HowToCodePage

Layered models and TCP/IP

How the OSI and TCP/IP models split network work into layers, and why encapsulation is the idea that lets every level be replaced independently.

Two models, one idea

A network stack is a stack of promises. Each layer provides a service to the layer above and hides how that service is delivered. The OSI model names seven layers; the TCP/IP model that is actually deployed collapses them into four or five. Both describe the same packets.

OSI layersTCP/IP layerProtocols you will meetUnit
7 Application, 6 Presentation, 5 SessionApplicationHTTP, DNS, SMTP, SSH, TLSmessage
4 TransportTransportTCP, UDP, QUICsegment / datagram
3 NetworkInternetIP, ICMP, routing protocolspacket
2 Data link, 1 PhysicalLinkEthernet, Wi-Fi, ARP, fibreframe / bits

Because each layer is independent, swapping Wi-Fi for Ethernet changes nothing above the link layer, and moving a service from IPv4 to IPv6 changes nothing in HTTP.

Encapsulation in practice

Every layer takes the payload from above and wraps it in its own header. Reading a capture from the outside in is exactly this unwrapping in reverse.

# on Linux: watch a real request get wrapped, layer by layer
sudo tcpdump -n -i any 'tcp port 443 and host example.com'

# what a captured GET / looks like, from the inside out:
GET / HTTP/1.1
Host: example.com                 <- application data (layer 7)
  TCP: sport 51422 dport 443, seq/ack, SYN|ACK|PSH flags   <- layer 4
    IP: 10.0.0.7 -> 93.184.216.34, TTL 64, proto 6         <- layer 3
      Ethernet: src/dst MAC, ethertype 0x0800              <- layer 2
        ...bits on the wire                                <- layer 1
  • A segment is TCP + payload; a packet is IP + segment; a frame is the link header + packet + trailer.
  • The link layer MTU (usually 1500 bytes on Ethernet) is the reason TCP has to segment large writes at all.
  • Bridges and switches forward frames using MAC addresses; routers forward packets using IP addresses.
  • NAT rewrites addresses and ports at layers 3 and 4, which is why inbound peer-to-peer connections need port mapping.
💡
The layers are a vocabulary for reasoning, not a law of physics. TLS sits between transport and application, and QUIC folds transport and TLS together — real stacks bend the model where it buys latency.

Where the abstraction leaks

Layer boundaries are clean in diagrams and leaky in production. Knowing which layer owns a symptom is most of network debugging.

  • Timeouts on connect (never established) are usually transport or routing, not HTTP.
  • A 502 from a reverse proxy means the proxy reached the network but the upstream did not answer usefully.
  • TLS handshake failures are frequently a missing intermediate certificate, not a TCP problem.
  • Packet loss looks like slowness rather than an error, because TCP retransmits until it succeeds.

FAQ

Where does TLS fit in the models?
Between transport and application. HTTPS is HTTP carried inside TLS over TCP, so TLS secures a session that HTTP then uses — it does not add a layer that HTTP knows about.
Why learn OSI if TCP/IP is what runs?
OSI names the layers cleanly and separates session and presentation concerns. Use it as a map, use TCP/IP as the territory.

HTTP and DNS in practice One page request, end to end

Last refreshed 2026-09-18.