Network Models & Layers

OSI 7-Layer Model

The OSI (Open Systems Interconnection) model is a conceptual framework that standardizes network communication into seven distinct layers. Each layer has a specific responsibility and communicates only with the layers directly above and below it.

TCP/IP Model

The TCP/IP model is the practical, four-layer model that the Internet actually uses. It collapses the OSI's top three layers into one Application layer and merges Physical + Data Link into a single Link layer.

Data Encapsulation

As data moves down the stack, each layer wraps it with its own header (and sometimes trailer), creating a new Protocol Data Unit (PDU). The receiving side strips headers in reverse order — this is decapsulation.

What Each Header Contains

Data Link Layer

Layer 2 handles communication within a single network segment (LAN). It uses MAC addresses — 48-bit hardware addresses burned into NICs — to identify devices on the same link.

Ethernet Frames

An Ethernet II frame contains: Preamble (8B) | Dest MAC (6B) | Src MAC (6B) | EtherType (2B) | Payload (46-1500B) | FCS (4B). The EtherType field indicates the upper-layer protocol (0x0800 = IPv4, 0x86DD = IPv6).

ARP — Address Resolution Protocol

ARP maps a known IP address to a MAC address on the local network. A host broadcasts "Who has 192.168.1.1?" and the owner replies with its MAC. Results are cached in an ARP table to avoid repeated broadcasts.

Switches

Layer 2 switches learn MAC addresses by inspecting the source MAC of incoming frames, building a MAC address table. They then forward frames only to the correct port, unlike hubs which flood every port. This dramatically reduces collision domains.

Network Layer — IP & ICMP

Layer 3 provides logical addressing and routing between networks. IP addresses are hierarchical, enabling aggregation of routes and efficient forwarding.

IPv4

IPv4 addresses are 32-bit, written in dotted-decimal notation (e.g. 192.168.1.0/24). Subnetting divides a network into smaller blocks using a subnet mask. CIDR (Classless Inter-Domain Routing) replaced the old class-based system, allowing arbitrary prefix lengths like /22 or /27.

# Subnetting example
Network:   10.0.0.0/16       → 65,536 addresses
Subnet A:  10.0.0.0/24       → 256 addresses (10.0.0.0 - 10.0.0.255)
Subnet B:  10.0.1.0/24       → 256 addresses (10.0.1.0 - 10.0.1.255)

# Host bits = 32 - prefix_length
/24 → 8 host bits → 2^8 = 256 addresses (254 usable)

IPv6

IPv6 uses 128-bit addresses written in hexadecimal (e.g. 2001:db8::1). It eliminates the need for NAT, has a simplified header, mandatory IPsec support, and built-in autoconfiguration (SLAAC). Adoption is growing but IPv4 remains dominant via NAT.

ICMP

Internet Control Message Protocol is used for diagnostics and error reporting. ping sends ICMP Echo Request/Reply to test reachability. traceroute uses incrementing TTL values — each router that decrements TTL to 0 sends back an ICMP Time Exceeded message, revealing the path.

Routing & Routing Protocols

Routers forward packets between networks by consulting a routing table. Each entry maps a destination prefix to a next-hop address and outgoing interface. When multiple entries match, the router uses longest prefix match — the most specific route wins.

# Example routing table
Destination        Next Hop        Interface    Metric
10.0.0.0/8         192.168.1.1     eth0         10
10.0.1.0/24        192.168.1.5     eth1         5      ← more specific, wins for 10.0.1.x
0.0.0.0/0          192.168.1.1     eth0         1      ← default route (gateway of last resort)

BGP — Border Gateway Protocol

BGP is the routing protocol of the Internet. It operates between Autonomous Systems (AS) — large networks owned by ISPs, cloud providers, or enterprises, each identified by an AS Number (ASN).

OSPF — Open Shortest Path First

OSPF is a link-state Interior Gateway Protocol (IGP) used within a single AS. Every router builds a complete topology map (Link-State Database) and runs Dijkstra's algorithm to compute shortest paths. OSPF converges faster than distance-vector protocols and supports hierarchical design with areas (Area 0 is the backbone).

Transport Layer — TCP vs UDP

Layer 4 provides end-to-end communication between processes on different hosts. It uses port numbers (0-65535) to multiplex multiple connections over a single IP address. A socket is identified by the tuple: (src IP, src port, dst IP, dst port, protocol).

Port Multiplexing

Ports allow a single host to run many services simultaneously. Well-known ports (0-1023) are reserved for standard services: 80 (HTTP), 443 (HTTPS), 22 (SSH), 53 (DNS). Ephemeral ports (49152-65535) are assigned dynamically to client-side connections by the OS.