OSI vs TCP/IP model: layers and mapping
Seven layers or four, and which one the exam wants
The OSI model has seven layers and is the reference model that exams use to talk about where something happens. The TCP/IP model has four layers and describes how the protocols that run the internet are actually organised. They describe the same traffic, so the rule is: use the OSI numbers when a question says “Layer 2”, “Layer 3” or “Layer 4”, and use TCP/IP only when a question asks about the protocol suite itself. The OSI model is the one you must be able to recite and apply; the TCP/IP model is the one that maps to real packets.
RFC 1122 defines the TCP/IP host stack as a link layer, an internet (IP) layer, a transport layer and an application layer. Some textbooks split the link layer into two and show five layers, which is why a question that asks “how many layers” should give the model’s name.
The two models side by side
| OSI layer | Name | TCP/IP layer | Typical items | Data unit |
|---|---|---|---|---|
| 7 | Application | Application | HTTP, DNS, SMTP, SSH, DHCP | Data |
| 6 | Presentation | Application | Encoding, encryption, compression | Data |
| 5 | Session | Application | Session setup and teardown | Data |
| 4 | Transport | Transport | TCP, UDP, port numbers | Segment (TCP), datagram (UDP) |
| 3 | Network | Internet | IP, ICMP, routers | Packet |
| 2 | Data link | Link | Ethernet, MAC addresses, switches, VLANs | Frame |
| 1 | Physical | Link | Cables, connectors, radio signals | Bits |
OSI layers 5 to 7 collapse into one application layer in TCP/IP, because real protocols such as HTTP handle all three jobs in one place. That is why exam questions about “which layer does TLS belong to” are awkward: the answer depends on the model the author has in mind, and the question normally says so.
One request through the layers
A browser requests a page over HTTPS. Each layer wraps the data from the one above, which is encapsulation:
- Application: the HTTP request is the data.
- Transport: TCP adds a header with the destination port 443 and a source port chosen by the client. The result is a segment.
- Network: IP adds the source and destination IP addresses. The result is a packet.
- Data link: Ethernet adds the source and destination MAC addresses and a trailer. The result is a frame.
- Physical: the frame is sent as bits on the cable or radio.
At the receiver the process runs backwards (de-encapsulation). On the path, a switch reads only up to the Ethernet header, a router reads up to the IP header and rewrites the Ethernet header at every hop, and the IP addresses stay the same end to end. That last sentence explains many “which address changes” questions: MAC addresses change at each router hop, IP addresses do not (ignoring NAT).
Devices and layers
| Device or feature | Layer | Decision is based on |
|---|---|---|
| Hub, repeater, cable, NIC signalling | 1 | Nothing, it repeats bits |
| Switch, bridge, VLAN, MAC table | 2 | Destination MAC address |
| Router, Layer 3 switch | 3 | Destination IP address |
| Packet filter, stateful firewall | 3 and 4 | IP address, port, connection state |
| Application firewall, proxy, load balancer (content-aware) | 7 | Content of the request |
A Layer 3 switch routes between VLANs and therefore decides on IP addresses; treat “multilayer switch” as a layer 2 and layer 3 device.
Using the layers to troubleshoot
The model earns its place as a troubleshooting order. Start at the bottom and move up, or at the symptom and move to the layer it names:
- No link light, wrong cable, speed or duplex fault: layer 1.
- Link is up but the host cannot reach its own subnet: layer 2, check VLAN, MAC table and port security.
- The local subnet works, other subnets do not: layer 3, check the mask, default gateway and routes.
- Ping works but the application does not: layer 4 or above, check port filtering, then the service.
- Name does not resolve but the IP is reachable: layer 7, DNS.
Which exams test this
| Exam | How the topic appears | Where on this site |
|---|---|---|
| CompTIA Network+ N10-009 | Networking Concepts, objective 1.1: explain the seven OSI layers; Network Troubleshooting, objective 5.1, names top-to-bottom and bottom-to-top OSI troubleshooting as an approach | Networking concepts explained, Network troubleshooting explained |
| CCNA 200-301 | Minor, indirect topic: neither version names the OSI or TCP/IP model, but objectives use the layer vocabulary. v1.1 (until Feb 2, 2027): Layer 2 and Layer 3 switches (1.1.b) and TCP versus UDP (1.5). v2.0 (from Feb 3, 2027): Layer 2/Layer 3 interfaces (2.1.a) and troubleshooting basic Layer 2/Layer 3 connectivity (2.4) | Switching and network access explained |
How layer questions are built
Questions state a device or protocol and ask for the layer, or state a symptom and ask for the layer or the first check. The traps: counting TLS as one fixed layer, forgetting that a router is layer 3 while a switch is layer 2, confusing the PDU names (a frame is not a packet), and answering with the TCP/IP number when the question uses OSI. Constraint words include “first”, “which layer”, “encapsulated” and “end to end”. If the question says the IP address stays the same while the MAC address changes, the subject is routing.
Practice questions
Question 1. A host sends a file to a server in another network. The frame leaves the host and crosses one router. Which statement is true when the frame arrives at the server?
- A. The source MAC address is still the address of the original host
- B. The source IP address is the address of the router
- C. The source MAC address is that of the last router and the source IP address is still the original host
- D. The TCP source port was changed by the router
Show answer
Answer: C
A router de-encapsulates the frame, makes a layer 3 decision on the destination IP address and builds a new frame with new source and destination MAC addresses for the next hop. The IP addresses are unchanged from end to end unless NAT is in use, so the source IP is still the host’s. The MAC addresses of the original frame are not carried across the router. The TCP port numbers stay the same because the router does not change the segment.
Question 2. Users can open a web page by IP address but not by name. Link lights are on and the default gateway answers ping. At which OSI layer does the problem sit most likely?
- A. Layer 1, physical
- B. Layer 2, data link
- C. Layer 3, network
- D. Layer 7, application
Show answer
Answer: D
Reaching the page by IP address shows that layers 1 to 4 work. Name resolution is performed by DNS, an application layer protocol at layer 7. A physical fault, a VLAN fault and a routing fault would each stop access by IP address as well.