Deck 2 - OSI Model

Protocol

A set of rules for formatting and processing data — like a common language that lets computers communicate even when their hardware and software are completely different.

OSI model

The Open Systems Interconnection model: a seven-layer reference model that breaks network communication into distinct layers, each with its own function. Created so equipment from different vendors can interoperate.

OSI layers (top to bottom)

7 Application, 6 Presentation, 5 Session, 4 Transport, 3 Network, 2 Data Link, 1 Physical. Mnemonic: "Please Do Not Throw Sausage Pizza Away"

OSI layers (bottom to top)

1 Physical, 2 Data Link, 3 Network, 4 Transport, 5 Session, 6 Presentation, 7 Application. Mnemonic: "Please Do Not Throw Sausage Pizza Away."

Encapsulation

Adding header information as data moves DOWN the layers on the sending device — each layer wraps the data before passing it lower.

De-encapsulation

Stripping header information as data moves UP the layers on the receiving device — each layer unwraps the data before passing it higher.

PDU names by layer

Protocol Data Unit. The name data goes by at each layer: Data (Application/Presentation/Session), Segment (TCP) or Datagram(UDP) (Transport), Packet (Network), Frame (Data Link), Bits (Physical). Mnemonic: "Don't Stop Pouring Free Beer."

Layer 7 – Application

The entry point where user applications access network services. Handles interfacing with user apps, network management, and remote access. Because it's the most exposed layer, it's a common target for attackers. (Web browsing, Remote Access, Email Communication, File Transfers)

Layer 6 – Presentation

Gets data into a common format both ends can understand. Handles data conversion, character/code translation, compression, and encryption/decryption.

Layer 5 – Session

Sets up, maintains, and tears down sessions (conversations) between applications. Manages dialog control: simplex, half duplex, and full duplex. (Online Banking, Remote Terminal Access (SSH))

Layer 4 – Transport

Provides end-to-end communication between hosts. Uses TCP (connection-oriented, reliable) or UDP (connectionless, best effort). Data unit is the segment (TCP) or datagram (UDP).

Layer 3 – Network

Moves data between hosts on DIFFERENT networks using logical IP addresses. Determines the best route using routing tables. Device: router. Data unit: packet.

Layer 2 – Data Link

Moves data between devices on the SAME network using physical MAC addresses. Packages data into frames and detects errors. Devices: switches and bridges. Data unit: frame.

Layer 1 – Physical

Transmits raw bits across the medium — as electrical signals on copper, light pulses on fiber, or radio waves wirelessly. Devices: cables, connectors, hubs, modems, wireless access points.

TCP vs UDP

Transmission Control Protocol (TCP) is connection-oriented and reliable (uses flags, guarantees ordered delivery). User Datagram Protocol (UDP) is connectionless and best-effort (faster, no delivery guarantee). Both operate at Layer 4 (Transport).

Layer 3 vs Layer 2 addressing

Layer 3 (Network) uses logical IP addresses to communicate between different networks. Layer 2 (Data Link) uses physical MAC addresses to communicate within the same network.

Data Link sublayers

LLC (Logical Link Control) is the upper sublayer, handling flow control and error control. MAC (Media Access Control) is the lower sublayer, handling physical addressing and access to the shared medium.

LLC sublayer

Logical Link Control: the upper sublayer of the Data Link layer that provides flow control and error control.

MAC sublayer

Media Access Control: the lower sublayer of the Data Link layer that manages access to the physical medium and handles physical addressing using MAC addresses.

Devices by OSI layer

Layer 1 (Physical): hubs, cables, modems. Layer 2 (Data Link): switches, bridges. Layer 3 (Network): routers.

Well-known ports

Ports 0–1023 — reserved for common, standardized services (HTTP, FTP, SMTP, etc.).

Registered ports

Ports 1024–49151 — assigned to specific vendor or application uses.

Dynamic / private ports

Ports 49152–65535 — temporary ports used by clients for outgoing connections.

FTP port

21 — File Transfer Protocol, used to transfer files between a client and server.

Telnet port

23 — Telnet, provides remote command-line access to a device (unencrypted).

SMTP port

25 — Simple Mail Transfer Protocol, used to send email between mail servers.

TFTP port

69 — Trivial File Transfer Protocol, a simple, lightweight file transfer with no authentication (runs over UDP).

HTTP port

80 — Hypertext Transfer Protocol, used to load web pages (unencrypted).

POP3 port

110 — Post Office Protocol version 3, the device receives email, email goes to the email server, email server sends it to end device to download, and the server deletes its copy of the email.

IMAP port

143 — Internet Message Access Protocol, accesses and syncs email across multiple devices (leaving it on the server).

SNMP port

161 — Simple Network Management Protocol, used to monitor and manage network devices.

Simplex

One-way only. Data flows in a single direction and never the other way. (Keyboard sending data to computer)

Half Duplex

This is a two way, but only one direction at a time. (Walkie-talkie)

Full duplex

Two-way simultaneously. Both sides can send and receive at the same time with no waiting. (Phone call, modern Ethernet)