The OSI and TCP/IP Models

Every network conversation you have ever had — loading a web page, sending a message, streaming video — is built on layering. Instead of one giant protocol that does everything, networking splits the work into stacked layers, each with a single job and a clean contract to the layer above and below. This is the first thing interviewers probe, because if you understand layering you can reason about where a problem lives: is it a cabling issue, a routing issue, a port issue, or an application bug?

Why layer at all?

Layering gives you three properties that matter:

• Separation of concerns. The layer that puts bits on a wire does not care whether those bits are HTTP or DNS. The layer that speaks HTTP does not care whether the link is Wi-Fi or fiber.
• Interoperability. Because each layer exposes a fixed interface, you can swap one implementation for another. Ethernet and Wi-Fi both satisfy the link layer, so TCP does not change when you walk from your desk to a coffee shop.
• Encapsulation. Each layer wraps the data from the layer above in its own header (and sometimes a trailer), like nested envelopes. The receiver unwraps them in reverse.

The OSI reference model (7 layers)

The OSI model is a teaching and reference model. Real networks rarely implement it exactly, but interviewers expect you to know all seven layers, their order, their PDU (protocol data unit), and a representative protocol for each.

Explore the stack interactively below — click a layer to see its responsibilities, PDU, and how data is encapsulated on the way down:

A classic mnemonic top-to-bottom is "All People Seem To Need Data Processing" (Application, Presentation, Session, Transport, Network, Data Link, Physical).

| # | Layer | PDU | Job | Examples | |---|-------|-----|-----|----------| | 7 | Application | Data | Interface to the user's app | HTTP, DNS, SMTP, FTP | | 6 | Presentation | Data | Encoding, encryption, compression | TLS, JPEG, ASCII/UTF-8 | | 5 | Session | Data | Establish/manage/tear down sessions | RPC, NetBIOS | | 4 | Transport | Segment / Datagram | End-to-end delivery, ports | TCP, UDP | | 3 | Network | Packet | Logical addressing, routing | IP, ICMP, routing protocols | | 2 | Data Link | Frame | Node-to-node on one link, MAC | Ethernet, Wi-Fi (802.11), ARP | | 1 | Physical | Bit | Signals on the medium | Copper, fiber, radio |

Reading the table like an interviewer

The two layers that dominate interview discussion are layer 3 (Network) and layer 4 (Transport). Layer 3 gives you a logical address (an IP) that is routable across the whole internet. Layer 2 gives you a physical address (a MAC) that is only meaningful on a single link. The hop-by-hop dance — "route by IP, deliver on each hop by MAC, resolve one to the other with ARP" — is a favorite follow-up.

The TCP/IP model (4 layers)

The TCP/IP model is what the internet actually runs on. It collapses OSI's seven layers into four by folding the top three (Application, Presentation, Session) into a single Application layer and the bottom two into a single Link (or Network Access) layer.

| TCP/IP layer | Maps to OSI | Example protocols | |--------------|-------------|-------------------| | Application | 5, 6, 7 | HTTP, DNS, TLS, gRPC | | Transport | 4 | TCP, UDP | | Internet | 3 | IP, ICMP | | Link | 1, 2 | Ethernet, Wi-Fi, ARP |

The key insight: TLS is application-layer in the TCP/IP model even though OSI purists file encryption under the Presentation layer. In practice, TLS runs as a library on top of TCP, so most engineers treat it as sitting just below HTTP.

Encapsulation: a worked example

Say your browser sends GET /index.html. Watch the envelopes stack up as the request travels down the stack:

Application:  GET /index.html HTTP/1.1 ...           (HTTP message)
Transport:   [TCP hdr | GET /index.html ...]         (segment, dst port 443)
Network:     [IP hdr  | TCP hdr | data]              (packet, dst 142.250.x.x)
Data Link:   [Eth hdr | IP hdr | TCP hdr | data | Eth trailer]  (frame, dst MAC)
Physical:    010101000101110...                      (bits/signal)

On the receiving host each layer strips its own header and hands the payload up. This is why a TCP header addition does not force the IP layer to understand HTTP — it just carries opaque bytes.

Common interview gotchas

• Routers vs switches. A switch operates at layer 2 (forwards frames by MAC within a LAN). A router operates at layer 3 (forwards packets by IP between networks). A "layer 3 switch" does both.
• Ports live at layer 4, not layer 3. IP addresses identify a host; ports identify a process/socket on that host. A socket is the pair (IP, port).
• A hub is layer 1. It just repeats electrical signals to all ports — no addressing, no filtering.
• Where does a firewall sit? It depends. A packet filter is layer 3/4 (IP + port rules). A Web Application Firewall inspects HTTP, so it is layer 7.

In the interview

1. Recite the OSI layers in order and give one protocol per layer. Fumbling the order signals shallow prep.
2. Map OSI to TCP/IP and note that the real internet uses the 4-layer model.
3. Anchor on layer 3 vs layer 4 — logical vs port addressing, routing vs end-to-end delivery.
4. Explain encapsulation with the nested-header picture; it shows you understand why layering works, not just the list.