OSI vs TCP/IP Model
OSI has 7 layers, TCP/IP has 4. Both describe encapsulation. Built a real Ethernet+IPv4+TCP frame in Python: 37 bytes of data became a 91-byte frame, and small packets are mostly header.
The OSI model splits networking into seven layers (Physical, Data Link, Network, Transport, Session, Presentation, Application), while the TCP/IP model has four (Link, Internet, Transport, Application). Both describe encapsulation, where each layer wraps data from above in its own header. Interviewers expect the device mapping: switches work at layer 2 with MAC addresses, routers at layer 3 with IP addresses.
The OSI model splits networking into seven layers and the TCP/IP model into four, but they describe the same thing: each layer wraps the data from the layer above in its own header. OSI is the vocabulary used in textbooks and interviews, TCP/IP is what the internet actually runs.
- The OSI model has seven layers: Physical, Data Link, Network, Transport, Session, Presentation and Application, numbered 1 to 7 from the bottom.
- The TCP/IP model has four layers, merging Session, Presentation and Application into Application, and Data Link and Physical into Link.
- A hand-built frame turned a 37-byte HTTP request into a 91-byte frame by adding a 20-byte TCP header, a 20-byte IPv4 header and a 14-byte Ethernet header.
- The minimum header overhead for TCP over IPv4 over Ethernet is 20 + 20 + 14 = 54 bytes, so headers are 98.2% of a frame carrying a 1-byte payload and 3.6% at 1,460 bytes.
- A switch forwards frames by MAC address at OSI layer 2, a router forwards packets by IP address at layer 3, and a hub repeats bits at layer 1.
01Two models, one job
Sending a web request across the world involves electrical signals, addressing, routing, reliable delivery and an application protocol. Nobody designs that as one block. Networks are built in layers, where each layer offers a service to the one above and uses the one below. HTTP does not care whether the bits travel over Wi-Fi or fibre, and Ethernet does not care that the payload is HTTP.
Two models describe the layering. OSI (Open Systems Interconnection) was drawn up by ISO as a reference with seven layers. The TCP/IP model came out of the protocols already in use on the internet and has four. Interviews ask for both because OSI gives you names for the problems and TCP/IP matches reality.
02The seven OSI layers
From the bottom up:
- Physical: bits as voltage, light or radio. Cables, hubs, Wi-Fi radio.
- Data Link: frames between two devices on the same link, with MAC addresses. Ethernet, Wi-Fi, switches.
- Network: packets across networks with IP addresses, and routing. IP, routers.
- Transport: process-to-process delivery with ports. TCP for reliable ordered streams, UDP for datagrams.
- Session: opening, keeping and closing a dialogue between applications.
- Presentation: data formats, encryption, compression.
- Application: protocols the user-facing software speaks. HTTP, DNS, SMTP.
The mnemonic Please Do Not Throw Sausage Pizza Away gives layers 1 to 7 by initial letters. Layers 5 and 6 are where OSI and reality part ways: in practice nothing on the internet implements a separate session or presentation layer. TLS encryption is the usual example people argue about, since it could sit at 5, 6 or just above transport. I would say so in an interview rather than pretend there is an agreed answer.
03The four TCP/IP layers and how they map
The TCP/IP model has Link, Internet, Transport and Application. The mapping to OSI:
OSI TCP/IP
7 Application \
6 Presentation >--------- Application (HTTP, DNS, SMTP)
5 Session /
4 Transport ------------ Transport (TCP, UDP)
3 Network ------------ Internet (IP, ICMP)
2 Data Link \
1 Physical /---------- Link (Ethernet, Wi-Fi)The Internet layer name comes from the job of joining separate networks, which is what IP does. The host requirements standard, RFC 1122, describes the same four-layer structure for hosts. Some textbooks split Link back into Data Link and Physical to get a five-layer model; if a question says "five-layer", that is what it means.
04Encapsulation: build a real frame
Encapsulation means each layer treats whatever it receives from above as an opaque payload and prepends its own header. To check that I understood the sizes, I built a frame by hand with Python's struct module: an HTTP request, a 20-byte TCP header with no options, a 20-byte IPv4 header with a computed checksum, and a 14-byte Ethernet header.
import struct, socket
def ip_checksum(hdr):
s = sum(struct.unpack("!%dH" % (len(hdr) // 2), hdr))
while s >> 16:
s = (s & 0xFFFF) + (s >> 16)
return ~s & 0xFFFF
payload = b"GET / HTTP/1.1\r\nHost: example.com\r\n\r\n" # layer 7 data
# Layer 4: TCP header, 20 bytes (no options). Checksum left 0 here for brevity.
tcp = struct.pack("!HHIIBBHHH", 51512, 80, 1000, 0, 5 << 4, 0x18, 65535, 0, 0)
# Layer 3: IPv4 header, 20 bytes
total_len = 20 + len(tcp) + len(payload)
ip = struct.pack("!BBHHHBBH4s4s", 0x45, 0, total_len, 0x1234, 0x4000, 64, 6, 0,
socket.inet_aton("192.168.1.10"), socket.inet_aton("93.184.216.34"))
ip = ip[:10] + struct.pack("!H", ip_checksum(ip)) + ip[12:]
# Layer 2: Ethernet header, 14 bytes
eth = bytes.fromhex("aabbccddeeff") + bytes.fromhex("112233445566") + struct.pack("!H", 0x0800)
frame = eth + ip + tcp + payload
print("payload bytes :", len(payload))
print("TCP header :", len(tcp))
print("IPv4 header :", len(ip))
print("Ethernet hdr :", len(eth))
print("frame total :", len(frame), "(+4 byte FCS added by the NIC)")
print("IP checksum re-verifies to 0:", ip_checksum(ip) == 0)
# Peel it back: each layer reads only its own header
et = struct.unpack("!6s6sH", frame[:14])
print("ethertype :", hex(et[2]))
ihl = (frame[14] & 0xF) * 4
proto = frame[14 + 9]
print("IP protocol :", proto, "(6 = TCP)")
sport, dport = struct.unpack("!HH", frame[14 + ihl: 14 + ihl + 4])
print("ports :", sport, "->", dport)
for size in (1, 100, 1460):
print(f"payload {size:5d} B -> overhead {54/(54+size):.1%} of frame")Output:
payload bytes : 37
TCP header : 20
IPv4 header : 20
Ethernet hdr : 14
frame total : 91 (+4 byte FCS added by the NIC)
IP checksum re-verifies to 0: True
ethertype : 0x800
IP protocol : 6 (6 = TCP)
ports : 51512 -> 80
payload 1 B -> overhead 98.2% of frame
payload 100 B -> overhead 35.1% of frame
payload 1460 B -> overhead 3.6% of frameThe parsing half shows the layering working: the Ethernet header's type field 0x0800 says the next header is IPv4, the IP protocol field 6 says the next is TCP, and the TCP header carries the ports. On the receiving side each layer reads its own header, strips it and hands the rest upward. The TCP checksum is left at zero in this demo, so this is a teaching frame, not one a real network would accept. The three overhead lines are why tiny packets are wasteful and why protocols batch small writes.
05Which device or protocol lives where
Interviewers often ask where a device sits. A hub repeats bits at layer 1. A switch reads the destination MAC address in the frame and forwards it out the right port, which is layer 2. A router reads the destination IP address and picks the next hop, which is layer 3. A firewall that filters by port is working at layer 4; one that inspects HTTP is at layer 7. Load balancers are described as L4 or L7 for exactly this reason: an L4 balancer decides from addresses and ports, while an L7 balancer reads the request.
Protocols follow the same idea. ARP and Ethernet at 2, IP and ICMP at 3, TCP and UDP at 4, HTTP, DNS and SMTP at 7. Some protocols, like ARP, straddle two layers and no table gets every case right, so give the reasoning rather than a memorised label.
06Common interview questions
Q: Name the OSI layers.
A: Physical, Data Link, Network, Transport, Session, Presentation, Application, from the bottom.
Q: How does the TCP/IP model differ from OSI?
A: It has four layers, merging Session, Presentation and Application into one, and Data Link and Physical into Link. It describes protocols that exist; OSI is a reference model.
Q: At which layer do routers and switches work?
A: Routers at the Network layer (3) using IP addresses, switches at the Data Link layer (2) using MAC addresses.
Q: What is encapsulation?
A: Each layer wraps the data from the layer above in its own header, so application data becomes a segment, then a packet, then a frame.
Q: What is the minimum header overhead for TCP over IPv4 over Ethernet?
A: 20 + 20 + 14 = 54 bytes, plus a 4-byte frame check sequence at the end of the frame.
Q: Where does TLS fit?
A: Debated. It runs above TCP and below the application protocol, so it is described as layers 5 or 6 in OSI terms and sits inside the Application layer in TCP/IP.