🧱 01-02: OSI Model Recap¶
📌 What Is the OSI Model?¶
The OSI Model (Open Systems Interconnection Model) is a conceptual, 7-layer framework that describes how data moves from one device to another across a network. It was created by the ISO in the late 1970s/early 1980s as a vendor-neutral blueprint so that hardware and software from different manufacturers could all interoperate.
💡 The OSI model is rarely implemented layer-for-layer in real software — the actual internet runs on the simpler TCP/IP model (see 01-03: TCP/IP Model & Encapsulation). But OSI remains the universal teaching and troubleshooting reference, because it cleanly separates concerns that the TCP/IP model blurs together.
🔢 The 7 Layers (Top to Bottom)¶
| # | Layer | PDU Name | Core Job | Example Protocols/Devices |
|---|---|---|---|---|
| 7 | Application | Data | Provides network services directly to end-user software | HTTP, HTTPS, FTP, SMTP, DNS |
| 6 | Presentation | Data | Translates, encrypts, and compresses data for the application layer | TLS/SSL encryption, JPEG, ASCII/Unicode encoding |
| 5 | Session | Data | Opens, manages, and closes conversations between two hosts | Session tokens, NetBIOS, RPC |
| 4 | Transport | Segment (TCP) / Datagram (UDP) | End-to-end delivery, reliability, ordering | TCP, UDP |
| 3 | Network | Packet | Logical addressing and routing between networks | IP, ICMP, routers |
| 2 | Data Link | Frame | Physical addressing (MAC) and delivery within a single local network | Ethernet, Wi-Fi (802.11), switches, ARP |
| 1 | Physical | Bits | Raw transmission of 0s and 1s over a medium | Cables, radio signals, hubs, connectors, voltages |
PDU stands for Protocol Data Unit — the name given to the "chunk" of data at each layer. This naming matters a lot once you start reading packet captures: a "frame" and a "packet" are not interchangeable terms, they refer to specific layers.
🧠 Mnemonic¶
A classic way to remember the layers from Layer 7 down to Layer 1:
All People Seem To Need Data Processing (Application, Presentation, Session, Transport, Network, Data Link, Physical)
Or bottom-up (Layer 1 to Layer 7):
Please Do Not Throw Sausage Pizza Away (Physical, Data Link, Network, Transport, Session, Presentation, Application)
💡 Pick whichever direction sticks better for you — many security tools and job interviews expect you to rattle these off instantly, so it's worth memorizing cold.
🔍 Layer-by-Layer Detail¶
Layer 1 — Physical¶
The actual electrical, optical, or radio signal. This layer knows nothing about addresses or data meaning — just voltages, light pulses, or radio waves representing 1s and 0s.
- Devices: cables (copper, fiber), hubs, repeaters, network interface card (NIC) hardware.
- Security angle: physical tapping of a cable, or a rogue hub creating a shared broadcast domain (see 01-07: Network Hardware & Attack Surface).
Layer 2 — Data Link¶
Groups raw bits into frames and handles addressing within a single local network segment using MAC addresses (burned into network hardware).
- Devices/protocols: Ethernet, Wi-Fi, switches, ARP (Address Resolution Protocol — maps IP to MAC).
- Security angle: ARP spoofing, MAC flooding — covered in depth in Module 03.
Layer 3 — Network¶
Handles logical addressing (IP addresses) and routing — figuring out the path a packet should take across multiple networks to reach a destination that isn't on the local segment.
- Devices/protocols: IP, ICMP (used by
ping/traceroute), routers. - Security angle: IP spoofing, route injection.
Layer 4 — Transport¶
Provides end-to-end communication between the correct applications on two hosts (using port numbers), and optionally reliability/ordering.
- Protocols: TCP (reliable, connection-oriented), UDP (unreliable, connectionless).
- Security angle: SYN flooding, session hijacking, port scanning — covered in Module 02/04.
Layer 5 — Session¶
Manages the lifecycle of a conversation: establishing it, keeping it alive, synchronizing it, and tearing it down. In practice, a lot of "session" behavior in modern applications (like web session cookies) is implemented at the application layer instead, which is one reason this layer feels fuzzy in real-world TCP/IP networking.
Layer 6 — Presentation¶
Translates data between the format the application understands and the format suitable for transmission — this includes encryption/decryption (TLS), compression, and character encoding (ASCII, UTF-8).
💡 In the real world, TLS is often described as living "between Layer 4 and Layer 7," which is exactly the kind of job the Presentation layer was designed for — a good example of OSI's conceptual value even when real protocols don't respect the boundary cleanly.
Layer 7 — Application¶
The layer closest to the end user — the protocols that applications actually speak to exchange meaningful data.
- Protocols: HTTP/HTTPS (web), DNS (name resolution — Module 06), SMTP (email), FTP (file transfer).
- Security angle: this is where most "web app" vulnerabilities live (SQL injection, XSS) — technically outside the scope of pure network security, but the traffic still travels through every layer below it.
📦 Encapsulation: The Basic Idea¶
As data moves down the stack from Application to Physical on the sending device, each layer wraps the data from the layer above it in its own header (and sometimes a trailer) — like nesting envelopes inside envelopes. This is called encapsulation.
[ Application Data ]
↓ wrapped by Transport layer
[ TCP/UDP Header | Application Data ]
↓ wrapped by Network layer
[ IP Header | TCP/UDP Header | Application Data ]
↓ wrapped by Data Link layer
[ Ethernet Header | IP Header | TCP/UDP Header | Application Data | Ethernet Trailer ]
↓ converted to bits
[ 01001010101010111000... ]
On the receiving end, the reverse process — decapsulation — happens: each layer strips off its corresponding header as the data moves back up the stack, until only the original application data remains.
💡 This is exactly why the PDU is renamed at each layer: a "frame" contains a "packet," which contains a "segment," which contains the application's raw data. Once a frame's Ethernet header is stripped off by a switch/router, what remains is a packet — the name changes because the contents changed.
The full worked walkthrough — with a real HTTP request traced through every header — is in 01-03: TCP/IP Model & Encapsulation.
📌 Key Takeaways¶
- The OSI model has 7 layers: Physical, Data Link, Network, Transport, Session, Presentation, Application (bottom to top).
- Each layer has its own PDU name: bits (Physical), frame (Data Link), packet (Network), segment/datagram (Transport), data (everything above).
- Mnemonic: All People Seem To Need Data Processing (top to bottom).
- Layer 2 uses MAC addresses; Layer 3 uses IP addresses; Layer 4 uses port numbers to reach the right application.
- Encapsulation wraps data in a new header at every layer going down the stack; decapsulation unwraps it going up the stack on the receiving side.
- Real-world networking uses the simpler 4-layer TCP/IP model, but OSI remains the standard reference for discussing where an attack or protocol "lives."
- Almost every attack category in this course maps cleanly to a specific OSI layer — which is why understanding the layers first makes the rest of the course click into place.