Foundations stage summary

A reference model is a blueprint, not a building. Before ISO published the OSI model in 1984, the major vendors each ran their own proprietary networking system, so what you knew about IBM's SNA was worth nothing in front of DEC's DECnet, and there was no shared way to ask which part of a conversation had broken. ISO/IEC 7498-1 states its own purpose in clause 1: to provide a common basis for coordinating the development of standards for systems interconnection. It was written to let separate teams design different parts of a stack without redesigning each other's work, and it was never meant to be deployed as software.

The seven layers are not an arbitrary number. Hubert Zimmermann, the model's original architect, published the boundary principles in a 1980 paper, four years before formal publication: create a boundary where the description of the service can be small and the number of interactions across it is minimised. Three layers would have loaded too many responsibilities onto each one, and fifteen would have spent too much on crossing boundaries. Knowing where the principle came from is what stops the model becoming a recitation exercise.

The payoff is diagnostic. You do not deploy the OSI model, you use it to describe what you deployed, which means the first useful move in front of a broken service is to name the layer whose responsibility is in doubt. That single habit is what the rest of the stage equips, and it is why the stage opens here rather than with addresses or protocols.

Encapsulation is the mechanism that makes layering work in practice. Each layer takes what the layer above handed it, treats the whole of it as payload, and adds its own header. On the way back up the process reverses, header by header. Because of that nesting, each layer's unit has its own correct name: a segment at the transport layer, a packet at the network layer, a frame at the link layer. Calling all three a packet is not a style choice, it throws away the one word that would have told a reader where to look.

What changes on the journey is the sharpest part of the module. The link-layer header is rewritten at every hop, because it addresses one device to the next device on one segment, so the source and destination link addresses on a frame arriving at a server are those of the last router and the server, not of the original client. The IP header survives the whole path, which is why the IP addresses are the ones you match when you correlate two captures taken at different points. The transport header is read only by the two endpoints.

Headers are also why size matters. They are the addressing, not waste, but the total has to fit the path, and when a large transfer stalls while small requests succeed the encapsulation story is usually the one to test first. A hop that silently cannot carry the full-sized unit produces exactly that split behaviour, and it is invisible if you only ever look at whether the connection opened.

OSI describes seven layers and the Internet architecture uses four, and they are not rivals. They agree closely where it matters most for daily work: the transport layer and the network layer mean the same responsibilities in both. RFC 1122 is the document that says what is actually implemented, and it describes the Internet application layer as essentially combining the functions of the top two OSI layers, Presentation and Application. Those responsibilities did not disappear; character encoding, serialisation and dialogue state are all still handled, but by application protocols and libraries rather than by separately deployed layers.

The genuine breaks are worth naming precisely, because they are what the exam and real arguments both test. TLS sits above the transport connection and below the application protocol without owning a layer number of its own. QUIC is more awkward still: it carries transport responsibilities, its own cryptographic handshake and stream multiplexing inside one protocol that runs over UDP, so any attempt to assign it a single OSI number produces a debate instead of a diagnosis.

The working rule follows from that. Use the four-layer Internet model when you are troubleshooting a live system, because it matches how the software is actually built. Use OSI vocabulary when you need to state a responsibility precisely, as in saying that a fault is a transport-layer problem rather than an application one. Forcing a perfect mapping between the two is the mistake; using each where it is stronger is the skill.

Taken in turn, the layers are a short list of jobs. The physical layer carries signals on cable, fibre or air. The data link layer moves frames between devices on one segment, and switches live there. The network layer handles addressing and routing across networks, and routers decide the path. The transport layer is responsible for delivery between two endpoints, with TCP providing ordering and reliability and UDP declining both. Above that sits application space, where the session and presentation responsibilities are implemented by protocols and libraries rather than by separate deployed layers.

The reason to learn them in that shape is that each layer comes with a class of device, a typical failure and a check that yields evidence. Hubs sit at layer 1, switches at layer 2, routers at layer 3, and firewalls and load balancers straddle layers 3, 4 and 7, so naming the layer already shortens the list of things that could be wrong. The working habit is to start at layer 1 and work up, because each layer depends on the one below it and most problems live in the bottom three: a missing link light resolves in seconds, while a theory about DNS can absorb an hour and still be wrong.

Application-layer facts need the same discipline about evidence. HTTP/3 runs over QUIC and is specified in RFC 9114, and its adoption is a measured range rather than a single settled figure: roughly 21 to 35 percent of traffic on Cloudflare Radar depending on the window and method, and about 39 percent of websites advertising HTTP/3 support on W3Techs, both measured on 13 July 2026. Two numbers that disagree are not a contradiction when one counts traffic and the other counts websites; quoting either without its source, method and date is what turns a fact into folklore.

The lower boundary matters more than it used to. For most people the first hop is wireless, so the physical and link layers in question are shared radio rather than a dedicated cable, and Wi-Fi 7 certification opened in January 2024. Module 8 takes that hop on its own terms; the point to carry from here is that saying a fault is at layer 1 or layer 2 means something different when the medium is shared.

A request depends on four kinds of identifier and each has a different scope. The domain name is the layer 7 identifier, global in scope, and it changes when the owner updates the record. The IP address is the layer 3 identifier and it is end to end, unchanged as the packet crosses router after router. The MAC address is a 48-bit link-layer identifier whose scope is one segment, and it changes at every router hop. The port is a 16-bit number from 0 to 65,535 whose scope is one host, and it exists so that one address can run many services at once; an address and port pair together form a socket.

The order of operations follows from the scopes. Only one of the four is a name, and it has to act first: nothing further along the path can begin until DNS has turned the hostname into an address. Then the host resolves the next-hop link address on the local segment, using ARP on IPv4 or Neighbour Discovery on IPv6, and only then does the transport connection open. Knowing the order tells you which step to test when the path stops part way.

This is also where two habits of accuracy belong. A MAC address is not a permanent factory property that you can rely on as an identity: the first three bytes often identify the organisation that registered the address block, but modern clients can present locally administered randomised addresses for privacy. And because the link address changes at each hop while the IP address does not, the identifier you see in a capture tells you immediately whether you are looking at a local segment problem or a routed one.

Subnetting looks like arithmetic and is really a decision procedure. The prefix length says how many leading bits are the network part, and the host applies that mask to its own address and to the destination, then compares. If the network parts match, the destination is local and the host resolves the neighbour's link address and delivers the frame directly. If they do not, the host hands the frame to its default gateway. A host at 10.0.1.50/24 sending to 10.0.2.25 compares 10.0.1.0 with 10.0.2.0, finds them different, and goes to the gateway; the IP addresses in the packet do not change while that happens.

The counting is where marks and outages are both lost. A /26 leaves six host bits, so 64 addresses in total, of which 62 are usable once the network address and the broadcast address are set aside. Off-by-one errors at those boundaries are the classic trap, and they are the reason two teams can allocate overlapping ranges while both believing their arithmetic was right.

Two corrections close the module. A subnet is not a security boundary: two subnets joined by a router with no access control reach each other by design, and segmentation is a control you configure rather than a side effect of a mask. And an IPv4 plan is now half a plan. The arithmetic remains daily work in private ranges, VPN pools, container networks and branch LANs, but on 28 March 2026 Google measured 50.10 percent of its worldwide users reaching it over IPv6, so most of the people any addressing scheme serves already have a working IPv6 path beside the IPv4 one.

IPv6 addresses are 128 bits written in hexadecimal, with runs of zeros compressed, and the design goal behind that width was to make addresses boring again so that hosts stop competing for them. Reading one means naming its parts: a global routing prefix, a subnet identifier, and an interface identifier. The habit worth building is to read an address the way you read a phone number, in fields rather than as one long string.

The planning rule is that every LAN segment is a /64, and the interface identifier occupies the lower half. That changes what subnetting means. Instead of counting hosts and subtracting reserved addresses, you allocate /64s out of a /48 and the question becomes how many segments an organisation needs, not how many devices sit on each one. There is no broadcast address to subtract and no argument about host counts, which is why an IPv6 plan is usually shorter than the IPv4 plan it sits beside.

Hosts get addresses in more than one way, and the choice is a management decision. SLAAC, specified in RFC 4862, lets a host build its own address from a router advertisement and is the default. DHCPv6, specified in RFC 8415, is chosen where the network wants to record and control what each host receives. A link-local address from fe80::/10 is always present, and unique local addresses from RFC 4193 play the role the private ranges play in IPv4. There is no NAT by design: addresses are global end to end, and default-deny comes from a stateful firewall doing its job, not from translation hiding hosts by accident.

Wi-Fi is the hop most people never think about and the one that shapes their experience most. Frames cross shared air rather than a dedicated cable, so airtime is a contended resource and the link behaves unlike wire in ways that surprise people who learned on switches. Two names matter here and are routinely confused: the SSID is the network name a user selects, while the BSSID is the address of one individual access point radio. The opening of the 6 GHz band mattered more to real deployments than any headline speed increase, because it added room rather than raw rate.

Wi-Fi 7, which is 802.11be, has been certified since January 2024, and its real features are Multi-Link Operation across bands, 320 MHz channels and 4096-QAM. The adoption picture is a lesson in reading numbers carefully: about 1.8 percent of global connections in the first quarter of 2026, with Singapore leading at 25.1 percent, and yet it is the enterprise refresh default, with roughly 118 million access points forecast to ship in 2026. Installed base and purchasing default are two different measurements of the same technology.

Wi-Fi 8, which is 802.11bn and carries the name Ultra High Reliability, targets roughly 25 percent gains in effective throughput, tail latency and roaming loss, with certification planned for late 2027 and ratification expected in 2028. That is the argument of the module in one line: generation numbers now buy reliability rather than speed. When a complaint arrives, the three usual suspects at this layer are roaming stickiness, airtime saturation and interference, and none of them is fixed by a faster headline rate.

The classic sequence still holds as a spine: resolve the name, open a connection, complete a TLS handshake, send the request, receive the first byte. Learning it in that order is what lets you say where a request stopped rather than that it was slow. What has changed is the connection step, and the change is large enough that the old mental model now mispredicts what a capture shows.

Three additions make up the 2026 connection dance. The browser may first fetch an HTTPS or SVCB record, specified in RFC 9460, learning from DNS which protocols the server supports, which addresses to try and the keys for Encrypted Client Hello. It then races IPv6 and IPv4 rather than choosing one, using Happy Eyeballs from RFC 8305; version 3 of that work is an Internet-Draft, so it should never be cited as an RFC. And it frequently skips TCP altogether by opening QUIC over UDP 443. The mental model changes from connect then speak, to ask DNS how to connect, then race.

Each step leaves its own failure signature, which is the point of learning the sequence at all. A name that never resolves, an address that answers on one family and not the other, a handshake that opens and then stalls, and a first byte that arrives long after the connection was established are four different faults with four different next tests. Cold requests feel slower than warm ones because resolution, connection setup and the handshake are each paid once, and nothing is broken when that happens.

The capstone asks for one thing that is harder than it sounds: narrate a single request path end to end, out loud, with a checkpoint at each step. The path now starts on a wireless first hop and includes the race between IPv6 and IPv4, so the two newest modules in the stage are rehearsed rather than just read. The note that comes out of the exercise has four parts: the symptom as reported, the first function that failed and the layer it sits at, one observable given as the command and its output, and one safe next test. Four sentences, and the last part is singular on purpose, because changing two things at once means neither result proves anything.

The failure modes of a bad note are as instructive as the format. Joining the request path halfway along and treating whatever you find there as the beginning, saying that something is wrong with the network instead of naming the layer, the protocol and the output, and reporting a symptom such as a SERVFAIL as though it were the cause are the traps that survive into professional work and waste the most time. A note that says the network was slow tells the next person nothing; a note that says the name resolved in milliseconds, the connection opened on IPv6 and the first byte took several seconds tells them exactly where to look next.

One misconception is worth retiring at the end of the stage. IPv6 is not experimental and not a project for later: it was the majority path for Google's worldwide users as of 28 March 2026, and it is already the other half of any addressing plan you draw. Carrying that into the applied stage matters, because the protocols taught there behave differently depending on which family the connection actually used.