OSI & TCP/IP models
In one line
Network models split communication into layers, each solving one problem and relying only on the layer below, so a web request becomes nested envelopes: HTTP inside TCP inside IP inside an Ethernet or Wi-Fi frame.
What it is
The OSI model is a 7-layer reference model: Physical (1), Data Link (2), Network (3), Transport (4), Session (5), Presentation (6) and Application (7). It is mainly a teaching and vocabulary tool; people say 'a layer 4 load balancer' or 'a layer 7 firewall' using its numbers.
The TCP/IP model is what the internet actually runs. It has 4 layers: Link (Ethernet, Wi-Fi), Internet (IP), Transport (TCP, UDP) and Application (HTTP, DNS, TLS, SSH). OSI layers 5 to 7 collapse into the single Application layer, and layers 1 and 2 into Link.
Each layer adds its own header when sending (encapsulation) and removes it when receiving (decapsulation). A layer only talks to the same layer on the other machine, using the services of the layer below.
Why interviewers ask
Interviewers use the layer model as shared vocabulary for debugging and design. If you can say where a problem lives (DNS at the application layer, packet loss at the network layer, a bad cable at the physical layer) and what L4 versus L7 load balancing means, you show you can reason about real systems instead of reciting a list.
How it works
- 1Application layer: your browser builds an HTTP request such as GET /index.html. This is the data the user cares about.
- 2Transport layer: TCP splits the byte stream into segments and adds a header with source and destination ports (for example 52000 to 443) and sequence numbers. Ports identify which program on a host gets the data.
- 3Network layer: IP wraps each segment in a packet with source and destination IP addresses. Routers read only this header to forward packets hop by hop towards the destination.
- 4Link layer: the packet is wrapped in a frame with MAC addresses for the next hop only (your laptop to your home router), and sent as electrical, radio or light signals on the physical medium.
- 5At every router the frame is removed and rebuilt for the next link, but the IP packet inside keeps the same end-to-end IP addresses (unless NAT rewrites them). At the destination each layer strips its header and passes the rest up until the web server reads the HTTP request.
Worked example · Following one HTTPS request from a laptop to a server
- Layer 7: the browser creates 'GET /' for example.com, and TLS encrypts it.
- Layer 4: TCP adds a header: source port 52000, destination port 443, sequence number 1001.
- Layer 3: IP adds a header: source 192.168.1.20, destination 93.184.215.14, TTL 64.
- Layer 2: Wi-Fi adds a frame header: source MAC of the laptop, destination MAC of the home router (found with ARP).
- The home router strips the frame, rewrites the source IP to its public IP (NAT), decrements TTL to 63 and builds a new frame for the ISP link. This repeats at each router; TTL drops by one per hop.
- The server's network card accepts the frame, IP sees its own address, TCP hands bytes to the process listening on port 443, TLS decrypts and the web server reads 'GET /'.
Picture it
Sending a letter abroad: you write the letter (application), put it in an envelope addressed to a person in a flat (transport port), the post office puts it in a bag addressed to a city (IP), and each truck or plane only knows its next stop (link). Each handler reads only their own label.
Key patterns
Bottom-up troubleshooting
When: Something cannot connect and the cause is unknown
How: Check link, then IP (ping, traceroute), then port (nc), then application (curl). The first layer that fails is where to look.
Name the layer in design talk
When: Choosing load balancers, firewalls or proxies
How: L4 devices see IPs and ports only and are fast; L7 devices see URLs, headers and cookies and can make smarter decisions at more CPU cost.
Encapsulation overhead
When: Reasoning about packet sizes and MTU
How: Ethernet MTU is 1500 bytes; minus 20 bytes of IPv4 header and 20 of TCP header leaves about 1460 bytes of payload per segment. Tunnels and VPNs add headers and shrink this further.
Real-world use
L4 vs L7 load balancers
AWS Network Load Balancer works at layer 4 and routes by IP and port only, which is very fast. AWS Application Load Balancer and NGINX work at layer 7 and can route by URL path, host header or cookie.
Firewalls and security groups
AWS security groups and iptables filter by IP, protocol and port (layers 3 and 4). A web application firewall like Cloudflare WAF inspects HTTP content (layer 7) to block SQL injection patterns.
Debugging tools mapped to layers
ping and traceroute test layer 3 reachability using ICMP, telnet or nc to a port tests layer 4, and curl -v tests the full layer 7 request including TLS and HTTP status.
Wireshark
Wireshark shows every captured packet as nested layers (Ethernet, IP, TCP, HTTP), which is the clearest real view of encapsulation.
In a project
Users report that your company's web app 'is down' for some offices but not others, and you are asked to find the cause quickly.
- Work up the layers: from an affected office, check the link and IP layer with ping to the server IP and traceroute to see where packets stop.
- If IP is reachable, test layer 4 with nc -vz host 443 to check that the TCP port accepts connections.
- If the port works, test the application layer with curl -v to check DNS resolution, the TLS handshake and the HTTP status code.
- In this case traceroute stops at the office's ISP edge, while DNS and the server are fine, so you route those offices through a VPN and open a ticket with the ISP.
Impact: Layered troubleshooting cut the diagnosis from hours of guessing to about 15 minutes and proved the problem was outside your servers, so engineers did not waste time rolling back healthy code.
Trade-offs
Use it when
- OSI numbers: talking about devices and features (L4 vs L7 load balancing, L3 routing)
- TCP/IP model: explaining how the internet actually works end to end
- Layered thinking: debugging connectivity step by step
Avoid it when
- Forcing every protocol into exactly one OSI layer: TLS, for example, sits between transport and application and is argued both ways
- Memorising session and presentation layer protocols as if they were separate in real stacks; in TCP/IP they are part of the application
Cost: Each layer adds a header: about 14 bytes Ethernet, 20 bytes IPv4 (40 for IPv6), 20 bytes TCP or 8 bytes UDP, before any application data.
Common mistakes
- Mixing up which addresses live where: MAC addresses are layer 2 and change every hop; IP addresses are layer 3 and stay end to end (except through NAT).
- Saying routers look at ports or URLs: plain routers forward by IP; ports are layer 4, URLs are layer 7.
- Treating OSI as the model the internet implements; real stacks follow the 4-layer TCP/IP model.
- Putting HTTP at the transport layer or TCP at the network layer.
- Forgetting that each layer only trusts the layer below for its service, which is why TCP can be reliable on top of unreliable IP.
Interview questions
Quick revision
- OSI 7 layers: Physical, Data Link, Network, Transport, Session, Presentation, Application.
- TCP/IP 4 layers: Link, Internet, Transport, Application.
- L2 = MAC and switches; L3 = IP and routers; L4 = TCP/UDP and ports; L7 = HTTP, DNS.
- Encapsulation: data, then segment (TCP), packet (IP), frame (link).
- MAC changes per hop; IP stays end to end (except NAT).
- Ethernet MTU 1500 bytes; typical TCP payload about 1460 bytes.
- Debug bottom-up: ping, traceroute, nc, dig, curl -v.
Check yourself
1. At which OSI layer do routers make forwarding decisions?
2. Which address normally changes at every hop as a packet crosses the internet?
3. Which pair correctly matches protocol and TCP/IP layer?
4. A load balancer routes /api requests to one pool and /images to another. What kind is it?
Saved on this device. Create a free account to keep it on every device.
Practise this with Sam
A real mock interview, out loud, with an honest scorecard. Free to start.