The OSI Model and TCP/IP Suite
The layering mental model behind every attack and defense
The OSI model layers networking into seven stages, while the TCP/IP suite implements the four layers that actually run the internet. Security lives at every layer — so defenders must know where each threat sits.
What you will learn
- Map security concepts onto OSI and TCP/IP layers
- Explain encapsulation with a real HTTP request
- Say which layer a given attack or control operates at
What is this?
The OSI model describes seven conceptual layers — physical, data link, network, transport, session, presentation and application — that each handle one job. The TCP/IP model collapses these into four practical layers: link, internet, transport and application. Every byte on a wire is wrapped (encapsulated) with headers at each layer, and unwrapped in reverse order at the destination. Knowing which layer something happens at tells a security analyst where to look and which control applies.
Why do you need it?
- A packet capture is only readable if you understand how each layer's header is stripped as data climbs the stack.
- Attacks are layer-specific: MAC spoofing is layer 2, IP spoofing layer 3, TLS interception layer 4+, XSS strictly application.
- Firewalls can block by layer — a URL filter inspects layer 7, a stateful firewall layer 3/4.
- Troubleshooting and incident response force you to 'walk the layers' to find where traffic disappears.
Mental model
Mailing a package through a courier
Sending a packet across a network
Your letter (payload) goes in the envelope (layer 4), which gets a label with addresses (layer 3), which goes inside the courier's box (layer 2), which a truck (layer 1) physically moves. Each handler only reads its own label.
How it works
- Application layer (7/4): HTTP, DNS, SMTP — the protocol your software actually speaks.
- Transport layer (4): TCP segments and UDP datagrams, with ports that identify which app gets the data.
- Internet/layer 3: the IP packet, with source and destination IP addresses.
- Link/layer 2: frames with MAC addresses, shifted by switches; the physical wire/radio (layer 1) carries the bits.
- Encapsulation: each layer wraps the layer above, so an HTTP request becomes one TCP segment, one IP packet, one frame.
- Decapsulation at the receiver peels headers in reverse order until the app gets its original request.
Encapsulation as an HTTP request travels out.
In production
- An analyst reads a pcap in Wireshark: she filters 'tcp.port==443' knowing the transfer is layer 4 and the crypto inside is layer 5+.
- A stateful firewall tracks TCP state and drops a 'connection' that never completed the three-way handshake — a layer 4 logic check.
- A SOC alert on 'HTTP POST to /admin' is an application-layer signal, triaged against layer 3 context (source IP, geo).
Best practices
- Always say which layer a problem is at before touching tools — it halves the search space.
- Learn to read pcap columns as layer headers: MACs (L2), IPs (L3), ports (L4), payload (L5-7).
- Map every security control you deploy to the layer it protects; unused layers are where events hide.
Common mistakes
- Confusing ports (layer 4) with protocols (layer 7) when filtering traffic.
- Thinking encryption 'protects the packet' — TLS only encrypts layers 5+, headers still leak.
- Debugging application symptoms at the physical layer first; check the fast layers (7, 4, 3) in order.
Debugging tips
- Start an incident by asking 'which layer did the first anomaly appear at?'
- When something 'just doesn't connect', test each layer in order: cable/L1, MAC/L2, IP/L3, port/L4, app/L7.
- tcpdump -i any port 443 shows layer 3/4 context; Wireshark's follow-TCP-stream reassembles layers 5-7 for you.
Security considerations
- Encryption at TLS (L5+) hides content but layer 3/4 metadata (who talks to whom, when, how much) stays visible on the wire — often enough for an attacker to map your network.
- Spoofable fields (MAC, source IP) mean you must never trust the network layer alone for identity.
Interview checkpoint
Quick quiz
At which layer does a TCP port number appear?
TLS encryption hides protocol headers such as IP addresses from an on-path observer.