---
title: "The OSI model and the TCP/IP model, explained"
description: "The seven layers, the four that actually run the internet, how they map onto each other, and how to use them to find a fault. After you have checked DNS."
url: "https://unifiedit.tech/articles/osi-model"
lastmod: "2026-10-12"
type: "article"
published: "2026-10-10"
updated: "2026-10-10"
authors: ["Cody Franklin"]
tags: ["Routing and switching", "UniFi"]
---


# The OSI model and the TCP/IP model, explained

The seven layers, the four that actually run the internet, how they map onto each other, and how to use them to find a fault. After you have checked DNS.

Cody Franklin · 2026-10-10 · https://unifiedit.tech/articles/osi-model

<!-- body -->

## Overview

The OSI model is the vocabulary of network engineering. When one engineer tells another "that's a layer 2 problem," both know where to look. This article covers what the seven layers are, which protocols live at each, how the model maps onto the four-layer TCP/IP model the internet actually runs on, and how to use the layers to find a fault.

## Common causes of network issues

### 1. DNS

> “Before you do anything, check DNS. It's always DNS.”
>
> — Every network engineer, ever

In our experience more tickets end at DNS than at any other single cause, and it looks like a total outage: everything below is working and the client still can't turn a name into an address.

If the address answers and the name doesn't, stop looking at cables and routes. The fault is the resolver, the forwarder it uses, the DHCP option that handed it out, or a filter eating the reply.

```powershell Windows — PowerShell
nslookup unifiedit.tech     # resolves? who answered?
ping 1.1.1.1                # path up, by address?
ping cloudflare.com         # same path, by name?
ipconfig /flushdns          # drop a stale answer
```

```shell macOS — zsh
dig unifiedit.tech +short   # resolves? to what?
ping -c 3 1.1.1.1           # path up, by address?
ping -c 3 cloudflare.com    # same path, by name?
sudo killall -HUP mDNSResponder   # drop a stale answer
```

```shell Linux — bash
dig unifiedit.tech +short   # resolves? to what?
ping -c 3 1.1.1.1           # path up, by address?
ping -c 3 cloudflare.com    # same path, by name?
resolvectl status           # which resolver is in use
resolvectl flush-caches     # drop a stale answer
```

After DNS, the usual suspects, each with the layer it lives at:

2. **DHCP.** No lease, or a lease from the wrong server: the client has a 169.254 address or the wrong gateway. Layer 7, but it travels by broadcast, so it's confined to one VLAN unless a relay carries it.
3. **The wrong VLAN or a dead port.** No link light, a port negotiated down to 100 Mb/s, or a port tagged for the wrong network. Layers 1 and 2.
4. **Gateway, mask or route.** The client reaches its own subnet and nothing else. Layer 3.
5. **A firewall rule.** Everything resolves, everything pings, one application fails. Layer 4.

## The OSI model

The **Open Systems Interconnection (OSI) model** is a reference model that divides network communication into seven layers, each with a defined job. The International Organization for Standardization published it as ISO 7498 in 1984; today it is ISO/IEC 7498-1, and the ITU-T publishes the same text as X.200. Each layer serves the layer above it, rides on the layer below, and talks only to its peer on the other machine.

It is a model, not a protocol: nothing on your network runs OSI. Its value is vocabulary, and product names borrow it: a layer 3 switch, a layer 4 load balancer, a layer 7 firewall.

![The seven OSI layers as a stack, Application at the top to Physical at the bottom, with the unit of data at each layer](/images/articles/osi-model/osi-model-seven-layers.png "Figure 1 · The OSI model")
*The seven layers, top to bottom, with the unit of data each one handles.*

The wrapping is called **encapsulation**. The application hands its data to the transport layer, which puts a TCP or UDP header in front of it: a segment (TCP) or a datagram (UDP). The network layer puts an IP header in front of that: a packet. The data link layer adds an Ethernet header in front and a frame check sequence behind: a frame. The physical layer turns the frame into bits. The receiver peels each header off in reverse, and each layer reads only its own.

The seven layers, bottom up, because that is the order you troubleshoot in: a cable that is not plugged in explains every symptom above it.

### Layer 1 — Physical

Moves bits across a medium: copper, glass or air. The physical layer defines connectors, pinouts, voltages, light wavelengths, radio channels and bit timing. Cables, patch panels, transceivers, media converters and repeaters are layer 1 devices. The unit is the **bit**.

Protocols: Cat6 (100 m) · OM4 (multimode) · OS2 (single-mode) · SFP+ (10G optic) · 802.3 (Ethernet PHY) · 802.11 (radio) · PoE (802.3bt)

![A fiber handhole set in a trench on a campus run, two orange conduits rising out of it](/images/articles/osi-model/fiber-handhole-layer-1.jpg "Handhole · conduit")
![Single-mode fiber patch cords plugged into a fiber distribution panel](/images/articles/osi-model/fiber-patch-panel-layer-1.jpg "Single-mode fiber · SC/APC")
*The part of the network you can trip over: a handhole on a campus fiber run, and single-mode patch cords landing in a distribution panel.*

**How it fails:** no link light, a port flapping, a link negotiating at 100 Mb/s instead of 1 Gb/s, a kinked fiber, a cheap patch cord, a PoE budget that is already spent. **First check:** the port's status and negotiated speed on the switch, its CRC and error counters, the optic's receive power, and then swap the cable.

### Layer 2 — Data link

Delivers frames between devices on the same network segment, addressed by MAC address. Switches, bridges and access points are layer 2 devices. ARP sits on the boundary between layers 2 and 3: it is how a host finds the MAC address behind an IP address. The unit is the **frame**.

Protocols: Ethernet (802.3) · Wi-Fi (802.11) · VLAN (802.1Q) · STP (802.1D) · RSTP (802.1w) · LACP (802.1AX) · ARP (RFC 826) · MAC (48-bit)

![Clear RJ45 plugs seated in a row of switch ports in the dark, one lit blue by its link light](/images/articles/osi-model/rj45-link-light-layer-2.jpg "RJ45 · link light")
*Every lit port is a layer 2 segment. The VLAN on each port decides which network its frames belong to. Photo: David Farkas, Unsplash.*

![An Ethernet frame: destination and source MAC addresses, EtherType, the IP packet as payload, and the frame check sequence](/images/articles/osi-model/ethernet-frame-layer-2.png "Figure 2 · An Ethernet frame")
*A frame is the packet with an Ethernet header in front and a check sequence behind. A switch reads the two MAC addresses and nothing else.*

**How it fails:** a port in the wrong VLAN, a native VLAN mismatch on a trunk, a spanning-tree loop that takes a building down, a MAC address flapping between two ports, an SSID mapped to the wrong VLAN, a client with no DHCP lease because no DHCP server or relay is on its VLAN. **First check:** the port's VLAN membership and tagging, the switch's MAC table, the spanning-tree state, and the ARP table on the client.

### Layer 3 — Network

Gets a packet from one network to another. Every host has an IP address and a mask, and together they say which addresses are local and which need a router. Anything not local goes to the default gateway, and from there every router on the path reads one thing, the destination address, and forwards the packet one hop closer. Routers and layer 3 switches live here; so does ICMP, which is why ping and traceroute are layer 3 tools. The unit is the **packet**.

Protocols: IPv4 (RFC 791) · IPv6 (RFC 8200) · ICMP (ping · traceroute) · IPsec (ESP · IKEv2) · OSPF (IP proto 89) · BGP (TCP 179)

![A packet’s path from a laptop through its NAT gateway and internet routers to the unifiedit.tech server, routed by IP address](/images/articles/osi-model/packet-path-layer-3.png "Figure 3 · A packet’s path")
*Two networks with the internet between them. Every router on the path reads one thing, the destination address. The gateway also rewrites the source on the way out, which is why the server only ever sees 203.0.113.10.*

![An IPv4 packet: a 20-byte header with source and destination addresses, TTL and protocol, then the TCP segment as payload](/images/articles/osi-model/ip-packet-header-layer-3.png "Figure 4 · An IP packet")
*A packet is the segment with an IP header in front. A router reads the destination address, lowers the TTL by one and forwards; it never looks inside the payload.*

**How it fails:** a wrong mask or gateway, a route that exists in one direction only, two sites sharing a subnet across a VPN, a tunnel MTU nobody lowered. **First check:** ping the gateway, then something past it; traceroute to see where the replies stop; read the routing table at both ends, because the far side has to route back.

### Layer 4 — Transport

Gets data to the right program on the right host. IP delivers to a machine; transport delivers to a port, which is how one server runs the web on 443 and mail on 587 at the same address. TCP is the careful one: it opens a connection with a handshake, numbers every byte, resends what goes missing and backs off when the path is congested. UDP is the fast one: it sends and does not look back, which is what voice, video and DNS want. QUIC rebuilds TCP's guarantees on top of UDP and carries HTTP/3. Stateful firewalls, NAT and load balancers all decide here, by port. The unit is the **segment** (TCP) or the **datagram** (UDP).

Protocols: TCP (RFC 9293) · UDP (RFC 768) · QUIC (RFC 9000) · Ports (0–65535)

![One MacBook, three transport conversations: DNS over UDP port 53, a search over TCP port 443, and a call over UDP](/images/articles/osi-model/transport-layer-udp-tcp-conversations.png "Figure 5 · One address, three conversations")
*One MacBook, three conversations. DNS asks once over UDP and gets one answer. The search needs every byte, so TCP connects first and acknowledges everything. The call needs now more than complete, so UDP streams and never looks back. The port on each end says which program is talking.*

**How it fails:** a firewall rule on the port, a NAT table that is full, asymmetric routing through a stateful firewall, and packet loss, which TCP hides as slow rather than down. **First check:** does the port answer at all; then the firewall logs, then the retransmission counters.

```shell Linux — bash
nc -zv mail.example.com 587   # does anything answer on the port?
ss -tan state established     # what is connected right now?
```

### Layer 5 — Session

Opens, maintains and closes the dialogue between two applications. On a TCP/IP network this work happens inside the application protocol or a library, which is why the TCP/IP model has no session layer at all. Layers 5 and 6 are thin in practice and matter mostly as vocabulary.

Protocols: RPC · NetBIOS (139) · SIP (5060 · 5061) · SOCKS (1080) · PPTP (legacy)

### Layer 6 — Presentation

Translates data between the form the application uses and the form that crosses the network: character encoding, serialization, compression and encryption. TLS is most often placed here, though it fits several places (see the questions below). Certificate errors, cipher mismatches and encoding bugs are presentation layer faults.

Protocols: TLS 1.3 (RFC 8446) · UTF-8 · ASN.1 · JSON · JPEG · gzip

### Layer 7 — Application

The protocols that applications speak. Not the application itself: the browser is not layer 7; HTTP is. Proxies, web application firewalls, DNS filters and firewalls that identify applications work here. The unit is **data**.

Protocols: DNS (53) · HTTP (80) · HTTPS (443) · DHCP (67 · 68) · SMTP (25 · 587) · IMAP (993) · SSH (22) · NTP (123) · SNMP (161) · RDP (3389) · SMB (445)

![A browser loading unifiedit.tech with DevTools timing each step: DNS, TCP, TLS 1.3, the GET, the 200 OK and the paint](/images/articles/osi-model/application-layer-page-load-timing.png "Figure 6 · One page load")
*One page load touches four layers in order: DNS and HTTP at 7, TLS at 6, TCP at 4, IP under all of it. The first step is the one that fails most.*

**How it fails:** DNS. Also an expired certificate, an HTTP 5xx, a proxy nobody documented, a DHCP scope with no leases left. **First check:** `dig`, then `curl -v`, then the server's own logs.

## The TCP/IP model

The **TCP/IP model**, also called the Internet protocol suite, is the four-layer model the internet actually runs on. [RFC 1122](https://www.rfc-editor.org/rfc/rfc1122), Requirements for Internet Hosts, set it down in 1989 with four layers: link, internet, transport and application. TCP/IP had been running on the ARPANET since January 1, 1983; the model describes protocols that existed, not services that ought to.

You will also meet a five-layer version in textbooks, which splits link into physical and data link. Cisco's curriculum teaches the four. Both are fine; say which one you mean.

### Link — OSI layers 1 and 2

Everything it takes to move a frame across one physical network: the medium, the MAC addresses, the switches between them. RFC 1122 says little about this layer on purpose. IP was built to run over whatever link is there, and it has: Ethernet, Wi-Fi, fiber, cellular, a tunnel across someone else’s network. ARP lives here, turning a next-hop IP address into a MAC address on the local segment.

Protocols: Ethernet (IEEE 802.3) · Wi-Fi (IEEE 802.11) · ARP (RFC 826) · PPP (RFC 1661)

### Internet — OSI layer 3

IP and its helpers: ICMP for errors and diagnostics, and the routing protocols that fill the tables IP forwards by. Its one promise is to carry a packet from any host to any other host across any number of networks, best effort: no guarantee it arrives, arrives once, or arrives in order. Every layer above is built on that being enough.

Protocols: IPv4 (RFC 791) · IPv6 (RFC 8200) · ICMP (RFC 792) · ICMPv6 (RFC 4443)

### Transport — OSI layer 4

End to end between programs, by port. TCP adds the connection, the ordering and the retransmission that IP leaves out; UDP adds only the ports and a checksum; QUIC rebuilds TCP’s guarantees on top of UDP. This is the last layer most of the network reads: stateful firewalls, NAT and load balancers decide by port and look no further.

Protocols: TCP (RFC 9293) · UDP (RFC 768) · QUIC (RFC 9000) · SCTP (RFC 9260)

### Application — OSI layers 5 to 7

Whatever the program speaks, including the jobs OSI gives to the session and presentation layers. HTTP, DNS, TLS, SSH and SMTP all sit here together. The model has no separate layer for encryption or encoding because the protocols that need them carry their own.

Protocols: HTTP (RFC 9110) · DNS (RFC 1035) · TLS 1.3 (RFC 8446) · SSH (RFC 4253) · SMTP (RFC 5321)

## OSI vs. TCP/IP

The two models disagree in two places. Session and presentation fold into the application because in real protocols that work happens inside HTTP, inside SMTP, or inside a library such as TLS. Physical and data link merge because the suite says nothing about the wire: the same IP packet crosses copper, fiber and radio unchanged.

![How the seven OSI layers map onto the four TCP/IP layers: application 5 to 7, transport 4, internet 3, link 1 and 2](/images/articles/osi-model/osi-vs-tcp-ip-model-mapping.png "Figure 7 · OSI ↔ TCP/IP")
*How the seven OSI layers map onto the four TCP/IP layers.*

Use both: OSI is the vocabulary, TCP/IP is what runs. When a firewall rule or a job posting says layer 4, it means the OSI number.

| Layer | Unit | Identifier | First check |
| --- | --- | --- | --- |
| 7 Application | Data | Hostname, URL | DNS, certificate, server logs |
| 6 Presentation | Data | — | Cipher, certificate, encoding errors |
| 5 Session | Data | — | Timeouts, authentication, RPC binding |
| 4 Transport | Segment, datagram | Port | Port open, firewall logs, retransmits |
| 3 Network | Packet | IP address | Ping the gateway, traceroute, routes, MTU |
| 2 Data link | Frame | MAC address | VLAN on the port, MAC table, STP, ARP |
| 1 Physical | Bits | — | Link light, speed, CRC counters, optic levels |

### Which layer is…

The questions that come up most, answered with the OSI number first and the TCP/IP layer second.

- **DNS.** Layer 7, application. UDP and TCP port 53; DNS over TLS on 853; DNS over HTTPS on 443.
- **DHCP.** Layer 7, application, on UDP 67 and 68. It discovers a server by broadcast, so it is confined to one VLAN unless a relay forwards it.
- **ARP.** Between layers 2 and 3; engineers say layer 2.5. It maps an IPv4 address to a MAC address and carries no IP header, so TCP/IP places it in the link layer. IPv6 replaces it with Neighbor Discovery, which runs over ICMPv6 at layer 3.
- **TLS.** Most often layer 6, presentation; some texts say 5. In TCP/IP it is application. It sits between TCP and HTTP, which is the useful fact.
- **ICMP.** Layer 3, network. Ping and traceroute.
- **VLANs (802.1Q).** Layer 2, data link.
- **MAC address**, layer 2. **IP address**, layer 3. **Port number**, layer 4. **Hostname and URL**, layer 7.
- **A switch** works at layer 2. **A layer 3 switch** also routes between VLANs, in hardware. **A router** works at layer 3. **A firewall** works at layers 3 and 4 when it is stateful and at layer 7 when it identifies applications. **A load balancer** works at layer 4 (by port) or layer 7 (by URL or header). **An access point** works at layers 1 and 2.
- **NAT.** Layer 3 when it rewrites addresses and layer 4 when it also rewrites ports, which is what every office gateway does.
- **QUIC.** Layer 4, transport, carried in UDP. HTTP/3 runs on it.
- **OSPF and BGP.** Routing protocols serve layer 3. OSPF rides directly on IP as protocol 89; BGP rides on TCP port 179. Ask what they do, not what they ride on.

## Troubleshooting with the model

Three ways to walk a problem, and one rule that comes first.

1. **DNS first.** Resolve a name, ping an address, ping a name.
2. **Bottom up when nothing works.** Link light, negotiated speed, VLAN on the port, MAC table, IP address and mask, default gateway, ping the gateway, ping past it, port open, application. Each step proves the layer under it.
3. **Top down when one thing is broken.** If other applications work from the same host, layers 1 to 4 are proven. Start at 7: the name, the certificate, the server.
4. **Divide and conquer when you have no idea.** Ping the default gateway. Success proves layers 1 to 3 on your side of it; failure sends you down, not up.

In a UniFi network each layer has a place where it shows itself: port status and negotiated speed for layer 1, the client list and VLAN assignment for layer 2, the gateway's routes for layer 3, the firewall rules and their hit counters for layer 4, and the DNS and application logs for layer 7.

## Questions engineers ask

### Is the OSI model still used?

As vocabulary, everywhere. No network runs the OSI protocols; every network runs TCP/IP. The seven layer numbers are how engineers, vendors and standards say where a device or a fault sits.

### Why does TCP/IP have four layers and OSI seven?

OSI was designed before its protocols existed; TCP/IP was written down after its protocols were running. Session and presentation turned out to live inside applications, and the medium turned out not to matter to IP, so TCP/IP never separated them.

### Which OSI layer is DNS?

Layer 7, the application layer. It is also the first thing to check when a network is down.

### What is the difference between a frame, a packet and a segment?

The same data at three layers. Segment: the transport unit (TCP; UDP says datagram). Packet: the segment with an IP header. Frame: the packet with an Ethernet header and trailer.

### What is a layer 3 switch?

A switch that also routes between VLANs in hardware, so inter-VLAN traffic never leaves for a router. Layers 2 and 3 in one box.

### Is TLS layer 6 or layer 7?

Textbooks disagree: most say 6, some say 5, the TCP/IP model says application. All agree where it sits: between TCP and the application protocol.

## How we help

When a network is down, our [TAC](/services/managed-services) answers with an engineer who walks these layers for a living, and our [security audit](/services/cybersecurity) reads a UniFi configuration layer by layer, from port security to DNS filtering. If you want your own team to think this way, [we teach it](/services/training).

## Sources

Every layer, protocol and header in this article is defined in one of the documents below. Where the article and a textbook disagree, the document wins.

- ISO/IEC 7498-1, [Open Systems Interconnection, Basic Reference Model](https://www.iso.org/standard/20269.html), 1994 · also ITU-T X.200
- RFC 1122, [Requirements for Internet Hosts: Communication Layers](https://www.rfc-editor.org/rfc/rfc1122), 1989
- RFC 1123, [Requirements for Internet Hosts: Application and Support](https://www.rfc-editor.org/rfc/rfc1123), 1989
- RFC 791, [Internet Protocol](https://www.rfc-editor.org/rfc/rfc791), 1981
- RFC 8200, [Internet Protocol, Version 6](https://www.rfc-editor.org/rfc/rfc8200), 2017
- RFC 9293, [Transmission Control Protocol](https://www.rfc-editor.org/rfc/rfc9293), 2022
- RFC 768, [User Datagram Protocol](https://www.rfc-editor.org/rfc/rfc768), 1980
- RFC 9000, [QUIC: A UDP-Based Multiplexed and Secure Transport](https://www.rfc-editor.org/rfc/rfc9000), 2021
- RFC 1035, [Domain Names: Implementation and Specification](https://www.rfc-editor.org/rfc/rfc1035), 1987
- RFC 7858, [DNS over TLS](https://www.rfc-editor.org/rfc/rfc7858), 2016
- RFC 8484, [DNS Queries over HTTPS](https://www.rfc-editor.org/rfc/rfc8484), 2018
- RFC 2131, [Dynamic Host Configuration Protocol](https://www.rfc-editor.org/rfc/rfc2131), 1997
- RFC 826, [Address Resolution Protocol](https://www.rfc-editor.org/rfc/rfc826), 1982
- RFC 4861, [Neighbor Discovery for IPv6](https://www.rfc-editor.org/rfc/rfc4861), 2007
- RFC 8446, [TLS Protocol Version 1.3](https://www.rfc-editor.org/rfc/rfc8446), 2018
- 802.1Q, [Bridges and Bridged Networks (VLANs)](https://standards.ieee.org/ieee/802.1Q/10323/), IEEE
- 802.3, [Ethernet](https://standards.ieee.org/ieee/802.3/10422/), IEEE
- 802.11, [Wireless LAN](https://standards.ieee.org/ieee/802.11/7028/), IEEE