CCNA guide

OSI Model vs TCP/IP Model Explained (With Examples)

Layered models are the first thing you learn in networking and the last thing you stop using for troubleshooting, even after years on the job. "It's a Layer 1 problem" means "check the cable"; "ping works but the website doesn't" points you to the upper layers. The model is a shared language.

In this guide you'll see the 7 layers of the OSI model and the 4 layers of the TCP/IP model, what the data is called at each layer, which protocols and devices belong to each one, how a request to a website is encapsulated step by step, and which traps show up in the exam. At the end there are 5 practice questions with answers.

In the Networking Academy CCNA v8 courses, the models are taught in CCNA 1 · ITN, module 2 (protocols and models), and the layers are then covered one by one: physical (module 3), data link (module 5), network (module 9), transport (module 14) and application (module 15).

Why we use layered models

A network does many things at once: it turns bits into signals, finds the recipient on the same segment, picks a path across the Internet, checks that all the data arrived and hands it to the right application. Layered models split that work into pieces, each with its own role:

• each layer does one kind of job and uses the services of the layer below it;
• vendors can work independently: one company's network card works with another company's operating system, because both follow the same interfaces between layers;
• you can change one layer without touching the others: you switch from cable to Wi-Fi and the browser doesn't notice a thing;
• you troubleshoot methodically: you check the layers one at a time, bottom-up or top-down.

The OSI model: the 7 layers

OSI (Open Systems Interconnection) was published by ISO as a reference model. The actual OSI protocols never caught on, but the 7-layer split became the standard vocabulary of the profession.

A few clarifications that save you from confusion:

• Layer 2 actually has two sublayers: LLC (the link to the network layer) and MAC (media access and physical addressing).
• Ethernet and Wi-Fi cover both Layer 1 and Layer 2. The standard describes both the signals and the frame format.
• At Layer 4, if the question doesn't name the protocol, the expected PDU is segment.
• A network card works at Layers 1 and 2, while a computer or server uses all 7.
• A modern firewall can inspect traffic from Layer 3 all the way up to Layer 7, depending on the type.

The upper layers (5, 6, 7): why they feel fuzzy

In practice, applications do the work of Layers 5 and 6 themselves. A browser opens the session, picks the data format and encrypts the connection (with TLS), all inside the same program. That's why many people treat them together as "the application part", which is exactly what the TCP/IP model does.

The TCP/IP model: 4 layers (or 5)

The TCP/IP model came about together with the protocols the Internet uses. It isn't a theory written up front; it describes how today's networks actually work. In CCNA materials it has 4 layers:

Some books show a 5-layer TCP/IP model, where Network Access is split into Data Link and Physical. Same idea, just with a clearer bottom boundary. In the exam, read carefully how many layers the model in the question has.

OSI vs TCP/IP side by side

In short: when you say "Layer 2 switch" or "Layer 1 problem", you're speaking OSI. When you explain how a web page gets from the Internet to your phone, you're thinking in TCP/IP. The two overlap neatly, and in the exam you need to switch between them effortlessly.

PDUs: what the data is called at each layer

On the way down, each layer adds its own header in front of the data it gets from above. The result is called a PDU (Protocol Data Unit), and it has a different name at each layer:

Layer 2 is the only one that also adds something at the end: the FCS (Frame Check Sequence), a checksum the receiver uses to verify that the bits arrived intact. A frame with a bad FCS is dropped.

Adding headers is called encapsulation. The reverse process at the receiver, where each layer reads and removes its own header, is called decapsulation.

Full example: what happens when you open a website

Let's follow a real request. You're on a laptop, connected to your home router, and you type routerel.app into the browser. The starting data (made up, but realistic):

Step 0: find the server's IP address (DNS)

The browser knows a name, but the network works with addresses. The laptop asks a DNS server, usually over UDP port 53, and gets back the address 203.0.113.10. The DNS request also goes through every layer, exactly as below, just with UDP instead of TCP.

Step 1: the application layer

The browser prepares the HTTP request (essentially "give me the home page of routerel.app"). Because the site uses HTTPS, once the TCP connection is established the request is encrypted with TLS. As far as the model is concerned, the result is data.

Step 2: the transport layer

HTTPS uses TCP port 443. Before any data is sent, TCP sets up the connection with the three-way handshake (SYN, SYN-ACK, ACK). Then the data gets a TCP header with:

• source port: a number picked temporarily by the operating system, for example 51514, so the reply gets back to the right browser connection;
• destination port: 443;
• sequence and acknowledgment numbers, so nothing gets lost and everything arrives in order.

Now you have a segment.

Step 3: the network layer

The segment gets an IP header: source 192.168.1.10, destination 203.0.113.10, a TTL (for example 64 or 128, depending on the operating system) and the field saying there's TCP inside. Now you have a packet.

Step 4: the data link layer

Here's the most important idea in the whole example. The laptop compares the destination's network with its own: 203.0.113.10 is not in 192.168.1.0/24. So the packet can't be delivered directly; it has to be handed to the default gateway.

The laptop needs the router's MAC address, not the server's. If it doesn't already have it cached, it finds it with ARP. Then it builds the Ethernet frame:

• destination MAC: BB-BB-BB-22-22-22 (the home router);
• source MAC: AA-AA-AA-11-11-11 (the laptop);
• type: IPv4;
• at the end, the FCS.

Now you have a frame.

Step 5: the physical layer

The network card turns the frame into bits: electrical signals on the cable or radio waves on Wi-Fi.

What the router does

The router receives the bits and rebuilds the frame. It checks the FCS, sees that the destination MAC is its own and strips the frame. It reads the IP packet, looks up the destination in its routing table, decrements the TTL by 1 and builds a new frame with the right MAC addresses for the next link. The home router does one more thing: NAT, replacing the private source IP address with the public address it got from the ISP.

Every router along the path repeats the story: a new frame at every hop, while the IP packet travels on.

What the server does

The server does the reverse trip: bits → frame (checks the FCS, strips the Ethernet header) → packet (checks the destination IP, strips the IP header) → segment (sees port 443 and hands the data to the web server) → data. The web server replies, and the reply is encapsulated and sent back with the ports swapped: source 443, destination 51514.

Header summary

The rule to remember: MAC addresses change at every hop, IP addresses stay the same end to end (unless NAT steps in).

Common exam traps

1. The switch is Layer 2, the router Layer 3, the hub Layer 1. The exception: the multilayer (Layer 3) switch, which can route.
2. Segment vs. datagram vs. packet vs. frame. TCP makes segments, UDP datagrams, IP packets, Ethernet frames. If the question says "at Layer 2", the answer is frame. If the question doesn't name the protocol, the expected layer 4 PDU is segment.
3. Who adds which address. Ports: Layer 4. IP addresses: Layer 3. MAC addresses: Layer 2.
4. Only Layer 2 adds a trailer. Layers 4, 3 and 2 add headers; only Layer 2 adds a trailer (FCS).
5. Internet = Network. The "Internet" layer in TCP/IP maps to OSI Layer 3, not to the Internet as a whole.
6. Network Access = Layers 1 and 2. Not just Layer 1.
7. Encryption, compression and formats (JPEG, ASCII) belong to Layer 6, Presentation. The dialog (opening, closing, resuming) belongs to Layer 5, Session.
8. ICMP is at Layer 3, even though its messages travel inside IP packets. Ping doesn't use ports.
9. ARP sits on the boundary between Layers 2 and 3. It maps an IP address to a MAC address, and its messages go straight into Ethernet frames, with no IP header. Read carefully what the question is asking: its role, or where its messages are carried.
10. The destination MAC of a packet headed for the Internet is the gateway's, not the server's. This is probably the most common trap in the whole topic.
11. Encapsulation goes top-down (7 → 1), decapsulation bottom-up (1 → 7).

Memory tricks

For the OSI layers from the bottom up (Physical, Data Link, Network, Transport, Session, Presentation, Application):

From the top down (A, P, S, T, N, D, P):

For the PDUs, from the top down (Data, Segment, Packet, Frame, Bits):

If none of these stick, make up your own: a silly sentence you invented yourself is usually the one you remember best.

Practice questions

1. A PC sends an email. At which OSI layer is the destination port added, and what is the resulting PDU called if the transport protocol is TCP?
2. A switch receives a frame and looks in its address table to decide which port to send it out of. Which address does it decide on, and at which layer is it working in this case?
3. A packet leaves PC A, passes through two routers and reaches server B. Without NAT, what changes at each hop: the MAC addresses, the IP addresses or both?
4. Which OSI layers does the Network Access layer of the TCP/IP model map to?
5. A file is compressed and encrypted before it's sent. Which OSI layer does the model assign these functions to?

How to use the model in practice

The model isn't just for the exam. When "the internet doesn't work", an orderly bottom-up troubleshooting pass looks like this:

• Layer 1: is the cable plugged in, is the port LED on, is Wi-Fi turned on?
• Layer 2: is the port in the right VLAN, does the MAC address show up in the switch's table? (For VLANs, see the guide to VLANs and trunks.)
• Layer 3: does the device have the right IP address, mask and gateway? Does ping to the gateway work? (For masks and subnets: subnetting step by step; for IPv6: IPv6 addresses explained.)
• Layer 4 and above: does ping to the server work but the website doesn't? Then check DNS, the port, the firewall, the application.

The commands you use for these checks on Cisco devices are collected in the Cisco IOS commands cheat sheet.

Frequently asked questions

Routerel is an independent app and is not affiliated with, sponsored by or endorsed by Cisco Systems, Inc. Cisco, CCNA, Cisco IOS and Networking Academy are trademarks of Cisco Systems, Inc.