OSI Model

OSI Model#

The Open Systems Interconnection (OSI) model is the standard seven-layer reference for network protocols. Linux ships TCP/IP (see TCP/IP), but operators still use OSI numbering as shorthand – “L2 switch”, “L4 load balancer”, “L7 proxy”.

Layer

Name

Examples

Linux / tools

7

Application

HTTP, DNS, SSH, SMTP, IMAP, FTP

curl, dig, ssh, nc

6

Presentation

TLS, character sets, compression

OpenSSL, GnuTLS

5

Session

RPC, NetBIOS, TLS session resumption

Mostly absorbed into L7 / TLS

4

Transport

TCP, UDP, QUIC, SCTP

ss, conntrack

3

Network

IPv4, IPv6, ICMP, routing

ip, ping, traceroute

2

Data Link

Ethernet, MAC, ARP, VLAN, Wi-Fi

ip link, arp, bridge

1

Physical

Copper / fiber / radio, NIC, PHY

ethtool, mii-tool

Mnemonic, bottom → top: Please Do Not Throw Sausage Pizza Away.

OSI vs TCP/IP#

Linux speaks TCP/IP, so OSI’s layers 5 and 6 collapse into the application layer in practice. The mapping operators keep in mind:

        flowchart LR
    subgraph OSI["OSI, 7 layers"]
        direction TB
        A7["7 Application"]
        A6["6 Presentation"]
        A5["5 Session"]
        A4["4 Transport"]
        A3["3 Network"]
        A2["2 Data Link"]
        A1["1 Physical"]
    end
    subgraph TCP["TCP/IP, 5 layers"]
        direction TB
        B5["Application"]
        B4["Transport"]
        B3["Network"]
        B2["Link"]
        B1["Physical"]
    end
    A7 --- B5
    A6 --- B5
    A5 --- B5
    A4 --- B4
    A3 --- B3
    A2 --- B2
    A1 --- B1

Common shorthand#

  • L2 switch, forwards by MAC address; VLAN-aware.

  • L3 router, forwards by IP; aware of routing tables.

  • L4 load balancer, distributes by TCP/UDP port (haproxy mode tcp, AWS NLB, Cilium L4 LB).

  • L7 load balancer / proxy, inspects HTTP, gRPC, TLS SNI (nginx, envoy, AWS ALB, Cloudflare).

  • L7 firewall / WAF, filters by HTTP request content (ModSecurity, Cloudflare WAF, AWS WAF).

See also: man 7 packet (raw L2 frames), Network Protocols.

Contents