OSI Model vs TCP/IP Model: Layers, Protocols and a Wireshark Walkthrough

Almost every networking interview I have sat in starts with "explain the OSI model". In this post you will learn the seven OSI lay...

Almost every networking interview I have sat in starts with "explain the OSI model". In this post you will learn the seven OSI layers and the four TCP/IP layers, see which protocols and devices live at each one, understand encapsulation, and then open Wireshark to watch a real HTTP request pass through every layer. Once you have seen the layers in a capture, you will never need to memorize them blindly again.

Why we use layered models

Sending a web page involves many separate jobs: signaling bits, reaching the next device, finding a path across networks, recovering lost data and showing the page. A layered model gives each job to one layer, so you can swap Wi-Fi for Ethernet without changing your browser and troubleshoot "bottom-up": cable, switch, IP, application.

A protocol is the agreed set of rules two devices follow at a given layer, for example the format of an IP header or how TCP acknowledges data.

The OSI reference model

The Open Systems Interconnection (OSI) model was published by the International Organization for Standardization (ISO) as ISO/IEC 7498-1. ISO also designed a full set of OSI protocols, but they never won in the market. What survived is the seven-layer model, which we now use as a common language for describing any network.

A popular way to remember the layers from 7 down to 1: "All People Seem To Need Data Processing" (Application, Presentation, Session, Transport, Network, Data Link, Physical).

OSI layer table

#	OSI layer	Main job	PDU name	Example protocols / standards	Example devices
7	Application	Network services used by applications	Data	HTTP, DNS, SMTP, FTP, SSH, DHCP, SNMP	Hosts, servers, application firewalls
6	Presentation	Data format, character encoding, compression, encryption	Data	TLS (often placed here), ASCII/UTF-8, JPEG, MPEG	Hosts
5	Session	Opening, managing and closing conversations between applications	Data	NetBIOS session service, RPC	Hosts
4	Transport	End-to-end delivery between applications using port numbers; reliability and flow control (TCP)	Segment (TCP) / Datagram (UDP)	TCP, UDP	Hosts, stateful firewalls, load balancers
3	Network	Logical addressing and routing between networks	Packet	IPv4, IPv6, ICMP, OSPF, EIGRP	Routers, Layer 3 switches
2	Data Link	Delivery on the local link using MAC addresses; framing and error detection	Frame	Ethernet (IEEE 802.3), Wi-Fi (802.11), 802.1Q, PPP	Switches, bridges, wireless access points, NICs
1	Physical	Sending bits as electrical, light or radio signals	Bits	1000BASE-T, 10GBASE-SR, RJ45 pinouts, fiber and radio specs	Cables, connectors, hubs, repeaters, media converters

A few notes, because many notes online get these wrong:

• The Data Link layer has two sublayers: LLC (Logical Link Control, IEEE 802.2), which talks to the network layer, and MAC (Media Access Control), which handles addressing and access to the medium.
• HTTPS is HTTP running over TLS. SSL is the older, now deprecated predecessor of TLS. TLS provides confidentiality and authentication; it does not make anything faster.
• Real protocols do not always fit neatly; TLS is placed differently by different books. The model is a guide, not a law.

The TCP/IP model

The TCP/IP suite came out of research funded by the US Defense Advanced Research Projects Agency (DARPA) in the 1970s and was deployed on ARPANET in 1983. Today its protocols are developed and published by the Internet Engineering Task Force (IETF) as RFCs. The Internet Assigned Numbers Authority (IANA) does not "manage TCP/IP"; it maintains the registries of numbers the protocols use, such as port numbers, protocol numbers and top-level IP address allocations.

RFC 1122 describes four layers. Many textbooks, including Cisco's CCNA material, also use a five-layer "updated" version that splits Link into Data Link and Physical.

TCP/IP layer (RFC 1122)	Matches OSI layers	Key protocols
Application	7, 6, 5	HTTP, HTTPS (HTTP over TLS), DNS, DHCP, FTP, SSH, Telnet, SMTP, SNMP, NTP
Transport	4	TCP (connection-oriented, reliable), UDP (connectionless, best effort)
Internet	3	IPv4, IPv6, ICMP, ICMPv6
Link	2, 1	Ethernet, Wi-Fi, ARP (sits between link and internet), PPP

Figure: The seven OSI layers, their PDU names, and how they map to the four TCP/IP layers.

OSI vs TCP/IP: what actually differs

Point	OSI	TCP/IP
Number of layers	7	4 (or 5 in many textbooks)
Origin	ISO committee, designed model-first	DARPA research, protocols first, model described afterwards
Use today	Reference and troubleshooting vocabulary	The protocol suite the internet actually runs
Upper layers	Separate Session, Presentation and Application	One Application layer; apps handle session and format themselves
Connection types	Network layer offers both; the original transport layer is connection-oriented only	Internet layer (IP) is connectionless only; transport offers both TCP (connection-oriented) and UDP (connectionless)
Design separation	Clear separation of services, interfaces and protocols	Less formal separation; more practical

Engineers use OSI numbers ("a Layer 2 problem") to describe TCP/IP traffic. That is how the two models work together.

Encapsulation: how data moves down and up the stack

When your browser sends a request, each layer adds its own header in front of the data it receives from the layer above. This is encapsulation.

1. Application: the browser creates the HTTP request text, for example GET / HTTP/1.1.
2. Transport: TCP adds a header with the source port (a random high port, for example 51544) and destination port 80, plus sequence and acknowledgment numbers. The result is a segment.
3. Network: IP adds a header with source and destination IP addresses and a TTL. The result is a packet.
4. Data Link: Ethernet adds a header with source and destination MAC addresses and a trailer with the FCS (frame check sequence). The result is a frame.
5. Physical: the NIC turns the frame into signals on the cable or radio.

The receiving host reverses this (de-encapsulation): each layer reads and removes its own header and passes the rest up. Routers in the middle only go up to Layer 3; they remove the old Ethernet frame, read the IP header, and build a new frame for the next link. The IP addresses stay the same end to end (unless NAT changes them), but the MAC addresses change on every hop.

Wireshark walkthrough: one HTTP request, every layer

Now let's see this for real. You need Wireshark (free, from wireshark.org) and a website that still uses plain HTTP, because with HTTPS the application data is encrypted and you only see TLS. Your home router's login page (often http://192.168.1.1) works well. If your router redirects to HTTPS, use a plain-HTTP test site such as neverssl.com instead.

My lab: PC 192.168.1.10, web server (router admin page) 192.168.1.1. Your values will differ.

Step 1: start the capture

Open Wireshark, double-click your active interface (Wi-Fi or Ethernet), then open the HTTP page in your browser. Stop the capture after the page loads.

Step 2: filter the traffic

Type this display filter into the filter bar and press Enter:

ip.addr == 192.168.1.1 && tcp.port == 80

This shows only TCP traffic on port 80 to and from the server. You should see the TCP three-way handshake first: SYN, SYN, ACK, ACK. Then the GET request, the server's HTTP/1.1 200 OK response, and finally FIN or RST packets closing the connection.

The packet list pane (top) should look similar to this. Your times, ports and lengths will differ:

No.	Source	Destination	Protocol	Length	Info
1	192.168.1.10	192.168.1.1	TCP	66	51544 → 80 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM
2	192.168.1.1	192.168.1.10	TCP	66	80 → 51544 [SYN, ACK] Seq=0 Ack=1 Win=29200 Len=0 MSS=1460 SACK_PERM WS=128
3	192.168.1.10	192.168.1.1	TCP	54	51544 → 80 [ACK] Seq=1 Ack=1 Win=262656 Len=0
4	192.168.1.10	192.168.1.1	HTTP	412	GET / HTTP/1.1
5	192.168.1.1	192.168.1.10	TCP	60	80 → 51544 [ACK] Seq=1 Ack=359 Win=30336 Len=0
6	192.168.1.1	192.168.1.10	HTTP	1250	HTTP/1.1 200 OK (text/html)

Notice that packet 5 acknowledges 359: the server confirms it received bytes 1 to 358 of the GET request, so it expects byte 359 next.

Step 3: open the GET packet

Click the packet whose Info column shows GET / HTTP/1.1. The middle pane (packet details) shows one line per layer. Collapsed, it looks similar to this:

Frame 4: 412 bytes on wire (3296 bits), 412 bytes captured (3296 bits)
Ethernet II, Src: 00:1a:2b:3c:4d:5e, Dst: 00:aa:bb:cc:dd:01
Internet Protocol Version 4, Src: 192.168.1.10, Dst: 192.168.1.1
Transmission Control Protocol, Src Port: 51544, Dst Port: 80, Seq: 1, Ack: 1, Len: 358
Hypertext Transfer Protocol

Read it from top to bottom and you are reading the stack from bottom to top:

• Frame is Wireshark's summary of the Physical layer view: the frame size on the wire and when it was captured.
• Ethernet II is Layer 2: the source MAC is your NIC; the destination MAC is the next device on the link (here the router). If you browse to a site on the internet, the destination MAC is still your default gateway's MAC, not the remote server's.
• Internet Protocol Version 4 is Layer 3: source and destination IP addresses. Expand it to see TTL (128 is typical for Windows, 64 for Linux and macOS) and Protocol: TCP (6).
• Transmission Control Protocol is Layer 4: your random source port and destination port 80. Len: 358 is the size of the HTTP data inside.
• Hypertext Transfer Protocol is Layer 7: expand it to see the request line and headers such as Host and User-Agent.

Check the arithmetic: 14 bytes Ethernet header + 20 bytes IP header + 20 bytes TCP header + 358 bytes HTTP = 412 bytes. That is encapsulation, visible in numbers. (The 4-byte FCS is usually removed by the NIC before Wireshark sees the frame. Your TCP header may be 32 bytes if timestamps are enabled, which is common on Linux.)

When you expand each section, these are the fields worth finding:

Section (layer)	Field	Value in this capture
Ethernet II (L2)	Type	IPv4 (0x0800)
IPv4 (L3)	Header Length / Total Length	20 bytes / 398
IPv4 (L3)	Time to Live / Protocol	128 / TCP (6)
TCP (L4)	Header Length / Flags	20 bytes / 0x018 (PSH, ACK)
HTTP (L7)	Request line / Host	GET / HTTP/1.1 / 192.168.1.1

The IPv4 Total Length of 398 is the IP header plus everything above it: 20 + 20 + 358.

Step 4: follow the conversation

Right-click the GET packet and choose Follow > TCP Stream. Wireshark shows the request and response as plain text, which is exactly why HTTP is unsafe for passwords. Try the same with an HTTPS site and you will only see TLS records.

The client's request is shown in red and the server's response in blue. The start of the stream looks like this (headers vary by browser and server):

GET / HTTP/1.1
Host: 192.168.1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.9
Connection: keep-alive

HTTP/1.1 200 OK
Content-Type: text/html
Connection: keep-alive

<!DOCTYPE html>
<html>
...

Prefer video? Watch more hands-on labs on the Technical Hakim YouTube channel.

Common mistakes

• Calling everything a "packet". On the exam, segment (L4), packet (L3) and frame (L2) are different answers.
• Thinking switches are Layer 3. A normal access switch forwards using MAC addresses (Layer 2). Only a multilayer (Layer 3) switch routes.
• Expecting to see the remote server's MAC address. MAC addresses are only local to each link.
• Capturing HTTPS and wondering where the HTTP is. It is encrypted inside TLS.
• Mixing filter types. tcp.port == 80 is a display filter; capture filters use BPF syntax such as tcp port 80.

Summary

• OSI has 7 layers and is the vocabulary we use; TCP/IP has 4 (or 5) and is what the internet runs.
• PDUs: data, segment, packet, frame, bits.
• Each layer adds a header on the way down and removes it on the way up.
• Wireshark's packet details pane is the OSI model on your screen.

Related tutorials

• Network Troubleshooting with ping, traceroute and show Commands
• Subnetting Made Simple: /24 to /30 with Worked Examples
• Types of Computer Networks: LAN, MAN, WAN, PAN (and more) Explained
• Network Standards: De Facto vs De Jure (with IEEE 802 Examples)

Sources

• ISO/IEC 7498-1, Open Systems Interconnection Basic Reference Model
• RFC 1122, Requirements for Internet Hosts: Communication Layers: https://www.rfc-editor.org/rfc/rfc1122
• RFC 791 (IPv4): https://www.rfc-editor.org/rfc/rfc791
• RFC 9293 (TCP): https://www.rfc-editor.org/rfc/rfc9293
• RFC 9112 (HTTP/1.1): https://www.rfc-editor.org/rfc/rfc9112
• Wireshark User's Guide