Network Layers — OSI 1-7 and TCP/IP

In 1978 the International Organization for Standardization (ISO) started work on a universal model for computer networks — a way to divide the messy problem of "get bits from computer A to computer B" into layered pieces that could be designed, replaced, and reasoned about independently. In 1984 they published ISO/IEC 7498 — the OSI 7-layer reference model.

By the time the OSI model was standardized, the internet was already running on a competing model: TCP/IP (RFC 1122, 1989). TCP/IP has 4 layers instead of 7 and it's what actually runs the real internet. But the OSI 7-layer model won as the teaching and troubleshooting vocabulary. When a networking engineer says "it's a Layer 2 problem" or "we terminate TLS at Layer 7," they mean OSI layers. Every network engineer, sysadmin, and distributed-systems architect speaks this language.

The layers matter because they let you localize failure and compose functionality. Cable cut? Layer 1. WiFi authentication failing? Layer 2. Can't reach the gateway IP? Layer 3. Connection refused? Layer 4. TLS cert expired? Layer 6/7 boundary. HTTP 502? Layer 7. The vocabulary also tells you where each product plays: AWS NLB is L4 (packet-level). AWS ALB / Nginx / HAProxy L7 mode operate at L7 (HTTP-aware). Cloudflare spans L3-L7. Understanding what layer something lives at tells you what it can and can't do.

Interactive: click any layer to explore

Click any of the 7 layers below to see its purpose, the protocols that live at that layer, and the real-world systems you can point at as concrete examples.

Animated: watch an HTTP request travel down and up the stack

Theory is cheap. Watching a packet actually descend through Layer 7 → Layer 1, gain a header at each layer (encapsulation), cross the wire, then ascend back up on the server side (decapsulation) — that's where it clicks. Play the animation. Pause at any layer to see what gets added.

The layers in one sentence each

OSI vs TCP/IP — the model reality gap

The OSI model has 7 layers. TCP/IP has 4. What's the difference, and why do we still teach OSI if the internet runs on TCP/IP?

The answer: OSI's 5, 6, and 7 all became "application layer" in TCP/IP because in practice, application developers own all three. HTTPS is an application-layer protocol even though it uses TLS (technically layer 6) for encryption. The 7-layer OSI vocabulary is more precise for reasoning, but the 4-layer TCP/IP model is what you actually build against.

Encapsulation — how data becomes bits

When you send an HTTP request, it goes through every layer on the way down (each layer wraps the previous with its own header), then the bits arrive at the destination and get unwrapped in reverse.

This is why a single HTTP request can end up as ~20 bytes of TCP header + 20 bytes of IP header + 14 bytes of Ethernet frame header around your actual payload. For a 1-byte HTTP body, you're sending ~55 bytes of overhead. This is also why Ethernet MTU (~1500 bytes) matters — larger packets get fragmented at Layer 3.

Where common systems live — a real-world map

The interview litmus test

Every serious system design interview probes your layer vocabulary. Common questions:

• "L4 vs L7 load balancer — when to pick which?" L4 = fast, TCP-level, can't inspect content (AWS NLB, HAProxy L4 mode). L7 = HTTP-aware, can route by URL / header / cookie, slower, more expensive (AWS ALB, Nginx, HAProxy L7, Envoy).
• "Where does TLS terminate in your architecture?" Usually at the L7 load balancer or CDN edge. Origin then sees plain HTTP.
• "How does Anycast work?" L3 — the same IP is announced from many places via BGP. Routers pick the "nearest" one. Used by Cloudflare, Google DNS (8.8.8.8), root DNS servers.
• "What's the difference between WebSocket and HTTP long-polling?" Both L7. WebSocket upgrades an HTTP connection to a full-duplex persistent channel; long-polling reuses HTTP request-response pattern.
• "Why is UDP the wrong choice for reliability but the right choice for video?" Layer 4 — UDP has no retransmit, no ordering. For video, retransmitting old frames is worse than dropping them.

Applied in real systems — one company per layer

Key takeaways

• 7 OSI layers: 1 Physical · 2 Data Link · 3 Network · 4 Transport · 5 Session · 6 Presentation · 7 Application. Mnemonic: "Please Do Not Throw Sausage Pizza Away".
• TCP/IP collapses OSI layers 5-6-7 into a single "Application" layer. That's what actually runs the internet.
• Data encapsulation: your HTTP request gets wrapped in TLS (L6), then TCP (L4), then IP (L3), then Ethernet (L2), then sent as bits (L1). Each layer adds ~14-40 bytes of header.
• L4 vs L7 load balancers: L4 = fast + protocol agnostic + can't inspect (NLB, HAProxy TCP mode). L7 = HTTP-aware + route by URL/header/cookie + terminates TLS (ALB, Nginx, Envoy).
• Anycast is L3: same IP announced from many places via BGP. Cloudflare, Google DNS, root DNS.
• Every product plays at a specific layer. Know which. AWS Direct Connect = L1/L2. VPN = L3. Load balancer "L4 vs L7" you have to pick. Firewall "L3 filtering vs L7 WAF" you have to pick.
• Modern protocols like QUIC/HTTP/3 increasingly blur the layer boundaries — encryption + transport + streams in one protocol.

References

• ISO/IEC 7498-1 (1984, revised 1994) — the OSI reference model standard.
• RFC 1122 (1989) — Requirements for Internet Hosts (TCP/IP model).
• Tanenbaum & Wetherall — Computer Networks, 6th ed. The definitive textbook.
• Kurose & Ross — Computer Networking: A Top-Down Approach. The other textbook, and more approachable.
• Cloudflare Learning Center — free layer-by-layer articles at cloudflare.com/learning/.