OSI Model Explained — Understanding How Network Communication Works

Series: Networking Fundamentals for Cloud & DevOps — Part 2 of 6

The OSI Model is one of those topics where you should understand the purpose of the layers rather than memorize definitions. Once you understand what each layer is responsible for, concepts like MAC addresses, IP addresses, ports, TCP/UDP, and encapsulation start fitting together naturally.

What is the OSI Model?

OSI = Open Systems Interconnection.

The OSI Model is a 7-layer conceptual model that divides network communication into different responsibilities.

The goal of networking is simple: allow two hosts to communicate and exchange data, and the OSI Model helps us understand what happens at each stage of that communication.

Think of it like a human body. The body has different systems — nervous, muscular, respiratory, etc. — and each has a specific responsibility.

Similarly, networking is divided into 7 layers, with each layer handling a specific part of communication.

The 7 Layers

7  Application
6  Presentation
5  Session
4  Transport
3  Network
2  Data Link
1  Physical

Enter fullscreen mode Exit fullscreen mode

For now, we’ll focus more heavily on Layers 1–4, because these directly connect with what we learned in Part 1 about repeaters, switches, routers, IPs, and MAC addresses.

1. Layer 1 — Physical

Purpose: Transporting bits

Computers ultimately deal with bits — 10110100101001010... — 0s and 1s.

Layer 1 is responsible for physically transporting those bits from one device to another using things like:

• Ethernet cables
• Fiber
• Wi-Fi radio signals
• Repeaters
• Hubs

Analogy

Think of Layer 1 as the road itself.

It doesn’t care who is sending something or where that information ultimately needs to go. It simply provides the physical medium through which something can travel — Host ─── Cable / Wi-Fi / Fiber ─── Host.

The medium could be copper, fiber, or wireless radio.

Layer 1 = Bits + physical medium

2. Layer 2 — Data Link

Purpose: Hop-to-hop communication

Layer 2 works on top of the physical medium and handles communication between directly connected devices — one hop at a time.

MAC Address

A MAC address is typically 48 bits, represented as 12 hexadecimal digits — e.g. 94:65:9C:3B:8A:E5.

Every network interface (NIC) has a MAC address.

Layer 2 technologies include:

• NICs
• Ethernet
• Switches
• MAC addresses

Why “Hop-to-Hop”?

Suppose we have:

Host A
   ↓
Router 1
   ↓
Router 2
   ↓
Router 3
   ↓
Host B

Enter fullscreen mode Exit fullscreen mode

There are multiple hops.

Layer 2 communication is concerned with the current hop, not the entire journey:

Host A → Router 1
Router 1 → Router 2
Router 2 → Router 3

Enter fullscreen mode Exit fullscreen mode

The Layer 2 information can change at every hop.

Analogy: Think of sending a package through multiple delivery centers. Each delivery center only needs to know:

“Where should this package go next?”

It doesn’t personally deliver the package all the way to the final destination. That’s hop-to-hop communication.

3. Layer 3 — Network

Purpose: End-to-end addressing and routing

Layer 3 uses IP addresses — for example, source 10.1.1.11 to destination 10.8.8.88.

Unlike MAC addresses, IP addresses identify the source and final destination of the communication.

Layer 3 is where routers operate and where routing between different networks happens.

Host A                                     Host B
10.1.1.11                                  10.8.8.88
   │                                           │
   └──→ Router ──→ Router ──→ Router ──────────┘

Enter fullscreen mode Exit fullscreen mode

The routers look at the destination IP and determine where to forward the packet next.

Analogy: Going back to our package example:

• IP address = final destination address
• MAC address = next delivery location/person
• Router = delivery center deciding where the package goes next

The Most Important Difference: MAC vs IP

This is very important.

Host A (IP = 10.1.1.11, MAC = a1a1) wants to communicate with Host B (IP = 10.8.8.88, MAC = e8e8).

The IP addresses represent the end-to-end communication: 10.1.1.11 → 10.8.8.88, unchanged for the whole journey.

But MAC addresses are used for each individual hop:

a1a1 → b2b2
b3b3 → c4c4
c5c5 → d6d6
d7d7 → e8e8

Enter fullscreen mode Exit fullscreen mode

So remember: Layer 3 (IP) → end-to-end, source IP → destination IP. Layer 2 (MAC) → hop-to-hop, current device → next device.

This explains something very important about routers:

Routers forward packets between networks, but the Layer 2 frame is rebuilt for each hop.

The IP packet is carried through the journey, while the Layer 2 addressing changes as the packet moves from one link to the next.

Put Everything You’ve Learned Together

Now the previous concepts start connecting:

                 NETWORK
                    │
          ┌─────────┴─────────┐
          │                   │
        Host                Host
          │                   │
       Layer 3            Layer 3
          IP                  IP
          │                   │
       Layer 2            Layer 2
         MAC                 MAC
          │                   │
       Layer 1            Layer 1
       Physical           Physical

Enter fullscreen mode Exit fullscreen mode

And the devices:

Layer Main Concept Examples L1 Physical Bits / signals Cable, Fiber, Wi-Fi, Repeater, Hub L2 Data Link MAC + hop-to-hop NIC, Switch, Bridge L3 Network IP + routing Router, IP-enabled devices

Easy Memory

L1 = Bits. L2 = MAC / Hop-to-hop. L3 = IP / End-to-end.

4. Layer 4 — Transport

Purpose: Service-to-service communication

Now we reach an important problem. Layer 3 gets the data to the correct host using an IP address. But a host can run many services at the same time.

For example, your laptop could have a browser on HTTPS, an SSH session, a chat app on UDP, and a game on TCP/UDP.

All of them use the same IP address. So we need another addressing mechanism to identify which service/application should receive the data. That is the job of:

Layer 4 → Ports

IP vs Port

IP address = which machine? Port = which service on that machine?

For example, 192.168.1.10:443:

192.168.1.10
      │
      └── Host
           │
           └── Port 443 → HTTPS service

Enter fullscreen mode Exit fullscreen mode

IP gets you to the host; port gets you to the service on that host.

This is one of the most important concepts to carry forward into Cloud and DevOps.

TCP and UDP

Layer 4 mainly uses:

• TCP — Transmission Control Protocol
• UDP — User Datagram Protocol

Both use ports. The port range is 0 to 65535.

TCP favors reliability. It provides mechanisms such as:

• Connection establishment
• Reliable delivery
• Ordering
• Retransmission
• Flow/congestion control

Examples: HTTPS → TCP/443, HTTP → TCP/80, SSH → TCP/22.

UDP favors efficiency and low overhead. It does not provide TCP’s connection-oriented reliability mechanisms.

Examples: DNS → commonly UDP/53, QUIC → UDP/443.

The important idea is not simply to memorize which protocol uses which port. Remember the trade-off: TCP → Reliability. UDP → Efficiency / low overhead.

Server Port vs Client Port

This is another important Layer 4 concept.

Suppose you open https://example.com. The server might be listening on TCP/443. Your computer, however, needs a source port for the connection — it can choose an ephemeral (temporary) source port.

Client                                      Server

192.168.1.10:49152  ─────────────────→  93.184.216.34:443

Enter fullscreen mode Exit fullscreen mode

Here, 49152 is the client’s temporary/ephemeral source port, and 443 is the server’s listening service port.

The response comes back:

93.184.216.34:443  ─────────────────→  192.168.1.10:49152

Enter fullscreen mode Exit fullscreen mode

The client uses that source port to associate the response with the correct connection/application.

Client ports are often described as “random,” but more accurately they are dynamically/ephemerally allocated by the operating system.

Multiple Connections to the Same Server

This is where ports become really useful. Your computer can have multiple connections to the same server IP and destination port:

TCP 192.168.1.10:6666  ───→  3.3.3.3:80
TCP 192.168.1.10:9999  ───→  3.3.3.3:80
TCP 192.168.1.10:5555  ───→  3.3.3.3:80

Enter fullscreen mode Exit fullscreen mode

Here the destination IP and destination port stay the same, but the source ports are different. Therefore, the OS can distinguish between the different connections. This is one reason the source port matters.

Combine L2, L3 and L4

Suppose a client (IP = 10.1.1.11, MAC = a1a1, Port = 1025) talks to a server (IP = 192.168.1.99, MAC = 8AE5, Port = 80).

As the data moves down the OSI stack, additional information is added:

L4 → TCP:       Source Port 1025       → Destination Port 80
L3 → IP:        Source 10.1.1.11       → Destination 192.168.1.99
L2 → Ethernet:  Source MAC a1a1        → Destination MAC 8AE5
L1 → Bits:      010101010101...

Enter fullscreen mode Exit fullscreen mode

This gives us the hierarchy: L2 → MAC → which device on this hop? L3 → IP → which host/network? L4 → Port → which service?

This is one of the most important things to remember.

Layers 5, 6 and 7

The distinction between Layers 5, 6 and 7 is somewhat vague in modern networking. The OSI Model is a conceptual model, not a strict rule that every modern protocol must fit perfectly into exactly one layer. So don’t get obsessed with forcing every modern protocol into one specific OSI layer.

Layer 5 — Session

Responsible conceptually for:

• Establishing communication sessions
• Maintaining sessions
• Terminating sessions

Think of it as managing the conversation/session between applications.

Layer 6 — Presentation

Responsible conceptually for how data is represented. Examples include:

• Encoding
• Encryption/decryption
• Compression

How should the data be represented so the other side can understand it?

Layer 7 — Application

This is the layer closest to the applications/services that use networking:

• HTTP
• HTTPS
• DNS
• FTP
• SMTP
• SSH

These are protocols/services that applications use to communicate over a network.

OSI vs TCP/IP Model

In real-world networking, you’ll commonly encounter the TCP/IP model. The simplified mapping is:

OSI                         TCP/IP

7  Application  ───────┐
6  Presentation         ├──→ Application
5  Session      ───────┘

4  Transport   ───────────→ Transport / Host-to-Host

3  Network     ───────────→ Internet

2  Data Link   ───────┐
1  Physical           ├──→ Network Access
              ────────┘

Enter fullscreen mode Exit fullscreen mode

So TCP/IP essentially combines some of the OSI layers. For Cloud and DevOps, you’ll encounter the TCP/IP model frequently, but the OSI model remains extremely useful for reasoning about networking problems.

Encapsulation — Very Important

Now we come to one of the most useful concepts. When sending data, it moves down the layers:

Application
     ↓
Transport
     ↓
Network
     ↓
Data Link
     ↓
Physical

Enter fullscreen mode Exit fullscreen mode

Each layer adds its own information. This process is called:

Encapsulation

Suppose the application creates DATA. As it moves down the stack, each layer wraps it further:

Layer 4 → DATA + TCP header
Layer 3 → DATA + TCP header + IP header
Layer 2 → DATA + TCP header + IP header + Ethernet header
Layer 1 → 101010101010...

Enter fullscreen mode Exit fullscreen mode

Each layer adds information needed for its own responsibility.

De-encapsulation

The receiving machine does the opposite. The incoming bits move upward:

Physical
    ↓
Data Link
    ↓
Network
    ↓
Transport
    ↓
Application

Enter fullscreen mode Exit fullscreen mode

Each layer processes and removes the information added by the corresponding sending layer. This is called:

De-encapsulation

So the overall idea is:

Sender                         Receiver

Data                           Data
  ↓                              ↑
TCP + Data                     TCP + Data
  ↓                              ↑
IP + TCP + Data                IP + TCP + Data
  ↓                              ↑
Ethernet + IP + TCP + Data     Ethernet + IP + TCP + Data
  ↓                              ↑
Bits                           Bits

Enter fullscreen mode Exit fullscreen mode

PDU Names

Another thing worth remembering is the name given to the data at different layers.

Layer PDU L7–L5 Data L4 Segment (TCP) / Datagram (UDP) L3 Packet L2 Frame L1 Bits

So you can visualize it like this:

                 DATA
                   ↓
        ┌─────────────────┐
L4      │  TCP  │  DATA   │  ← Segment
        └─────────────────┘
                   ↓
      ┌───────────────────────┐
L3    │ IP │ TCP │ DATA       │  ← Packet
      └───────────────────────┘
                   ↓
   ┌──────────────────────────────┐
L2 │ L2 │ IP │ TCP │ DATA         │  ← Frame
   └──────────────────────────────┘
                   ↓
      101010101010101010...
                   ↑
                  Bits

Enter fullscreen mode Exit fullscreen mode

The names give you a useful mental hierarchy: Data → Segment → Packet → Frame → Bits.

The Complete Picture 🔥

This is the mental model I’d recommend remembering:

L7  Application
        │
L6  Presentation
        │
L5  Session
        │
L4  Transport
        ├── Port
        ├── TCP / UDP
        └── Service-to-Service
        │
L3  Network
        ├── IP
        ├── Routing
        └── End-to-End
        │
L2  Data Link
        ├── MAC
        ├── Switching
        └── Hop-to-Hop
        │
L1  Physical
        ├── Bits
        └── Cable / Wi-Fi / Fiber

Enter fullscreen mode Exit fullscreen mode

And the 4 most important ideas for your Cloud + DevOps learning:

• L1 → Move bits
• L2 → Move frames hop-to-hop using MAC
• L3 → Move packets between hosts/networks using IP
• L4 → Deliver data to the correct service using ports

This is the foundation you’ll keep using when working with:

• Security Groups
• NACLs
• Load Balancers
• Target Groups
• VPCs
• Route Tables
• TCP/UDP
• Troubleshooting connectivity
• Network access problems

The AWS terminology will change, but the underlying networking concepts remain the same.

What’s Next

Now that we understand how communication is divided into layers, the next step is to go deeper into the mechanisms that make those layers actually work — especially MAC addressing, ARP, switching, IP addressing, routing, TCP/UDP, and how packets move through a real network.

Part 2 of 6 — Networking Fundamentals for Cloud & DevOps
A prerequisite series before diving deeper into AWS VPC, subnets, routing, security groups, and network troubleshooting.