CCNA Notes #02: Complete OSI Model Explained for CCNA | All 7 Layers Made Easy

CCNA Notes #02: OSI Model — Complete 7-Layer Reference Guide

Covers: OSI Overview · All 7 Layers · TCP & UDP · IP Header · Ethernet Frame · ICMP · TCP/IP Model Comparison · Interview Lines

---

1. What is the OSI Model?

OSI stands for Open Systems Interconnection. It is a logical reference model developed by ISO (International Organization for Standardization) in 1984. It is an open standard—meaning it is not owned by any single vendor.

The OSI model defines how communication takes place between devices from source to destination by dividing the entire networking process into 7 distinct layers, each with a specific role.

Why was OSI created?

As networks grew in size and complexity, different vendors (like Cisco, Juniper, and HP) were building devices using their own proprietary technologies. These devices couldn't communicate with each other. There was a need for a common standard framework. ISO researched various networking models and introduced the OSI Reference Model to solve this problem.

What does OSI give us?

• A standardized approach to network design and communication
• Interoperability between devices from different vendors
• A common language for network engineers worldwide
• A structured way to understand, design, and troubleshoot networks
• Ability to isolate and fix a problem at one layer without disturbing others

Interview Line: "OSI is a 7-layer logical reference model developed by ISO in 1984 that defines how devices from different vendors communicate by standardizing networking functions at each layer."

Troubleshooting Tip:
Ping not working → Check Layer 3 (Network)
Cable issue → Check Layer 1 (Physical)
MAC table issue → Check Layer 2 (Data Link)
Session dropping → Check Layer 5 (Session)

---

2. OSI Layers at a Glance

Data flows from Layer 7 down to Layer 1 at the sender (encapsulation), travels across the medium, then goes from Layer 1 up to Layer 7 at the receiver (decapsulation).

#	Layer Name	PDU	Key Function	Key Protocols / Devices
7	Application	Data	User-facing services (web, email, file)	HTTP, HTTPS, DNS, DHCP, FTP, SSH, SMTP
6	Presentation	Data (Formatted)	Translation, Encryption, Compression	SSL/TLS, JPEG, MP3, MPEG
5	Session	Data	Establish, manage, terminate sessions	NetBIOS, RPC, PPTP
4	Transport	Segment (TCP) / Datagram (UDP)	End-to-end delivery, flow control, ports	TCP, UDP
3	Network	Packet	Logical addressing, routing, path selection	IP, ICMP, OSPF, EIGRP | Router
2	Data Link	Frame	MAC addressing, error detection	Ethernet, ARP, PPP | Switch, Bridge
1	Physical	Bits	Signal transmission over physical medium	Cables, Hub, Repeater, WAP

Encapsulation & Decapsulation

Encapsulation — At the sender, each layer adds its own header (control information) to the data as it passes downward from Layer 7 to Layer 1. Each layer wraps the data from the layer above.

Decapsulation — At the receiver, each layer removes its corresponding header as data travels upward from Layer 1 to Layer 7.

Memory trick for sender flow (top to bottom): All People Seem To Need Data Processing
Application → Presentation → Session → Transport → Network → Data Link → Physical

---

Layer 7 Application Layer

PDU: Data

The Application Layer is the topmost layer and the closest layer to the end user. It provides an interface between the user and the network—meaning it is the gateway through which applications access network services. It also checks whether the required communication resources are available and informs the user if they are not.

What does it do?

• Acts as an interface between the user and network services
• Provides network services to applications: web browsing, email, file transfer, network management
• Checks availability of communication resources before starting
• Works on a client-server model—the client sends a request, server sends a response

Key Protocols & Port Numbers

Protocol	Port	Transport	Purpose
HTTP	80	TCP	Web communication — not secure, data sent in clear text
HTTPS	443	TCP	Secure web (encrypted using SSL/TLS)
DNS	53	TCP/UDP	Name resolution—converts FQDN to IP address (e.g., google.com → 142.x.x.x)
DHCP	67 (server) / 68 (client)	UDP	Automatically assigns IP, subnet mask, default gateway, DNS server
FTP	20 / 21	TCP	File transfer between client and server. Port 20 = data (<512 bytes), Port 21 = control (>512 bytes). Not secure.
TFTP	69	UDP	Trivial FTP—no authentication, no browsing, must type exact filename. Cannot be secured.
SMTP	25	TCP	Sending emails
POP3	110	TCP	Receiving emails—downloads to local device
IMAP	143	TCP	Access emails on server without downloading them
SSH	22	TCP	Secure remote access (encrypted)
Telnet	23	TCP	Remote access — NOT secure (data in plain text)
SNMP	161/162	TCP/UDP	Network monitoring and management
NTP	123	UDP	Time synchronization across network devices

Security at Application Layer

• SSL (Secure Sockets Layer) and TLS (Transport Layer Security) provide encryption, data integrity, and authentication
• HTTPS uses SSL/TLS—encryption is handled at the Presentation Layer in OSI but initiated at Application layer

Interview Line: "The Application Layer provides network services directly to end-user applications and acts as an interface between the user and the network."

---

Layer 6 Presentation Layer

PDU: Formatted Data

The Presentation Layer is responsible for how data is presented, formatted, and secured. It acts as a translator—ensuring that data sent by one system can be understood and used by another, even if they use different formats or encoding schemes.

Key Functions

1. Data Translation (Encoding & Decoding)

Converts data between different formats so both sender and receiver understand it. The same encoding/decoding algorithm must be used at both ends; otherwise, data will not be correctly received or interpreted.

• Example: ASCII ↔ EBCDIC conversion

File Type	Formats
Audio	MP3, WMA
Video	MP4, WMV, AVI, MPEG
Image	JPEG, BMP
Text/Document	DOC, PDF

2. Encryption & Decryption

Converts plain text → cipher text before transmission (encryption) and back to original at the receiver (decryption). This is how HTTPS works — SSL/TLS encryption happens at this layer.

3. Compression & Decompression

Reduces the size of data to improve bandwidth utilization and speed up transmission. When you watch a video, compression/decompression is handled here.

Protocols / Examples

• SSL (Secure Sockets Layer) / TLS (Transport Layer Security)
• JPEG, MP3, MPEG — format encoding/decoding

Interview Line: "The Presentation Layer is responsible for data formatting, encryption, and compression to ensure proper data representation between communicating systems."

---

Layer 5 Session Layer

PDU: Data

The Session Layer manages the lifecycle of a communication session between two devices — it creates the session, keeps it alive while communication is happening, and properly closes it when done.

Key Functions

1. Session Establishment

Creates and opens a connection between sender and receiver. The number of sessions a device can handle depends on the number of ports available (Port number = 16 bits = 0–65535 per LAN ).

2. Session Management

Maintains and keeps track of all active connections. In a single LAN, two users cannot be assigned the same session ID for the same destination, but can share the same session ID for different destinations.

3. Session Termination

Properly closes the connection after communication is complete — for example, when a user logs out of a website.

4. Dialog Control

Controls the mode of communication between two devices:

• Simplex — One-way only (e.g., TV broadcast)
• Half-Duplex — Both directions but one at a time (e.g., walkie-talkie)
• Full-Duplex — Both directions simultaneously (e.g., phone call)

5. Synchronization (Checkpoints)

Inserts checkpoints during data transmission. If a failure occurs mid-transfer, communication resumes from the last checkpoint rather than starting over.

Protocols / Technologies

• NetBIOS
• RPC (Remote Procedure Call)
• PPTP (used in VPNs)

Real-World Example

When you log into a website: the session starts after login, stays active while you browse, and ends when you log out or the session times out.

Interview Line: "The Session Layer manages the session lifecycle — establishment, maintenance, and termination — between two communicating devices."

---

Layer 4 Transport Layer

PDU: Segment (TCP) / Datagram (UDP)

The Transport Layer is responsible for end-to-end communication between the source and destination devices. It breaks data into smaller pieces at the sender, manages their reliable (or fast) delivery, and reassembles them at the receiver. This layer is where TCP and UDP live.

Key Functions

1. Segmentation & Reassembly

Divides large chunks of data into smaller segments at the sender so transmission losses can be minimized. By default, the Maximum Segment Size (MSS) = 1460 bytes. Each segment is numbered and reassembled in the correct order at the destination.

2. Sequencing

Each segment is assigned a sequence number at the sender. At the receiver, these numbers are used to rearrange data in the correct order and detect any missing segments. Sequence numbers are 32-bit fields (2^32 = 4.3 billion possible values).

3. Acknowledgement

The receiver sends an acknowledgement (ACK) back to the sender as a receipt of successful data delivery.

4. Flow Control

Prevents the sender from overwhelming the receiver. If the receiver's buffer is full, it sends a "not ready" signal to pause transmission, then sends a "ready" signal once the buffer is cleared. Uses the sliding window mechanism.

5. Error Detection & Correction

Detects errors using checksum. In TCP, lost or corrupted segments are automatically retransmitted. If an ACK is not received within a timeout (default 5 seconds), the same segment is sent again. This is known as Retransmission.

6. Multiplexing (Port Numbers)

Uses port numbers to identify which application each segment belongs to, allowing multiple applications to communicate simultaneously over the same connection.

---

TCP vs UDP — Comparison

Feature	TCP	UDP
Connection type	Connection-oriented (3-way handshake)	Connectionless (no handshake)
Reliability	Guaranteed delivery	Best-effort (no guarantee)
Acknowledgement	Yes	No
Sequencing	Yes	No
Flow control	Yes (windowing)	No
Retransmission	Yes (automatic)	No
Header size	20–60 bytes (variable)	8 bytes (fixed)
Speed	Slower (more overhead)	Faster (low overhead)
Protocol number	6	17
Use cases	HTTPS, FTP, SMTP, SSH, Telnet	DNS, DHCP, TFTP, SNMP, VoIP, Streaming

Key Rule: Use TCP when reliability is more important than speed. Use UDP when speed is more important than reliability (e.g., VoIP, video streaming — these don't need error recovery).

---

TCP 3-Way Handshake

Before any data is transferred, TCP establishes a connection using a 3-way handshake process. During SYN, connection parameters are negotiated (MSS, Window Size, Selective ACK, Congestion technique). The SYN packet TCP header is 24 bytes; all other TCP packets are 20 bytes.

Step	Sent By	Message	Meaning
1	Client → Server	SYN (Seq=0)	Client requests connection and shares its parameters
2	Server → Client	SYN + ACK (Seq=10, ACK=1)	Server acknowledges and shares its own parameters. If parameters are acceptable, it agrees; otherwise it sends its own.
3	Client → Server	ACK (Seq=1)	Client confirms — connection is now established. Actual data transfer begins after this.

MSS (Maximum Segment Size)

MSS is negotiated during the 3-way handshake — the lowest value between sender and receiver is always used.

MSS = IP MTU − TCP header − IP header = 1500 − 20 − 20 = 1460 bytes

Window Size & Windowing

Buffer — Storage used to hold data before it is processed. Window Size — The empty/available space in the buffer (i.e., how much data can be received at once). Two types: Sending Window and Receiving Window. The receiving window (lowest among sender and receiver) is always negotiated.

Before windowing was introduced: each segment had to be acknowledged before the next one was sent — very slow. With windowing, multiple segments can be sent against a single acknowledgement. Default window size = 4128 bytes. Example: Window Size = 3 means 3 segments can be sent before waiting for ACK.

Selective Acknowledgement (SACK)

A TCP feature where, if a specific segment is missing during transmission, only that missing segment is re-requested — not all the data. This is TCP-only and is negotiated during the 3-way handshake.

Congestion Technique

TCP manages network congestion using a flag called ECE (Explicit Congestion Echo), negotiated during the 3-way handshake. If this flag is not negotiated, the congestion technique is not used.

---

Port Number Ranges

Range	Category	Description
0 – 1023	Well-Known Ports	Pre-defined for specific protocols (HTTP=80, SSH=22, etc.)
1024 – 49151	Registered Ports	Assigned to specific services/applications
49152 – 65535	Dynamic / Private (Ephemeral)	Randomly assigned to client-side connections

---

TCP Segment Header — Field-by-Field

TCP header size ranges from 20 bytes (minimum) to 60 bytes (maximum). The first 5 rows (5 × 4 = 20 bytes) are always present. The Options field can add up to 40 bytes.

Header length field value × 4 = actual header size in bytes. Range of field value: 5–15. Range of actual size: 20–60 bytes.

Field	Size	Purpose & Notes
Source Port	16 bits	Port of the sending application — usually a random ephemeral port (e.g. 49152)
Destination Port	16 bits	Port of receiving application — pre-defined (e.g. 80 for HTTP, 443 for HTTPS)
Sequence Number	32 bits	Tracks order of data; used for reassembly, retransmission, and detecting lost segments. Carries size of data inside the segment.
Acknowledgement Number	32 bits	Tells sender what to send next. Always = last received sequence number + 1. Example: ACK=1001 means data up to Seq 1000 was received.
Header Length (Data Offset)	4 bits	Size of the TCP header. Value × 4 = header size in bytes.
Reserved	3 bits	Not currently used. Always set to 0. Reserved for future use.
Flags (Control Bits)	6 bits	See flag table below
Window Size	16 bits	Flow control — tells sender how much data the receiver can currently handle
Checksum	16 bits	Error detection — verifies both header and data. Expressed in hexadecimal. If values don't match, packet is dropped.
Urgent Pointer	16 bits	Used only when URG flag is set. Format: X:Y (X = where urgent data starts, Y = size in bytes). Rarely used.
Options	0–40 bytes	Carries 3-way handshake parameters: MSS, window scaling, timestamps, SACK. Present only in SYN packets (making SYN header 24 bytes).
Data (Payload)	Variable	Actual data being transmitted from the application layer above

TCP Flags — Detailed

Flag	Full Name	When set to 1
SYN	Synchronisation	Used to initiate a connection and exchange connection parameters (MSS, window size, etc.)
ACK	Acknowledgement	This packet is an acknowledgement (confirming receipt)
FIN	Finish	Used to gracefully terminate a TCP connection (session logout)
RST	Reset	Abruptly resets/terminates the connection — used when session expires or destination port is unavailable
PSH	Push	Forces all buffered segments to be sent immediately to the receiving application in received order. Not recommended to set often as it forces the receiving CPU to act immediately.
URG	Urgent	Data is urgent — bypasses the buffer and is processed immediately. Urgent Pointer field becomes active.

---

UDP Header — Field-by-Field

UDP header is fixed at 8 bytes — this is why UDP is faster. There is no connection setup, no acknowledgement, no sequencing, and no retransmission. If reliability is needed, the application layer must handle it.

Field	Size	Purpose
Source Port	16 bits	Identifies the sending application
Destination Port	16 bits	Identifies the receiving application
Length	16 bits	Total length of UDP header + data (minimum 8 bytes)
Checksum	16 bits	Error detection — optional in IPv4, mandatory in IPv6
Data (Payload)	Variable	Actual user data being transmitted

---

Layer 3 Network Layer

PDU: Packet  RouterLayer 3 SwitchFirewall

The Network Layer is responsible for delivering packets from the source to the destination across multiple different networks. It adds logical (IP) addresses to data and determines the best path for delivery.

Main Functions

• Logical Addressing (IP Addressing) — Adds source and destination IP addresses to the segment, turning it into a packet. Includes subnetting and summarization.
• Path Determination — Calculates all possible paths between source and destination.
• Path Selection — Selects the best path from all available paths (using routing protocols).
• Packet Forwarding — Forwards packets hop-by-hop toward the destination.

Routing Protocols

Routing protocols carry routing information and help routers determine and select the best path:

• RIP / RIPv2 — Routing Information Protocol
• OSPF — Open Shortest Path First (Protocol number: 89)
• EIGRP — Enhanced Interior Gateway Routing Protocol (Protocol number: 88, Cisco proprietary)
• BGP — Border Gateway Protocol (used on the internet between ISPs)

Layer 3 Protocols & Protocol Numbers

Protocol	Protocol Number	Purpose
ICMP	1	Control messages — ping, traceroute, error reporting
IGMP	2	Multicast group management
TCP	6	Reliable transport (from transport layer)
UDP	17	Fast transport (from transport layer)
GRE	47	Generic Routing Encapsulation (tunneling)
EIGRP	88	Cisco routing protocol
OSPF	89	Link-state routing protocol

Port Number vs Protocol Number:
Port numbers are assigned at the Transport Layer for data generated by the Application Layer.
Protocol numbers are used in the IP header to identify what Transport Layer or Network Layer protocol is encapsulated inside the IP packet.

---

IPv4 Header — Field-by-Field

Minimum IP header size = 20 bytes. Maximum = 60 bytes (with Options).

Memory order: Version → Header Length → Type of Service → Total Length → Identification → Flags → Fragment Offset → TTL → Protocol → Header Checksum → Source IP → Destination IP → Options → Data

Field	Size	Purpose & Notes
Version	4 bits	IP version. Value = 4 for IPv4, 6 for IPv6.
Header Length (IHL)	4 bits	Size of the IP header (minimum 20 bytes). Helps locate where data begins.
Type of Service / DSCP	8 bits	QoS (Quality of Service) — prioritizes traffic. Range 0–7 (0 = least important). Used for voice, video, data prioritization. Replaced by DSCP (Differentiated Services Code Point) with more features.
Total Length	16 bits	Total size of the packet = IP header + data (payload/segment)
Identification	16 bits	Identifies all fragments that belong to the same original packet. All fragments of one packet share the same ID (in hex, 16 bits = 4 hex digits).
Flags	3 bits	Bit 1: Reserved (always 0). Bit 2: DF (Don't Fragment) — 0=fragmentation allowed, 1=no fragmentation. Bit 3: MF (More Fragments) — 1=more fragments coming, 0=this is the last fragment.
Fragment Offset	13 bits	Indicates the position/order of this fragment in the original packet. Used for correct reassembly at the destination.
TTL (Time To Live)	8 bits	Limits packet lifespan — prevents infinite routing loops. See TTL section below.
Protocol	8 bits	Identifies the upper-layer protocol encapsulated inside. ICMP=1, TCP=6, UDP=17, EIGRP=88, OSPF=89
Header Checksum	16 bits	Error checking for the IP header only (not data). Recalculated at every router hop.
Source IP Address	32 bits	IP address of the sender
Destination IP Address	32 bits	IP address of the receiver
Options	Variable	Rarely used. For special purposes: security, routing options. Makes header larger than 20 bytes.
Data (Payload)	Variable	The TCP or UDP segment from the layer above

---

Segmentation vs Fragmentation

Feature	Segmentation	Fragmentation
Done by	Transport Layer	Network Layer
Applied to	Data generated from Application Layer	Data generated from Network Layer
Protocol	TCP	IP
Reassembly	At destination Transport Layer	At destination Network Layer

Fragmentation Example

Packet = 5000 bytes (includes IP header). MTU = 1500 bytes. ICMP header = 8 bytes.

Fragment	Total Length	Identification	Fragment Offset	MF Flag
1st	1480+20=1500	0x0001	0	1
2nd	1480+20=1500	0x0001	1480	1
3rd	1480+20=1500	0x0001	2960	1
4th (last)	532+20=552	0x0001	4440	0

Note: IP is a connectionless protocol — no retransmission, no acknowledgement.

---

TTL — Time To Live (Deep Dive)

TTL is an 8-bit field in the IP header. Despite the name, it does NOT measure time in seconds — it measures the number of hops (routers) a packet is allowed to cross.

• The sender sets the TTL value
• Every router that forwards the packet decrements TTL by 1
• When TTL reaches 0: the packet is dropped and the router sends an ICMP Time Exceeded (Type 11) message back to the sender
• Helps identify how many routers exist between source and destination (used in traceroute)
• Prevents packets from looping indefinitely in the network

Operating System / Device	Default TTL
Cisco devices	255
Linux / macOS	64
Windows	128

Interview Line: "TTL is an 8-bit field in the IP header that limits the number of hops a packet can take. Each router decrements it by 1. When TTL = 0, the packet is dropped and an ICMP Time Exceeded message is sent back to the source."

---

ICMP — Internet Control Message Protocol (Protocol #1)

ICMP is used to verify connectivity and report errors between source and destination. It does not carry user data — it is purely a control/diagnostic protocol.

ICMP Tools

• Ping (Packet Internet Groper) — Tests connectivity. Sends Echo Request (Type 8) and expects Echo Reply (Type 0).
• Traceroute — Traces the path between source and destination by incrementally increasing TTL.

ICMP Message Types

Message	Type Code	Meaning
Echo Request	Type 8	Ping request sent to destination
Echo Reply	Type 0	Ping reply from destination
Destination Unreachable	Type 3	Router cannot reach the destination network
Time Exceeded	Type 11	TTL reached 0 — packet dropped by router

Cisco Ping Output

• ! — Success (received Echo Reply)
• U — Destination Unreachable
• . — Request Timed Out (RTO)

Setting	Windows Default	Cisco Default
Timeout	5 seconds	2 seconds
Packets sent	4 packets	5 packets
Data size	32 bytes	100 bytes

---

Layer 2 Data Link Layer

PDU: Frame  SwitchBridgeNIC

The Data Link Layer is responsible for node-to-node delivery of data over a single physical link. While the Network Layer uses IP addresses for end-to-end routing, the Data Link Layer uses MAC addresses to move data between directly connected devices, one hop at a time.

Main Functions

• Reliable data transfer over a single link (one hop)
• Uses MAC (Media Access Control) addressing — a physical address embedded in the NIC card
• Controls access to the transmission medium (MAC sublayer)
• Error detection using FCS (Frame Check Sequence) — runs CRC (Cyclic Redundancy Check) algorithm on data + header
• LLC (Logical Link Control) — encapsulates the packet into a frame and identifies the Layer 2 protocol being used. Manages protocols like STP, VTP, DTP.

Data Link Protocols

• ARP (Address Resolution Protocol)
• RARP (Reverse Address Resolution Protocol)
• Proxy ARP, Inverse ARP, Gratuitous ARP
• HDLC (High-Level Data Link Control)
• PPP (Point-to-Point Protocol)
• CDP (Cisco Discovery Protocol)

Ethernet is defined by the IEEE 802.3 standard (introduced in 1980).

---

Ethernet Frame Format — Field-by-Field

Format: | Preamble (7) | SFD (1) | Destination MAC (6) | Source MAC (6) | EtherType (2) | Data (46–1500) | FCS (4) |

Minimum frame size = 64 bytes  |  Maximum frame size = 1518–1522 bytes
Frame < 64 bytes = Runts  |  Frame > 1522 bytes = Giants
Note: Ethernet header itself = 18 bytes. MTU (1500 bytes) does NOT include the Ethernet header.

Field	Size	Purpose & Notes
Preamble	7 bytes	A pattern of alternating 0s and 1s (FLP — Fast Link Pulses). Synchronizes the sender and receiver — allows them to lock onto the data stream before the actual frame begins. Preamble is never attached to data.
SFD (Start Frame Delimiter)	1 byte	Always set to 10101011. Last two bits are 11 — signals adjacent devices to stop sending FLPs and start receiving data. Marks the start of the actual frame (Destination MAC follows). Sometimes counted as part of Preamble, making it 8 bytes total.
Destination MAC Address	6 bytes	MAC address of the receiving device. Can be unicast, multicast, or broadcast (FF:FF:FF:FF:FF:FF).
Source MAC Address	6 bytes	MAC address of the sending device. Always a unicast (individual) address — the least significant bit of the first byte is always 0.
EtherType / Type	2 bytes	Identifies the upper-layer protocol: IPv4 = 0x0800, IPv6 = 0x86DD, ARP = 0x0806, 802.1Q VLAN tag = 0x8100
Data / Payload	46–1500 bytes	Actual data from the Network Layer (IP packet). If data is less than 46 bytes, padding is added to reach the minimum.
FCS (Frame Check Sequence)	4 bytes	Error detection using CRC algorithm. The CRC value is calculated and stored in FCS by the sender. The receiver runs the same algorithm and compares — if values don't match, the frame is discarded. Unlike TCP checksum, FCS covers both data and header.

---

Layer 1 Physical Layer

PDU: Bits  HubRepeaterCablesWAP

The Physical Layer is the lowest layer of the OSI model. It deals purely with hardware — transmitting raw bits (0s and 1s) over a physical medium as electrical, optical, or radio signals. There is no addressing, no logic, and no error checking at this layer.

Main Functions

• Converts digital frames (from Data Link Layer) into bits/binary and vice versa
• Converts digital data into electrical signals (copper cable), light pulses (fiber), or radio waves (wireless) and back
• Acts as the bridge between software (logical) and hardware (physical)
• No decision-making — devices are unintelligent (Hub just forwards signals to all ports)

Transmission Media

Media Type	Examples	Signal Type
Twisted Pair Cable	CAT5, CAT6 (UTP/STP)	Electrical
Coaxial Cable	Cable TV coax	Electrical
Fiber Optic Cable	Single-mode, Multi-mode	Light (optical)
Wireless	Wi-Fi, Bluetooth	Radio waves

---

OSI Model vs TCP/IP Model

Feature	OSI Model	TCP/IP Model
Developed by	ISO (International Organization for Standardization)	DOD (Department of Defense, USA)
Number of layers	7 layers	4–5 layers
Type	Reference / Logical Model	Practical / Implementation Model
Purpose	Defines HOW communication will take place at each layer	Defines WHICH protocols will be used to make communication possible
Usage	Troubleshooting and understanding networks	Actual implementation in real networks

TCP/IP Layer Mapping

TCP/IP Layer	Equivalent OSI Layers	Key Protocols
Application Layer	Application + Presentation + Session (Layers 7, 6, 5)	HTTP, HTTPS, DNS, DHCP, Telnet, SSH, FTP, TFTP
Transport Layer (Host-to-Host)	Transport (Layer 4)	TCP header, UDP header
Internet Layer (Network)	Network (Layer 3)	IP header, ICMP
Data Link Layer	Data Link (Layer 2)	Ethernet header, ARP header, MAC address, CDP
Physical Layer (Access Layer)	Physical (Layer 1)	Cables, signals, hardware

---

Quick Revision Summary

Layer	Name	PDU	Key Devices	What to Remember
7	Application	Data	—	User-facing; HTTP(80), HTTPS(443), DNS(53), FTP(20/21), SSH(22), DHCP(67/68)
6	Presentation	Formatted Data	—	Translation, Encryption (SSL/TLS), Compression; format = JPEG, MP3, MPEG
5	Session	Data	—	Create, Manage, Terminate sessions; Dialog Control (Half/Full duplex); Checkpoints
4	Transport	Segment/Datagram	—	TCP (reliable, port 6) vs UDP (fast, port 17); 3-way handshake; MSS=1460; windowing
3	Network	Packet	Router, L3 Switch, Firewall	IP addressing, routing; TTL; ICMP; fragmentation; OSPF(89), EIGRP(88)
2	Data Link	Frame	Switch, Bridge, NIC	MAC addressing; Ethernet (IEEE 802.3); FCS/CRC; min 64B, max 1518B
1	Physical	Bits	Hub, Repeater, Cables	Raw signal transmission; no addressing, no logic

Key Port Numbers to Memorize

Protocol	Port	Protocol	Port
HTTP	80 (TCP)	HTTPS	443 (TCP)
FTP Data	20 (TCP)	FTP Control	21 (TCP)
SSH	22 (TCP)	Telnet	23 (TCP)
SMTP	25 (TCP)	DNS	53 (TCP/UDP)
DHCP Server	67 (UDP)	DHCP Client	68 (UDP)
TFTP	69 (UDP)	POP3	110 (TCP)
NTP	123 (UDP)	IMAP	143 (TCP)
SNMP	161/162 (TCP/UDP)	—	—