// learn · networking · 8 min

The OSI & TCP/IP layers, animated.

Two famous models describe how data turns into bits on the wire. Watch a packet get wrapped layer by layer at the sender, ride the wire, then unwrap layer by layer at the receiver — and see how OSI's 7 layers and TCP/IP's 4 layers describe the same thing.

// osi & tcp/ip layers

A packet wrapped layer by layer at the sender, transmitted, then unwrapped layer by layer at the receiver. Watch the headers stack and peel off.

// before you start

you should know

·Rough sense of what an IP address is
·Have heard of TCP and UDP, even vaguely
·Helpful: the URL flow lesson — it shows TCP and IP in context

by the end you'll

Name every OSI layer in order. Explain what header each layer adds, and why IP and MAC addresses serve different purposes.

pace: 8 minutes

// 7 OSI layers, top to bottom: 7 Application, 6 Presentation, 5 Session, 4 Transport, 3 Network, 2 Data Link, 1 Physical. TCP/IP groups layers 5–7 as "Application" and layers 1–2 as "Link".

osi & tcp/ip — step 1 / 6 · the layers

Two models, same packet

Two famous models describe the same thing: how data turns into bits on the wire. OSI splits it into 7 layers (1 = Physical at the bottom, 7 = Application at the top). TCP/IP groups them into 4 (Link, Internet, Transport, Application). Same packet, different labels.

// key insight

Each layer only talks to the layers next to it. The Transport layer knows nothing about the cable or the Wi-Fi chip. The Network layer knows nothing about your TCP sequence numbers. That isolation is why you can replace one part of the stack — swap Ethernet for Wi-Fi, swap TCP for QUIC, swap HTTP for SSH — without rewriting the rest.

// exam-ready · what each layer adds and how to inspect it

$L7 ApplicationHTTP, DNS, SSH, SMTP — curl -v, dig

$L6 Presentationencoding, TLS, compression

$L5 Sessionsockets, RPC, connection state

$L4 TransportTCP/UDP + ports — ss -tlnp, tcpdump

$L3 NetworkIP + routing — ip route, ping, traceroute

$L2 Data LinkEthernet + MAC — ip neighbor, arp -a

$L1 Physicalcables, NICs, signals — ip link, ethtool

$TCP/IP : Link= OSI L1 + L2

$TCP/IP : Internet= OSI L3 (IP)

$TCP/IP : Transport= OSI L4 (TCP/UDP)

$TCP/IP : Application= OSI L5 + L6 + L7

$tcpdump -i any -nnwatch every layer at once

$ss -tlnpL4: who's listening on which port

$ip routeL3: how packets leave this host

$ip neighborL2: which MAC = which next hop

$ip -s linkL1/L2: NIC stats and errors

// check yourself

4 quick questions

Which OSI layer adds the source and destination IP addresses?

Why does a packet need BOTH an IP address and a MAC address?

Which best describes the difference between TCP and UDP?

At which OSI layers do switches and routers operate?

These aren't graded — they're just for active recall, which is what actually makes the lesson stick.

🧅

// now poke at the layers

Network tools

ping (L3), traceroute (L3), DNS lookup (L7), MTU check (L2/L3), and more. Each one operates at a specific layer — try them while picturing where in the stack you are.

open →

Read this lesson as text6 chapters · quiz answers

01Two models, same packet
Two famous models describe the same thing: how data turns into bits on the wire. OSI splits it into 7 layers (1 = Physical at the bottom, 7 = Application at the top). TCP/IP groups them into 4 (Link, Internet, Transport, Application). Same packet, different labels.
02Application layer — your data
Whatever your program is sending — an HTTP request, a DNS query, an SSH packet — starts here. At this point it's just bytes the app decided on. No addresses yet, no ports. The kernel hasn't touched it.
03Transport (TCP) wraps with ports + sequencing
The kernel wraps your data in a TCP header (or UDP, if your app picked that). The header carries source port (which app on YOUR side), destination port (which app on the other side), and a sequence number so the receiver can reassemble out-of-order packets.
04Network (IP) wraps with addresses
Now we need to know how to route this thing across the internet. The IP layer adds a header with source IP, destination IP, TTL (max hops before the packet is dropped), and which protocol is inside (6 = TCP, 17 = UDP).
05Data Link (Ethernet) wraps with MAC addresses
Addresses for the next hop on the local network. The Ethernet header adds source MAC (the NIC sending the frame) and destination MAC (usually your default gateway's NIC). A small trailer (FCS) is added at the end so the receiver can detect corruption.
06Across the wire, then peel back
The physical layer turns the frame into actual electrical signals, light pulses, or radio waves. The receiver does the reverse — strip Ethernet, strip IP, strip TCP — and hands the original HTTP request up to its application. Six layers in, six layers out.

Quiz — answers

Which OSI layer adds the source and destination IP addresses?: →Layer 3 — NetworkLayer 3 (Network) is where IP lives. Layer 2 (Data Link) handles MAC addresses for the next-hop link. Layer 4 (Transport) handles port numbers. Layer 7 (Application) is your actual program data.
Why does a packet need BOTH an IP address and a MAC address?: →IP is the end-to-end address (doesn't change as the packet crosses routers). MAC is the next-hop address (rewritten at every hop).The IP address tells routers WHERE the packet should ultimately go — it stays the same across the whole journey. The MAC address only matters for the current physical link, so it gets rewritten at every router/switch hop. That's why ARP exists: to find out 'what MAC should I use for THIS next hop?'
Which best describes the difference between TCP and UDP?: →TCP is connection-oriented and reliable (ordered delivery, retransmission, flow control). UDP is fire-and-forget — fewer guarantees, less overhead.Both are Layer 4 transport protocols. TCP gives you a reliable, ordered byte stream (used by HTTP, SSH, most app traffic). UDP gives you tiny independent datagrams with no guarantees (used by DNS, NTP, real-time audio/video, QUIC). Encryption is layered on top — TLS over TCP, DTLS or QUIC over UDP.
At which OSI layers do switches and routers operate?: →Switches at Layer 2 (MAC addresses on the local link); routers at Layer 3 (IP addresses across networks).A switch forwards frames based on MAC address — that's Layer 2. A router forwards packets based on IP address and a routing table — that's Layer 3. Modern 'Layer 3 switches' and 'Layer 4-7 load balancers' blur this line, but the textbook answer is L2 / L3.