← networks book ⊞ All topics

OSI 7-Layer Model — What Each Layer Does and Why the Split Exists

Networking is split into seven stacked layers, each with exactly one responsibility and a clean contract with its neighbours above and below. That split is the whole point: swapping Ethernet for Wi-Fi changes only the bottom two layers, and HTTP, TCP and IP never notice. The OSI (Open Systems Interconnection) reference model, standardized by ISO in 1984, lost to TCP/IP as an implementation — but its vocabulary won outright. Every time an engineer says “that’s a Layer 2 problem” or “we need an L7 load balancer,” they are speaking OSI.

Key Components

Layer (and the peer-layer contract)
One slice of the networking job with a single responsibility, a defined interface to the layer directly above and below, and nothing else. Two properties follow. First, a layer talks to its peer layer on the remote machine as if the two were connected directly — the transport layer on your laptop reasons about the transport layer on the server, not about fibre optics. Second, any layer can be swapped out without touching the others, which is what lets copper, Wi-Fi, TCP, UDP and HTTP all evolve on independent schedules.
PDU (Protocol Data Unit) & encapsulation
The name for “the thing a given layer hands around,” and it is layer-specific: a Transport-layer PDU is a segment (TCP) or datagram (UDP), a Network-layer PDU is a packet, a Data Link PDU is a frame, and the Physical layer deals in bits. Encapsulation is the act of producing them: your data gets an L4 header (now a segment), then an L3 header (now a packet), then an L2 header and trailer (now a frame), then goes out as bits. Receiving runs the same steps backwards — decapsulation.
MAC address — the Layer 2, one-hop identity
A 48-bit hardware address burned into a device’s NIC (Network Interface Card), the chip that physically connects a machine to the network. A MAC address is meaningful only within a single local network and answers exactly one question: which device on this wire should receive this frame. It is rewritten at every hop. ARP (Address Resolution Protocol) is the lookup that turns a known next-hop IP into its MAC.
IP address — the Layer 3, end-to-end identity
A logical address identifying a host anywhere on the internet, which stays unchanged from the original sender to the final destination. Because it is global, IP is what supports routing: choosing which network to send toward next. A host compares the destination IP against its own subnet (the local network it belongs to) to decide between “deliver locally” and “hand to my default gateway,” the router that serves as the LAN’s exit door.
Switch vs router — forwarding vs routing
Two different operations at two different layers, and the single most-confused pair in networking. A switch is an L2 device: it moves frames to the right port within one network based on destination MAC, using a CAM table (its learned map of MAC → port). A router is an L3 device: it moves packets between networks based on destination IP, consulting a routing table to pick a next hop. Switches forward; routers route.

Concrete Example

Layering is easiest to believe when you look at the bytes it produces. A single HTTPS request leaving a laptop is not one object — it is four nested ones, each wrapped by the layer below in strict order. This is encapsulation made literal:

bytes on the wire ─────────────────────────────────────────────────────────▶

┌──────────────┬───────────┬────────────┬──────────────────────────┬─────┐
│ Ethernet hdr │  IP hdr   │  TCP hdr   │ TLS record + HTTP request│ FCS │
│ src/dst MAC  │ src/dst IP│ src/dst port│  GET /index.html ...    │     │
└──────────────┴───────────┴────────────┴──────────────────────────┴─────┘
 └─ L2 FRAME ─────────────────────────────────────────────────────────────┘
                └─ L3 PACKET ────────────────────────────────────────┘
                            └─ L4 SEGMENT ───────────────────────────┘
                                          └─ L7 DATA ────────────────┘

Read the brackets bottom-up and you have the send path: the application produces data, the transport layer prepends a port header to make a segment, the network layer prepends an IP header to make a packet, and the data link layer wraps the whole thing in a MAC header and trailer to make a frame. The physical layer then emits it as voltage, light or radio. On receipt the destination unwraps in the reverse order. Note that no layer inspects the payload it was handed — the IP header is written without ever parsing the HTTP request inside it.

The second thing worth tracing is what each intermediate device actually touches. Take a laptop at 192.168.1.10 fetching a page from a server at 93.184.215.14, across this topology:

[Laptop] ── [Switch] ── [Router R1] ═══ internet ═══ [Router R2] ── [Server]
 192.168.1.10            gateway                                    93.184.215.14
                       192.168.1.1
#WhoWhat happensLayer
1Laptop Compares 93.184.215.14 against its own subnet. Not local → “send toward my default gateway, R1.” This is a routing decision, made by the host. L3
2Laptop ARPs for R1’s MAC, then builds the frame: dstMAC = R1, but dstIP = 93.184.215.14, unchanged. L2 (helper)
3Switch Reads dstMAC = R1, looks it up in the CAM table, forwards out that port. Never looks at the IP header. Makes no path decision. L2
4Router R1 Reads dstIP, consults its routing table, picks next hop R2. Rewrites srcMAC/dstMAC for the new link, decrements TTL. Both IP addresses untouched. L3
5Router R2 Routes by destination IP again, rewrites the MAC pair one last time for the final hop to the server. L3

One sentence captures the whole table: the IP addresses are fixed end-to-end; the MAC addresses are rewritten at every router. That is precisely the L3-vs-L2 distinction — global and unchanging versus local and per-hop — and it is the most useful thing the OSI model gives you. A useful thought experiment: delete the switch and routing still works (plug the laptop straight into R1); delete the routers and nothing ever leaves the LAN. Routers are what make it “the internet.”

Visual Model

Think about posting a letter overseas. You write it, hand it to a courier, who hands it to an airline, which hands it to a plane’s crew. Each party only talks to the one next to it and only cares about its own job — the airline never reads your letter, and you never fly the plane. If the airline swaps a 737 for an A320, your letter is unaffected, because the interface between courier and airline never changed. That division of labour is OSI, and it is why Wi-Fi versus Ethernet is invisible to HTTP.

The stack below is the whole model in one view. Step through it top-down — the order a click travels as it leaves your machine — or click any layer directly. Each row carries the layer’s job, its PDU name, the address it uses, and which devices act at that layer.

Step 1 of N
Send ↓ data moves down the stack, each layer adding a header (encapsulation) # Layer & job PDU Address Examples & who acts here 7 Application Interface to the app or user — what you’re asking for Data HTTP, DNS, SMTP, SSH endpoints only 6 Presentation Format, encrypt, compress, encode Data TLS, JPEG, UTF-8 endpoints only 5 Session Open, maintain and tear down a dialogue Data session management endpoints only; often folded elsewhere 4 Transport End-to-end delivery: ports and reliability Segment Port TCP, UDP endpoints only — routers never read this 3 Network Logical addressing & routing across networks Packet IP IP, ICMP ROUTERS act here — global scope 2 Data Link Delivery across one physical link (one hop) Frame MAC Ethernet, Wi-Fi SWITCHES act here — local scope 1 Physical Raw bits as signals on a medium Bits copper, fibre, radio, voltages cables, repeaters, the NIC’s radio/PHY Receive ↑ data moves up the stack, each layer stripping its header (decapsulation) Mnemonics — top-down 7→1: “All People Seem To Need Data Processing” · bottom-up 1→7: “Please Do Not Throw Sausage Pizza Away”

Loading…

Two beliefs about that L3/L2 boundary trip up almost everyone learning this material. Both are worth correcting explicitly, because getting them backwards makes every later topic — ARP, VLANs, subnetting, load balancing — harder than it needs to be.

Misconception 1 — “Switches route, and IP is just something ARP uses for labels”

Inverted on both counts. Switches do not route; routers route. These are two distinct operations:

  • Routing (L3, done by routers): deciding, from the destination IP, which network to send toward next — crossing between networks.
  • Switching / L2 forwarding (L2, done by switches): moving a frame out the right port within one network, from the destination MAC. No path decision, no network crossing.

A plain switch does not even parse the IP header. It reads the destination MAC, checks its CAM table (“that MAC lives on port 5”), and forwards. It holds no routing table and has no concept of a “next network.”

And IP is not incidental — IP drives every routing decision, and ARP is subordinate to it. The real order of operations on a host sending to a remote destination is:

  1. The IP decision comes first: “Is the destination on my subnet? No → send toward my gateway.” That is an L3 decision, and the host makes it.
  2. ARP is a downstream helper: “The next hop is already decided — the router at 192.168.1.1. Now, what is its MAC?” ARP answers only that narrow lookup.

So IP makes the decision and ARP fetches the MAC needed to execute it. ARP exists to serve IP’s decision, not the other way round. The one-liner: routers route using IP between networks; switches forward using MAC within one network; IP is the boss, and MAC and ARP carry out its orders one hop at a time.

Misconception 2 — “A switch is part of the endpoint machines, and only carries traffic to the router”

No on both counts. A switch is a separate physical device — a standalone box with many ports (8, 24, 48). Every device on the local network gets its own cable into it: each laptop, each server, the printer, and the router. The switch is the central junction of one local network.

The “part of the endpoint” intuition comes from confusing the switch with the NIC, which really is built into every machine and really does hold that machine’s MAC address. The NIC is the endpoint’s plug; the switch is the external thing all the plugs connect into. Different objects entirely.

Nor is a switch only a device↔router shuttle. It handles all intra-subnet traffic:

  • Local → local (the router is never involved): laptop → switch → printer, both on the same subnet. The router never sees the frame at all.
  • Local → outside: laptop → switch → router → internet. Here the switch merely carries the frame to the router the host already chose at L3; the router then does the routing.
RoleWhat it isJobLayerAn endpoint?
Endpoint / hostLaptop, server, phone, printerProduces and consumes data; runs the full stackL1–L7it is the endpoint
SwitchSeparate box; the LAN’s junctionMoves frames within one network by MACL2no
RouterSeparate box; the network’s exit doorMoves packets between networks by IPL3no

Endpoints are where data is born and dies, which is why only they run all seven layers. Switches and routers are intermediary infrastructure: they move other machines’ data — a switch at L2, a router at L3 — and neither runs your applications. Think of a mail room: the endpoints are employees writing and reading mail; the switch is the building’s internal mail carrier, walking mail between desks and out to the loading dock — shared staff, not part of any one employee; the router is the loading dock connecting the building to the outside world.

Deeper — Edge Cases & Gotchas

The reality check: OSI lost, but its vocabulary won

The internet is not actually built on OSI. It runs on the TCP/IP model, which has fewer layers. OSI is a reference model: an idealized seven-layer design that predates and competed with TCP/IP, and lost as an implementation. What survived is the shorthand, and it is genuinely load-bearing in day-to-day engineering:

  • “That’s a Layer 2 issue” — switching, MAC addresses, VLANs.
  • “We need a Layer 3 device” — a router.
  • “Put an L7 load balancer in front” — it routes on HTTP paths, so it must parse the application protocol. Versus an L4 load balancer, which routes on IP and port alone: faster, and deliberately dumber.

The practical rule: learn OSI for the shared language and for its layer-by-layer troubleshooting method (is the cable live? does the frame reach the switch? does the packet reach the gateway? is the port open? does the app respond?). Learn TCP/IP for what is actually deployed.

The layers you should nail versus the ones you should merely recognize

Layers 5 and 6 have genuinely fuzzy boundaries in practice, and modern stacks routinely fold session management into the application or the transport layer. Spending study time trying to draw a crisp line between them is wasted effort. Layers 1 through 4 are where the operational reality lives — nail those hard, and know 5 through 7 by role.

Layer 3 switches are not a counterexample

“Layer 3 switches,” or multilayer switches, do route — because they have router functionality built in. When such a device routes, it is acting as a router at L3; the name describes a box that performs two roles, not a redefinition of what switching means. A pure L2 switch never routes.

Anti-pattern: saying “Chrome is Layer 7” (or “my API server is Layer 7”).
wrong:  Chrome            → Layer 7
right:  HTTP              → Layer 7   (the protocol)
        Chrome            → a user of Layer 7 (an application)

Why it breaks: the layer is the protocol and its rules, not the program that speaks it. Conflating the two makes the model useless the moment one application speaks several L7 protocols (a browser doing HTTP, DNS and WebSockets at once), or several applications speak the same one. The layer names a contract; software is a client of that contract.

Anti-pattern: treating OSI as literal architecture rather than a thinking tool.
the model says:   TLS  →  L6 Presentation (encryption)
reality:          TLS  runs on top of TCP (L4), and terminates
                       inside the application process

Why it breaks: real protocols smear across OSI boundaries. TLS does encryption, which is L6’s job description, but it rides directly on TCP and is negotiated by the application — it does not slot cleanly into any single layer. Insisting that every protocol has one true layer number leads to unproductive arguments and, worse, to the belief that the model is wrong when it is simply approximate. The seven layers are a map. Maps are useful precisely because they are not the territory.

Anti-pattern: getting the direction rule backwards when reasoning about headers.
send    (7 → 1):  add headers      = encapsulation
receive (1 → 7):  strip headers    = decapsulation

Why it breaks: the direction determines which header is available to inspect at any given moment. A device that only reaches L2 during decapsulation — a switch — has literally not unwrapped far enough to see an IP address. That constraint, not policy or configuration, is why a switch cannot route.

Test Yourself

Wi-Fi and Ethernet are completely different technologies, yet the same HTTP request works unchanged over both. Which layers differ, and why doesn’t the change ripple upward?

A router and a switch both forward traffic. What is the fundamental OSI difference between them?

If the internet actually runs on TCP/IP and not on OSI, why is the seven-layer model still worth learning?