The OSI Model Explained: One Web Request Through All 7 Layers (Network+)

ReferenceNovember 1, 2026

ExplainerLevel beginnerTime ~20 minTool ip, curl, tcpdumpCost freeExam N+ 1 · also 5

What you’ll know

The seven OSI layers, what each one does, which devices and protocols live there, how it lines up with the four-layer TCP/IP model, and how to see every layer for yourself in one real web request.

Why it matters. The OSI model is how network people point at a problem: “it’s a layer 2 issue” means switches and MAC addresses, “layer 7” means the application. Network+ asks about it directly, and the troubleshooting questions assume you think in layers, bottom up.

The seven layers, bottom to top

#	Layer	Its job	Things that live here
1	Physical	Bits as signals: voltage, light, radio	Cables, connectors, Wi-Fi radio, hubs, repeaters
2	Data link	Frames between neighbors on the same network, addressed by MAC address	Switches, bridges, Ethernet, 802.11 Wi-Fi frames, ARP, VLAN tags
3	Network	Packets between networks, addressed by IP address	Routers, IPv4, IPv6, ICMP (ping)
4	Transport	Delivery between programs, by port number	TCP (reliable, handshake), UDP (fast, no handshake)
5	Session	Opening, keeping and closing a conversation	Session setup and teardown (often handled inside the app or TLS today)
6	Presentation	Data format, encryption, compression	TLS encryption, character encoding, JPEG, compression
7	Application	The protocol the program speaks	HTTP/HTTPS, DNS, SMTP, SSH, DHCP

Memory trick, top to bottom: All People Seem To Need Data Processing (Application, Presentation, Session, Transport, Network, Data link, Physical). Bottom to top: Please Do Not Throw Sausage Pizza Away.

Next to the TCP/IP model

TCP/IP layer	Covers OSI layers
Application	7, 6 and 5
Transport	4
Internet	3
Network access (link)	2 and 1

Real networks run TCP/IP; OSI is the vocabulary everyone uses to talk about it. The exam uses both.

Layer 8 is the user. It’s not on the exam, but it’s on every help desk ticket. — Nyx

Try it: one web request, layer by layer

Open Ubuntu (WSL) or any Linux terminal. Your interface name and addresses will differ from ours.

Layers 1 and 2: is the link up, and what’s my MAC?

$ ip -br link show eth0
 eth0             UP             00:15:5d:98:b0:6f <BROADCAST,MULTICAST,UP,LOWER_UP>

LOWER_UP means the physical link is up (layer 1). The 00:15:5d:… value is this card’s MAC address (layer 2).

Layer 3: my IP address and the route out

$ ip -br addr show eth0
 eth0             UP             172.19.53.155/20 fe80::215:5dff:fe98:b06f/64
$ ip route get 1.1.1.1
 1.1.1.1 via 172.19.48.1 dev eth0 src 172.19.53.155

Packets for the internet go via the default gateway, 172.19.48.1. That is a layer 3 decision.

Layer 2 again: how the gateway’s IP becomes a MAC (ARP)

$ ping -c1 172.19.48.1 > /dev/null; ip neigh show 172.19.48.1
 172.19.48.1 dev eth0 lladdr 00:15:5d:c9:b4:5a DELAY

ARP found the gateway’s MAC address. Every frame to the internet is actually addressed to this MAC, while the IP inside it is the far-away server’s.

Layer 7 helper: DNS turns the name into an address

$ getent ahostsv4 example.com | head -1
 104.20.23.154   STREAM example.com

DNS is an application-layer protocol. Big sites return several addresses, so yours may differ.

Layers 4 to 7: watch the connection (two terminals)

$ sudo tcpdump -ni eth0 -c 4 tcp port 443
 IP 172.19.53.155.35994 > 172.66.147.243.443: Flags [S], ...
 IP 172.66.147.243.443 > 172.19.53.155.35994: Flags [S.], ...
 IP 172.19.53.155.35994 > 172.66.147.243.443: Flags [.], ...
 IP 172.19.53.155.35994 > 172.66.147.243.443: Flags [P.], ... length 517
$ curl -sv -o /dev/null https://example.com 2>&1 | grep -E "Connected|SSL connection|GET|HTTP/2"
 * Connected to example.com (172.66.147.243) port 443
 * SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519 / id-ecPublicKey
 > GET / HTTP/2
 < HTTP/2 200

Start tcpdump in one terminal, run curl in the other. [S], [S.], [.] is the TCP three-way handshake to port 443 (layer 4). The 517-byte packet is the TLS hello, and the TLS line is the encryption (layer 6). GET and HTTP/2 200 are the application talking (layer 7).

Troubleshoot bottom up

No LOWER_UP, or the Wi-Fi isn’t connected: layer 1. Check the cable, port or radio.
No IP address, or a 169.254.x.x one: DHCP didn’t answer (see DHCP explained).
Can ping the gateway but not the internet: layer 3 (routing) or further out.
Ping works but the site won’t load: DNS, a firewall on the port (layer 4) or the application itself.

Where this fits

This is part of the free Network+ roadmap: every hands-on networking lesson on StashGrid, in order, tagged by exam domain.

NextSpanning tree: stop switch loops→

Go deeper

TCP and UDP handshake lab — layer 4 in depth
ARP lab — layer 2 address resolution
What happens when you type a URL — the same request as a story

Explainer, written by StashGrid with AI help and checked against the CompTIA Network+ (N10-009) exam objectives before publishing. Every command was run in Ubuntu 24.04 (WSL2) and Windows 11 on 1 Nov 2026, and the output shown is what we got. StashGrid isn’t affiliated with CompTIA. Spotted an error? Tell us.