5.1 OSI Model
Key Takeaways
- The OSI model has seven layers from Physical (1) to Application (7), each with a defined role in end-to-end communication
- Each layer uses a Protocol Data Unit (PDU): bits, frames, packets, segments, and data for layers 1–7 respectively
- Switches primarily operate at Layer 2; routers operate at Layer 3 — a frequent Cyber Test discrimination item
- HTTP, FTP, and DNS are Application-layer protocols; TCP/UDP are Transport; IP is Network; Ethernet is Data Link
- Troubleshooting by OSI layer (cable → MAC → IP → ports → app) is a practical skill the exam rewards
The Open Systems Interconnection (OSI) model is a seven-layer conceptual framework that describes how data moves between networked systems. You will not configure “OSI” on a console — it is a teaching and troubleshooting map. On the Cyber Test (CT / ICTL heritage), expect questions that name a layer, ask which device works at a layer, match a protocol to a layer, or identify the correct Protocol Data Unit (PDU).
Think of OSI as a stack of specialized workers. The bottom layers move raw signals and local frames. The middle layers deliver packets across networks and reliable (or unreliable) streams between hosts. The top layers present data to applications users actually open. When something fails, cyber operators climb or descend the stack until the broken layer is found.
Why Models Matter for Cyber Aptitude
Military cyber work mixes networking, security, and systems thinking. If a help desk ticket says “users cannot reach the web portal,” a Layer-1 cable fault, a Layer-2 VLAN misconfiguration, a Layer-3 wrong gateway, a Layer-4 blocked port, or a Layer-7 application crash can all produce the same symptom. OSI vocabulary lets you separate those causes quickly — exactly the kind of layered reasoning the Cyber Test measures.
OSI is descriptive, not a mandatory product standard. Real Internet traffic follows the TCP/IP (DoD) model more closely. Still, exam writers love OSI because each layer has clean responsibilities and memorable PDUs.
The Seven Layers (Bottom to Top)
Memorize both the number and the name. A common mnemonic for layers 1→7 is “Please Do Not Throw Sausage Pizza Away” (Physical, Data Link, Network, Transport, Session, Presentation, Application). Top-down: “All People Seem To Need Data Processing.”
| Layer | Name | PDU | Primary job | Example protocols / technologies |
|---|---|---|---|---|
| 7 | Application | Data | User-facing network services and APIs | HTTP/HTTPS, FTP, SMTP, DNS, SSH, DHCP (client/server apps) |
| 6 | Presentation | Data | Encoding, compression, encryption translation | TLS/SSL (often discussed here), JPEG, MPEG, ASCII/Unicode |
| 5 | Session | Data | Establish, manage, tear down dialogues | NetBIOS, RPC session concepts, SIP dialogs (conceptual) |
| 4 | Transport | Segment (TCP) / Datagram (UDP) | End-to-end delivery, ports, reliability choices | TCP, UDP, SCTP |
| 3 | Network | Packet | Logical addressing and path selection | IPv4, IPv6, ICMP, OSPF, BGP (routing) |
| 2 | Data Link | Frame | Node-to-node delivery on a link; MAC addressing | Ethernet (IEEE 802.3), Wi-Fi MAC (802.11), PPP, switches/bridges |
| 1 | Physical | Bits | Signals, cables, connectors, radio waves | Copper, fiber, RF, hubs/repeaters, NICs (PHY) |
Exam tip: DNS is an Application-layer service even though its packets ride on UDP/TCP. Do not place DNS at Transport just because it uses port 53.
Layer-by-Layer Detail
Layer 1 — Physical
Concerns voltage levels, light pulses, radio modulation, pinouts, and media. Failures look like “link light dark,” CRC storms from a bad cable, or distance limits exceeded. Devices: hubs, repeaters, cabling, fiber transceivers. PDU = bits.
Layer 2 — Data Link
Frames traffic for a single hop (or broadcast domain). Uses MAC addresses. Ethernet switches learn MAC tables and forward frames. VLANs and many wireless association concepts sit here. PDU = frame. If two hosts on the same subnet cannot ARP each other, suspect Layer 2 first.
Layer 3 — Network
Moves packets between networks using logical addresses (IP). Routers make forwarding decisions and decrease TTL. ICMP (ping/traceroute signaling) is Network-layer. PDU = packet. “Wrong default gateway” and “no route to host” are classic Layer-3 symptoms.
Layer 4 — Transport
Delivers data between processes via port numbers. TCP provides connection-oriented reliability (sequencing, ACKs, retransmission). UDP is connectionless and lightweight. PDU = segment (TCP) or datagram (UDP). A firewall blocking TCP/443 is a Transport-relevant control even if the policy is written as “HTTPS.”
Layers 5–7 — Session, Presentation, Application
These upper layers are thinner on many exams but still tested:
- Session — dialog control (who talks when; reconnect concepts).
- Presentation — data formats and encryption presentation (TLS is frequently mapped here or discussed with Application — know both framings; prefer Presentation for encryption/format questions).
- Application — protocols users and apps invoke (HTTP, SMTP, FTP, DNS).
On CT-style items, if the question mentions “which layer provides encryption/formatting,” choose Presentation; if it names HTTP or FTP, choose Application.
Devices Mapped to Layers
| Device | Primary OSI layer | Why |
|---|---|---|
| Hub / repeater | 1 | Regenerates bits; no MAC intelligence |
| Switch / bridge | 2 | Forwards frames by MAC |
| Router / Layer-3 switch (routing mode) | 3 | Forwards packets by IP |
| Firewall (stateful) | 3–4 (often 3/4/7 in practice) | Filters by IP, ports, sometimes app |
| Host application (browser) | 7 | Generates Application PDUs |
Scenario: Users on VLAN 10 cannot reach VLAN 20. Same switch shows both VLANs up. Likely missing inter-VLAN routing (Layer 3), not a Layer-1 cable — unless trunks are down.
Troubleshooting With the Stack
A practical bottom-up checklist used in ops and on exams:
- Physical — Link lights, correct cable type, radio association.
- Data Link — Correct VLAN, MAC learning, ARP resolution on-LAN.
- Network — IP, mask, gateway, routing, ping to gateway then remote.
- Transport — Port open? TCP handshake complete?
- Application — Service running, correct URL, cert/auth errors.
Top-down is useful when the app clearly errors (“HTTP 503”) but connectivity is fine.
Common Exam Traps
- Confusing switch (L2) with router (L3).
- Calling IP a Layer-4 protocol.
- Placing Ethernet at Network because “networks use Ethernet.”
- Thinking hubs “switch” frames — hubs flood bits at Layer 1.
- Mixing PDU names: frames are not packets; segments are not frames.
Master the table, practice two scenarios per layer, and you will convert OSI from memorization into diagnostic speed — a core Networking domain skill for the Cyber Test.
Which OSI layer is primarily responsible for logical addressing and selecting paths between networks?
An Ethernet switch forwards traffic using MAC addresses. At which OSI layer does this device primarily operate?
What is the Protocol Data Unit (PDU) name commonly associated with the Transport layer when using TCP?
A technician confirms link lights are on and ARP succeeds on the local subnet, but traceroute fails at the first hop beyond the gateway. Which layer is the most likely problem domain?