Network Layer Models

The OSI seven-layer model and how the TCP/IP model maps onto it — with the protocols, data units, devices, and the attacks and tooling that live at each layer. Tap a layer to jump to its detail.

The stack, side by side

OSI is the seven-layer teaching model; TCP/IP is the four-layer model the internet actually runs on. Same journey, coarser grouping. Application at the top, physical media at the bottom.

OSI · 7 layersTCP/IP · 4 layers
7ApplicationHTTP · DNS · SMTP · SSH · RDPData 6PresentationTLS/SSL · encoding · JPEGData 5SessionNetBIOS · RPC · SMB sessionsData 4TransportTCP · UDP · portsSegment 3NetworkIP · ICMP · routingPacket 2Data LinkEthernet · MAC · ARP · VLANFrame 1Physicalcables · fiber · radio · bitsBits
ApplicationOSI 5–7: talks to the app
TransportOSI 4: end-to-end delivery
InternetOSI 3: addressing & routing
Network AccessOSI 1–2: the local link

Encapsulation: heading down the stack, each layer wraps the one above in its own header. The unit's name changes with it — Data → Segment → Packet → Frame → Bits — and the receiving host unwraps it back up in reverse.

Every layer, with examples

Protocols and devices that operate at each layer, plus the SOC lens — what an attacker does here and where you'd catch it.

7

Application

Data
Protocols & examples
HTTP/SDNSSMTPIMAP/POP3FTP/SFTPSSHRDPSNMPLDAPNTP
Devices
Hosts & the apps themselves, next-gen (L7) firewalls, web proxies, application load balancers
SOC lens
Phishing, web attacks (SQLi, XSS), malicious downloads, and C2 tunneled over HTTPS or DNS. Caught in proxy / WAF logs and Zeek http.log / dns.log.
6

Presentation

Data
Protocols & examples
TLS/SSLencryptionMIMEASCII/UnicodeJPEG/PNGcompression
Devices
Mostly software; TLS terminators and SSL-inspection appliances live here
SOC lens
Certificate anomalies, JA3 / JA3S TLS fingerprints, weak ciphers, and self-signed certs fronting C2.
5

Session

Data
Protocols & examples
NetBIOSRPCSMB sessionPPTPsocketsnamed pipes
Devices
Software session managers and gateways that open, hold, and tear down sessions
SOC lens
Session hijacking, pass-the-hash over SMB sessions, and RPC abuse for lateral movement.
4

Transport

Segment / Datagram
Protocols & examples
TCPUDPQUICports 80/443/22/3389/53
Devices
L4 firewalls, network load balancers, NAT gateways
SOC lens
Port scans, SYN floods, traffic on unexpected ports, and beacon cadence. Read it in ss/netstat and firewall / flow logs.
3

Network

Packet
Protocols & examples
IPv4/IPv6ICMPIPsecOSPFBGPARP (L2 / L3)
Devices
Routers and L3 switches
SOC lens
IP spoofing, ICMP tunneling, BGP / route hijack, and geo / ASN anomalies. Read it in NetFlow / IPFIX, traceroute, and GeoIP lookups.
2

Data Link

Frame
Protocols & examples
EthernetWi-Fi 802.11MACARPVLAN 802.1QSTPPPP
Devices
Switches, bridges, NICs, wireless access points
SOC lens
ARP spoofing / MITM, MAC flooding, VLAN hopping, and rogue DHCP. Read it in arp -a and switch CAM / port-security logs.
1

Physical

Bits
Protocols & examples
copper / fiberRJ45connectorsradio / RFvoltagebits on the wire
Devices
Hubs, repeaters, media converters, cables, transceivers
SOC lens
Physical taps, rogue devices, cable / RF jamming, and hardware implants. Controlled with NAC, port security, and physical inspection.

Remembering the order

The two classic mnemonics — one for each direction through the stack.

Layer 7 → 1 (top down)

All People Seem To Need Data Processing

Application · Presentation · Session · Transport · Network · Data Link · Physical

Layer 1 → 7 (bottom up)

Please Do Not Throw Sausage Pizza Away

Physical · Data Link · Network · Transport · Session · Presentation · Application