Stop 02 · Networking Fundamentals for SecurityTopics · 1/10

OSI & TCP/IP Models

In short

When someone says "it's a layer 7 problem" or "blocked at layer 3", they're using these models. They're just a shared map of how data gets wrapped, sent and unwrapped between two machines.

Conceptual layered models describing how network communication works — the shared vocabulary used constantly when discussing where an attack or a defense mechanism actually operates.

The blob packs a gift into a box, then a bigger box, then a courier bag.

Think of it like this

Sending a gift by courier

You wrap the gift, put it in a box, stick on an address label, and the courier puts it in a sack on a van. At the other end, each layer comes off in reverse. Network data gets wrapped the same way, one layer at a time.

Watch it happen

Wrapping one web request (TCP/IP model)

Application

Transport

Internet

Link

1/5Application: your browser writes the HTTP request, GET /index.html. OSI splits this into layers 5 to 7.

The big ideas

What you need to know

OSI has 7, TCP/IP has 4

OSI is the teaching model with seven layers. TCP/IP is what the internet actually runs, with four.

Each layer adds a header

This wrapping is called encapsulation. Each layer only reads its own header and ignores the rest.

Layers locate problems

Cable unplugged is layer 1. Wrong IP is layer 3. A broken login page is layer 7.

Controls live at layers

Basic firewalls filter at layers 3 and 4. A web application firewall reads layer 7 content.

See it in code

Walk through the code

bash

1# Layer 3: can I reach the machine at all?2ping -c 3 example.com3 4# Layer 4: is port 443 open on it?5nc -zv example.com 4436 7# Layer 7: does the web app answer properly?8curl -I https://example.com

1/3ping uses ICMP at the network layer to check the host is reachable.

Troubleshoot bottom-up. If ping fails, there's no point debugging the website yet. (Some servers block ping, so a failure there isn't always final.)

Save yourself the pain

Common mistakes

Oops

Memorising the seven layer names and stopping there.

Do this instead

Learn what each layer adds and which tools work there. That's what helps when debugging or reading alerts.

Oops

Thinking the OSI model is how the internet is built.

Do this instead

It's a reference model. Real protocols map to TCP/IP's four layers, and some blur the lines.

Your mission

See the layers in a real packet

~20 min

Quick check

A firewall rule blocks all traffic to TCP port 23. Which TCP/IP layer is it working at?

Go deeper

1Memorize the 7 OSI layers well enough to name them in order.
2Learn which layer common attacks (ARP spoofing, SQL injection) primarily target.
3Understand the simpler, more practical TCP/IP model as the one used in most real security discussions.