The OSI model and how data is encapsulated

Why this matters

The OSI model is not a description of how any real network works. No packet has ever passed through seven layers on its way out of a laptop; the software that actually moves your traffic implements four, and TCP/IP predates OSI as a working system by years.

It matters anyway, for two reasons, and only one of them is the exam.

The first is that it is the industry's shared vocabulary for where a problem is. When someone says "that's a layer 2 issue" they are saying something precise and useful: the frame is not getting between two devices on the same segment, so stop testing DNS. A troubleshooting conversation without layers is people guessing at each other. Domain 5 of this exam is 24% troubleshooting, the largest single domain, and almost all of it is layered reasoning wearing different clothes.

The second is that N10-009 asks you to place things. Not to recite the layers — to know that a switch is layer 2 and a router is layer 3, that TLS is presentation-ish, that a load balancer might be 4 or 7 and the difference changes what it can see. Nearly every appliance, protocol and failure in this course gets tagged with a layer somewhere, and if the model is shaky the tags are noise.

Learn it as a filing system, not as physics.

The lesson

The seven layers, top to bottom and bottom to top

The model stacks seven layers. Data from an application travels down the stack on the sending machine and back up on the receiving one. Each layer talks to its opposite number on the other machine, and to the layers directly above and below it on its own.

Bottom to top, which is the order they are numbered:

Layer 1 – Physical. Electrical, optical and radio reality: voltages, light pulses, frequencies, pinouts, connectors, the cable itself. Layer 1 has no idea what a message is. It moves bits. A crushed cable, a bent fibre, a bad transceiver, the wrong pinout, a run past 100 metres — all layer 1. Hubs and repeaters live here, as do the media and connectors covered later in this course.

Layer 2 – Data link. Turns a stream of bits into frames addressed to a specific device on the same local segment, using MAC addresses. This is where switches operate, where VLANs are defined, where spanning tree runs, and where error detection (a frame check sequence) happens. Layer 2 does not know what a network is; it knows "this segment" and "these MAC addresses".

Layer 3 – Network. Addresses and routes between different networks. IPv4 and IPv6 live here, along with ICMP, and this is where routers work. Layer 3 provides logical addressing that is independent of the hardware — the thing that makes an internet possible at all. Fragmentation and TTL are layer 3 concerns.

Layer 4 – Transport. Turns "get it to that host" into "get it to that service on that host", using port numbers. TCP gives you connections, sequencing, acknowledgement and retransmission; UDP gives you none of those and is faster and smaller for it. Segmentation into TCP segments or UDP datagrams happens here.

Layer 5 – Session. Establishes, maintains and tears down conversations between applications, and decides whose turn it is to talk. In practice, very little modern software has a distinct session layer — the functions exist but are usually folded into the application or transport. Examples given at this level include RPC and NetBIOS session services.

Layer 6 – Presentation. Translation: character encoding, data formats, compression and encryption. TLS is the standard exam answer here, though in reality TLS straddles 5, 6 and 7. The idea is the useful part: somewhere between "the connection works" and "the application understands it", bytes have to be put into an agreed form.

Layer 7 – Application. Not the application itself — the network services the application uses. HTTP, DNS, SMTP, FTP, SNMP are layer 7 protocols. Your browser is not layer 7; the HTTP it speaks is.

Remembering the order without a mnemonic you will misremember

Most people learn "Please Do Not Throw Sausage Pizza Away" (layers 1→7) or "All People Seem To Need Data Processing" (7→1). Either is fine, but a mnemonic gets you the names, not the meanings, and exam questions are about meanings.

A more durable version is to ask what each layer adds that the one below could not do:

• 1 moves bits. Cannot say who they are for.
• 2 adds a local address. Cannot leave the segment.
• 3 adds a global address. Cannot say which program wants it.
• 4 adds a port. Cannot manage a long conversation.
• 5 adds a session. Cannot agree on a format.
• 6 adds a format. Cannot do anything useful on its own.
• 7 is the useful thing.

If you can generate that chain, you can place any technology you meet.

Encapsulation: what actually happens to your data

Encapsulation is the mechanism the layers use. Each layer on the way down wraps what it received from above in its own header (and sometimes a trailer), then hands the result down. Each layer on the way up strips its own header off and passes the rest up. A layer never inspects the layers above it — it treats their output as an opaque payload.

Sending a web request, roughly:

1. Layer 7 produces an HTTP request: GET /index.html, plus headers.
2. Layer 6/5 may encrypt it with TLS and manage the session state.
3. Layer 4 prepends a TCP header — source port (something ephemeral, say 49152), destination port 443, sequence number, flags. The result is a segment.
4. Layer 3 prepends an IP header — source IP, destination IP, TTL, protocol number. The result is a packet.
5. Layer 2 prepends an Ethernet header — source MAC, destination MAC, EtherType — and appends a frame check sequence. The result is a frame.
6. Layer 1 transmits the frame as bits.

The names matter on the exam. Segment at 4, packet at 3, frame at 2, bits at 1, and "data" or "PDU" above 4. A question that says "at which layer is the data referred to as a frame" is asking you to recall exactly this.

Two details that earn marks:

The addresses at layer 2 and layer 3 behave completely differently. The source and destination IP addresses stay the same end to end (barring NAT). The source and destination MAC addresses are rewritten at every hop — they only ever identify two devices on the same segment. When a packet crosses a router, the router strips the frame, decrements the TTL in the IP header, and builds a new frame with new MAC addresses for the next hop. If you can explain that, you understand the difference between switching and routing, which is a large part of domain 2.

Decapsulation is not symmetric with failure. If the frame check sequence fails at layer 2, the frame is dropped and nothing above ever hears about it. Ethernet detects errors; it does not correct them. Recovery, if any, is TCP's job at layer 4 — which is why a bad cable shows up as poor throughput and retransmissions rather than corrupted web pages.

Where the model and reality disagree

Be ready for the fact that the TCP/IP model — the one the internet actually runs — has four layers: Link, Internet, Transport, Application. OSI's 5, 6 and 7 all collapse into TCP/IP's Application layer; OSI's 1 and 2 collapse into Link. N10-009 teaches OSI, and exam questions use OSI numbering, but knowing that TLS "is layer 6" is a convention rather than a fact will stop you arguing with a question.

Similarly, plenty of real equipment refuses to sit on one layer. A multilayer switch does layer 2 and 3. A next-generation firewall inspects 3 through 7. A load balancer at "layer 4" forwards based on IP and port without looking at content; the same box at "layer 7" reads the HTTP host header and can route on URL. That distinction — what a device can see — is the practical meaning of a layer, and it is how the exam frames appliance questions.

On the exam

• Place the device. Hub and repeater: 1. Switch, bridge, access point: 2. Router, multilayer switch: 3. Firewall: 3/4, or up to 7 if it is an NGFW. Load balancer: 4 or 7 depending on what it inspects.
• Place the protocol. Ethernet and ARP: 2 (ARP is the classic trick — it resolves an IP to a MAC but is a layer 2 protocol). IP, ICMP: 3. TCP, UDP: 4. HTTP, DNS, SMTP, FTP, SNMP: 7.
• Name the PDU. Bits, frame, packet, segment/datagram, data.
• Expect "at which layer" troubleshooting questions. "Users on one switch cannot reach anything, the link light is on" is layer 2 or 3, not 1. "No link light" is 1. "The site loads over IP but not by name" is 7, specifically DNS.
• Do not over-think 5 and 6. They carry the fewest questions and the fuzziest real-world mapping. Know what they are for and the standard examples; spend your revision time on 1 through 4 and 7, which is where the marks are.

A final warning worth more than any mnemonic: the model's value on this exam is as a narrowing tool. When a troubleshooting question gives you symptoms, ask what is the lowest layer that could produce them, and rule upward from there. Almost every wrong answer in domain 5 comes from starting at layer 7 because that is where the user noticed.