OSI Model Reference

The seven OSI layers with the protocols, data units and real troubleshooting signals that belong to each, mapped against the TCP/IP model.

Reference Protocol Reference Runs in your browser

Result

OSI layers

LayerNameData unitExamplesWhat it does
7ApplicationDataHTTP, DNS, SMTP, SSH, SNMP, DHCP, SIPThe protocol the user or application actually speaks. Most "network problems" reported by users live here.
6PresentationDataTLS, ASN.1, JPEG, character encodingEncoding, serialisation and encryption. Folded into layer 7 in practice - TLS is the example that matters.
5SessionDataRPC, NetBIOS, SIP dialogs, TLS session resumptionEstablishing and resuming conversations. Rarely a separate concern in modern stacks.
4TransportSegment / datagramTCP, UDP, QUIC, SCTPPorts, multiplexing and, for TCP, reliability, ordering and congestion control.
3NetworkPacketIPv4, IPv6, ICMP, OSPF, BGP, IPsecLogical addressing and routing between networks. Where TTL, fragmentation and route selection live.
2Data linkFrameEthernet, 802.1Q, PPP, ARP, STP, LACPMAC addressing on a single segment, VLAN tagging and loop prevention.
1PhysicalBit / symbolCopper, fiber, radio, SFP optics, RJ45 pinoutSignalling on the medium. Where the fault is far more often than anyone expects.

OSI versus TCP/IP

OSITCP/IP modelPractical mapping
7, 6, 5ApplicationEverything above the transport API - including TLS.
4TransportTCP, UDP and QUIC (which is transport implemented over UDP).
3InternetIP, ICMP and the routing protocols that populate the table.
2, 1LinkEthernet framing and the physical medium beneath it.

Troubleshooting by layer

LayerTypical symptomsFirst commands
L1Link down, CRC errors, low optical receive power, wrong SFP, damaged patch leadethtool, show interface, SFP diagnostics, OTDR
L2VLAN not tagged, wrong native VLAN, MAC flapping, spanning-tree block, MTU mismatchshow mac address-table, show spanning-tree, tcpdump -e
L3Missing or wrong route, asymmetric path, ACL drop, MTU/PMTUD black holeping, traceroute, show ip route, mtr
L4Port filtered, TCP handshake incomplete, window too small, NAT table exhaustionnc -zv, ss -tan, tcpdump port X
L7DNS resolution failure, expired certificate, application error, HTTP 5xxdig, curl -v, openssl s_client
Practical order
Work bottom-up when the fault is unknown. Confirming layer 1 and 2 takes seconds and eliminates the most common causes; starting at layer 7 with an application trace is how an afternoon disappears.

About OSI Model Reference

The OSI model is a shared vocabulary more than an implementation. Its real value is as a troubleshooting discipline: naming the layer a symptom belongs to tells you which commands to reach for and which half of the stack you can stop thinking about.

Where the model stops matching reality

MPLS sits awkwardly between layers 2 and 3 and is often called layer 2.5. VXLAN carries layer 2 frames inside layer 4 UDP, inverting the stack. TLS is formally presentation but implemented as a library above the transport socket. QUIC implements transport semantics over UDP inside userspace. The model is still the right vocabulary for triage — it just should not be mistaken for an implementation blueprint.

Why layers 5 and 6 feel unused

Because the internet runs on TCP/IP, which has four layers, not seven. Session and presentation concerns exist - TLS is presentation, SIP dialogs are session - but they are implemented inside applications rather than as distinct network layers. When a colleague says "layer 7 problem", they mean everything above the transport socket.

Common use cases

  • Structuring an incident investigation so it converges instead of wandering.
  • Explaining to a stakeholder which team owns which part of a fault.
  • Studying for CCNA, JNCIA or similar certifications.

Edge cases and gotchas

  • Some real behaviour spans layers: MTU problems present as an application hang but are caused at layer 3, and MPLS sits awkwardly between 2 and 3.

Frequently asked questions

What layer is a switch?
A traditional switch is layer 2, forwarding on MAC addresses. A layer 3 switch also routes on IP. Modern datacentre switches do both simultaneously per VLAN.
Which layer is TLS?
Formally presentation (6). In practice it is implemented as a library between the socket and the application, which is why everyone calls it layer 7 in conversation.