Ravindra BagaleCourses & study guides

3. OSI Model, TCP/IP Model, TCP vs UDP and the 3-Way Handshake

3.1 The Seven OSI Layers

By Last updated:

OSI model ISO ne banavla. Real internet TCP/IP var chalto, pan engineers roj OSI chi bhasha boltat – "Layer 7 firewall", "Layer 4 load balancer". Mnemonic lakshat theva: All People Seem To Need Data Processing (7 → 1).

   Sender                                                    Receiver
 +------------------+        (logical communication)      +------------------+
 | 7 Application    | <---------------------------------> | 7 Application    |
 | 6 Presentation   | <---------------------------------> | 6 Presentation   |
 | 5 Session        | <---------------------------------> | 5 Session        |
 | 4 Transport      | <------------ segments -----------> | 4 Transport      |
 | 3 Network        | <------------ packets ------------> | 3 Network        |
 | 2 Data Link      | <------------ frames -------------> | 2 Data Link      |
 | 1 Physical       | ============== bits ==============  | 1 Physical       |
 +------------------+     cable / fibre / radio           +------------------+
   Data goes DOWN the stack (encapsulation) and UP at the receiver (decapsulation)
# Layer Main function Protocols / standards Devices Data unit (PDU)
7 Application Interface for user applications; network services HTTP, HTTPS, FTP, SMTP, DNS, SSH, DHCP, SNMP Gateways, L7 load balancers (AWS ALB), WAF Data / message
6 Presentation Translation, encryption, compression, data format TLS/SSL, JPEG, PNG, ASCII, UTF-8, MPEG — Data
5 Session Establish, maintain, terminate sessions; checkpoints NetBIOS, RPC, SQL session, PPTP — Data
4 Transport End-to-end delivery, ports, segmentation, flow & error control TCP, UDP L4 load balancers (AWS NLB), firewalls Segment (TCP) / Datagram (UDP)
3 Network Logical addressing (IP), routing between networks IPv4, IPv6, ICMP, ARP*, OSPF, BGP Router, L3 switch Packet
2 Data Link Physical (MAC) addressing, framing, error detection on a link Ethernet (802.3), Wi-Fi (802.11), PPP, VLAN (802.1Q) Switch, bridge, NIC Frame
1 Physical Transmission of raw bits over the medium; voltages, connectors RJ-45, fibre, DSL, Bluetooth radio, 802.11 PHY Hub, repeater, cables, modem Bit

* ARP works between Layer 2 and 3 (it maps IP → MAC), so books place it in either.

Layer-by-layer in simple words

  • Layer 7 – Application: What the user's program speaks. The browser speaks HTTP; ssh speaks the SSH protocol. Not the application itself (Chrome), but the protocol it uses.
  • Layer 6 – Presentation: Makes data understandable to both sides — character encoding (UTF-8), compression (gzip) and encryption (TLS). HTTPS = HTTP + TLS.
  • Layer 5 – Session: Opens, manages and closes a conversation (session). E.g. keeping you logged in, resuming a large download.
  • Layer 4 – Transport: Adds source and destination port numbers. TCP is reliable (3-way handshake, acknowledgements, retransmission, ordering) — used by HTTP, SSH, MySQL. UDP is fast and connectionless — used by DNS, video calls, online games.
  • Layer 3 – Network: Adds source and destination IP addresses and chooses the path (routing). Routers work here. ping (ICMP) tests this layer.
  • Layer 2 – Data Link: Adds MAC addresses (48-bit hardware address like 0a:1b:2c:3d:4e:5f) to move frames within one local network. Switches work here.
  • Layer 1 – Physical: Converts frames into electrical signals, light pulses or radio waves.

Why this matters for security

Attacks happen at every layer: cable tapping (L1), ARP spoofing and MAC flooding (L2), IP spoofing and ICMP floods (L3), SYN floods and port scans (L4), session hijacking (L5), SSL stripping (L6), SQL injection and XSS (L7). Defences are layered the same way – this is called defence in depth (बहुस्तरीय संरक्षण).

Ravindra Bagale's Tip

Many students put a switch at Layer 3 and a router at Layer 2. Remember: a normal switch uses MAC addresses – Layer 2; a router uses IP – Layer 3. Candidates have reported the interview question "Which layer does a router work at?" at companies like PwC. Answer it confidently.

Practice task

Draw the 7 layers from memory. For each, write one protocol, one device and one attack.