Why Layers?

Networking is the most complex system you’ll operate: billions of machines, no central authority, and messages that routinely cross thousands of miles and dozens of vendors’ equipment. Nobody can design that as one monolith. So networks are layered: each layer solves one problem (addressing, reliability, delivery, meaning) using only the layer below it, and exposes only its interface upward.

Layers give you three engineering superpowers:

• Abstraction — an application uses sockets without knowing if the link is fiber, Wi-Fi, or satellite.
• Substitution — swap Ethernet for Wi-Fi, IPv4 for IPv6, without touching the layers above.
• Debuggability — when something breaks, you can bisect by layer: is it the link, the network, the transport, or the app?

The OSI Model (7 Layers)

The Open Systems Interconnection (OSI) model is the reference taxonomy. You will be asked to recite these in every networking interview, but the goal is understanding what each layer does:

The mnemonic “Please Do Not Throw Sausage Pizza Away” (Physical, Data-link, Network, Transport, Session, Presentation, Application) is worth knowing, but the practical layers are 1–4 and 7: sessions and presentation mostly live inside the application or transport in the real internet.

The TCP/IP Model (4 Layers)

The OSI model describes concepts; the TCP/IP model describes the actual internet — and it collapses layers:

Why only four? Because the internet famously followed the “rough consensus and running code” philosophy — the session/presentation distinctions weren’t worth their weight, and everything from DNS to TLS to HTTP got folded into (or on top of) the application layer.

Encapsulation: How Layers Talk

Layers communicate through encapsulation. Each layer wraps the data with its own header:

[ HTTP request (application)          ]
[ TCP | HTTP payload                  ]   ← TCP adds port numbers + sequence
[ IP  | TCP | HTTP                    ]   ← IP adds source/dest addresses
[ ETH | IP | TCP | HTTP ]  <CRC>          ← Link adds MAC addresses + checksum

The sender builds down (each layer adds a header); the receiver strips up (each layer removes its header). The unit at each layer has a name — a Protocol Data Unit (PDU):

“Packet” is the word everyone uses for the IP-level unit; a “frame” is the on-wire unit. When you see a network trace (tcpdump, Wireshark), you’re seeing the encapsulated stack from the inside out.

Where Real Protocols Live

The phrase you’ll hear constantly — “L4 load balancer,” “L7 firewall,” “at the network layer” — is shorthand for which layer’s header that device inspects. A Layer-4 load balancer forwards by port number; a Layer-7 one can route by URL. Layer numbers are the map of the whole discipline.

Decapsulation and Diagnostics

When a packet crosses your network, each device reads only its layer’s header: a switch reads layer-2 frames and forwards by MAC, a router reads layer-3 packets and forwards by IP address, and your host delivers the payload to the application by layer-4 port. A tool like traceroute works by reading layer-3 time-to-live errors; tcpdump decapsulates all the way down so you can see every header. Being able to say “this is a link-layer problem, not a transport problem” is the fundamental skill this model gives you.

Practice Trajectory

1. Use ip addr (or ifconfig) to find your machine’s IP and MAC addresses — one per layer.
2. traceroute google.com and watch the packet traverse routers — note where the network layer’s job is visible.
3. Run tcpdump -n -c 10 while loading a webpage; identify the Ethernet frame, IP packet, and TCP segment headers in one capture.
4. Explain, in two sentences, why a TCP connection is identified by four numbers (source IP, source port, dest IP, dest port) — i.e., which layer contributes which.
5. Classify a real failure you’ve seen by layer (cable = 1, wrong gateway = 3, blocked port = 4, bad URL = 7).

When It’s the Right Tool