OSI and TCP/IP models - what each layer is for · Linux

The OSI and TCP/IP models are conceptual frameworks for thinking about network communication. They are not implemented as such by Linux - the kernel’s networking stack is a single integrated piece - but the layered view is essential for diagnosing problems.

The seven OSI layers

#	Layer	What it does	Examples
7	Application	User-facing protocols	HTTP, DNS, SSH, SMTP
6	Presentation	Encoding, encryption, compression	TLS, ASCII, JPEG
5	Session	Dialog control, checkpoints	NetBIOS, RPC
4	Transport	End-to-end delivery, ports, ordering	TCP, UDP
3	Network	Logical addressing and routing	IPv4, IPv6, ICMP
2	Data Link	Framing, MAC addressing	Ethernet, Wi-Fi, ARP
1	Physical	Bits on a wire	Cables, optical, radio

Layer 5 (Session) is rarely invoked in modern sysadmin work; its concerns are usually handled inside the application protocol. Layers 6 and 7 are often discussed together.

The four TCP/IP layers

The TCP/IP model (the model the internet actually uses) collapses OSI to four layers:

TCP/IP layer	OSI layers	What it does
Application	5, 6, 7	Protocols an application talks to (HTTP, DNS, TLS)
Transport	4	TCP, UDP
Internet	3	IP, ICMP
Link	1, 2	Ethernet, ARP, Wi-Fi

When a Linux sysadmin says “transport layer”, they mean TCP/UDP. When they say “layer 3”, they mean IP. “Layer 2” means Ethernet and ARP.

How Linux maps to the model

The kernel has one integrated stack. The pieces that correspond to each layer:

Application: socket file descriptors in userspace, protocol libraries (OpenSSL, glibc getaddrinfo).
Transport: TCP and UDP implementations in the kernel; ss and /proc/net/tcp expose them.
Internet: IPv4 and IPv6 stacks; ip route, ip addr, /proc/net/route.
Link: NIC drivers, ARP and neighbour subsystem; ip link, ip neigh, arp.

Layer-by-layer diagnosis

When a service is unreachable, walk down the layers in order:

Application: is the service listening? (ss -ltn)
Transport:   can I reach the port? (nc -vz, telnet)
Internet:    can I route to the host? (ip route get, ping)
Link:        is the interface up? (ip link, ethtool)
Physical:    is the link light on? (ip link, switch port LED)

Each layer has its own set of tools and its own failure modes. A DNS failure is layer 7. A wrong subnet mask is layer 3. A cable unplugged is layer 1.