← Interview Prep

The OSI Model — Layer by Layer

The 7 OSI layers with PDUs, functions, protocols and devices; encapsulation/decapsulation; OSI vs the TCP/IP model; what-layer-is-X (ARP, MPLS, VXLAN, TLS, LBs); and layer-by-layer troubleshooting.

The OSI model is the shared vocabulary of networking: seven layers, each doing one job and talking only to the layers directly above and below it. You rarely implement "pure OSI," but every interview and every troubleshooting session is framed in its terms — "that's a Layer 2 problem," "the LB works at Layer 4," "TLS sits around Layer 6."

Two things to nail: what each layer does (and its PDU + example protocols), and how encapsulation walks the stack — each layer wraps the layer above in its own header on the way down, and strips it on the way up.

The seven layers

Mnemonic: "All People Seem To Need Data Processing" (7→1).

Encapsulation & decapsulation

Sending is top-down; each layer adds its header (L2 also adds a trailer, the FCS). Receiving is bottom-up; each layer strips its own header and hands the payload up. The receiver's layer N only ever reads layer N's header — that's the whole point.

send (host A)                         wire                 receive (host B)
  L7  data                                                  L7  data
  L4  [TCP | data]                                          L4  strip TCP
  L3  [IP | TCP | data]                                     L3  strip IP
  L2  [Eth | IP | TCP | data | FCS]  ── bits ──▶            L2  strip Eth/FCS
  L1  0101110100...                                         L1  recover bits

Each layer's "next-protocol" field tells the receiver what the payload is: EtherType (L2→L3), IP Protocol / IPv6 Next Header (L3→L4), TCP/UDP port (L4→app). See Protocol Headers.

OSI vs the TCP/IP model

The real stack is the 4-layer TCP/IP model; OSI is the reference overlay on top of it.

"What layer does X operate at?"

A favorite trap — several protocols don't sit cleanly on one layer:

Troubleshooting by layer

The model is a debugging checklist. Two directions:

• Bottom-up (most common for "it's down"): L1 link/optics & errors → L2 MAC/VLAN/STP → L3 IP/routing/ping → L4 ports/firewall → L7 app. Fix the lowest broken layer first — a dirty fiber (L1) makes every layer above look broken.
• Top-down (for "app is slow"): reproduce at L7, then peel down to isolate.

Map symptoms to layers: CRC errors → L1/L2; ARP incomplete → L2/L3; "no route to host" → L3; connection refused / timeout → L4 (port/firewall); TLS/cert error → L6; HTTP 5xx → L7. See Troubleshooting Scenarios and Packet Life: google.com.