What Is the OSI Model?
The OSI (Open Systems Interconnection) model breaks networking into seven layers, giving engineers a shared language for describing exactly where something happens. It is more of a teaching and troubleshooting framework than the stack the internet literally runs — that is TCP/IP — but “that’s a layer 7 problem” is a sentence security people say for a reason.
What are the seven layers?#
| # | Layer | Concerned with | Security example |
|---|---|---|---|
| 7 | Application | User-facing protocols | WAF, app exploits |
| 6 | Presentation | Encoding, encryption | TLS |
| 5 | Session | Connection management | Session hijacking |
| 4 | Transport | TCP/UDP delivery | SYN flood |
| 3 | Network | IP, routing | IP spoofing |
| 2 | Data Link | MAC, switching | ARP spoofing |
| 1 | Physical | Cables, signals | Wiretaps, jamming |
A common mnemonic bottom-to-top: “Please Do Not Throw Sausage Pizza Away.”
Why does the layered model matter?#
Because it makes attacks and defenses locatable. Saying an attack is “layer 3” versus “layer 7” immediately narrows what it can do and what stops it. It also clarifies otherwise-confusing terms — a “layer 7 DDoS” attacks the application, while a “layer 3/4 DDoS” floods the network, and the two need different mitigations.
The OSI model is the reference frame for this cluster. Continue at the Network Security hub.
Frequently asked questions#
What are the seven OSI layers?
From bottom to top: Physical (cables, signals), Data Link (MAC, switches), Network (IP, routing), Transport (TCP/UDP), Session (connections), Presentation (encoding, encryption), and Application (user-facing protocols). A common mnemonic is "Please Do Not Throw Sausage Pizza Away."
How does the OSI model differ from TCP/IP?
The OSI model is a seven-layer conceptual reference; the TCP/IP model is a four-layer practical model that the internet actually runs on. OSI is more granular and used for teaching and troubleshooting, while TCP/IP describes the real protocol stack. They map onto each other closely.