| 7 Application |
Message |
URL, hostname |
Browser, app, ALB, API gateway, CDN, WAF |
HTTP, DNS, gRPC, SMTP, Postgres |
ALB, API Gateway, CloudFront, Route 53 |
curl -v, dig, DevTools |
5xx, retry storms, DNS caching, duplicate POSTs |
| 6 Presentation |
Message |
— |
TLS libraries, serialisers |
TLS, JSON, protobuf, UTF-8, gzip/brotli |
ACM/certificate manager, KMS |
openssl s_client, xxd |
Expired/missing-chain certificates, mojibake, precision loss |
| 5 Session |
Message |
Session ID, ticket, cookie |
TLS, HTTP/2, connection pools |
TLS resumption, HTTP/2 streams, WebSocket |
Sticky sessions, ElastiCache sessions |
curl -v (Re-using), openssl -reconnect |
Keep-alive 502s, sticky imbalance, idle disconnects |
| 4 Transport |
Segment / datagram |
Port |
Kernel, L4 LB, firewall |
TCP, UDP, QUIC |
NLB, security groups |
ss -ti, nc -vz, netstat -s |
Refused vs timeout, port exhaustion, retransmits, backlog drops |
| 3 Network |
Packet |
IP address |
Router, L3 switch, NAT, firewall |
IPv4/6, ICMP, BGP, OSPF |
VPC, subnets, route tables, NAT/IGW, TGW, NACL |
ip route, traceroute, mtr, ping |
Overlapping CIDRs, no route, PMTU black-hole, asymmetric routing |
| 2 Data Link |
Frame |
MAC address |
Switch, Wi-Fi AP, bridge, NIC |
Ethernet, 802.11, ARP, VLAN, STP, VXLAN |
ENI, (hidden) virtual switch |
arp -a, ip neigh, tcpdump -e |
Stale ARP, loops/broadcast storms, VLAN mismatch, MTU |
| 1 Physical |
Bit / symbol |
— |
Cables, optics, radios, NIC PHY, ONT |
1000BASE-T, 802.11ax PHY, GPON, DWDM |
Instance network bandwidth |
ethtool, wdutil, iw, networkQuality |
CRC errors, low SNR, duplex mismatch, distance (latency floor) |
