The OSI model and network appliances
Network problems get easier once you can say which part of the conversation is failing. The OSI (Open Systems Interconnection) reference model splits network communication into seven layers. Each layer does one job and depends on the layer below it.
Network+ uses the layer numbers constantly. A question may call a switch a Layer 2 device or a firewall rule a Layer 4 rule without explaining further, so learn the layers well enough to place any device or protocol on them.
| Layer | Name | What it does | Unit of data | Examples |
|---|---|---|---|---|
| 7 | Application | Network services that programs use | Data | HTTP, DNS, SMTP, FTP, SSH |
| 6 | Presentation | Formats, compresses, and encrypts data so both sides can read it | Data | Character encoding, TLS encryption, image formats |
| 5 | Session | Opens, manages, and closes sessions between programs | Data | Session setup and teardown, remote procedure calls |
| 4 | Transport | Delivery between programs on two hosts, using port numbers | Segment (TCP) or datagram (UDP) | TCP, UDP |
| 3 | Network | Logical (IP) addressing and routing between networks | Packet | IP, ICMP, routers, Layer 3 switches |
| 2 | Data link | Delivery on the local network using MAC addresses, with error detection | Frame | Ethernet, 802.11 Wi-Fi, switches, bridges, access points |
| 1 | Physical | Bits sent as electrical, light, or radio signals | Bits | Cables, connectors, hubs, repeaters, transceivers |
Remember the layers from 1 to 7 with Please Do Not Throw Sausage Pizza Away: Physical, Data link, Network, Transport, Session, Presentation, Application.
Encapsulation is what happens as data moves down the layers on the sending computer. The transport layer adds a header with port numbers, the network layer adds source and destination IP addresses, and the data link layer adds source and destination MAC addresses plus a trailer, the frame check sequence (FCS), that the receiver uses to detect damaged frames. The receiving device reverses the process (decapsulation), removing one header at each layer.
Real networks run the TCP/IP model, which has four layers: Application (OSI layers 5 to 7), Transport (layer 4), Internet (layer 3), and Link (layers 1 and 2). Network+ questions use the OSI numbers.
The layers become a troubleshooting map. A cut cable is a Layer 1 problem. A device in the wrong VLAN is Layer 2. A wrong default gateway or a missing route is Layer 3. A firewall blocking TCP port 443 is Layer 4. A misconfigured web application is Layer 7.
Networking appliances can be physical boxes or virtual appliances: the same software running as a virtual machine on a hypervisor or as a service in a cloud provider. For the exam, what matters is the job each one does.
| Appliance | What it does | Workplace example |
|---|---|---|
| Router | Forwards packets between different networks using IP addresses and a routing table (Layer 3) | The office edge router connects the LAN to the ISP and is the default gateway for every PC |
| Switch | Forwards frames inside a LAN using its MAC address table (Layer 2); a multilayer switch can also route between VLANs (Layer 3) | A 48-port access switch connects the desks, phones, and printers on one floor |
| Firewall | Permits or denies traffic by rules. Stateful firewalls track connections; next-generation firewalls also identify applications and users | Allows HTTPS from the internet to the web server only, and blocks everything else |
| IDS | Watches a copy of the traffic and raises alerts on suspicious patterns; it does not block | Connected to a mirrored switch port, it alerts the security team to a port scan |
| IPS | Sits inline, in the path of the traffic, and can drop malicious packets as they pass | Placed behind the firewall, it blocks a known exploit aimed at the mail server |
| Load balancer | Spreads requests across several servers, checks their health, and stops sending to a server that fails | Three web servers share one virtual IP so the site stays up if one of them crashes |
| Proxy | Makes requests on behalf of clients; can cache, filter, and log. A reverse proxy sits in front of servers instead | All staff web browsing passes through a proxy that blocks known malware sites |
| NAS | A storage appliance that shares files over the network (file-level access, using SMB or NFS) | A department file share that users map as a drive |
| SAN | A dedicated high-speed storage network that gives servers block-level access to disks, over Fibre Channel or iSCSI | Virtualization hosts keep virtual machine disks on SAN storage that appears to them as local drives |
| Wireless access point (AP) | Bridges Wi-Fi clients onto the wired network (Layer 2) | Ceiling-mounted APs in each conference room |
| Wireless LAN controller | Centrally configures and manages many lightweight APs | One controller pushes the SSID, security settings, and channel plan to 40 APs |
IDS versus IPS: an IDS detects and alerts, usually from a copy of the traffic. An IPS sits inline and can block. If the scenario says the device must stop the attack, the answer is an IPS.
NAS versus SAN: a NAS shares files, so users see a folder. A SAN provides raw blocks, so a server sees a disk that it formats itself.
The objectives also list one application and three functions:
- Content delivery network (CDN): a provider's servers around the world keep cached copies of web content close to users, which cuts latency and takes load off the origin server.
- Virtual private network (VPN): an encrypted tunnel across an untrusted network such as the internet, joining a remote user or a branch office to the private network.
- Quality of service (QoS): classifies and marks traffic so that delay-sensitive traffic, such as voice and video calls, is sent ahead of bulk transfers when a link is busy.
- Time to live (TTL): a field in the IP header that every router lowers by one. When it reaches zero, the router discards the packet and returns an ICMP time exceeded message, so a packet caught in a routing loop cannot circulate forever. DNS records also carry a TTL: how long a resolver may cache the answer.
Word bank
All definitions →- Encapsulation
- Adding each layer's header, and at Layer 2 a trailer, to data as it moves down the layers before it is sent.
- Multilayer switch
- A switch that can also route traffic between VLANs at Layer 3.
- OSI model
- A seven-layer reference model that splits network communication into separate jobs, from physical signals (Layer 1) to application services (Layer 7).
- Protocol data unit (PDU)
- The name for data at a given layer: bits, frames, packets, segments or datagrams, and data.
- Stateful firewall
- A firewall that tracks each connection and automatically allows the return traffic of sessions it permitted.
- Virtual appliance
- Network software, such as a router or firewall, running as a virtual machine or cloud service instead of a dedicated box.
Knowledge check
A user's laptop shows a link light and can reach printers on its own subnet, but nothing beyond it. Other users on the subnet can browse the web. Which OSI layer should troubleshooting focus on first?
Which device must sit inline in order to stop malicious traffic as it passes?
At which OSI layer does a switch make forwarding decisions using MAC addresses?