Networking
OSI vs. TCP/IP Model
Every topic in this domain — Ethernet, IP, TCP, UDP, and everything built on top — is organized around a 4-layer model. You may have also heard of a 7-layer model (OSI). Both are real, both are still used, and they describe the same stack of technology at different levels of detail. This page exists to connect them, and to clear up the single most common point of confusion in networking: what "TCP/IP" actually refers to.
- What it is
- Two different ways of naming the same layered stack — OSI (7 layers, a teaching/reference model) and TCP/IP (4 layers, what's actually implemented).
- Mental model
- OSI is a detailed textbook diagram of a car engine; TCP/IP is the four things you actually interact with as a driver — both describe the same engine.
- Key numbers
- OSI: 7 layers. TCP/IP: 4 layers (sometimes shown as 5, splitting Link into Data Link + Physical).
- Reach for it when
- You hear "Layer 3" or "Layer 7" in a job description, firewall setting, or load balancer doc and need to know what that number means.
Why there are two models
The OSI model (Open Systems Interconnection) was designed in the late 1970s as a vendor-neutral, complete reference for how networking could be layered — seven distinct responsibilities, each strictly separated. It was never fully implemented as designed.
The TCP/IP model is not a competing theory — it's a description of the stack that actually won and became the internet, developed and deployed before OSI was finished. It compresses several of OSI's layers together because, in practice, one piece of software (or one protocol) often does what OSI splits into two or three separate layers.
Every page in this Networking domain — the diagram on the domain landing page included — uses the 4-layer TCP/IP model, because it matches what you'll actually find implemented on real hardware. OSI still matters because its vocabulary ("Layer 2 switch," "Layer 7 firewall," "Layer 4 load balancer") is everywhere in networking, security, and infrastructure job descriptions and tooling — so it's worth knowing even though nothing on the wire literally has 7 separate headers.
The OSI model — 7 layers
Read bottom to top — each layer is numbered, and the number is what people mean by "Layer 3" or "Layer 7":
- 7 — Application
- What the user-facing software actually does — HTTP, MQTT, DNS. The only layer a typical app developer writes code against directly.
- 6 — Presentation
- Data format/translation — encoding, compression, encryption formatting. In practice, this responsibility is usually folded into the application protocol itself (e.g. TLS, JSON encoding) rather than existing as a separate layer.
- 5 — Session
- Establishing, managing, and tearing down a logical conversation between two applications. Also usually folded into the application or transport layer in real implementations (a TCP connection largely does this job).
- 4 — Transport
- End-to-end delivery between two programs — TCP and UDP live here.
- 3 — Network
- Addressing and routing across multiple networks — IP lives here.
- 2 — Data Link
- Framing and addressing on one local link — Ethernet's MAC addressing lives here.
- 1 — Physical
- The actual electrical signals, radio waves, or light pulses on the medium — voltage levels on a cable, the radio signal of Wi-Fi.
The TCP/IP model — 4 layers
This is the model this entire domain is organized around. It merges OSI's top three layers (Application, Presentation, Session) into one, and its bottom two (Data Link, Physical) into one — because in real systems, no protocol cleanly draws those extra lines.
- Application
- HTTP, HTTPS/TLS, DNS, MQTT, CoAP, AMQP, SSH, FTP, SMTP — every protocol built for one specific job, on top of a transport.
- Transport
- TCP and UDP — port numbers, and (for TCP only) reliability.
- Internet (Network)
- IP — addressing and routing across networks.
- Link
- Ethernet or Wi-Fi — local, one-hop delivery and the physical signal itself.
How they map onto each other
Why it's called "TCP/IP" — and why that doesn't exclude UDP
This is the single most common mix-up in networking, and it's an entirely reasonable one: the name "TCP/IP" makes it sound like the model is specifically about TCP paired with IP, as if UDP were something separate, off to the side.
It isn't. "TCP/IP" is simply the name of the whole protocol suite, coined because TCP and IP were the first two protocols standardized as part of it, back in the 1970s — the same way a company might get named after its first product and keep that name long after shipping a dozen more. UDP is just as much a "TCP/IP" protocol as TCP is — it sits at the exact same Transport layer, built on the exact same IP layer underneath. Neither one is "the real" transport protocol with the other bolted on; they're two different, equally first-class answers to the same transport-layer question, covered side by side in TCP vs. UDP.
A useful way to say it precisely: IP is the one constant every protocol here is built on. TCP and UDP are the two choices for what to build on top of IP — not "TCP is IP's partner and UDP is the odd one out."
Real-world applications
- "Layer 4 load balancer" vs. "Layer 7 load balancer" — an L4 balancer only looks at IP/port information (Transport layer and below) to route traffic; an L7 balancer reads the actual HTTP request (Application layer) to make smarter routing decisions.
- "Layer 2 switch" vs. "Layer 3 switch" — a plain switch forwards by MAC address only (Data Link); a "Layer 3 switch" also makes IP routing decisions (Network), blurring the line with a router.
- Firewall rules — "stateless packet filtering" typically operates at Layer 3/4 (IP address, port), while a "next-gen" or "application-aware" firewall inspects Layer 7 (the actual HTTP/DNS/etc. content).
- Network troubleshooting language — "it's a Layer 1 problem" (a bad cable) vs. "it's a Layer 3 problem" (routing) vs. "it's a Layer 7 problem" (the application itself) is how network engineers narrow down where in the stack a fault actually lives.
Gotchas
- OSI's Presentation and Session layers are frequently taught as if they map to real, separate protocols — in practice, almost nothing implements them as distinct layers; their jobs are absorbed into the application protocol (TLS handles what Presentation was meant to do) or the transport (a TCP connection largely does what Session was meant to do).
- "TCP/IP" is sometimes used loosely to mean "the internet" or "networking in general," not literally the two protocols — context usually makes clear which meaning is intended.
- A 5-layer variant of the TCP/IP model exists too (splitting Link into separate Data Link and Physical layers) — you'll see both 4-layer and 5-layer versions in different textbooks; this domain uses 4, matching OSI's Link-layer collapse.