1 – Linux Fundamentals completed
• Estimated reading time: 20 minutes

Introduction

Every time you browse a website, send an email, or transfer a file, data travels through a complex stack of networking protocols. Understanding how these protocols are organized into layers is fundamental to diagnosing network issues, configuring servers, and building networked applications.

Two models describe this layered architecture: the OSI (Open Systems Interconnection) model with seven layers, and the TCP/IP model with four layers. While the OSI model is primarily a theoretical reference, the TCP/IP model reflects how the Internet actually works. In this lesson, you will learn both models, understand how data is encapsulated as it moves down the stack, and identify key protocols at each layer.

The OSI 7-Layer Model

The OSI model was developed by the International Organization for Standardization (ISO) in 1984 as a universal framework for understanding network communication. It divides the communication process into seven distinct layers, each with a specific responsibility.

Layer 7 – Application Layer

The Application layer is the closest to the end user. It provides network services directly to applications such as web browsers, email clients, and file transfer utilities. Protocols at this layer include:

• HTTP/HTTPS: Web browsing
• SMTP/IMAP/POP3: Email
• FTP/SFTP: File transfer
• DNS: Domain name resolution
• SSH: Secure remote access

Layer 6 – Presentation Layer

The Presentation layer handles data translation, encryption, and compression. It ensures that data sent by the Application layer of one system can be read by the Application layer of another system. Examples include SSL/TLS encryption, JPEG compression, and character encoding (ASCII, UTF-8).

Layer 5 – Session Layer

The Session layer establishes, manages, and terminates connections (sessions) between applications. It handles session checkpointing and recovery. Protocols such as NetBIOS and RPC operate at this layer.

Layer 4 – Transport Layer

The Transport layer provides end-to-end communication between processes. It is responsible for segmentation, flow control, and error recovery. The two primary protocols are:

• TCP (Transmission Control Protocol): Reliable, connection-oriented, guarantees delivery through acknowledgments and retransmission.
• UDP (User Datagram Protocol): Unreliable, connectionless, faster but with no delivery guarantee. Used for streaming, DNS queries, and gaming.

# View active TCP connections
$ ss -tn
State   Recv-Q  Send-Q  Local Address:Port   Peer Address:Port
ESTAB   0       0       192.168.1.10:22      192.168.1.5:54312
ESTAB   0       0       192.168.1.10:443     203.0.113.50:38721

# View listening UDP sockets
$ ss -uln
State   Recv-Q  Send-Q  Local Address:Port   Peer Address:Port
UNCONN  0       0       0.0.0.0:53           0.0.0.0:*
UNCONN  0       0       0.0.0.0:68           0.0.0.0:*

Layer 3 – Network Layer

The Network layer handles logical addressing and routing. It determines the best path for data to travel from source to destination across multiple networks. The primary protocol is IP (Internet Protocol), which provides IP addresses and routing. Other protocols include ICMP (used by ping) and IGMP (multicast).

# View the IP routing table
$ ip route show
default via 192.168.1.1 dev ens33 proto dhcp metric 100
192.168.1.0/24 dev ens33 proto kernel scope link src 192.168.1.10 metric 100

Layer 2 – Data Link Layer

The Data Link layer provides node-to-node data transfer between two directly connected nodes. It handles MAC (Media Access Control) addressing, frame formatting, and error detection. Ethernet and Wi-Fi (802.11) are Layer 2 technologies.

# View MAC addresses of network interfaces
$ ip link show
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP
    link/ether 00:0c:29:ab:cd:ef brd ff:ff:ff:ff:ff:ff

Layer 1 – Physical Layer

The Physical layer deals with the actual transmission of raw bits over a physical medium — copper cables, fiber optic, or wireless radio waves. It defines electrical signals, connectors, and data rates.

The TCP/IP 4-Layer Model

The TCP/IP model is the practical model used by the Internet. It consolidates the OSI model’s seven layers into four:

• Application Layer (OSI Layers 5-7): HTTP, FTP, SSH, DNS, SMTP
• Transport Layer (OSI Layer 4): TCP, UDP
• Internet Layer (OSI Layer 3): IP, ICMP, ARP
• Network Access Layer (OSI Layers 1-2): Ethernet, Wi-Fi

# Comparison of OSI and TCP/IP layers:
#
# OSI Model              TCP/IP Model
# ─────────────────      ────────────────
# 7. Application    ─┐
# 6. Presentation    ├─  Application
# 5. Session        ─┘
# 4. Transport      ───  Transport
# 3. Network        ───  Internet
# 2. Data Link      ─┐
# 1. Physical       ─┘   Network Access

Encapsulation and Decapsulation

As data travels down the protocol stack from application to physical medium, each layer adds its own header (and sometimes a trailer) to the data. This process is called encapsulation. When data arrives at the destination, each layer removes its header in reverse order — this is decapsulation.

• Application data → Transport layer adds TCP/UDP header → Segment
• Segment → Internet layer adds IP header → Packet
• Packet → Network Access layer adds Ethernet header + trailer → Frame
• Frame → Physical layer converts to bits → Bits on the wire

# Capture packets to see encapsulation in action
$ sudo tcpdump -i ens33 -c 3 -nn
tcpdump: verbose output suppressed, use -v for full protocol decode
listening on ens33, link-type EN10MB (Ethernet), capture size 262144 bytes
10:15:01.123456 IP 192.168.1.10.22 > 192.168.1.5.54312: Flags [P.], seq 1:37, ack 1, win 502, length 36
10:15:01.123789 IP 192.168.1.5.54312 > 192.168.1.10.22: Flags [.], ack 37, win 511, length 0
10:15:01.234567 IP 192.168.1.10.22 > 192.168.1.5.54312: Flags [P.], seq 37:109, ack 1, win 502, length 72

Protocol Data Units at Each Layer

Each layer uses a specific term for its data unit:

• Application layer: Data / Message
• Transport layer: Segment (TCP) or Datagram (UDP)
• Internet layer: Packet
• Network Access layer: Frame
• Physical layer: Bits

Common Protocols by Layer

Here is a summary of the most important protocols you will encounter:

# Application Layer Protocols
HTTP   - Port 80   - Web traffic (unencrypted)
HTTPS  - Port 443  - Web traffic (encrypted via TLS)
SSH    - Port 22   - Secure remote shell
FTP    - Port 21   - File transfer
SMTP   - Port 25   - Email sending
DNS    - Port 53   - Name resolution
DHCP   - Port 67/68 - Dynamic IP assignment

# Transport Layer
TCP    - Connection-oriented, reliable
UDP    - Connectionless, best-effort

# Internet Layer
IPv4   - 32-bit addressing
IPv6   - 128-bit addressing
ICMP   - Diagnostics (ping, traceroute)

# Network Access Layer
Ethernet (802.3) - Wired LAN
Wi-Fi (802.11)   - Wireless LAN

Inspecting Layers on Linux

Linux provides powerful tools to inspect each layer of the network stack:

# Layer 2 – View Ethernet/MAC information
$ ip link show ens33
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP mode DEFAULT
    link/ether 00:0c:29:ab:cd:ef brd ff:ff:ff:ff:ff:ff

# Layer 3 – View IP addresses
$ ip addr show ens33
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500
    inet 192.168.1.10/24 brd 192.168.1.255 scope global ens33
    inet6 fe80::20c:29ff:feab:cdef/64 scope link

# Layer 4 – View active connections (TCP and UDP)
$ ss -tunap
Netid  State   Recv-Q  Send-Q  Local Address:Port  Peer Address:Port  Process
tcp    LISTEN  0       128     0.0.0.0:22           0.0.0.0:*          users:(("sshd",pid=1234,fd=3))
tcp    ESTAB   0       0       192.168.1.10:22      192.168.1.5:54312  users:(("sshd",pid=5678,fd=4))
udp    UNCONN  0       0       0.0.0.0:68           0.0.0.0:*          users:(("dhclient",pid=890,fd=6))

# Layer 7 – Test an application-layer protocol
$ curl -I https://example.com
HTTP/2 200
content-type: text/html; charset=UTF-8
content-length: 1256

Key Takeaways

• The OSI model provides a 7-layer theoretical framework for understanding network communication; the TCP/IP model is a practical 4-layer model used by the Internet.
• Each layer has a specific responsibility: Application (user services), Transport (end-to-end delivery), Internet/Network (routing and addressing), Network Access/Data Link + Physical (local delivery and transmission).
• Encapsulation adds headers at each layer as data moves down the stack; decapsulation removes them at the destination.
• Protocol Data Units have specific names: Data, Segment/Datagram, Packet, Frame, Bits.
• Linux tools like ip, ss, tcpdump, and curl allow you to inspect and troubleshoot each layer.

What’s Next

In Lesson 12, you will learn about IP Addressing, Subnetting, and CIDR — the foundation of how devices are identified and organized on networks. You will master IPv4 addressing, subnet calculations, and be introduced to IPv6.