The OSI Model and Encapsulation
Use layered models to localise faults and explain exactly where each protocol, device, and header operates.
- Certification
- CompTIA Network+
- Recommended study time
- 5h 35m
- Status
- Not started
Recommended study time
About 5h 35m in total, measured from the material on this page. At your session length of 45 minutes that is 8 sittings.
- Read the lesson22 min
About 2,819 words at a careful technical reading pace.
- Second pass with notes13 min
Re-read the harder parts and write your own notes.
- Recall from memory12 min
2 written recall questions.
- Practice decision12 min
One applied decision with feedback.
- Teach it back20 min
Write the topic in your own words.
- Real-world scenario15 min
Read the situation and justify your decision in writing.
- Hands-on practice2h 40m
Labs, commands and configuration until you can do it unaided.
- Spaced review1h 20m
4 short review sessions spread over the following weeks.
Learning objectives
- Describe each OSI layer's responsibility and typical protocols.
- Explain encapsulation and decapsulation as data crosses layers.
- Localise a reported fault to a specific layer using observed evidence.
Start here
About 8 minutes of reading, in 10 short parts.
The OSI model is a seven-layer map of everything a network does, from electrical signals on a cable to the app on your screen. Beginners often meet it as a list to memorise, but its real job is to give you a shared vocabulary for saying exactly where a problem lives. Once you can place a symptom at a layer, troubleshooting stops being guesswork.
Where you meet it: A help desk ticket says 'the internet is down'; a network engineer uses OSI layers to work out in minutes whether it is a cable, a switch, a router, or a website that is actually broken.
The lesson, part by part
Open one part at a time. Each part stands on its own, so you can stop and come back.
Imagine sending a letter. You write a message, put it in an envelope, add an address, hand it to the postal service, and a van carries it down the road. Each step adds its own wrapper and its own job, and the person at the other end unwraps it in reverse. Networking works the same way: your web request gets wrapped in several layers of information before it goes anywhere, and each device along the path only needs to read its own layer of wrapping to do its job.
The seven-layer OSI model just names each of those wrapping steps: physical wires and signals, the local hop between two devices, the path across networks, the reliable delivery, the conversation session, the way data is formatted, and finally the application itself, like your browser. A switch only needs to look at the 'local hop' wrapper. A router looks one layer deeper, at the network wrapper. Your browser cares about the very inside of the envelope.
Key ideas
If you remember nothing else from this topic, remember these.
- The OSI model exists to give technicians a shared vocabulary for locating a fault, not to be recited from memory.
- Data is wrapped in a new header at every layer on the way out, called encapsulation, and unwrapped in reverse order on arrival, called decapsulation.
- The named unit of data changes per layer: bits at layer 1, frames at layer 2, packets at layer 3, segments or datagrams at layer 4.
- Devices are associated with the lowest layer they need to inspect: a hub with layer 1, a switch with layer 2, a router with layer 3, a firewall commonly with layer 3 and 4, and a web application firewall with layer 7.
- TCP/IP's four practical layers (link, internet, transport, application) map onto the seven OSI layers but compress session and presentation duties into the application layer.
- Troubleshooting should proceed from the bottom layer upward, because a broken lower layer makes testing anything above it meaningless.
Isolating a mystery outage with layered testing
A worked example, step by step.
A branch office reports that an internal file share is unreachable, but staff insist the internet works fine on the same machines.
- 01Check layer 1Confirm the link light is lit on the workstation's NIC and switch port; a dark light ends the investigation immediately.
- 02Check layer 2Run arp -a to confirm the workstation has learned the gateway's MAC address, proving local switching is functioning.
- 03Check layer 3Ping the file server's IP address directly; a reply confirms routing between the workstation and server subnet works.
- 04Check layer 4Use telnet fileserver 445 to test whether the SMB port itself accepts a connection, isolating the transport layer.
- 05Interpret the failureThe telnet attempt times out even though ping succeeds, meaning layers 1 through 3 are healthy and the fault sits at layer 4 or above.
- 06Investigate the transport blockCheck the server's host firewall rules and find that SMB was recently restricted to a different subnet by a security policy update.
- 07Apply the fixAdd the branch subnet to the allowed SMB source list on the file server's firewall.
- 08Confirm resolutionRe-run telnet fileserver 445, observe a successful connection, then confirm the share reopens in File Explorer.
Outcome: The fault was pinpointed to a layer 4 firewall rule in minutes rather than hours, because each layer was tested in strict order before moving upward.
OSI layers, units, and representative devices
Worth keeping at hand while you work.
- Layer 7 Application
- HTTP, DNS, SMTP, FTP; data unit is simply application data
- Layer 6 Presentation
- Encoding, compression, TLS record formatting; data unit is data
- Layer 5 Session
- Session establishment and teardown; data unit is data
- Layer 4 Transport
- TCP and UDP, ports, reliability; data unit is a segment (TCP) or datagram (UDP)
- Layer 3 Network
- IP addressing and routing; data unit is a packet; routers operate here
- Layer 2 Data Link
- MAC addressing and switching; data unit is a frame; switches and bridges operate here
- Layer 1 Physical
- Cables, connectors, voltages, radio signals; data unit is a bit; hubs and NICs operate here
- Encapsulation
- Adding a header at each layer while sending
- Decapsulation
- Removing a header at each layer while receiving
- TCP/IP link layer
- Combines OSI layers 1 and 2
- TCP/IP internet layer
- Equivalent to OSI layer 3
- TCP/IP application layer
- Combines OSI layers 5, 6, and 7
Common misunderstandings
What most beginners get wrong here.
A switch reads IP addresses to decide where to forward a frame.
A standard layer 2 switch forwards based on the destination MAC address, not the IP address; only a layer 3 switch or router reads IP information.
The OSI model is how the actual internet works.
The internet runs on TCP/IP's four-layer model; OSI is a conceptual teaching and troubleshooting reference, not the literal protocol stack in use.
If ping works, the application must also be reachable.
Ping only proves layer 3 connectivity; the application at layer 7 can still be down, blocked at layer 4, or misconfigured.
Encapsulation only happens once, at the very start.
Encapsulation happens at every layer the data passes through on the way down the stack, with a new header added each time.
Presentation and session layers are things end users configure directly.
These layers are largely handled automatically by libraries such as TLS and socket APIs; end users rarely interact with them directly.
Exam traps
How the question writers try to catch you out.
- Network+ scenario questions describe a symptom, such as a device reachable by IP but not by name, and ask which layer is most likely at fault.
- Expect direct matching questions asking which layer a specific device or protocol belongs to, such as placing a switch at layer 2 and a router at layer 3.
- Distractors often swap layer 4 (ports, TCP/UDP) with layer 3 (IP addressing) since both feel like addressing concepts.
- Questions may ask for the correct data unit name at a given layer, such as identifying a segment versus a packet.
- Watch for questions that test whether you know encapsulation direction: adding headers while sending versus stripping them while receiving.
Check yourself
Answer in your head first, then reveal. This is not scored.
At which OSI layer does a standard switch make its forwarding decisions?
What is the correct term for the data unit at the transport layer when using TCP?
If ping to a server succeeds but a specific application times out, which layers have you already proven healthy?
What process happens to data as it travels down the stack before transmission?
Which TCP/IP layer combines OSI's session, presentation, and application layers?
Why should troubleshooting start at layer 1 rather than layer 7?
Quick reference
A condensed summary of the lesson above, for revision.
What It Is
The OSI model has seven layers: physical, data link, network, transport, session, presentation, and application. Each layer adds or removes its own header as data moves down the sending stack and up the receiving stack, a process called encapsulation and decapsulation. TCP/IP compresses these into link, internet, transport, and application layers.
Why It Matters
Saying 'the internet is broken' helps nobody. Saying 'we have link and IP connectivity, DNS resolves, but TCP 443 is refused' identifies a firewall or service problem and skips hours of irrelevant checks. Packet captures, ACLs, and load balancers are all described in layer terms.
How It Works
- Each layer adds a header describing how the next lower layer should handle the payload.
- Switches read layer 2 headers; routers read and rewrite layer 3 forwarding decisions.
- The receiving stack removes headers in reverse order and delivers the payload to the application.
Where You See It
- Packet captures, firewall rules, load balancer configuration, VPN design, and escalation notes.
Key Terms
- Frame
- A layer 2 unit addressed by MAC and carried on a local link.
- Packet
- A layer 3 unit addressed by IP and routed between networks.
- Segment
- A layer 4 TCP unit providing ports, ordering, and reliability.
- MTU
- Maximum transmission unit, the largest payload a link can carry.
- PDU
- Protocol data unit, the named data structure at a given layer.
Examples
- A switch forwards frames at layer 2, while a router makes forwarding decisions on layer 3 addresses.
- TLS operates above TCP, so a TLS failure with a completed handshake is not a routing problem.
Common Problems
- Layer 1 cabling faults
- VLAN or duplex mismatch at layer 2
- Wrong gateway at layer 3
- Blocked port at layer 4
- TLS or certificate errors above
How It Fails
- An MTU mismatch causes large transfers to hang while small requests succeed.
- A duplex mismatch produces slow throughput and rising error counters rather than a clean outage.
- A layer 7 proxy can return errors even when all lower layers are healthy.
How to Troubleshoot
- Prove the lowest layer first: link light, interface counters, and speed or duplex.
- Then verify addressing, routing, and reachability.
- Finally test the specific port and application response.
Practical Knowledge
- Record which layers you have proven working; it makes escalations short and credible.
- Interface error counters distinguish physical faults from configuration errors.
Exam Coverage
- OSI and TCP/IP layer functions
- Encapsulation and PDUs
- Layer-based troubleshooting
Interview Questions
- At which layer does a router operate and why does that matter?
- How do you prove a problem is not the network?
Watch and read
Verified official and reputable sources for this topic. Links open in a new tab.
Lesson notes and bookmark
Notes and bookmarks for this lesson, saved with everything else you have marked.
No notes on this item yet.
Learning progress
0% across six evidence areas. Reading alone does not change progress.
Prerequisites
Next steps
- 01Capture traffic with a packet analyser and identify headers layer by layer.
- 02Rewrite your last network ticket naming the layer proven working at each step.