OSI and TCP/IP models

In short

A network model is a layered blueprint that splits the job of moving data between two machines into independent layers, each offering a defined service to the layer above and using the service of the layer below. The OSI reference model (ISO/IEC 7498-1, also published as ITU-T X.200) defines seven layers and is the teaching and vocabulary standard; the TCP/IP model (RFC 1122) defines four layers and is what the Internet actually runs. Every Indian university computer-networks paper and GATE CS set opens with layer functions, PDUs and encapsulation, and almost every networking interview — TCS, Infosys, Wipro, HCL, Cisco India, Jio, Airtel, Nokia and Ericsson India, Tata Communications — begins with "explain the OSI layers" or "which layer does a switch work at". Network engineers also use the layers daily as a fault-isolation ladder (CCNA-style "troubleshoot bottom-up").

Explained

Why layering, and the three words that get confused

• Layering: a complex task (reliable communication over unreliable media) is decomposed so each layer solves one class of problem and hides it from the others. Change the medium, the application need not change.
• Service: *what* a layer offers to the layer above, through a SAP (service access point) — defined by primitives, not by implementation.
• Protocol: the rules and message formats used between peer entities on two machines of the *same* layer; it implements the service.
• Interface: how the layer above calls the layer below inside one machine (e.g. the socket API between application and transport).
• Service primitives (connection-oriented service): CONNECT.request → CONNECT.indication → CONNECT.response → CONNECT.confirm, then DATA.request/indication, then DISCONNECT. Confirmed vs unconfirmed service.
• Service types: connection-oriented reliable (byte stream or message sequence), connectionless unacknowledged datagram (IP, UDP), connectionless acknowledged datagram (some wireless links), request-reply.
• Design issues recurring at every layer: addressing, error control, flow control, multiplexing/demultiplexing, message ordering, segmentation and reassembly, routing (where relevant).
• Peer-to-peer rule: layer *n* on host A talks only to layer *n* on host B; data actually travels down the stack, across the medium, and up the other stack.

The seven OSI layers, layer by layer

1. Physical (L1): transmits raw bits. Covers voltage/optical levels, bit encoding (NRZ, Manchester, 4B/5B), bit rate and bit duration, media (UTP Cat 6, single/multimode fibre, radio), connectors and pinouts, topology, transmission mode (simplex, half-duplex, full-duplex), baseband vs broadband, multiplexing (TDM, FDM, WDM). Devices: repeater, hub, media converter, cables.
2. Data link (L2): makes a raw bit pipe into a reliable-enough link between two directly connected nodes — framing, physical (MAC) addressing, error detection/correction, flow control, and medium access. Split by IEEE 802 into LLC (802.2) and MAC sublayers. Devices: NIC, bridge, L2 switch, wireless access point. (Mechanisms are treated in the data-link note.)
3. Network (L3): end-to-end delivery across multiple networks — logical addressing (IP), routing/forwarding, fragmentation and reassembly, internetworking between dissimilar networks, congestion control and accounting. Protocols: IPv4/IPv6, ICMP, IGMP, routing protocols ride on it. Device: router, L3 switch.
4. Transport (L4): the first true end-to-end (host-to-host, process-to-process) layer — service-point addressing by port numbers, segmentation and reassembly, connection establishment and release, reliability (ACK, retransmission, sequencing), flow control and congestion control. TCP, UDP, SCTP. Device: firewall doing port filtering, L4 load balancer.
5. Session (L6−1 = L5): dialog control (who transmits when — half-duplex token management), session establishment and release, and synchronisation/checkpointing so a long transfer resumes from the last checkpoint rather than the start. Seen in RPC, NetBIOS, SIP-like signalling; absent as a separate layer in TCP/IP.
6. Presentation (L6): syntax and semantics of the data — character-code translation (ASCII, EBCDIC, Unicode/UTF-8), abstract syntax notation (ASN.1, BER/DER, XDR), compression (JPEG, MPEG, gzip) and encryption/decryption. TLS is commonly mapped here or at L5.
7. Application (L7): services the user or program actually invokes — HTTP, SMTP/IMAP/POP3, FTP, DNS, DHCP, SNMP, Telnet/SSH, SMB/NFS, and the network-virtual-terminal, file-transfer and directory abstractions OSI defined (FTAM, X.400, X.500).

Mnemonics: bottom-up "Please Do Not Throw Sausage Pizza Away"; top-down "All People Seem To Need Data Processing".

The TCP/IP model and the hourglass

• Four layers (RFC 1122): Application, Transport, Internet, Link (host-to-network). Many textbooks and AICTE-model syllabi teach a five-layer hybrid: Application, Transport, Network, Data link, Physical — because RFC 1122's "link layer" bundles OSI L1 + L2.
• Mapping: OSI 5+6+7 → TCP/IP Application; OSI 4 → Transport; OSI 3 → Internet; OSI 1+2 → Link.
• Hourglass / narrow-waist model: many applications and many link technologies, all funnelled through one internetwork protocol (IP). That single waist is why Ethernet, Wi-Fi, 4G/5G and fibre all interoperate.
• End-to-end argument (Saltzer, Reed, Clark): keep functions like reliability and encryption at the end hosts; keep the network core simple and stateless. This is why IP is "best effort" and TCP, not the routers, guarantees delivery.
• Demultiplexing keys: Ethernet EtherType (0x0800 IPv4, 0x86DD IPv6, 0x0806 ARP) → IP Protocol field (1 ICMP, 6 TCP, 17 UDP, 41 IPv6, 89 OSPF) → TCP/UDP destination port → application.
• Odd protocols: ARP straddles L2/L3 (it carries L3 addresses in L2 frames); ICMP is an L3 protocol carried inside IP; MPLS is called "layer 2.5"; a VPN tunnel carries L3 inside L4/L3 (cross-layer), and NAT rewrites L4 ports inside an L3 device — all genuine violations of strict layering.

Encapsulation, decapsulation and PDUs

• Going down the stack each layer prepends (and L2 also appends) its own header/trailer to the SDU it receives, producing its PDU: data/message → segment (TCP) or datagram (UDP) → packet/datagram (IP) → frame → bits/symbols.
• Going up, each layer strips its own header, checks it, and passes the payload to the layer above (decapsulation). A router decapsulates to L3, re-decides the next hop, and re-encapsulates in a new L2 frame — so MAC addresses change at every hop while IP addresses do not (barring NAT).
• MTU limits the L2 payload (1500 B for standard Ethernet, 9000 B for jumbo frames, 1492 B for PPPoE). An oversized IP packet is fragmented (IPv4 routers may fragment; IPv6 only the source does, using Path MTU Discovery).
• Only the payload is useful; every header is overhead, which is why small packets waste bandwidth badly (see worked examples).

Comparing the two models, and why OSI "lost"

• Why OSI was not adopted (Tanenbaum's four reasons): bad timing (TCP/IP was already deployed and free with BSD Unix), bad technology (seven layers, two near-empty ones, bloated specs), bad implementations (early OSI stacks were slow and buggy), bad politics (seen as bureaucratic/telecom-driven).
• Why TCP/IP is criticised: it does not distinguish service, interface and protocol; it is specific to its own protocols, so it cannot describe non-TCP/IP networks; the "link layer" is really an interface, not a layer; it omits the physical layer and has nothing to say about presentation/session concerns.
• Standards bodies: ISO/IEC and ITU-T (OSI, X-series), IETF via RFCs (TCP/IP; RFC 1122/1123 host requirements, RFC 1812 routers), IEEE 802 (LAN/MAN, L1-L2), W3C (web), 3GPP (mobile). In India: TEC/DoT issues Essential Requirements and the MTCTE certification regime for telecom equipment, BIS adopts many IS/ISO standards, TRAI regulates services, CERT-In issues security directions under the IT Act, 2000, and NIXI operates Internet exchanges. Specific test requirements change — check the current TEC ER before quoting one.

Using the layers in practice (troubleshooting ladder)

1. L1: link light, cable/SFP, ethtool, interface error counters, signal level.
2. L2: MAC/ARP table, VLAN, duplex mismatch, arp -a, show mac address-table.
3. L3: ping, traceroute/tracert, ip route, TTL expiry, MTU/fragmentation issues.
4. L4: telnet host port, nc -zv, netstat -an/ss -tlnp, firewall rule and port blocking.
5. L5-L7: nslookup/dig, curl -v, certificate validity, HTTP status codes, application logs.
6. Wireshark/tcpdump show the model directly: each captured packet expands as Frame → Ethernet II → IP → TCP → HTTP, one tree node per layer. This is the single most convincing lab answer in an interview.

Key points

• Layering - decomposition where each layer serves the one above and uses the one below; peer layers communicate by protocol.
• Service vs protocol vs interface - what is offered, the rules between peers, and the call boundary inside a host.
• OSI - ISO/IEC 7498-1 / ITU-T X.200, 7 layers, reference model only.
• TCP/IP - RFC 1122, 4 layers (Link, Internet, Transport, Application); 5-layer hybrid is the usual teaching form.
• PDU names - message, segment/datagram, packet, frame, bit, bottom-up reversed.
• Encapsulation - each layer adds a header (L2 also a trailer); decapsulation strips them on the way up.
• L1 physical - bits, encoding, media, data rate, duplex; repeater and hub.
• L2 data link - framing, MAC addressing, error detection, flow control, medium access; switch and bridge.
• L3 network - IP addressing, routing, fragmentation, internetworking; router.
• L4 transport - process-to-process delivery, ports, connection management, reliability, flow and congestion control.
• L5 session - dialog control, token management, synchronisation/checkpointing.
• L6 presentation - translation, compression, encryption; ASN.1, JPEG, TLS mapped here.
• L7 application - HTTP, DNS, SMTP, FTP, SNMP, SSH, DHCP.
• Hop-by-hop vs end-to-end - L1/L2 are per-link and change at every hop; L3 is end-to-end in addressing; L4 and above are end-to-end only.
• Hourglass model - one IP waist between many applications and many link technologies.
• End-to-end argument - put reliability/security at the hosts, keep the network core dumb and scalable.
• Demultiplexing chain - EtherType → IP Protocol number → port number → application.
• Layer violations - NAT, firewalls, MPLS (2.5), VPN tunnels, ARP straddling L2/L3.

Formulas and examples

Example 1 - overhead of a full-size TCP/IP/Ethernet frame. 1460 B application payload.

• TCP segment = 1460 + 20 = 1480 B; IP packet = 1480 + 20 = 1500 B (= Ethernet MTU, no fragmentation).
• Ethernet frame = 1500 + 18 = 1518 B; on the wire = 1518 + 20 = 1538 B.
• η = 1460 / 1538 = 94.93%; overhead = 78/1460 = 5.34%. On a 1 Gbit/s link, goodput = 1000 × 0.9493 ≈ 949.3 Mbit/s.

Example 2 - the same stack with a 1-byte payload (why small packets are wasteful).

• TCP 21 B → IP 41 B → Ethernet payload must be ≥ 46 B, so 5 B of padding → frame = 14 + 46 + 4 = 64 B (the minimum legal frame) → on wire 84 B.
• η = 1/84 = 1.19%. Maximum frame rate at 1 Gbit/s = 10⁹/(84 × 8) = 10⁹/672 ≈ 1,488,095 frames/s — the classic line-rate figure.

Example 3 - total bytes actually sent for a 2 MiB file. File = 2,097,152 B, MSS = 1460 B.

• Segments = ⌈2,097,152/1460⌉ = ⌈1436.4⌉ = 1437; 1436 full segments, last = 2,097,152 − 1436 × 1460 = 2,097,152 − 2,096,560 = 592 B.
• Wire bytes = 1436 × 1538 + (592 + 40 + 18 + 20) = 2,208,568 + 670 = 2,209,238 B.
• Overhead = 112,086 / 2,097,152 = 5.34% (TCP handshake, ACKs and ARP ignored).

Example 4 - delay budget and BDP, Mumbai to Chennai. Route ≈ 1,300 km of fibre, three 100 Mbit/s links (two routers in between), 1518 B frames, 50 µs processing per router.

• Propagation = 1.3 × 10⁶ / (2 × 10⁸) = 6.5 ms.
• Per-link transmission = 1518 × 8 / 10⁸ = 12,144/10⁸ = 121.44 µs; three links = 364.32 µs.
• Processing = 2 × 50 = 100 µs. One-way ≈ 6.5 + 0.364 + 0.100 = 6.96 ms; RTT ≈ 13.93 ms.
• BDP = 10⁸ × 13.93 × 10⁻³ = 1.393 × 10⁶ bits = ≈ 174 kB — the window a sender needs to keep the pipe full.

Example 5 - VoIP: header overhead dominates. G.711 voice, 160 B payload every 20 ms (50 packets/s).

• RTP 12 + UDP 8 + IP 20 = 40 B → IP packet 200 B → frame 218 B → on wire 238 B.
• η = 160/238 = 67.2%. Wire rate = 238 × 8 × 50 = 95.2 kbit/s for a 64 kbit/s codec — about 49% more. Mobile networks fight this with RoHC header compression (used on VoLTE), and the VoLTE/VoNR stack is itself a layered IMS design.

Where it is used

• Telecom and ISP operations: Jio, Airtel, Vi, BSNL, Tata Communications and Railtel design and fault-trace by layer; NOC tickets are classified as L1 (fibre cut), L2 (switching), L3 (routing/BGP) or L7 (application).
• Network equipment and product engineering: Cisco India, Juniper, Nokia, Ericsson, Samsung R&D, Tejas Networks and C-DOT build per-layer stacks; roles include protocol/datapath developer, NPU and switching-ASIC firmware, and conformance test engineer.
• IT services and enterprise IT: TCS, Infosys, Wipro, HCLTech, Accenture and Capgemini hire network and cloud engineers whose first screening questions are OSI layers, encapsulation and "where does a firewall sit"; certifications (CCNA, CompTIA Network+, AWS/Azure networking) are structured around the layers.
• Security and compliance: firewalls, IDS/IPS, WAFs and DDoS scrubbing are all described by the layer they inspect; CERT-In directions and RBI/SEBI cyber-security frameworks require layered (defence-in-depth) architecture and log retention.
• Government and research networks: NIC's NICNET, NKN (National Knowledge Network), ERNET, ISRO and DRDO ground-segment links, Indian Railways' control network — all specified and tested layer by layer, with TEC Essential Requirements and MTCTE certification for equipment sold in India.
• Exams and recruitment tests: GATE CS, UGC NET, ISRO scientist/engineer, BSNL JTO/JE, DRDO, BARC and most campus aptitude-plus-technical rounds carry direct questions on layer functions, PDUs and OSI-vs-TCP/IP.

Interview questions

• Q: Name the OSI layers bottom-up and give one function each. A: Physical (bit transmission), Data link (framing and MAC addressing), Network (logical addressing and routing), Transport (process-to-process reliability and ports), Session (dialog control and checkpointing), Presentation (translation, compression, encryption), Application (user services such as HTTP and DNS).
• Q: Why is OSI called a reference model when TCP/IP is the one in use? A: OSI's protocols were specified late, were heavy and poorly implemented while TCP/IP was already deployed and free with BSD Unix; OSI survives as the common vocabulary and layering framework.
• Q: Which layers do a hub, switch and router work at? A: A hub repeats bits at L1, a switch forwards frames by MAC address at L2, a router forwards packets by IP address at L3 (an L3 switch does both L2 and L3).
• Q: What exactly changes when a packet passes through a router? A: The L2 frame is stripped and rebuilt with new source/destination MAC addresses and a new FCS; the IP addresses stay the same while TTL is decremented and the IP checksum recomputed.
• Q: Difference between a service and a protocol? A: A service is the set of operations a layer offers upward through its SAP; a protocol is the set of message formats and rules used between peer entities to deliver that service — the protocol can be replaced without changing the service.
• Q: Where does TLS/HTTPS fit in the OSI model? A: Between the transport and application layers — usually mapped to the presentation layer (encryption) or the session layer; in the TCP/IP model it is simply part of the application layer, running over TCP.
• Q: Is ARP a layer 2 or layer 3 protocol? A: It straddles both — ARP frames are carried directly by Ethernet (EtherType 0x0806, so L2) but their purpose is to resolve L3 IP addresses to L2 MAC addresses; most syllabi place it at the L2/L3 boundary and some call it L2.5.
• Q: Which layers are end-to-end and which are hop-by-hop? A: Physical and data link act per link and are re-created at each hop; the network layer is end-to-end in addressing but processed at each router; transport and above exist only in the two end hosts.
• Q: Why does the TCP/IP model lack session and presentation layers? A: The designers found those functions application-specific and rarely needed uniformly, so they left compression, encryption and dialog control to each application — consistent with the end-to-end argument.
• Q: What is the hourglass model and why does it matter? A: Many applications above and many link technologies below converge on a single network-layer protocol, IP; this narrow waist is what lets any application run over any medium and is the reason for the Internet's scale.
• Q: A user says "the website is down." How do you use the models to diagnose it? A: Work bottom-up — link status (L1), ARP/VLAN (L2), ping and traceroute (L3), telnet to port 80/443 (L4), then DNS resolution, certificate and HTTP response (L5-L7) — stopping at the first failing layer.
• Q: Give an example where strict layering is deliberately broken, and why. A: NAT and stateful firewalls read and rewrite L4 ports inside an L3 device, and MPLS inserts a label between L2 and L3 — both sacrifice layer purity for address conservation, security or fast forwarding.

Common mistakes

• Reciting the layers but not being able to place a given protocol or device; interviewers always follow up with "and where does ICMP/ARP/TLS/a firewall sit?"
• Mixing up PDU names — calling an IP packet a "frame", or a UDP PDU a "segment" (it is a datagram).
• Claiming the session and presentation layers exist in TCP/IP, or that TCP/IP has five layers per RFC 1122 (it defines four; five is the teaching hybrid).
• Saying MAC addresses change hop by hop *and* IP addresses change too — IP addresses are preserved end to end except where NAT intervenes.
• Forgetting the Ethernet preamble (8 B) and inter-frame gap (12 B) in efficiency and line-rate calculations, or forgetting the 64-byte minimum frame and its padding.
• Unit slips in delay problems: bytes vs bits, µs vs ms, Mbit/s vs MB/s; and using 3 × 10⁸ m/s for fibre instead of ≈ 2 × 10⁸ m/s.
• Treating the model as reality — assuming an OSI-compliant stack is running when the box is actually TCP/IP, or assuming layering is never violated in production networks.

Related topics

Data link layer: framing, error control and MAC · IP addressing and subnetting · TCP, UDP, HTTP and DNS · Routing algorithms and protocols · Socket programming · Network security: firewalls, VPN and IDS