Part 2 — The mental model

2.1 The seven layers in one table

Mnemonic (top-down): All People Seem To Need Data Processing. Bottom-up: Please Do Not Throw Sausage Pizza Away.

2.2 The rule that makes it work: each layer talks only to its neighbours and its peer

   Laptop                                                   Server
┌─────────────┐        "peer" conversation (logical)     ┌─────────────┐
│ L7  HTTP    │ ◀─────────────────────────────────────▶  │ L7  HTTP    │
│ L6  TLS/JSON│ ◀─────────────────────────────────────▶  │ L6  TLS/JSON│
│ L5  session │ ◀─────────────────────────────────────▶  │ L5  session │
│ L4  TCP     │ ◀─────────────────────────────────────▶  │ L4  TCP     │
│ L3  IP      │ ◀──▶ router ◀──▶ router ◀──▶ router ◀──▶ │ L3  IP      │
│ L2  Wi-Fi   │ ◀──▶ AP │ Eth ◀──▶ │ ... each link ... ◀▶│ L2  Ethernet│
│ L1  radio   │ ~~~~ ~~ │ ─── ──── │ ═══ fibre ═══ ───── │ L1  copper  │
└─────────────┘                                          └─────────────┘

Two ideas carry most of the weight:

1. Vertical (service): each layer uses only the layer below it and serves only the layer above it. TCP doesn't know whether it's running over Wi-Fi or fibre. HTTP doesn't know about MAC addresses.
2. Horizontal (protocol): each layer talks logically to the same layer on the other side. L4 to L7 are end-to-end: only the two endpoints read them. L1 to L3 are hop-by-hop: every router and switch along the way reads and rewrites them.

The single most useful sentence in networking: MAC addresses change at every hop; IP addresses stay the same end to end (unless NAT rewrites them); ports and everything above belong to the endpoints (unless a proxy terminates the connection).

2.3 Encapsulation: envelopes inside envelopes

On the way down, each layer wraps the data from above in its own header (and sometimes a trailer). On the way up, each layer removes its own wrapper and passes the rest upward.

L7  HTTP request          [ POST /api/v1/orders  headers  {"cartId":"c_8812",...} ]
L6  TLS record        [TLS hdr][ ..........encrypted HTTP bytes.......... ][auth tag]
L4  TCP segment   [TCP hdr][ ..................TLS record.................... ]
L3  IP packet  [IP hdr][ ......................TCP segment.......................]
L2  Frame [MAC hdr][ ............................IP packet.......................... ][FCS]
L1  Bits  ▁▃▇▅▂▇▁▃▅▇▂▁▃▅▇▂▁▃▅▇▂▁▃▅▇▂▁▃▅▇▂▁▃▅▇▂▁▃▅▇▂▁▃▅▇▂▁▃▅▇▂▁▃▅▇▂▁▃▅▇▂▁▃▅▇▂▁▃▅▇▂▁▃

Compare it to posting a letter. You write it (L7), translate it into a language both of you read and seal it (L6), number the pages so they can be put back in order (L4), put a city-and-street address on the envelope (L3), and then the local van takes it to the next sorting office (L2) by road (L1). Each sorting office puts it on a different van (new L2), but the street address (L3) doesn't change.

2.4 The honest truth about OSI vs real life

The Internet doesn't run on OSI protocols. It runs on the TCP/IP suite, which has four or five layers. OSI is the vocabulary engineers use to talk about it. When someone says "that's an L7 load balancer" or "L2 adjacency", they're using OSI terms for TCP/IP things.

¹ DHCP is an L7 protocol (over UDP) whose purpose is to configure L3.

² ARP sits between L2 and L3. It's carried directly in Ethernet frames (L2), and its job is to map L3 addresses to L2 addresses.

Where the model is fuzzy, and why that's fine:

• TLS is variously called L4.5, L5, L6, or L7. Its handshake behaves like a session (L5), and its record encryption behaves like presentation (L6).
• QUIC / HTTP/3 combines L4, L5, and L6 into one protocol that runs in user space over UDP.
• Routing protocols (BGP, OSPF) carry L3 control information, but BGP is itself carried over TCP.

Use the model for what it's good at: locating a problem, splitting responsibility, and naming things precisely. Don't argue about which layer TLS belongs to in a design review. Ask "which component terminates it, and what can that component see?"

2.5 Layers are not steps in time

People often assume L1 happens first and L7 happens last. Here's the actual order of events for our click:

Long before the click (seconds to hours earlier):
  L1   Wi-Fi radio links up with the router
  L2   Wi-Fi association + WPA3 authentication
  L3   DHCP gives the laptop 192.168.1.23 (DHCP itself is L7-over-UDP!)
  L2/3 ARP learns the router's MAC

At the click (t = 0):
  L7   DNS lookup for shop.example.com      ← an L7 protocol, needed BEFORE...
  L4   TCP handshake                        ← ...the L4 connection can start
  L5/6 TLS handshake
  L7   HTTP POST
       ... and every single one of those uses L1–L3 for every packet.

The layers describe nesting, not chronology. The chapters below go bottom-up, as you asked, but they keep pointing out when each thing happens.