Chapter 6 — OSI Layers: The Network Stack

The OSI model is a way of thinking about how data travels across a network, broken into 7 layers. Each layer has a specific job and talks to the layers above and below it.

The Simple Version (5-year-old)

Imagine sending a birthday gift to a friend:

You write a card (application — your message).
You put it in a box (presentation — packaged properly).
You label it with a tracking number (session — identify this shipment).
You put it in a truck (transport — moves it reliably).
The truck follows road signs (network — routing).
The truck drives on the actual road (data link — the physical network).
The road itself (physical — the wire/fiber/air).

Data works the same way — each layer wraps the data from the layer above and hands it down to the layer below.

The OSI Model vs The TCP/IP Model

The OSI model is a theoretical 7-layer framework. The TCP/IP model is what the internet actually uses — 4 layers that map onto OSI.

OSI Model                    TCP/IP Model         Protocols
┌─────────────────────┐      ┌──────────────────┐
│ L7  Application     │      │                  │  HTTP, HTTPS, DNS, FTP, SMTP
├─────────────────────┤      │  Application     │  WebSocket, gRPC, SSH
│ L6  Presentation    │      │                  │  TLS/SSL, gzip, JSON, Base64
├─────────────────────┤      ├──────────────────┤
│ L5  Session         │      │  (part of App)   │  TLS sessions, RPC sessions
├─────────────────────┤      ├──────────────────┤
│ L4  Transport       │      │  Transport       │  TCP, UDP, QUIC, SCTP
├─────────────────────┤      ├──────────────────┤
│ L3  Network         │      │  Internet        │  IPv4, IPv6, ICMP, BGP
├─────────────────────┤      ├──────────────────┤
│ L2  Data Link       │      │                  │  Ethernet, Wi-Fi (802.11)
├─────────────────────┤      │  Network Access  │  ARP, PPP, VLAN (802.1Q)
│ L1  Physical        │      │                  │  Copper, Fiber, Radio waves
└─────────────────────┘      └──────────────────┘

In practice, engineers talk about layers using OSI numbers (L3, L4, L7) even when they mean the TCP/IP model. "L7 load balancer" means it operates at the Application layer.

Important note: TLS doesn't fit neatly into OSI. TLS spans functionality across L4-L7 — session establishment (L5), encryption/encoding (L6), and application security (L7). In practice, just think of TLS as "between TCP and HTTP."

Encapsulation — Wrapping Data as It Goes Down

When data travels from your browser to Netflix, each layer wraps the data from the layer above with its own header. This is encapsulation.

Your HTTP GET request (bytes)
        │
        │ L6/L7: TLS wraps it
        ▼
[TLS Record Header | Encrypted HTTP data]
        │
        │ L4: TCP wraps it
        ▼
[TCP Header | TLS Record]
        │
        │ L3: IP wraps it
        ▼
[IP Header | TCP Header | TLS Record]
        │
        │ L2: Ethernet wraps it
        ▼
[Ethernet Frame Header | IP Header | TCP Header | TLS Record | FCS]
        │
        │ L1: transmitted as bits
        ▼
10110101 00011011 ... (electrical signal on wire / light on fiber / radio waves)

On the receiving end, each layer unwraps (decapsulates):

Bits arrive at Netflix's server
  → L1 converts to bytes
  → L2 strips Ethernet header, checks FCS
  → L3 strips IP header, checks destination IP
  → L4 strips TCP header, reorders segments
  → L6 decrypts TLS
  → L7 parses HTTP request
  → Application processes "GET /"

Layer 1 — Physical

What it does: Transmits raw bits (0s and 1s) over a physical medium.

Doesn't know about: Addresses, packets, protocols. Just bits.

Media types:

Copper wire (Cat5e/Cat6):   Electrical voltage changes represent bits
                            Max: 10 Gbps (10GBASE-T), ~100m distance

Fiber optic:                Pulses of light represent bits
                            Single-mode: 10–400 Gbps, 100+ km distance
                            Multi-mode:  10–100 Gbps, ~500m distance

Wi-Fi (802.11ax/Wi-Fi 6):  Radio waves at 2.4 GHz / 5 GHz / 6 GHz
                            Max: ~9.6 Gbps theoretical (real-world ~1-2 Gbps)

5G NR:                      Radio waves, licensed spectrum
                            Max: ~20 Gbps theoretical (real-world ~500 Mbps)

Devices at L1: Network interface card (NIC), hubs (dumb repeaters), antennas, modems.

In Netflix's journey: Your bytes travel as light pulses in fiber optic cables under the ocean between continents.

Layer 2 — Data Link

What it does: Transfers data between two directly connected devices (same network). Handles framing, addressing within the local network, and error detection.

Key concept: MAC address — a hardware address (48 bits, like 00:1A:2B:3C:4D:5E), unique per network interface card. Used for addressing within a local network.

Ethernet Frame Structure

┌──────────────┬──────────────┬──────────────┬────────────────┬─────┐
│ Dst MAC      │ Src MAC      │ EtherType    │ Payload        │ FCS │
│ (6 bytes)    │ (6 bytes)    │ (2 bytes)    │ (46-1500 bytes)│ 4B  │
└──────────────┴──────────────┴──────────────┴────────────────┴─────┘

Dst/Src MAC: Who this frame is for, who sent it (within local network only).
EtherType: What's inside — 0x0800 = IPv4, 0x86DD = IPv6, 0x0806 = ARP.
FCS (Frame Check Sequence): CRC checksum to detect bit errors. Corrupted frames are dropped.

ARP — Address Resolution Protocol

When your laptop wants to send a packet to 192.168.1.1 (your router), it needs the router's MAC address first.

Your laptop broadcasts (to all devices on LAN):
  "Who has IP 192.168.1.1? Tell 192.168.1.105"

Router responds (unicast):
  "I have 192.168.1.1. My MAC is 00:11:22:33:44:55"

Your laptop caches this (ARP cache) and uses MAC 00:11:22:33:44:55 for the frame.

Note: When your packet leaves your local network, L2 Dst MAC changes at every hop — each router rewrites the Ethernet frame with the next router's MAC. The L3 IP addresses don't change (except with NAT).

Devices at L2: Switches (MAC address tables, forward frames to the right port), Wi-Fi access points, bridges.

VLANs — Virtual Local Area Networks

A VLAN logically divides one physical network into isolated segments. Frames carry a VLAN tag (802.1Q):

[Dst MAC | Src MAC | 0x8100 VLAN tag | VLAN ID (12-bit) | EtherType | Payload | FCS]

A datacenter might use VLANs to separate traffic types: management traffic on one VLAN, web traffic on another, storage traffic on another — isolated even on the same physical switches.

Layer 3 — Network

What it does: Routes packets from source to destination across multiple networks. This is where the internet happens.

Key protocols: IPv4, IPv6, ICMP, BGP, OSPF.

IPv4 Packet Structure

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
┌────────┬─────────┬──────────────────────────────────────────────┐
│Version │  IHL   │ DSCP / ECN        │     Total Length          │
├────────┴─────────┴──────────────────────────────────────────────┤
│        Identification               │Flags│  Fragment Offset    │
├─────────────────────────────────────────────────────────────────┤
│      TTL          │    Protocol     │       Header Checksum     │
├─────────────────────────────────────────────────────────────────┤
│                      Source IP Address                          │
├─────────────────────────────────────────────────────────────────┤
│                    Destination IP Address                       │
└─────────────────────────────────────────────────────────────────┘

Key fields:

TTL: Decremented at each router. Packet dropped when 0. Prevents routing loops.
Protocol: What's inside — 6 = TCP, 17 = UDP, 1 = ICMP.
Source/Dest IP: The globally routable addresses. These don't change across the internet (except at NAT).
DSCP: Differentiated Services Code Point — Quality of Service marking. Netflix marks video packets with a higher priority so routers handle them before background traffic.

IPv6 Packet Structure

┌──────────┬───────────────┬───────────────┬───────────────────────┐
│ Version  │ Traffic Class │  Flow Label   │                       │
├──────────┴───────────────┴───────────────┤  Payload Length       │
│  Next Header  │  Hop Limit               │                       │
├───────────────┴──────────────────────────┴───────────────────────┤
│                                                                  │
│                    Source IPv6 Address (128 bits)                │
│                                                                  │
├──────────────────────────────────────────────────────────────────┤
│                                                                  │
│                  Destination IPv6 Address (128 bits)             │
│                                                                  │
└──────────────────────────────────────────────────────────────────┘

IPv6 improvements over IPv4:

Fixed 40-byte header (no variable-length options) — faster routing
No fragmentation at routers (done at source only)
No broadcast — uses multicast
Built-in IPsec support
No ARP — uses NDP (Neighbor Discovery Protocol)

ICMP — Internet Control Message Protocol

ICMP is L3's "error and diagnostic" protocol. Lives inside IP packets (Protocol=1).

ping www.netflix.com
  → Sends ICMP Echo Request to 52.38.36.82
  ← Receives ICMP Echo Reply
  → Measures RTT (Round-Trip Time)

traceroute www.netflix.com
  → Sends packets with TTL=1 (dies at first router → ICMP Time Exceeded)
  → Sends packets with TTL=2 (dies at second router)
  → ... until destination reached
  → Maps the path and latency at each hop

Devices at L3: Routers, Layer 3 switches, firewalls (inspect IP addresses).

Layer 4 — Transport

What it does: End-to-end communication between applications. Multiplexes multiple conversations over one IP address using ports. TCP adds reliability; UDP adds speed.

Already covered in depth in Chapter 3 (TCP: Reliable Delivery).

Key addition — stateful firewalls live at L4:

Firewall rule example:
  ALLOW TCP from 0.0.0.0/0 to 10.0.4.55 port 443   (incoming HTTPS)
  ALLOW TCP from 10.0.4.55 to 0.0.0.0/0 (ESTABLISHED, RELATED)  (return traffic)
  DENY all other

Stateful = firewall tracks TCP state machine.
  SYN from outside → creates state table entry.
  Response ACK from inside → matches state → allowed.
  SYN from outside with no prior SYN → rejected (no state entry).

Devices at L4: Firewalls, L4 load balancers, NAT routers.

Layer 5 — Session

What it does: Manages sessions — persistent, stateful conversations between applications. Establishes, maintains, and terminates sessions.

In practice, this layer is rarely spoken of separately. TLS session management, HTTP keep-alive, WebSocket connections, and database sessions all fit here conceptually.

Layer 6 — Presentation

What it does: Data translation, encoding, and encryption. Makes sure sender's data format is understood by receiver.

In practice:

TLS/SSL encryption (encrypts L7 data)
Compression (gzip, Brotli)
Character encoding (UTF-8, ASCII)
Serialization (JSON → bytes, Protobuf, XML)

Layer 7 — Application

What it does: The actual protocol your application uses. This is where HTTP, DNS, SMTP, WebSocket, gRPC live.

This is the layer you write code against as a web developer. HTTP request methods, headers, status codes — all L7.

Devices at L7: Web servers (Nginx, Apache), API gateways, L7 load balancers, WAFs (Web Application Firewalls), CDNs.

Where Devices Operate

L7   WAF, API Gateway, L7 Load Balancer, CDN, Web Server, App Server
     (read HTTP headers, URLs, cookies — full request inspection)
     │
L6   TLS terminator (Nginx, Envoy)
     (decrypt/encrypt, compress/decompress)
     │
L5   Session manager
     (TLS session resumption, connection pools)
     │
L4   L4 Load Balancer, Firewall, NAT
     (read TCP/UDP, ports — no content inspection)
     │
L3   Router
     (read IP addresses only — just forward the packet)
     │
L2   Switch
     (read MAC addresses — forward within local network)
     │
L1   Hub, NIC, fiber, copper, Wi-Fi radio
     (just move bits)

The higher the layer, the more a device knows about your traffic — and the more it can do (inspect, block, route by content). The lower the layer, the faster and dumber the device.

Real Packet Journey for Your Netflix Request

Your browser creates:  GET / HTTP/2   (L7)
TLS encrypts it        (L6)
TCP segments it        (L4): [SrcPort:54321 DstPort:443 Seq:1000 | encrypted data]
IP wraps it            (L3): [SrcIP:192.168.1.105 DstIP:52.38.36.82 | TCP segment]
Ethernet frames it     (L2): [SrcMAC:aa:bb:cc DstMAC:router-MAC | IP packet | FCS]
NIC sends bits         (L1): 10110101 00011011...

→ Your router (L2 switch + L3 router):
   L2: receives frame, strips Ethernet header
   L3: reads IP, performs S-NAT (192.168.1.105 → 203.0.113.45)
       looks up routing table, forwards to ISP
   L2: re-wraps with new Ethernet frame to ISP's MAC

→ ISP router (L3 only):
   L3: reads IP, looks up routing table
   Forwards toward Netflix's AS

→ Netflix border router (L3):
   L3: reads IP, routes to edge server

→ Netflix edge / L4 LB:
   L4: receives TCP SYN, creates connection state
       performs D-NAT: 52.38.36.82 → 10.0.4.55

→ Netflix edge / TLS terminator (L6):
   Decrypts TLS → plain HTTP

→ Netflix L7 load balancer (L7):
   Reads HTTP headers → routes to correct backend

→ Netflix origin server (L7):
   Nginx / Zuul / Node.js processes HTTP request
   Returns HTML response

→ Same journey in reverse back to your browser

→ Your browser renders the HTML (L7)

Across the series

The OSI guide is a whole guide on this chapter's topic. It follows one "Place order" click through all seven layers with real addresses, a millisecond timeline, a byte-by-byte encapsulation budget, a hop-by-hop table of which header fields each device rewrites, and a debugging playbook organised by layer.

Key Takeaways

The OSI model has 7 layers. In practice, TCP/IP collapses them to 4.
L1–L2 (Physical, Data Link): Move bits and frames on a local network. Switches, NICs, cables.
L3 (Network): Route packets across networks. Routers use IP addresses.
L4 (Transport): End-to-end connection. TCP (reliable) or UDP (fast). Ports identify applications.
L5–L6 (Session, Presentation): TLS, compression, encoding. Often treated as part of L7 in practice.
L7 (Application): HTTP, DNS, SMTP. What your application code directly talks.
Encapsulation: Each layer wraps data from above. Decapsulation strips headers on the way up.
Higher layer = more intelligence = more features. Lower layer = less intelligence = more speed.
MAC addresses (L2) change at each hop. IP addresses (L3) stay the same end-to-end (except NAT).