The OSI Model
Build a packet from the bottom up, one header per problem, then use the same ladder to find which layer is broken.
An interactive Networking lesson: 21 steps, about 30 minutes, on a live simulation in your browser.
Your laptop joined the home Wi-Fi a moment ago. You want a page from web, a server four links away, and your program has 75 bytes of text to deliver: GET / HTTP/1.1 and a few headers.
Text cannot travel by itself. Something must say which program it is for, which machine that program runs on, and which device on this link should be handed the bits next. A network answers those questions separately, one layer per question, and each layer writes its answer in a header placed in front of the data. This lesson climbs that stack from the bottom, one real packet at a time.
What you will learn
One link: frames and MAC addresses
- The first thing on the wire: Layer 2 delivers a frame to a MAC address on the same link. It knows nothing beyond that link.
- How far does a MAC address reach?: A MAC address is only meaningful on one link. To reach a machine beyond your link you need a different kind of address.
Many links: IP
- A second envelope: IP: The IP header names the final destination. The Ethernet header names the next device on this link. Layer 3 is what lets a packet cross more than one link.
- What survives the trip?: MAC addresses are rewritten at every hop. The IP destination is written once and read by every router on the way.
- The one IP field routers do change: Every router subtracts one from the TTL, and a packet at zero is destroyed with an error to the sender. traceroute is that rule used as a tool.
One program: ports
- The machine answered. Did the program?: An IP address finds the machine. A port finds the program on it. Layer 4 is the first layer that ends at a program and not at a device.
- One device rewrites more: Routers rewrite layer 2 and lower the TTL. NAT also rewrites the source address and port. Nothing on the path touches the payload.
What the bytes mean
- Down the stack: encapsulation: Encapsulation: each layer takes what the layer above handed it, treats it as cargo, and puts its own header in front.
- Up the stack: decapsulation: Decapsulation is the same stack read from the outside in: check your header, strip it, and use one field in it to decide who gets the rest.
- Same slots, different protocols: Layers are slots, not fixed protocols. The transport slot holds TCP or UDP, the top slot holds HTTP or DNS, and the layers underneath carry either without knowing which.
- A layer slipped in between: A new layer can be inserted without changing the ones around it: TCP carries TLS the way it carried HTTP, and HTTP does not know it is being encrypted.
Seven layers on paper, four in the packet
- Now put numbers on them: OSI's seven numbers are the vocabulary. TCP/IP's four layers are what is in the packet. They agree on 1 to 4, and everything above is the application.
- A device is named by how deep it reads: A device is layer N when N is the highest header it reads to make its decision. It cannot act on anything above that.
- Drill: the layer-2 tool
Debug from the bottom
- Break it: the page stops loading
- Climb the stack again, one tool per layer: Prove each layer before blaming the one above it. The first tool that fails names the broken layer; everything above it is a victim, not a cause.
- Break it: same complaint, other layer
- The ladder, written down: Each tool speaks at one layer and proves every layer beneath it. Pick the tool by the layer you want to test.
- Drill: where does layer 3 stop?
Recap & playground
- Cheat sheet
- Playground