2 Network Models and Encapsulation
Learn how layered network models organize communication, how OSI and TCP/IP layers correspond, and how protocols encapsulate and deliver data across networks.
Why networking uses layers
Network models organize communication into layers. Each layer has a defined role and uses services from the layer below it. This division lets different applications, operating systems, and network technologies interoperate without requiring every component to perform every networking task.
The seven OSI layers
The divides networking into seven conceptual layers. Its upper layers describe application-facing functions, while its lower layers describe delivery across networks and physical links. The boundaries are conceptual: a protocol or service may span several functions.
From top to bottom, the layers and their typical roles are:
Layer 7 — Application: Provides network services to applications. Examples include HTTP, DNS, and SMTP.
Layer 6 — Presentation: Represents, transforms, compresses, or encrypts data. Examples include character encoding, data formats, and encryption functions.
Layer 5 — Session: Establishes, manages, and ends communication sessions; session-control functions in applications are examples.
Layer 4 — Transport: Provides process-to-process delivery and may handle reliability and multiplexing. TCP and UDP are examples.
Layer 3 — Network: Addresses and routes packets between networks. IPv4, IPv6, ICMP, and routing protocols such as OSPF are examples.
Layer 2 — Data Link: Transfers frames across a local link. Ethernet, Wi-Fi, and PPP are examples.
Layer 1 — Physical: Transmits signals and bits over a medium, using electrical or optical signaling over copper, fiber, or radio.
The and its correspondence
The describes the architecture used by the Internet. In a common four-layer version, its layers correspond approximately to OSI layers as follows:
Application: Corresponds approximately to OSI layers 5–7. Examples include HTTP, DNS, SMTP, and SSH.
Transport: Corresponds approximately to OSI layer 4. Examples include TCP and UDP.
Internet: Corresponds approximately to OSI layer 3. Examples include IPv4, IPv6, and ICMP.
Link or network access: Corresponds approximately to OSI layers 1–2. Ethernet, Wi-Fi, and PPP are examples; the physical medium carries the signals.
Some teaching materials divide the bottom TCP/IP layer into separate physical and data-link layers, producing a five-layer model. The Internet architecture groups some functions differently from OSI: for example, its application layer includes functions that OSI describes separately as presentation and session functions. Treat the correspondence as a practical guide, not as a claim that each protocol has a perfect one-to-one OSI equivalent.
and data units
As an application sends data, each lower layer typically adds control information, often a header, around the data it receives. This process is called . At the destination, layers read and remove their corresponding information in reverse order; this is .
For a typical request sent over Ethernet using IPv4 and TCP, the progression is:
The application produces data, such as an HTTP request.
TCP adds a transport header, creating a . The header includes source and destination port numbers.
IP adds an IP header, creating an , also called an IP datagram. The header includes source and destination IP addresses.
Ethernet adds a link-layer header and trailer, creating an . Its link-layer addresses identify delivery on the local link.
The physical layer transmits the frame as signals represented by bits.
At the receiving host, Ethernet processes the frame, IP processes the packet, TCP processes the segment, and the application receives the data. The common names for units are data at the application layer, segment for TCP, datagram for UDP or IP, packet for IP, frame for the link layer, and bits at the physical layer. Usage varies: “packet” is also often used informally for network traffic in general.
What headers do across a network
Each layer interprets its own header to perform its task. IP uses IP addresses for routing, while TCP uses port numbers to deliver data to the appropriate application process. TCP provides a reliable, ordered byte stream. IP provides addressing and packet delivery between networks, but does not itself guarantee successful delivery.
A link-layer frame can change as traffic crosses a router. The router removes the incoming link-layer framing and sends the in a new frame suited to the next link. The source and destination IP addresses generally remain the same end-to-end, although network features such as address translation can alter them.
Common protocols and layer placement
Common protocol-to-layer placements help with learning and troubleshooting, but they are not rigid laws. Protocol functions may combine or cross conceptual layer boundaries.
Ethernet (IEEE 802.3) and Wi-Fi (IEEE 802.11): Link technologies that include physical and data-link functions and move frames over local wired or wireless links.
ARP: A link-layer protocol, or a protocol at the boundary between link and Internet functions, that maps an IPv4 address to a link-layer address on a local network.
IPv4 and IPv6: Internet-layer protocols, corresponding to OSI layer 3, that address and forward packets across networks.
ICMP and ICMPv6: Internet-layer protocols that carry network control and error-reporting messages.
TCP and UDP: Transport protocols, corresponding to OSI layer 4, that multiplex traffic to application processes using ports. TCP also provides reliable, ordered delivery.
DNS, HTTP, SMTP, and SSH: Application-layer protocols, corresponding to OSI layer 7, that provide naming, web, email, and remote-access services.
TLS: Usually treated as part of the application stack. It protects application traffic with encryption and related security functions, and its role can resemble OSI presentation-layer functions.
DNS remains an application-layer protocol whether its messages travel over UDP or TCP. TLS is often shown above TCP in protocol stacks rather than assigned a separate OSI layer.