The OSI model, as engineers actually use it

Why it matters

Nobody configures the OSI model, but everybody talks in it. A "layer 4 load balancer" forwards TCP connections without reading them; a "layer 7" one reads HTTP and routes by path. A firewall rule, a TLS termination point, a service mesh: each sits at a layer, and knowing which one tells you what it can see and what it cannot. The model is a vocabulary for saying where in the stack a component works.

The idea

The OSI model describes networking as seven layers, each providing a service to the one above and using the one below. In practice the internet runs on the simpler TCP/IP model, and engineers collapse OSI to the four layers that map onto real decisions.

What each layer gives you

Layer	Unit	Identifies by	Typical question in a design
L7 Application	Request / message	URL, headers, method	Route by path or host? Terminate TLS? Cache responses?
L4 Transport	Segment / datagram	IP + port	Reliable stream or fast datagrams? Connection limits?
L3 Network	Packet	IP address	Which network, which region, how routed?
L2 Link	Frame	MAC address	Rarely in an interview; your cloud handles it

Encapsulation, briefly

When your service sends an HTTP response, the bytes are wrapped in a TCP segment (adding ports and sequence numbers), then in an IP packet (adding addresses), then in a link frame. Each hop along the way reads only the layers it needs: a router looks at IP, a layer 4 balancer at TCP ports, a layer 7 proxy at HTTP. This is why a layer 4 balancer is fast and dumb and a layer 7 proxy is slower and smart.

L4 versus L7: the distinction you will use

A layer 4 device sees connections: source and destination IP and port. It can spread connections across servers and block ports, cheaply and at line rate, but it cannot tell /api/orders from /images/logo.png. A layer 7 device terminates the connection, reads the HTTP request, and can route by path, host or header, rewrite URLs, cache, compress and authenticate. It costs CPU and adds latency, and it must hold TLS certificates if traffic is encrypted.

Trade-offs

Working higher in the stack buys intelligence (routing by content, caching, auth) with cost (CPU, latency, a component that must understand your protocol). Working lower buys speed and protocol-agnosticism with blindness. Most architectures use both: an L4 layer for raw distribution and DDoS protection, an L7 layer for routing and policy.

In an interview

Use the vocabulary precisely and it does work for you: "An L4 network load balancer in front for TCP distribution, then L7 application load balancers that terminate TLS and route by path to services." If asked why not only L7, the answer is cost and the ability to pass non-HTTP traffic through.