The OSI model and what each layer does

Responsibility: moving raw bits (ones and zeros) between devices using electrical voltages, light pulses, or radio waves.

Everything at the physical layer is about the medium. Copper cables (Cat5e, Cat6, Cat6a) carry electrical signals. Fibre optic cables carry light.

Wi-Fi (IEEE 802.11) does the same job with radio, and the current generation is Wi-Fi 7 (802.11be), certified by the Wi-Fi Alliance since January 2024. Shared airtime makes radio behave unlike a cable in ways that change how you diagnose it, so the access layer gets its own module later in this stage, wifi-and-the-access-layer.

Devices: cables, connectors (RJ-45, LC, SC), hubs, repeaters, media converters (copper to fibre). A hub is a multi-port repeater: it receives a signal on one port and copies it to all other ports. No intelligence. No MAC table. Every device on a hub shares the same collision domain.

Common problems: damaged cables, loose connectors, exceeding the 100-metre limit for copper Ethernet, electromagnetic interference from power cables or fluorescent lights, and attenuation (signal weakening over distance).

How to check: look at the link light on the NIC and switch port. Try a different cable. Try a different port. For Wi-Fi, check signal strength and channel interference.

A link light proves only that two devices agree there is a working medium between them. It says nothing about which device is at the far end, and that is the question Layer 2 exists to answer.

Responsibility: delivering frames between devices on the same local network segment using MAC addresses.

Switches live at the data link layer. A switch builds a MAC address table by watching the source MAC on every incoming frame. It learns which MAC is reachable through which port. When a frame arrives for a known destination MAC, the switch sends it out only that port. If the destination is unknown, it floods the frame out all ports (except the one it arrived on). This is called "learn on source, forward on destination."

VLANs (IEEE 802.1Q) let you split one physical switch into multiple logical broadcast domains. Devices in VLAN 10 cannot talk to devices in VLAN 20 without a router in between. The 802.1Q standard adds a 4-byte tag to the Ethernet frame, including a 12-bit VLAN ID (supporting up to 4,094 VLANs).

Spanning Tree Protocol (STP, IEEE 802.1D) prevents broadcast storms. If redundant links create a physical loop, broadcast frames circulate endlessly and can crash the network in seconds. STP blocks redundant paths and keeps them as standby failovers. Rapid STP (802.1w) converges in 1-3 seconds instead of the original 30-50 seconds.

Common problems: broadcast storms (loops), incorrect VLAN assignment, STP blocking a port unexpectedly, MAC address table overflow (in rare attack scenarios).

Every mechanism in this section, MAC learning, 802.1Q tags and STP blocking alike, stops at the edge of the broadcast domain. None of them can reach a device the switch has never heard a frame from, because that device is on a different network entirely. Getting there is Layer 3 work.

Responsibility: addressing and routing packets across different networks using IP addresses.

Routers live at the network layer. A router reads the destination IP address in a packet, checks its routing table, and forwards the packet toward the next hop. The routing table contains entries like: "To reach 10.0.0.0/8, send via 192.168.1.1 through interface GigabitEthernet0/1."

Routing protocols automate route discovery. OSPF (Open Shortest Path First) runs inside a single organisation and picks routes based on link cost. BGP (Border Gateway Protocol) runs between organisations and across the internet, choosing routes based on policy (AS path, preferences, agreements). Most enterprise networks use OSPF internally and BGP at the edge where they connect to ISPs.

ICMP (Internet Control Message Protocol) also lives here. It handles error reporting (ping uses ICMP Echo) and path discovery (traceroute uses ICMP Time Exceeded messages).

Common problems: missing or incorrect routes, misconfigured subnet masks, BGP route leaks (Pakistan/YouTube 2008, Vodafone Idea 2021), DHCP failure causing missing IP addresses.

A routing table gets a packet to the right machine and then stops caring. It has no opinion about which of the dozens of programs on that machine should receive the payload, and no way to notice that the packet never arrived at all. Both gaps are filled one layer up.

Responsibility: reliable (TCP) or fast (UDP) delivery between two endpoints, identified by port numbers.

TCP guarantees delivery, ordering, and flow control at the transport layer. Before any data flows, TCP runs a three-way handshake: the client sends SYN, the server replies SYN-ACK, and the client confirms with ACK. On a 100ms link, that handshake alone costs 100ms before a single byte of data moves. TCP is used by HTTP, SSH, SMTP, FTP, and database connections.

UDP skips the handshake and guarantees nothing. If a packet is lost, UDP does not retransmit it. This makes it faster and lighter, which is exactly what you want for DNS lookups (a lost query is simply retried), live video (a dropped frame is better than a delayed one), online gaming, and VoIP calls.

QUIC (RFC 9000) is a modern alternative built on UDP. It combines connection setup and TLS encryption in a single round trip (0-RTT in the best case), and it multiplexes independent streams so a lost packet only blocks its own stream. HTTP/3 (RFC 9114) runs on QUIC.

How much of the internet that accounts for depends entirely on who is counting and over what window, so quote the measurement rather than a round number. On 13 July 2026, Cloudflare Radar put QUIC at roughly 21 to 35 percent of traffic depending on the window and method chosen, while W3Techs recorded about 39 percent of websites advertising HTTP/3 support on the same date. Those two figures measure different things: traffic carried, and servers willing to carry it.

Common problems: port blocked by firewall, TCP connection timeouts, half-open connections, port exhaustion on busy servers.

TCP, UDP and QUIC all end in the same place: bytes handed to a program on the far host. What that program does with the bytes, and what it remembers between them, is where OSI layers 5, 6 and 7 still earn their keep as vocabulary, even though the Internet architecture collapses that work into one application layer.

As you learned in Module 3, TCP/IP exposes one Application layer above Transport. RFC 1122 explicitly maps OSI Presentation and Application into that space, while session responsibilities are usually implemented by application protocols, libraries, or transport features. The OSI definitions are still useful for understanding what kind of work is happening.

Layer 5, Session. Managing ongoing conversations. In practice: HTTP cookies that maintain login state across requests. WebSocket connections that stay open for real-time chat. SMB (Windows file sharing) sessions that track authentication across multiple file operations. SIP sessions that manage VoIP calls.

Layer 6, Presentation. Transforming data for the application. In practice: TLS encryption (securing HTTPS connections). JSON and XML serialisation (structuring data for APIs). Character encoding (UTF-8 ensuring text displays correctly worldwide). Compression (gzip and Brotli reducing HTTP response sizes by 60-80%).

Layer 7, Application. The protocols your software actually uses. HTTP (web), DNS (name resolution), SMTP (email sending), DHCP (automatic IP assignment), SSH (secure remote access), SNMP (network monitoring). Each runs on a well-known port: HTTP on 80, HTTPS on 443, DNS on 53, SSH on 22.

HTTP itself has three live versions, and the newest one moves the boundary. HTTP/3 is specified in RFC 9114 and runs over QUIC rather than TCP, so the reliability and ordering work that HTTP/1.1 and HTTP/2 leave to the transport is done inside the transport instead. The application-layer protocol looks the same to a developer: the same methods, headers and status codes.

Devices at L7: Layer 7 load balancers route traffic based on HTTP content (URLs, headers, cookies). Web Application Firewalls (WAFs) inspect HTTP requests for attacks like SQL injection. Next-generation firewalls add L7 deep packet inspection to traditional L3/L4 stateful filtering.

That completes the tour: seven responsibilities, and for each one a device that performs it and a failure that looks like it. The value of holding all seven in your head is not recall, it is the order in which you check them.

When something breaks, work from the bottom up. Each layer depends on the one below it, so if Layer 2 is broken, everything above it fails too. Checking from the bottom catches the most common problems first.

L1: Is the link light on? Is the cable plugged in? For Wi-Fi, is there signal? Try a different cable or port.

L2: Does the NIC show UP status? Is the switch port in the correct VLAN? Is STP blocking it? Run show mac address-table on the switch.

L3: Does the device have a valid IP address (not 169.254.x.x)? Can you ping the default gateway? Can you ping the destination by IP? Run traceroute to find where packets stop.

L4: Is the destination port open? Try telnet server 443 or Test-NetConnection -Port 443. Check firewalls (both network and host-based).

L5-7: Is DNS resolving correctly? Is TLS completing? Check the certificate. Clear browser cache. Check the application logs for HTTP 500 errors.

Most network problems live at Layers 1 through 3. If the lower layers check out, the problem is usually a firewall rule, a DNS misconfiguration, or an application error.