Understanding Network Models: OSI and TCP/IP

1. The Blueprint: The OSI Model

First, we need to understand the Open Systems Interconnection (OSI) model. While not used in practice today, it's the standard teaching tool because it breaks down the complex process of network communication into seven distinct, manageable layers. Understanding this theoretical framework makes it much easier to diagnose problems and understand where specific attacks and defenses operate.

To get a quick and clear overview of these seven layers, please watch the following video from the ByteByteGo channel.

Now that you have a visual idea, let's solidify that knowledge with a more detailed reading that connects these concepts directly to cybersecurity.

To summarize, the seven layers of the OSI model are:

• Layer 7: Application: Where user-facing applications like your web browser operate (HTTP, FTP, SMTP).
• Layer 6: Presentation: Handles data formatting, translation, and encryption (e.g., TLS/SSL).
• Layer 5: Session: Manages the dialogue (session) between two computers.
• Layer 4: Transport: Provides reliable or unreliable data delivery between hosts (TCP, UDP).
• Layer 3: Network: Handles logical addressing and routing between different networks (IP).
• Layer 2: Data Link: Deals with physical addressing on the local network (MAC addresses, Ethernet).
• Layer 1: Physical: The actual hardware that transmits signals (cables, Wi-Fi).

A common mnemonic to remember the layers is: Please Do Not Throw Sausage Pizza Away.

2. The Real World: The TCP/IP Model

The OSI model is the theory, but the TCP/IP model is the reality. The internet is built on the TCP/IP protocol suite. It's a more practical model that condenses the seven OSI layers into four (or sometimes five) layers.

This image provides a perfect side-by-side comparison.

As you can see, the Application, Presentation, and Session layers of the OSI model are combined into a single Application layer in the TCP/IP model. The lower layers map more directly.

Let's watch a video that focuses specifically on the TCP/IP model.

The TCP/IP model is often shown with either four or five layers. The five-layer version splits the "Link" or "Network Access" layer into the Data Link and Physical layers, making it align even more closely with the OSI model. For our purposes, the key is to understand the functions, not to get hung up on the number of layers.

3. How Data Moves: Encapsulation and Decapsulation

When you send data—for example, loading a webpage—it doesn't just go out as one big block. It travels down the stack of layers on your computer, and each layer wraps the data in a new "envelope" with its own addressing information. This process is called encapsulation. The receiving computer does the reverse, unwrapping each layer to get to the original data. This is decapsulation.

Each "envelope" has a special name, called a Protocol Data Unit (PDU):

• Segment/Datagram: At the Transport Layer (Layer 4), data is encapsulated into a TCP segment or a UDP datagram.
• Packet: At the Network Layer (Layer 3), the segment is encapsulated into an IP packet.
• Frame: At the Data Link Layer (Layer 2), the packet is encapsulated into a frame.

The video you just watched has an excellent animation of this process. Let's re-watch that specific part.

This concept is vital in penetration testing. When you use Wireshark to capture traffic, you are looking at these frames, packets, and segments. Attacks often involve inspecting or manipulating the headers added during encapsulation.

4. The Penetration Tester's View of Networking Models

So, why does this matter for you? Because every attack targets a specific layer. Understanding the models allows you to:

1. Categorize vulnerabilities: Is this a low-level network attack or a high-level application flaw?
2. Select the right tools: Nmap operates primarily at Layers 3 and 4. Burp Suite operates at Layer 7.
3. Understand defenses: A traditional firewall operates at Layers 3 and 4, while a Web Application Firewall (WAF) operates at Layer 7.

This final resource ties everything together from an ethical hacker's perspective. It discusses attack use cases and tools for each layer of the OSI model. Since you're already familiar with some of these tools, this should connect the theory directly to your practical experience.

Conclusion

Great work today. We've covered a lot of foundational ground that will serve you throughout your entire cybersecurity career.

Here are the key takeaways:

• The OSI Model is a 7-layer conceptual framework essential for understanding the theory of networking.
• The TCP/IP Model is a 4 or 5-layer practical model that powers the modern internet.
• Encapsulation is the process of wrapping data in headers as it moves down the network stack. Each layer adds information vital for communication.
• Every cyber attack, defensive tool, and network protocol operates at a specific layer. As a penetration tester, knowing the layers helps you choose the right tool for the job and understand exactly what you're attacking.

In our next lesson, we will put this theory into practice. You'll learn how to analyze network traffic with Wireshark to identify protocols and communication patterns. This will allow you to see the frames, packets, and segments we discussed today in a real-world context.