Home › Resources › The OSI Model

Executive Summary

The OSI model is a conceptual framework that breaks network communication into seven stacked layers, each with a defined job. It gives engineers a shared vocabulary for describing where a problem, a protocol, or an attack lives. Although real networks run on the TCP/IP model, the OSI model remains the standard teaching and troubleshooting reference.

What It Is

The Open Systems Interconnection (OSI) model is a reference framework standardized by the International Organization for Standardization that divides the work of moving data between two systems into seven distinct layers. From the bottom up they are: Physical, Data Link, Network, Transport, Session, Presentation, and Application. Each layer performs a specific function and communicates only with the layers directly above and below it, passing data through well-defined boundaries. As data is sent, it moves down the stack and each layer wraps it with its own control information, a process called encapsulation. On the receiving side the data moves back up the stack and each layer strips off the information meant for it.

Why It Matters

The OSI model matters because it turns a messy, invisible process into a structured map that people can reason about together. When something breaks, an engineer can ask which layer is failing: is it a cable and signal issue at Layer 1, an addressing issue at Layer 3, or an application response issue at Layer 7. Security professionals use the same map to place controls and attacks precisely. Firewalls, encryption, and monitoring all operate at particular layers, and knowing which is which prevents wasted effort. For anyone building a networking or security career, fluency in the seven layers is expected in interviews and daily work.

How It Works

Communication flows down the stack on the sending device and up the stack on the receiving device. The Physical layer moves raw bits as electrical, optical, or radio signals. The Data Link layer packages bits into frames and handles local delivery using hardware (MAC) addresses. The Network layer routes packets between networks using logical (IP) addresses. The Transport layer provides end-to-end delivery, ordering, and reliability, and this is where TCP and UDP live. The Session layer manages the dialogue between applications, opening and closing conversations. The Presentation layer handles data format, encoding, and encryption so both sides interpret data the same way. The Application layer is closest to the user and provides network services to software, such as web browsing and email. A common memory aid reads the layers from Layer 1 to Layer 7 as Please Do Not Throw Sausage Pizza Away.

Architecture Diagram

Visual Workflow

Common Attacks

• Cable tapping and physical signal interception at Layer 1
• MAC address spoofing and ARP poisoning at Layer 2
• IP spoofing and routing manipulation at Layer 3
• SYN floods and other transport-layer denial-of-service at Layer 4
• Application-layer attacks such as injection and HTTP floods at Layer 7

Common Mistakes

• Confusing the OSI model with the real protocol stack, which follows the TCP/IP model
• Memorizing layer names without understanding what each layer actually does
• Assuming a problem is always at Layer 7 when it is often lower in the stack
• Placing a security control at the wrong layer for the threat it should stop
• Ignoring the Data Link and Physical layers when troubleshooting connectivity

Best Practices

• Troubleshoot from the bottom of the stack upward to isolate faults quickly
• Map each security control and monitoring tool to the layer it protects
• Use the layer model as a shared vocabulary in incident and design discussions
• Remember that encryption and application logic differ, and treat them separately
• Cross-reference OSI layers with their TCP/IP equivalents when reading real traffic

Quick Checklist

• Can name all seven layers in order, top to bottom and bottom to top
• Can state the primary job of each layer in one sentence
• Can place TCP, UDP, IP, and MAC addresses at the correct layer
• Can identify which layer a given attack or control operates at
• Can map each OSI layer to the four-layer TCP/IP model

Recommended Tools

Industry Standards

Career Relevance

The OSI model is foundational knowledge for network engineers, network security engineers, SOC analysts, and security engineers, and it appears in nearly every entry-level networking and security interview. Cloud security engineers use it to reason about virtual networks and traffic flow. Understanding the layers lets professionals communicate precisely about where problems and defenses belong, which is a daily requirement across the roles that AI-Governance-Jobs.com serves.

Interview Questions

• Name the seven OSI layers in order and give the main function of each.
• At which layer do TCP and UDP operate, and how does that differ from IP?
• How does the OSI model map to the four-layer TCP/IP model?
• Which OSI layer would you investigate first for an ARP spoofing attack, and why?
• Explain encapsulation and what happens to data as it moves down the stack.

Related Certifications

Further Reading

• NIST Computer Security Resource Center Glossary
• IETF: The Internet Standards Process
• CISA: Securing Network Infrastructure Devices

FAQ