OSI and TCP/IP models

Why it matters

"Is it a layer 4 or a layer 7 load balancer?" "That's a layer 2 problem." "The firewall only sees up to layer 4." Engineers use layer numbers as shorthand every day, and each one carries a precise meaning about what a device can see and decide. The layered model is also the map for the rest of this stage: every later module zooms into one layer. Learning it once makes every networking conversation shorter.

The idea

Networking is split into layers, each solving one problem and relying only on the layer directly beneath it. The physical layer moves bits; the link layer moves frames between neighbours; the network layer moves packets across many networks; the transport layer moves data between programs; the application layer gives that data meaning. A layer does not care how the one below works, only what it promises. That separation is why the same HTTP request can travel over Wi-Fi, fibre and 5G without changing.

What each layer owns

Layer	Unit	Responsibility	Addresses	Examples	Devices that act here
7 Application	Message	What the data means	URLs, hostnames	HTTP, DNS, SMTP, gRPC	API gateways, L7 load balancers, WAFs
6 Presentation	—	Encoding, encryption, compression	—	TLS (roughly), JSON, gzip	Folded into apps and libraries in practice
5 Session	—	Long-lived conversations	—	Sessions, RPC framing	Folded into apps in practice
4 Transport	Segment / datagram	Process to process, reliability, ports	Ports	TCP, UDP, QUIC	L4 load balancers, stateful firewalls, NAT
3 Network	Packet	Host to host across networks	IP addresses	IPv4, IPv6, ICMP	Routers
2 Data link	Frame	Neighbour to neighbour on one link	MAC addresses	Ethernet, Wi-Fi	Switches, access points
1 Physical	Bit	Signals on a medium	—	Copper, fibre, radio	Cables, transceivers, hubs

How engineers actually use the numbers

Nobody implements OSI's layers 5 and 6 as separate things; TLS, serialisation and session handling live in applications and libraries. So in conversation, "layer 7" means "understands the application protocol" (can route by URL path, read headers, retry a request), "layer 4" means "sees connections and ports but not the content", "layer 3" means "routes by IP address", and "layer 2" means "the local network segment: MAC addresses, switches, VLANs". A layer 4 load balancer is fast and protocol-agnostic; a layer 7 one is smarter and costs more per request, because it must parse.

Why layering works and where it leaks

Layering lets each piece evolve independently: IPv6 replaced IPv4 underneath unchanged TCP, and HTTP/2 replaced HTTP/1.1 above unchanged TCP. But the boundaries leak in practice. TCP's behaviour depends on the path's latency and loss (layer 3 facts); NAT devices rewrite layer 4 port numbers; TLS sits awkwardly between 4 and 7; QUIC deliberately merges transport and encryption into one layer to move faster. Knowing the model is useful precisely because you can then name where it is being bent.

Trade-offs

Strict layering costs some efficiency (each layer adds headers and processing) and can hide information a lower layer would benefit from (TCP cannot tell congestion from wireless loss). The alternative, merging layers, buys performance and flexibility at the cost of independence: QUIC is faster to deploy than a new TCP precisely because it lives in user space above UDP, but it reimplements much of what the kernel already did.

In an interview

Use layer numbers precisely and attach a consequence: "An L4 load balancer can spread TCP connections but cannot route /api and /static differently or retry a failed request; for that we need L7, at a higher per-request cost." Or when debugging: "If ping works but the HTTP request fails, layers 3 and below are fine; the problem is at 4 or 7: port blocked, TLS mismatch, or the app itself."