The OSI model is a seven-layer reference framework that separates networking into physical transmission, link, network, transport, session, presentation and application concerns, used to reason about where a problem sits rather than to describe any real protocol stack.
Our take. The seven layers are a vocabulary, not an architecture, and the exams that make you memorise them are testing the vocabulary. Nobody has ever fixed a network by knowing what layer six does. Everybody who has fixed one used the model's real gift, which is a shared way to say where the problem stopped: the cable, the switch, the route, the port, or the application.
Layer
Name
What lives there in practice
The question it answers when something breaks
7
Application
HTTP, DNS, SMTP, the protocols programs speak
Is the service itself answering correctly?
6
Presentation
Encoding, compression, historically encryption
Rarely diagnosed separately today
5
Session
Dialogue control; largely absorbed by the layers around it
Rarely diagnosed separately today
4
Transport
TCP and UDP, ports
Can the two processes reach each other?
3
Network
IP, addressing, routing
Is there a route, and does the address resolve?
2
Data link
Ethernet, Wi-Fi frames, switches, MAC addresses, VLANs
Are the two devices on the same segment and talking?
1
Physical
Cables, radio, fibre, signalling
Is the link up at all?
The model was published as a standard for protocols nobody now runs, and it survived because the numbering is useful. Saying that a problem is at layer two tells another engineer, in two words, that the cable is fine and the routing is irrelevant and the switch or the frames between two neighbouring devices are where to look. Saying layer seven says the packets arrive and the application is misbehaving. The middle layers, five and six, have almost nothing to point at in a modern stack and are the ones courses spend the most time on, because they are the hardest to remember and therefore the easiest to examine.
Troubleshooting works up or down the model. Start at one, is the link lit, and climb; or start at seven, does the application respond, and descend to the layer where the answer changes from yes to no. Either way the model gives the search an order, and an engineer who follows it stops guessing. The networking certifications examine the layers directly; the security exams use the vocabulary throughout, since a firewall that filters at layer three cannot see what a layer-seven inspection would, and knowing the difference is the difference between the two products.
In practice
A user reports that a website does not load. Layer one: the laptop shows a connected network, so the link is up. Layer two: the laptop has a local address from the router and can reach it, so the local segment works. Layer three: a route to the internet exists and a public address answers a ping, so routing works. Layer four: a connection to the site's web port is refused, while a connection to a different site succeeds, so the network is fine and this one service is not accepting connections. Layer seven never gets a turn, because the failure was found a layer below it, and the report to the site's owner says exactly which layer and why.
TCP/IP is the protocol family that actually runs, usually described in four layers. The OSI model is the seven-layer framework used to talk about it, and mapping one onto the other is approximate by design.
A switch is a layer-two device: it forwards frames between devices on one segment by hardware address. The model tells you that; the switch does not know what a model is.
Routing is the layer-three job of moving packets between networks by address. When an engineer says the problem is at layer three, routing and addressing are what they mean.
Key takeaways
→Seven layers, two words: the model is a shared way to say where a problem stopped.
→Layers one to four and seven are diagnosed daily; five and six are examined more than they are used.
→Troubleshoot up from the cable or down from the application, and stop where the answer changes.
Certifications that test this
Vendor exams whose syllabus covers this concept — facts, cost and a preparation path on each page.
A rotating selection from the course directory, drawn from the subcategories where this concept is taught rather than picked for it. Details, price and the provider link are on the course page.
In today's digital age, websites are prime targets for hackers due to their critical role in business, communication, a…
Udemy
FAQ
Why learn a model that does not match real protocols?
Because the vocabulary is universal and the exams require it. Every networking and security engineer can say layer two or layer seven and be understood, and that shared shorthand is worth the afternoon it takes to memorise.
Which layer does a firewall work at?
Traditional firewalls filter at layers three and four, by address and port. Application-aware and web application firewalls inspect layer seven. Knowing which kind you have tells you what it cannot see, which is usually the important question.
Is the TCP/IP model better?
It is more accurate about the protocols that exist, with four layers instead of seven. It is less useful as a diagnostic shorthand, because it lumps together things engineers want to separate. Most people learn both and speak OSI.
Sources
The primary text this definition rests on. Read it before you trust ours.
ISO/IEC 7498-1, Information technology, Open Systems Interconnection, Basic Reference Model (1994)
