Almost every networking exam question is secretly an OSI question. “Which device forwards based on MAC address?” is Layer 2. “The link is up but the application fails” is a Layer 4 to 7 problem. “A frame is built” is Layer 2 encapsulation. Once the model is automatic, a large share of CompTIA Network+ and Cisco CCNA questions can be answered by locating the layer first. This guide gives you the table to memorize, the logic behind it, a full encapsulation walk-through and a practical troubleshooting method.
What is the OSI model and why does it exist?
OSI stands for Open Systems Interconnection. The reference model was developed by the International Organization for Standardization (ISO) and published as ISO/IEC 7498-1, with an aligned ITU-T text known as X.200. Its purpose was to let equipment from different vendors interoperate by agreeing on responsibilities: what must be done, in what order, and where the boundary between jobs sits.
Two ideas matter for everything that follows. Layering: each layer provides a service to the layer above and uses the service of the layer below, and a layer on one host communicates logically with the same layer on the peer host. Encapsulation: each layer wraps the data from the layer above in its own header (and sometimes trailer), so the unit of data grows as it moves down the stack. The practical payoff is that you can swap Wi-Fi for Ethernet at Layer 2 without changing IP, or swap TCP for UDP at Layer 4 without changing the cable.
A point worth stating plainly: real networks run the TCP/IP suite, not OSI protocol stacks. OSI survives as the common vocabulary, which is exactly why it is tested.
What are the 7 layers at a glance?
Memorize this table. It answers the majority of layer-matching questions.
| # | Layer | PDU | Key job | Examples | Devices |
|---|---|---|---|---|---|
| 7 | Application | Data | Network services to the user's software | HTTP, DNS, SMTP, DHCP, SSH, SNMP, FTP | Proxy, WAF, layer 7 load balancer |
| 6 | Presentation | Data | Data formatting, encryption, compression | TLS (conventionally), ASCII, JPEG, MPEG | None specific |
| 5 | Session | Data | Set up, maintain and tear down dialogs | RPC, NetBIOS sessions, SQL sessions | None specific |
| 4 | Transport | Segment (TCP) / datagram (UDP) | End-to-end delivery, ports, reliability | TCP, UDP | Stateful firewall, layer 4 load balancer |
| 3 | Network | Packet | Logical addressing and routing between networks | IP, ICMP, OSPF, IPsec | Router, layer 3 switch |
| 2 | Data Link | Frame | Local delivery, MAC addressing, error detection | Ethernet (802.3), Wi-Fi (802.11), VLAN tagging (802.1Q), STP | Switch, bridge, wireless access point |
| 1 | Physical | Bits | Transmit raw bits over a medium | Copper, fiber, radio, connectors, voltage levels | Hub, repeater, cables, transceivers |
What does each layer do?
Layer 1: Physical
Moves raw bits across a medium as electrical signals, light pulses or radio waves. It defines connectors, pinouts, cable types, signaling and data rates. It has no concept of addresses or errors beyond the signal itself. Typical faults: bad cable, wrong cable type, unplugged connector, dirty fiber, no power, interference, exceeded cable length.
Layer 2: Data Link
Delivers frames between devices on the same local network. It uses 48-bit MAC addresses, detects corrupted frames with a frame check sequence, and controls access to the shared medium. Switches build a MAC address table by learning source addresses and forward frames by destination MAC. VLANs (see what is a VLAN), trunking (802.1Q) and Spanning Tree Protocol also live here. Typical faults: VLAN mismatch, duplex mismatch, port security violations, switching loops, MAC table issues.
Layer 3: Network
Moves packets between different networks using logical IP addresses (both IPv4 and IPv6; see IPv4 vs IPv6). Routers read the destination IP, consult the routing table and forward toward the next hop; routing protocols such as OSPF populate that table. ICMP (ping, traceroute error messages) is a Layer 3 companion. This is where subnetting happens. Typical faults: wrong subnet mask, wrong default gateway, duplicate IP, missing route, overlapping subnets.
Layer 4: Transport
Provides end-to-end communication between processes, identified by port numbers. TCP adds connections, sequencing, acknowledgement, retransmission and flow control; UDP offers lightweight, connectionless delivery. This layer is large enough that it has its own guide: TCP vs UDP. Typical faults: a firewall blocking a port, a service not listening, a retransmission storm, session table exhaustion.
Layer 5: Session
Establishes, maintains and ends dialogs between applications, including checkpointing and recovery in long exchanges. It is the layer exams ask about least and the one real protocol stacks implement least cleanly: most of its functions are handled inside applications or by the transport layer. Remember it by its verbs: establish, maintain, terminate a session. RPC and NetBIOS sessions are the usual examples.
Layer 6: Presentation
Translates between the application's data format and the network format: character encoding (ASCII, Unicode), serialization, compression and encryption. Exam answer keys put “encryption and decryption” and “data format translation” here. In practice TLS does not fit into one OSI layer, which is why a purely design-level question may differ from a certification answer key; follow the key on the exam.
Layer 7: Application
The layer closest to the user, and a frequent source of confusion: it is not the application program itself (a browser) but the network service the program uses (HTTP). DNS, DHCP, SMTP, SNMP, SSH and FTP are all Layer 7 protocols. Faults here include misconfigured services, bad credentials, DNS failures and certificate errors.
How do I remember the layers?
| Direction | Mnemonic | Layers |
|---|---|---|
| Layer 1 up to 7 | Please Do Not Throw Sausage Pizza Away | Physical, Data Link, Network, Transport, Session, Presentation, Application |
| Layer 7 down to 1 | All People Seem To Need Data Processing | Application, Presentation, Session, Transport, Network, Data Link, Physical |
| PDUs, top to bottom | Data, Segment, Packet, Frame, Bits | Layers 7 to 5, then 4, 3, 2, 1 |
A mnemonic gets you the order; anchor facts get you the points. Attach one device, one address and one PDU to each of the layers you will be asked about most: Layer 2 = switch, MAC, frame; Layer 3 = router, IP, packet; Layer 4 = firewall or load balancer, port, segment. Layers 5 and 6 you mostly need to recognize by function.
How does encapsulation work step by step?
Follow one web request from a PC to a server on another network. The PC opens https://example.com, and the data is wrapped at each layer on the way down.
Sending side, top to bottom
Layers 7 to 5, data: the browser produces an HTTP request, protected by TLS. This is just data to everything below.
Layer 4, segment: TCP adds a header with a random source port (for example 51234) and destination port 443, plus sequence and acknowledgement numbers.
Layer 3, packet: IP adds a header with the PC's source IP and the server's destination IP.
Layer 2, frame: Ethernet adds a header with source MAC and destination MAC, and a trailer with the FCS. The destination MAC is that of the default gateway, because the server is on another network; the PC finds it with ARP.
Layer 1, bits: the NIC converts the frame to signals on the cable or radio.
Now the part that trips people up. At each router the frame is received, the Layer 2 header and trailer are stripped, the router reads the destination IP at Layer 3, chooses a next hop, and builds a new frame with fresh MAC addresses for the next link. So MAC addresses change at every hop, while IP addresses stay the same end to end (barring NAT). The server then decapsulates in reverse order: it checks the FCS, strips the frame, confirms the destination IP, hands the segment to TCP, which delivers data to the process listening on port 443.
A sense of scale: a standard Ethernet frame carries up to 1,500 bytes of payload (the MTU). With a minimum 20-byte IP header and 20-byte TCP header, that leaves up to 1,460 bytes of application data per segment, which is the typical TCP maximum segment size on Ethernet.
OSI model vs TCP/IP model
The TCP/IP model describes the protocol suite the internet actually uses. Network+ and CCNA both refer to it, and textbooks differ on whether it has four layers (as in RFC 1122) or five. The mapping:
| OSI layer | TCP/IP (4-layer) | TCP/IP (5-layer) | Typical protocols |
|---|---|---|---|
| 7 Application, 6 Presentation, 5 Session | Application | Application | HTTP, DNS, DHCP, SMTP, SSH |
| 4 Transport | Transport | Transport | TCP, UDP |
| 3 Network | Internet | Network | IP, ICMP |
| 2 Data Link | Link (Network Access) | Data Link | Ethernet, Wi-Fi |
| 1 Physical | Link (Network Access) | Physical | Cables, radio |
Other differences worth knowing: OSI was a model first and protocols second, while TCP/IP grew from working protocols; OSI strictly separates Presentation and Session, while TCP/IP leaves those jobs to applications; and OSI's layers are cleanly defined where TCP/IP's are looser. When an exam asks “at which layer”, it nearly always means the OSI number, and when it says “Internet layer” it means TCP/IP.
Which devices work at which layer?
| Device | Layer | Forwards based on |
|---|---|---|
| Hub, repeater, media converter | 1 | Nothing; regenerates signals to all ports |
| Switch, bridge, wireless access point | 2 | Destination MAC address |
| Router | 3 | Destination IP address and routing table |
| Layer 3 (multilayer) switch | 2 and 3 | MAC within a VLAN, IP between VLANs |
| Stateful firewall | 3 and 4 | IP addresses, ports and connection state |
| Next-generation firewall, WAF, proxy | Up to 7 | Application content, users and signatures |
| Load balancer | 4 or 7 | Ports (layer 4) or URLs and headers (layer 7) |
| NIC | 1 and 2 | Its own MAC; converts frames to signals |
ARP is the classic ambiguous case. It resolves a Layer 3 address (IP) to a Layer 2 address (MAC), so sources place it at Layer 2, at Layer 3 or between them. If a question forces a choice, read for the verb: “maps IP addresses to MAC addresses” is address resolution that bridges both layers, and most practice banks accept Layer 2 or flag it as Layer 2/3.
How do I troubleshoot by layer?
Layered troubleshooting turns “the network is broken” into a short sequence of tests. Three common approaches: bottom-up (start at Layer 1, best when you suspect a physical or link fault), top-down (start at the application, best when only one application fails) and divide and conquer (start at Layer 3, where ping gives a fast verdict, then move up or down). The general CompTIA methodology wraps this: identify the problem, establish a theory, test it, plan and implement a fix, verify, and document.
| Layer | Symptom | Tools and checks |
|---|---|---|
| 1 Physical | No link light, intermittent link, CRC errors | Cable tester, swap cable or port, check transceivers, show interfaces counters |
| 2 Data Link | Link up but no local communication, wrong VLAN, flapping | show vlan brief, show mac address-table, arp -a, check duplex and trunks |
| 3 Network | Cannot reach other subnets, APIPA address, duplicate IP | ipconfig / ip addr, ping, tracert / traceroute, show ip route |
| 4 Transport | Ping works, service unreachable, connection refused or timing out | netstat -an, test the port, review firewall and ACL rules, capture traffic |
| 5 to 7 | Name lookup fails, login or certificate errors, wrong content | nslookup / dig, curl, application and server logs, time sync |
The classic reasoning chain: if you can ping the server by IP, Layers 1 to 3 are working end to end. If the name fails, suspect DNS at Layer 7. If the IP works but the port does not, suspect Layer 4: a firewall rule or a service that is not listening. Use the evidence from each test to eliminate whole layers at once, rather than guessing.
How do Network+ and CCNA test the OSI model?
CompTIA Network+ N10-009 begins Domain 1 (Networking Concepts) with OSI-model concepts. Expect questions that give a protocol, device or PDU and ask for the layer, scenarios where you identify the failing layer from symptoms, and cross-topic items such as which layer a VLAN, an ACL or a load balancer operates at. The Network+ cheat sheet condenses the table above next to the port list, and the exam guide shows how Domain 1 fits the whole blueprint.
Cisco CCNA 200-301 is less likely to ask for a pure OSI recitation and more likely to use the vocabulary inside larger questions: a switch forwarding decision at Layer 2, a router lookup at Layer 3, a TCP versus UDP comparison at Layer 4, encapsulation of a frame as it crosses a router, or a troubleshooting item where you localize a fault. It leans on the TCP/IP model for protocol discussion. See the CCNA cheat sheet and the CCNA exam guide, and compare the two paths in Network+ vs CCNA.
What are the common exam traps?
- Mixing MAC and IP behavior across hops. MAC addresses are rewritten at every router; source and destination IP stay constant unless NAT is involved.
- Treating the browser as the Application layer. Layer 7 is the network service (HTTP, DNS), not the software program.
- Calling every PDU a packet. Use segment for TCP, datagram for UDP, packet for IP, frame for Layer 2 and bits for Layer 1.
- Hub versus switch. A hub is Layer 1 and repeats to all ports; a switch is Layer 2 and forwards by MAC address.
- “Layer 3 switch” confusion. It switches at Layer 2 and routes at Layer 3; it is not just a router with more ports.
- Counting layers differently. If an option says “Internet layer”, it is the TCP/IP model; if it gives a number, it is OSI.
- Assuming a working ping proves the application works. Ping (ICMP) proves Layer 3 reachability only.
- Direction of encapsulation. Encapsulation goes down on the sender, decapsulation up on the receiver. Do not reverse them.
- Where routing protocols sit. OSPF runs directly over IP and is classed as Layer 3; BGP runs over TCP and is often described as Layer 7 or Layer 4 depending on the source.
OSI model practice questions with answers
Answer before opening each one. For timed, exam-style practice, use the Network+ practice exam or the CCNA practice exam.
1. At which OSI layer does a router make its forwarding decision, and on what address?
Layer 3 (Network), using the destination IP address. A switch decides at Layer 2 using the destination MAC address.
2. What is the PDU at Layer 2, and what does it add to the packet it carries?
A frame. The Data Link layer adds a header with source and destination MAC addresses and a trailer with a frame check sequence (FCS) used to detect corruption.
3. A user reports that the link light on the PC network card is off. Which layer do you check first?
Layer 1 (Physical): cable, connector, port, transceiver or power. Nothing above Layer 1 can work if there is no link, so bottom-up troubleshooting starts here.
4. A host can ping its default gateway and a server by IP address, but the browser cannot open the server by name. Which layer is the most likely problem?
Layer 7 (Application), specifically name resolution: DNS. Layers 1 to 3 are proven by the successful pings. Check the DNS server settings and test with nslookup or dig.
5. Which OSI layer is responsible for encryption, compression and translating data formats according to most exam answer keys?
Layer 6 (Presentation). Layer 5 manages sessions (setup, maintenance and teardown of dialogs), and Layer 7 provides the interface applications use.
6. Which OSI layers does the TCP/IP Application layer correspond to?
Layers 5, 6 and 7 (Session, Presentation and Application). TCP/IP folds all three into a single Application layer.
7. Put these in the order they are created as data is sent: frame, segment, bits, packet.
Segment (Layer 4), then packet (Layer 3), then frame (Layer 2), then bits (Layer 1). Encapsulation proceeds down the stack, wrapping the data from the layer above with a new header.
8. Two hosts on the same VLAN both end up with the same IP address and keep losing connectivity. At which layer is the fault?
Layer 3. IP addressing belongs to the Network layer, and duplicate addresses cause conflicting ARP replies. The switch at Layer 2 is behaving correctly; the addressing plan or DHCP scope is not.
Frequently asked questions
What are the 7 layers of the OSI model?
From top to bottom: 7 Application, 6 Presentation, 5 Session, 4 Transport, 3 Network, 2 Data Link and 1 Physical. Data is encapsulated moving down the layers on the sender and decapsulated moving up on the receiver. The PDUs are data (layers 5 to 7), segment or datagram (4), packet (3), frame (2) and bits (1).
What is the easiest way to remember the OSI layers?
Use a mnemonic. From layer 1 up: "Please Do Not Throw Sausage Pizza Away" (Physical, Data Link, Network, Transport, Session, Presentation, Application). From layer 7 down: "All People Seem To Need Data Processing". Pair the mnemonic with an anchor fact for each layer, such as "layer 3 is IP and routers" and "layer 2 is MAC addresses and switches".
Is the OSI model actually used, or only for exams?
Real networks run on the TCP/IP protocol suite, not on OSI protocols. The OSI model survives as a shared vocabulary: engineers say "layer 2 problem", "layer 3 switch" or "layer 7 load balancer" every day, and troubleshooting by layer is a standard method. That makes it useful beyond exams, but it is a reference model, not a literal description of how stacks are built.
What is the difference between the OSI model and the TCP/IP model?
OSI has seven layers and was designed as a general reference model. TCP/IP has four (Application, Transport, Internet, Link), or five in many textbooks that split Link into Data Link and Physical. TCP/IP merges OSI layers 5 to 7 into one Application layer and merges layers 1 and 2 into Link. The middle layers line up: OSI 4 is TCP/IP Transport, OSI 3 is TCP/IP Internet.
At which OSI layer do routers, switches and hubs operate?
Routers operate at Layer 3 (Network) and forward by IP address. Traditional switches operate at Layer 2 (Data Link) and forward by MAC address, while multilayer or Layer 3 switches also route. Hubs and repeaters operate at Layer 1 (Physical) and simply regenerate electrical signals without reading addresses.
Which layer does TLS or encryption belong to?
Exam answer keys usually place encryption, compression and data formatting at Layer 6 (Presentation). In real stacks TLS sits between the application and the transport layer and does not map neatly onto one OSI layer. When a certification question asks about encryption or translation of data formats at the presentation layer, answer Layer 6; for a real design discussion, treat TLS as spanning layers 5 to 6.
How do Network+ and CCNA test the OSI model?
Network+ N10-009 starts Domain 1 with OSI concepts and expects you to match protocols, devices and PDUs to layers and to use the layers to troubleshoot. CCNA 200-301 uses the same vocabulary and the TCP/IP model throughout, and expects you to reason about encapsulation, switching versus routing and where each protocol operates.
Sources and further reading
- ITU-T Recommendation X.200: Open Systems Interconnection basic reference model (aligned with ISO/IEC 7498-1)
- RFC 1122: Requirements for Internet Hosts, Communication Layers (the TCP/IP layering)
- RFC 826: An Ethernet Address Resolution Protocol
- CompTIA Network+ certification page
- Cisco Learning Network: CCNA 200-301 exam topics
Put the layers to work
30 free questions per session on Network+ and CCNA, no signup and no credit card. The full 500-question bank is $11.99 lifetime per certification, or $9.99/month Pro unlocks every CertSharp certification.