OSI Model Reference
The seven OSI layers with the protocols, data units and real troubleshooting signals that belong to each, mapped against the TCP/IP model.
Result
OSI layers
| Layer | Name | Data unit | Examples | What it does |
|---|---|---|---|---|
| 7 | Application | Data | HTTP, DNS, SMTP, SSH, SNMP, DHCP, SIP | The protocol the user or application actually speaks. Most "network problems" reported by users live here. |
| 6 | Presentation | Data | TLS, ASN.1, JPEG, character encoding | Encoding, serialisation and encryption. Folded into layer 7 in practice - TLS is the example that matters. |
| 5 | Session | Data | RPC, NetBIOS, SIP dialogs, TLS session resumption | Establishing and resuming conversations. Rarely a separate concern in modern stacks. |
| 4 | Transport | Segment / datagram | TCP, UDP, QUIC, SCTP | Ports, multiplexing and, for TCP, reliability, ordering and congestion control. |
| 3 | Network | Packet | IPv4, IPv6, ICMP, OSPF, BGP, IPsec | Logical addressing and routing between networks. Where TTL, fragmentation and route selection live. |
| 2 | Data link | Frame | Ethernet, 802.1Q, PPP, ARP, STP, LACP | MAC addressing on a single segment, VLAN tagging and loop prevention. |
| 1 | Physical | Bit / symbol | Copper, fiber, radio, SFP optics, RJ45 pinout | Signalling on the medium. Where the fault is far more often than anyone expects. |
OSI versus TCP/IP
| OSI | TCP/IP model | Practical mapping |
|---|---|---|
| 7, 6, 5 | Application | Everything above the transport API - including TLS. |
| 4 | Transport | TCP, UDP and QUIC (which is transport implemented over UDP). |
| 3 | Internet | IP, ICMP and the routing protocols that populate the table. |
| 2, 1 | Link | Ethernet framing and the physical medium beneath it. |
Troubleshooting by layer
| Layer | Typical symptoms | First commands |
|---|---|---|
| L1 | Link down, CRC errors, low optical receive power, wrong SFP, damaged patch lead | ethtool, show interface, SFP diagnostics, OTDR |
| L2 | VLAN not tagged, wrong native VLAN, MAC flapping, spanning-tree block, MTU mismatch | show mac address-table, show spanning-tree, tcpdump -e |
| L3 | Missing or wrong route, asymmetric path, ACL drop, MTU/PMTUD black hole | ping, traceroute, show ip route, mtr |
| L4 | Port filtered, TCP handshake incomplete, window too small, NAT table exhaustion | nc -zv, ss -tan, tcpdump port X |
| L7 | DNS resolution failure, expired certificate, application error, HTTP 5xx | dig, curl -v, openssl s_client |
About OSI Model Reference
The OSI model is a shared vocabulary more than an implementation. Its real value is as a troubleshooting discipline: naming the layer a symptom belongs to tells you which commands to reach for and which half of the stack you can stop thinking about.
Where the model stops matching reality
MPLS sits awkwardly between layers 2 and 3 and is often called layer 2.5. VXLAN carries layer 2 frames inside layer 4 UDP, inverting the stack. TLS is formally presentation but implemented as a library above the transport socket. QUIC implements transport semantics over UDP inside userspace. The model is still the right vocabulary for triage — it just should not be mistaken for an implementation blueprint.
Why layers 5 and 6 feel unused
Because the internet runs on TCP/IP, which has four layers, not seven. Session and presentation concerns exist - TLS is presentation, SIP dialogs are session - but they are implemented inside applications rather than as distinct network layers. When a colleague says "layer 7 problem", they mean everything above the transport socket.
Common use cases
- Structuring an incident investigation so it converges instead of wandering.
- Explaining to a stakeholder which team owns which part of a fault.
- Studying for CCNA, JNCIA or similar certifications.
Edge cases and gotchas
- Some real behaviour spans layers: MTU problems present as an application hang but are caused at layer 3, and MPLS sits awkwardly between 2 and 3.