The OSI model, layer by layer
The OSI model splits networking into seven layers so you can reason about where a problem or an attack lives. Real networks run TCP/IP, but exams still think in OSI. Learn the layers, the data unit at each one, and which device works where, and a whole family of questions gets easy.
The seven layers
| Layer | Name | What it does | Examples | Data unit |
|---|---|---|---|---|
| 7 | Application | Provides network services directly to the user and the application. This is where protocols your software actually speaks live. | HTTP, HTTPS, DNS, SMTP, FTP | Data |
| 6 | Presentation | Formats data so both ends understand it: encoding, compression, and encryption. | TLS, JPEG, ASCII, MPEG | Data |
| 5 | Session | Opens, manages, and closes conversations between applications, including checkpointing and recovery. | NetBIOS, RPC, SIP session control | Data |
| 4 | Transport | End to end delivery between hosts. Segments the data, adds port numbers, and handles reliability and flow control. | TCP, UDP | Segment (TCP), datagram (UDP) |
| 3 | Network | Logical addressing and routing. Moves packets between different networks and picks the path. | IP, ICMP, routers | Packet |
| 2 | Data Link | Framing and delivery on the local link, using MAC addresses. Handles error detection for the hop. | Ethernet, switches, VLANs, PPP | Frame |
| 1 | Physical | Raw bits over a medium: cables, signals, radio waves, and the hardware that pushes them. | Cat 6 cable, fiber, hubs, repeaters | Bit |
Remembering the order
Top down, from layer 7 to layer 1: Please Do Not Throw Sausage Pizza Away.
- Please: Physical is at the bottom, so read the sentence in reverse for 1 to 7.
- Bottom up, layer 1 to layer 7: All People Seem To Need Data Processing.
Say it as: Please (Physical) Do (Data Link) Not (Network) Throw (Transport) Sausage (Session) Pizza (Presentation) Away (Application), from the wire up to the app.
How OSI maps to the TCP/IP model
The internet actually runs on the four layer TCP/IP model. Exams expect you to translate between the two without thinking.
| TCP/IP layer | Covers OSI layers | What lives there |
|---|---|---|
| Application | 7, 6, and 5 | HTTP, DNS, TLS, and everything the software touches directly |
| Transport | 4 | TCP and UDP, with their port numbers |
| Internet | 3 | IP addressing and routing |
| Network Access | 2 and 1 | Ethernet, MAC addresses, and the physical medium |
The OSI facts exams love to test
- Encryption lives at Layer 6. When a question asks where TLS or data formatting happens, the exam answer is Presentation, even though real implementations blur the line.
- Switches work at Layer 2, routers at Layer 3. Switches forward by MAC address, routers by IP address. A hub is Layer 1 and repeats everything to everyone, which is why it vanished from real networks.
- Port numbers are a Layer 4 idea. TCP and UDP carry source and destination ports, so any question about a port is a Transport layer question.
- Know the data unit chain. Bits at Layer 1 become frames at Layer 2, packets at Layer 3, and segments at Layer 4. Questions love asking what a packet is called once it picks up a MAC header and trailer: a frame.
- ARP ties Layer 3 to Layer 2. It maps IP addresses to MAC addresses, which is why ARP spoofing is a local network attack.
- Attacks have layers too. IP spoofing happens at Layer 3, a SYN flood hits Layer 4, and SQL injection or XSS live up at Layer 7, inside the application itself.
More cheat sheets
Common ports
The ports Security+, Network+, and CCNA expect you to know cold, with the one fact that matters for each.
Acronyms glossary
97 security acronyms across all 11 certs, each with a one line plain English meaning.
Which cert should you take?
Five questions, one recommendation. Match the cert to your experience and your goal.
OSI questions show up in nearly every exam here. Premium unlocks all 2,200 practice questions.
Go Premium: $12/year