Chapter 1: The OSI Model and TCP/IP Stack

Why Models Matter

When engineers designed the first computer networks in the 1960s and 70s, every manufacturer built proprietary systems that couldn’t talk to each other. The solution was to create reference models — abstract frameworks that define how networking should work in layers, so that each layer can be developed and replaced independently.

Two models dominate the field: the OSI model (a theoretical reference) and the TCP/IP model (the practical foundation of the Internet). Understanding both is essential for every network programmer, because they provide the vocabulary and mental framework you’ll use for the rest of this book — and your career.

The OSI Model — Seven Layers

The Open Systems Interconnection (OSI) model was developed by the International Organization for Standardization (ISO) in 1984. It divides network communication into seven layers, each with a distinct responsibility.

How Data Flows Through the Layers

When you send a message, it travels down the stack on the sender’s side and up the stack on the receiver’s side. At each layer going down, the data is wrapped in a new header (and sometimes a trailer) — a process called encapsulation.

Application Data
       ↓ encapsulate
[Transport Header] + Application Data           → Segment
       ↓ encapsulate
[Network Header] + Segment                      → Packet
       ↓ encapsulate
[Data Link Header] + Packet + [Trailer]          → Frame
       ↓ encapsulate
Physical bits on the wire                        → Bits

On the receiving side, each layer strips off its header (decapsulation) and passes the payload up to the next layer.

Layer 7 — Application

The application layer is where users and software interact with the network. Protocols here define how applications exchange data: HTTP for web pages, SMTP for email, DNS for name resolution, FTP for file transfers. When you write a Python program that makes an HTTP request, you’re operating at Layer 7.

Layer 6 — Presentation

The presentation layer handles data format translation. It ensures that data sent by one application can be read by another, regardless of internal representation. This includes character encoding (ASCII, UTF-8), data compression, and encryption. In practice, TLS encryption is often cited as a Layer 6 function, though it spans multiple layers.

Layer 5 — Session

The session layer manages dialogues between applications. It establishes, maintains, and terminates sessions — logical connections that persist across multiple request-response exchanges. In modern networking, session management is typically handled within the application layer (e.g., HTTP cookies, WebSocket connections), so Layer 5 is less distinct in practice.

Layer 4 — Transport

The transport layer provides end-to-end communication between processes on different hosts. The two dominant protocols are:

• TCP (Transmission Control Protocol) — reliable, ordered, connection-oriented delivery with flow control and congestion management
• UDP (User Datagram Protocol) — fast, connectionless, best-effort delivery with no guarantees

TCP uses a three-way handshake (SYN → SYN-ACK → ACK) to establish connections. UDP simply sends datagrams without setup. Your choice between TCP and UDP fundamentally shapes your application’s behavior.

Layer 3 — Network

The network layer handles logical addressing (IP addresses) and routing — determining the best path for packets to travel from source to destination across multiple networks. The Internet Protocol (IP) is the cornerstone of this layer. ICMP (used by ping and traceroute) also operates here.

Layer 2 — Data Link

The data link layer manages communication between devices on the same physical network segment. It uses MAC addresses (hardware addresses burned into network interface cards) to identify devices locally. Ethernet is the dominant Layer 2 protocol for wired networks; Wi-Fi (802.11) serves wireless networks.

This layer also handles error detection using checksums (like CRC) and flow control on the local link.

Layer 1 — Physical

The physical layer deals with the actual transmission of raw bits over a physical medium — copper cables, fiber optics, or radio waves. It defines electrical voltages, signal timing, cable specifications, and connector types. As a programmer, you rarely interact with Layer 1 directly, but understanding it helps when diagnosing hardware-level issues.

The TCP/IP Model — Four Layers

While the OSI model is the theoretical gold standard, the TCP/IP model (also called the Internet model or DoD model) is what the Internet actually runs on. It was developed alongside the ARPANET in the 1970s and consolidated into four layers.

Note: ARP’s placement is debated — it bridges Layer 2 and Layer 3.

The TCP/IP model is more pragmatic than the OSI model. It merges the top three OSI layers into a single Application layer (since most protocols span those boundaries anyway) and combines the bottom two into Network Access.

TCP/IP in Practice

When you write a Python program that opens a TCP connection, here’s what happens at each TCP/IP layer:

1. Application layer — Your code calls socket.connect() and sends data via socket.send()
2. Transport layer — TCP segments the data, adds sequence numbers, performs the three-way handshake
3. Internet layer — IP adds source and destination IP addresses, routers forward the packet hop by hop
4. Network Access layer — Ethernet frames the packet with MAC addresses, the NIC converts it to electrical signals

Protocol Data Units (PDUs)

Each layer wraps data in its own Protocol Data Unit (PDU). Using the correct PDU terminology helps when reading documentation and debugging:

Encapsulation in Detail

Let’s trace an HTTP request through the full encapsulation process:

1. Application:  "GET / HTTP/1.1\r\nHost: example.com\r\n\r\n"

2. Transport:    [TCP Header: src_port=52431, dst_port=80, seq=1, ack=0, flags=PSH+ACK]
                 + HTTP data

3. Network:      [IP Header: src=192.168.1.42, dst=93.184.216.34, TTL=64, proto=TCP]
                 + TCP segment

4. Data Link:    [Eth Header: src_mac=aa:bb:cc:dd:ee:ff, dst_mac=00:11:22:33:44:55, type=0x0800]
                 + IP packet
                 + [CRC Trailer]

5. Physical:     0100111010110001... (electrical signals on copper / light pulses in fiber)

Each layer only reads its own header. A router (Layer 3 device) strips the frame header, reads the IP header to make routing decisions, then re-encapsulates the packet in a new frame for the next hop.

OSI vs TCP/IP — When to Use Which

In practice, network professionals mix terminology from both models:

• Use OSI layer numbers when discussing specific functions: “This is a Layer 4 issue” (transport problem) or “Layer 7 load balancing” (application-aware routing)
• Use TCP/IP protocol names when discussing implementation: “We need to debug the TCP handshake” or “Check the IP routing table”
• In Python network programming, you operate primarily at the Transport layer (sockets) and Application layer (HTTP libraries), while the OS handles lower layers

The OSI model is your conceptual map; the TCP/IP model is the territory you’ll actually program.

Seeing the Layers on Your Machine

You can observe the layers in action using standard Linux tools:

# Layer 2 — View your MAC addresses and interfaces
ip link show

# Layer 3 — View your IP addresses
ip addr show

# Layer 3 — View the routing table
ip route show

# Layer 4 — View active TCP/UDP connections
ss -tuln

# Layer 7 — Make an HTTP request and see headers
curl -v http://example.com 2>&1 | head -30

We’ll explore all of these tools in depth throughout the book.

Key Takeaways

• The OSI model provides a 7-layer theoretical framework for understanding network communication
• The TCP/IP model consolidates this into 4 practical layers that mirror the Internet’s real architecture
• Encapsulation wraps data in headers at each layer going down; decapsulation strips them going up
• Each layer has a distinct Protocol Data Unit (PDU): data, segment/datagram, packet, frame, bits
• As a network programmer, you’ll work primarily at the Transport and Application layers, while the OS and hardware handle lower layers
• Both models are tools for thinking — use OSI layer numbers for concepts and TCP/IP protocol names for implementation