Skip to content

OSI vs TCP/IP Model#

The OSI model is a 7-layer reference that gives every network task a clear home. The TCP/IP model is the 4-layer stack the real internet runs on. Interviewers ask about both because the vocabulary (layer 4, layer 7) comes from OSI, while the wire protocols come from TCP/IP.

flowchart LR
  subgraph OSI[OSI 7-layer model]
    direction TB
    O7[7 Application]
    O6[6 Presentation]
    O5[5 Session]
    O4[4 Transport]
    O3[3 Network]
    O2[2 Data Link]
    O1[1 Physical]
  end
  subgraph TCP[TCP/IP 4-layer model]
    direction TB
    T4[Application]
    T3[Transport]
    T2[Internet]
    T1[Link]
  end
  O7 --- T4
  O6 --- T4
  O5 --- T4
  O4 --- T3
  O3 --- T2
  O2 --- T1
  O1 --- T1

  classDef service fill:#fef3c7,stroke:#92400e,stroke-width:1px,color:#0f172a;
  classDef edge fill:#cffafe,stroke:#0e7490,stroke-width:1px,color:#0f172a;
  class O7,O6,O5,O4,O3,O2,O1 service;
  class T4,T3,T2,T1 edge;
OSI seven-layer model showing peer-to-peer communication at each layer
Source: Wikimedia Commons. CC BY-SA / public domain.

OSI was published by ISO in 1984 as a teaching reference. TCP/IP came earlier (DARPA, 1970s) and shipped on actual hardware first. The internet won; OSI stayed as the shared mental model.

The 7 OSI layers in one line each#

# Layer Job Example protocols
7 Application What the user app speaks HTTP, gRPC, DNS, SMTP, FTP, SSH
6 Presentation Encoding, encryption, compression TLS, JPEG, ASCII, Protobuf, gzip
5 Session Open, manage, close conversations NetBIOS, RPC, SOCKS
4 Transport End-to-end delivery, ports, reliability TCP, UDP, QUIC
3 Network Addressing and routing across networks IP, ICMP, BGP, OSPF
2 Data Link Frames between two directly connected nodes Ethernet, Wi-Fi (802.11), ARP, MAC
1 Physical Bits on the wire or air Copper, fibre, radio, voltage levels

A trick to remember the order top-down: All People Seem To Need Data Processing. Bottom-up: Please Do Not Throw Sausage Pizza Away.

How TCP/IP collapses OSI#

TCP/IP keeps the same idea (each layer hides the one below) but groups OSI's top three and bottom two:

  • Application in TCP/IP = OSI 5 + 6 + 7. Apps just open a socket and write bytes; encoding and session control are app-internal.
  • Transport in TCP/IP = OSI 4. Same job.
  • Internet in TCP/IP = OSI 3. Same job, different name.
  • Link in TCP/IP = OSI 1 + 2. The kernel and NIC handle both bits and frames together.

This matters because real RFCs (TCP is RFC 793, IP is RFC 791) describe a 4-layer world, while the textbook diagram you saw in college has 7.

Where common protocols sit#

flowchart TB
  subgraph App[Application: L7]
    HTTP[HTTP / HTTPS]
    gRPC[gRPC]
    WS[WebSocket]
    DNS[DNS]
  end
  subgraph Pres[Presentation: L6]
    TLS[TLS]
  end
  subgraph Trans[Transport: L4]
    TCP[TCP]
    UDP[UDP]
    QUIC[QUIC]
  end
  subgraph Net[Network: L3]
    IP[IPv4 / IPv6]
    ICMP[ICMP]
  end
  subgraph Link[Data Link: L2]
    ETH[Ethernet / Wi-Fi]
    ARP[ARP]
  end
  subgraph Phy[Physical: L1]
    WIRE[Copper, fibre, radio]
  end
  App --> Pres --> Trans --> Net --> Link --> Phy

  classDef service fill:#fef3c7,stroke:#92400e,stroke-width:1px,color:#0f172a;
  classDef edge fill:#cffafe,stroke:#0e7490,stroke-width:1px,color:#0f172a;
  classDef datastore fill:#fee2e2,stroke:#991b1b,stroke-width:1px,color:#0f172a;
  classDef storage fill:#e5e7eb,stroke:#374151,stroke-width:1px,color:#0f172a;
  class HTTP,gRPC,WS,DNS service;
  class TLS edge;
  class TCP,UDP,QUIC datastore;
  class IP,ICMP,ETH,ARP,WIRE storage;

Three notes the diagram simplifies:

  1. TLS straddles L5 / L6 / L7 depending on who you ask. In TCP/IP it sits inside the Application layer.
  2. QUIC runs on UDP at L4 but bundles a TLS-1.3-equivalent handshake and stream multiplexing that look like L5 / L6 features. It blurs the model on purpose.
  3. DNS runs on UDP/53 (and TCP/53 for big answers), so although it's L7, it doesn't ride TCP for most lookups.

Why this matters in interviews#

The most common interview hooks for OSI vs TCP/IP:

  • Layer 4 vs Layer 7 load balancer. L4 (HAProxy in TCP mode, AWS NLB) reads IP and port and forwards. L7 (Nginx, Envoy, AWS ALB) parses HTTP, so it can route by path, host, or header, terminate TLS, and inject headers.
  • Where does TLS sit? L6 in OSI talk, "inside the application stack" in TCP/IP talk. You usually answer: "between TCP and HTTP" and move on.
  • What is encapsulation? Each layer adds a header to the payload from the layer above. We cover this in the deep dive.

Encapsulation in one picture#

flowchart LR
  P[HTTP payload] --> S[TCP segment<br/>TCP header + payload]
  S --> K[IP packet<br/>IP header + TCP segment]
  K --> F[Ethernet frame<br/>MAC header + IP packet + CRC]
  F --> W[Bits on the wire]

  classDef service fill:#fef3c7,stroke:#92400e,stroke-width:1px,color:#0f172a;
  classDef datastore fill:#fee2e2,stroke:#991b1b,stroke-width:1px,color:#0f172a;
  classDef storage fill:#e5e7eb,stroke:#374151,stroke-width:1px,color:#0f172a;
  class P service;
  class S,K datastore;
  class F,W storage;

Going down the stack on the sender, each layer wraps the previous payload. Going up on the receiver, each layer unwraps and hands the inner payload to the next layer up. The clean interfaces between layers are the entire point of layering.

When to use which model#

  • Teaching, vocab, troubleshooting: OSI. "It's a layer 2 issue" pins the problem to switches/MAC; "layer 7 health check" tells the load balancer to call /healthz not just open a TCP socket.
  • Implementing, reading RFCs: TCP/IP. Real protocols cite TCP/IP layers.

Both models describe the same physical reality. The difference is granularity, not behaviour.

The OSI vs TCP/IP layering model is the foundational vocabulary of computer networking. The OSI 7-layer model is the conceptual reference that gives every networking task a clear home. The TCP/IP 4-layer model is the engineering stack the real internet ships. Senior IC interviews lean on both: the OSI numbering for vocabulary ("layer 4 LB", "layer 2 switch") and the TCP/IP stack for actual protocols and RFCs.

This page walks through why layering exists, the seven OSI layers and what each one really does, how TCP/IP collapses them into four, where every protocol you know lives in the stack, how encapsulation wraps a payload as it flows down the sender's stack, and the practical interview applications: L4 vs L7 load balancers, where TLS sits, and how QUIC blurs the model.

Why layering exists#

Imagine writing a chat app in 1975 without layering. Your code would have to know:

  • How to format a chat message.
  • How to retransmit lost bytes.
  • How to find a route across an internetwork.
  • How to address a neighbour on the same physical wire.
  • How to put voltage on copper.

Every change at any layer (new wire type, new routing algorithm, new retransmission scheme) forces a rewrite of the whole app. Layering solves this with a separation of concerns: each layer offers a clean service to the one above and hides everything below.

flowchart TB
  App[Application code] -->|writes bytes| Sock[Socket API]
  Sock -->|knows nothing about IP| Trans[Transport layer]
  Trans -->|knows nothing about Ethernet| Net[Network layer]
  Net -->|knows nothing about voltage| Link[Link layer]
  Link --> Phy[Physical layer]

  classDef service fill:#fef3c7,stroke:#92400e,stroke-width:1px,color:#0f172a;
  classDef edge fill:#cffafe,stroke:#0e7490,stroke-width:1px,color:#0f172a;
  classDef datastore fill:#fee2e2,stroke:#991b1b,stroke-width:1px,color:#0f172a;
  classDef storage fill:#e5e7eb,stroke:#374151,stroke-width:1px,color:#0f172a;
  class App,Sock service;
  class Trans edge;
  class Net datastore;
  class Link,Phy storage;

Three properties fall out of this:

  • Substitution. Swap Ethernet for Wi-Fi at L2 with no L3+ changes.
  • Composition. Run HTTP on TCP or HTTP/3 on QUIC; the app barely notices.
  • Isolation of bugs. A flapping switch is L2; a routing loop is L3; a TCP retransmit storm is L4. The diagnostic path is the layer ladder.

The OSI 7-layer model in detail#

ISO published OSI in 1984 as ISO/IEC 7498-1. Each layer has a precise mandate.

Layer 1: Physical#

Bits on the medium. Voltage levels on copper, light pulses on fibre, modulated RF on Wi-Fi. The PHY chip on a NIC implements this layer. Specs like 1000BASE-T (gigabit copper) or 10GBASE-SR (fibre) live here.

Frames between two directly connected nodes. Adds MAC addresses so a switch can forward to the right port, plus a CRC so a damaged frame is dropped, not interpreted. Ethernet (IEEE 802.3), Wi-Fi (IEEE 802.11), PPP all sit here. ARP (IPv4) and NDP (IPv6) live on top of L2 to bind IP addresses to MAC addresses.

Layer 3: Network#

Packets routed across heterogeneous networks. IP (v4 or v6) does the addressing; routers forward packets toward the destination. ICMP (used by ping and traceroute), BGP (between autonomous systems), and OSPF (inside a single AS) ride at or near L3.

Layer 4: Transport#

End-to-end delivery between processes. TCP gives ordered, reliable, congestion-controlled byte streams. UDP gives unordered, best-effort datagrams. QUIC is built on UDP but adds reliability and streams, so it acts like L4 even though it sits inside a UDP datagram. Port numbers (16 bits) identify the process on each host.

Layer 5: Session#

Open, manage, and close a "conversation" between two endpoints. In modern protocols this layer is mostly absorbed into the application or transport. NetBIOS, RPC session control, and SOCKS proxy negotiation sit here.

Layer 6: Presentation#

Translate between application data and a wire format. Character encoding (ASCII / UTF-8), serialization (Protobuf, JSON, ASN.1), compression (gzip, deflate), and encryption (TLS) all qualify. TLS is the most-cited L6 protocol in interviews.

Layer 7: Application#

The protocol the user-facing code actually speaks: HTTP, gRPC, WebSocket, DNS, SMTP, IMAP, SSH, FTP. The application opens a socket, writes bytes that follow the L7 protocol grammar, and lets the lower layers ship them.

flowchart TB
  L7[L7 Application<br/>HTTP, gRPC, DNS, SSH]
  L6[L6 Presentation<br/>TLS, gzip, Protobuf]
  L5[L5 Session<br/>RPC session, SOCKS]
  L4[L4 Transport<br/>TCP, UDP, QUIC]
  L3[L3 Network<br/>IP, ICMP, BGP]
  L2[L2 Data Link<br/>Ethernet, Wi-Fi, ARP]
  L1[L1 Physical<br/>Copper, fibre, radio]
  L7 --> L6 --> L5 --> L4 --> L3 --> L2 --> L1

  classDef service fill:#fef3c7,stroke:#92400e,stroke-width:1px,color:#0f172a;
  classDef edge fill:#cffafe,stroke:#0e7490,stroke-width:1px,color:#0f172a;
  classDef datastore fill:#fee2e2,stroke:#991b1b,stroke-width:1px,color:#0f172a;
  classDef storage fill:#e5e7eb,stroke:#374151,stroke-width:1px,color:#0f172a;
  class L7,L6,L5 service;
  class L4 edge;
  class L3 datastore;
  class L2,L1 storage;

The TCP/IP 4-layer model#

TCP/IP is older than OSI (DARPA, 1970s) and was always pragmatic. RFC 1122 codifies four layers:

TCP/IP layer Covers OSI What lives here
Application L5 + L6 + L7 HTTP, gRPC, WebSocket, DNS, SMTP, SSH, TLS
Transport L4 TCP, UDP, QUIC
Internet L3 IPv4, IPv6, ICMP, IPsec
Link L1 + L2 Ethernet, Wi-Fi, PPP, NIC drivers

The collapse is on purpose:

  • The session and presentation boundaries are fuzzy in real apps. HTTP cookies are a session feature inside an application protocol. TLS is a presentation feature implemented as a library linked into the app. Splitting them into two extra layers was theoretically clean but engineering-noisy.
  • The physical and data link boundary is invisible above the kernel. The kernel hands a frame to the driver; the driver hands bits to the PHY. From a programmer's perspective it's one layer.
flowchart LR
  subgraph OSI[OSI 7-layer]
    direction TB
    O7[7 Application]
    O6[6 Presentation]
    O5[5 Session]
    O4[4 Transport]
    O3[3 Network]
    O2[2 Data Link]
    O1[1 Physical]
  end
  subgraph TCPIP[TCP/IP 4-layer]
    direction TB
    T4[Application]
    T3[Transport]
    T2[Internet]
    T1[Link]
  end
  O7 --- T4
  O6 --- T4
  O5 --- T4
  O4 --- T3
  O3 --- T2
  O2 --- T1
  O1 --- T1

  classDef service fill:#fef3c7,stroke:#92400e,stroke-width:1px,color:#0f172a;
  classDef edge fill:#cffafe,stroke:#0e7490,stroke-width:1px,color:#0f172a;
  class O7,O6,O5,O4,O3,O2,O1 service;
  class T4,T3,T2,T1 edge;

Where common protocols actually sit#

This is the table interviewers probe most often. Memorize the column alignment.

Protocol OSI layer TCP/IP layer Header size (typical)
HTTP/1.1, HTTP/2 7 Application 200-800 bytes
gRPC 7 (on HTTP/2) Application varies
WebSocket 7 (after HTTP upgrade) Application 2-14 bytes per frame
DNS 7 Application 12 bytes header + question/answer
TLS 1.3 6 Application 5-byte record header + crypto
TCP 4 Transport 20-60 bytes
UDP 4 Transport 8 bytes
QUIC 4 (with L5/L6 traits) Transport varies; encrypted
IPv4 3 Internet 20 bytes
IPv6 3 Internet 40 bytes
ICMP 3 Internet 8 bytes header
Ethernet (802.3) 2 Link 14 bytes + 4-byte CRC
Wi-Fi (802.11) 2 Link 24-34 bytes
ARP 2.5 Link 28 bytes

Three placements worth re-reading:

  • TLS at L6: it transforms application bytes into encrypted records, exactly what Presentation was designed for. But because TLS is a library on top of a TCP socket, TCP/IP groups it with Application.
  • QUIC at L4: it rides UDP but builds reliability, congestion control, and a TLS 1.3 handshake into a single transport. By behaviour it's a transport; by layering purists it touches L4, L5, and L6.
  • ARP at L2.5: it isn't IP (so not L3) but uses Ethernet broadcasts to resolve IP-to-MAC, so it lives in the seam between L2 and L3.

Encapsulation walkthrough#

Every byte your browser sends gets wrapped four times before it hits the wire. The reverse happens at the destination.

flowchart TB
  subgraph Sender
    A1[App writes<br/>'GET /index.html']
    A2[+ TCP header<br/>src port 50123, dst 443, seq 1]
    A3[+ IP header<br/>src 10.0.0.5, dst 93.184.216.34]
    A4[+ Ethernet header<br/>src MAC, dst MAC + CRC]
    A5[Bits on the wire]
    A1 --> A2 --> A3 --> A4 --> A5
  end
  subgraph Receiver
    B5[Bits off the wire]
    B4[Strip Ethernet,<br/>check CRC and dst MAC]
    B3[Strip IP,<br/>check dst IP]
    B2[Strip TCP,<br/>reorder, ACK, deliver bytes]
    B1[App reads<br/>'GET /index.html']
    B5 --> B4 --> B3 --> B2 --> B1
  end
  A5 -->|wire| B5

  classDef service fill:#fef3c7,stroke:#92400e,stroke-width:1px,color:#0f172a;
  classDef edge fill:#cffafe,stroke:#0e7490,stroke-width:1px,color:#0f172a;
  classDef datastore fill:#fee2e2,stroke:#991b1b,stroke-width:1px,color:#0f172a;
  classDef storage fill:#e5e7eb,stroke:#374151,stroke-width:1px,color:#0f172a;
  class A1,B1 service;
  class A2,B2 edge;
  class A3,B3 datastore;
  class A4,A5,B4,B5 storage;

The names change by layer:

Layer Unit name
L7 Application message
L4 Transport (TCP) segment
L4 Transport (UDP) datagram
L3 Network packet
L2 Data Link frame
L1 Physical bits / symbols

A common interview question: "What's the difference between a packet and a frame?" The answer: a packet is the L3 unit (IP); a frame is the L2 unit (Ethernet/Wi-Fi). One IP packet rides inside one Ethernet frame on each hop. If the packet is too big, IP fragments it; if any link is small (low MTU), the next-hop router may further fragment, or signal "fragmentation needed" via ICMP.

Header overhead#

For a small HTTP request, the wire overhead is significant:

Ethernet header     : 14 bytes (no VLAN)
Ethernet CRC        : 4 bytes
IPv4 header         : 20 bytes (no options)
TCP header          : 20 bytes (no options)
TLS record header   : 5 bytes
                     ------
Total per segment   : 63 bytes of overhead

For a 1500-byte MTU, the payload budget is 1500 - 14 - 20 - 20 = 1446 bytes of HTTP, minus TLS framing. That's why protocols like HTTP/2 multiplex many small requests over one big TCP connection: amortize the headers.

Layer 4 vs Layer 7 load balancing#

This is the most-cited practical use of OSI in system design interviews.

Layer 4 load balancer#

Operates on IP and TCP/UDP. It sees:

  • Source and destination IP.
  • Source and destination port.
  • TCP flags (SYN, ACK, FIN, RST).

It does not see the HTTP request line, headers, or body. Examples: AWS Network Load Balancer, HAProxy in TCP mode, Linux IPVS, F5 BIG-IP in L4 mode.

sequenceDiagram
  participant C as Client
  participant L4 as L4 LB
  participant S as Server
  C->>L4: TCP SYN to VIP:443
  L4->>S: TCP SYN (rewrite or DSR)
  S-->>L4: SYN/ACK
  L4-->>C: SYN/ACK
  Note over C,S: TLS handshake passes through opaque
  C->>L4: Encrypted bytes
  L4->>S: Encrypted bytes (no inspection)

Strengths: very fast (millions of connections per LB), protocol-agnostic, can carry any TCP/UDP traffic.

Weaknesses: cannot route by URL path or Host header; cannot inject X-Forwarded-For; cannot terminate TLS.

Layer 7 load balancer#

Terminates the application protocol (HTTP). It parses:

  • Method, path, query string.
  • Host header, Authorization, cookies.
  • HTTP/2 streams.

Examples: Nginx, Envoy, HAProxy in HTTP mode, AWS Application Load Balancer, GCP HTTPS Load Balancer.

sequenceDiagram
  participant C as Client
  participant L7 as L7 LB
  participant API as api-pod
  participant WEB as web-pod
  C->>L7: TCP + TLS handshake
  L7->>L7: Terminate TLS, parse HTTP
  C->>L7: GET /api/users Host: example.com
  L7->>API: Route by path /api/*
  API-->>L7: 200 OK
  L7-->>C: 200 OK
  C->>L7: GET /index.html Host: example.com
  L7->>WEB: Route by path /
  WEB-->>L7: 200 OK
  L7-->>C: 200 OK

Strengths: path-based routing, host-based routing, header injection, response rewriting, sticky sessions by cookie, per-route timeouts, WAF integration.

Weaknesses: must terminate TLS to inspect, so latency is higher and CPU cost is real; cannot proxy non-HTTP protocols.

Picking between them#

Need Pick
HTTPS for a single app with many paths L7
TCP databases (Postgres, Kafka, MySQL) L4
Long-lived custom binary protocol L4
Need to rewrite Location header on redirects L7
Need millions of concurrent connections per LB L4
Need WAF, bot mitigation, rate limit by URL L7

A common production pattern is L4 in front of L7: AWS NLB handles raw connection scaling and DDoS, then forwards to an Envoy fleet that handles HTTP routing and TLS.

Where OSI breaks (and that's fine)#

OSI is a model, not a law. Several modern protocols violate clean layering on purpose:

  • QUIC crams transport, encryption, and stream multiplexing into one binary. By OSI rules it spans L4 / L5 / L6.
  • HTTP/2 invents its own framing and multiplexing on top of TCP, doing what L5 was supposed to do.
  • Service mesh sidecars (Envoy, Linkerd) terminate L7 inside the pod and re-emit L4 to peers, so a single hop in the data plane crosses layers three times.
  • DPDK / kernel-bypass apps skip the kernel L3 / L4 stack entirely; the NIC delivers raw frames to user space.

Treat OSI as a reference grid. Real protocols draw outside the lines when there's an engineering reason.

OSI in troubleshooting#

The classic "is it broken below me?" ladder follows OSI bottom-up:

Layer Test
L1 Cable plugged in? Link light on? NIC up (ip link show)?
L2 ARP entry present (ip neigh)? Same broadcast domain?
L3 Ping the gateway? Route exists (ip route)? MTU correct?
L4 TCP handshake completes (tcpdump, nc -vz host port)?
L7 App responds (curl -v https://host/)? Returns expected status?

When an outage happens, walk this ladder. Layer 8 (the user) and Layer 9 (politics) are jokes but real teams use them.

FAQ#

What is the difference between OSI and TCP/IP model?#

OSI is a 7-layer conceptual reference model; TCP/IP is the 4-layer model the internet actually runs on. TCP/IP collapses OSI's top three layers (Session, Presentation, Application) into a single Application layer and merges Physical and Data Link into one Link layer.

Where does HTTP sit in the OSI model?#

HTTP sits at Layer 7 (Application) in OSI and at the Application layer in TCP/IP. TLS sits just below it at Layer 6 (Presentation) in OSI but is grouped with the Application layer in TCP/IP.

Why do we still teach OSI if the internet uses TCP/IP?#

OSI gives shared vocabulary. Phrases like layer 4 load balancer, layer 2 switch, or layer 7 firewall come from OSI numbering, so engineers reference it even when the real implementation is TCP/IP.

What is a layer 4 vs layer 7 load balancer?#

A layer 4 load balancer routes by IP and TCP/UDP port without inspecting payload. A layer 7 load balancer parses the application protocol (HTTP) and can route by hostname, path, header, or cookie.

What is encapsulation in networking?#

Each layer wraps the payload from the layer above with its own header. An HTTP request becomes a TCP segment, then an IP packet, then an Ethernet frame on the wire. The receiver strips headers in reverse order.

How does the OSI model work in practice?#

Each layer hides the one below it. The application writes bytes to a socket; the kernel turns those bytes into TCP segments, IP packets, then Ethernet frames, and the NIC sends bits on the wire. The receiver reverses the process so the peer application sees the same bytes.

Why does TCP/IP have 4 layers and OSI have 7?#

TCP/IP collapses OSI's top three layers into Application because real apps handle their own encoding and session state, and it merges OSI's bottom two into Link because the kernel and NIC drive both framing and signaling together. The middle two layers stay the same.

What is encapsulation and decapsulation?#

Encapsulation is when each sender layer prepends its header to the data from the layer above. Decapsulation is the receiver stripping those headers in reverse order so the peer application receives the same payload the sender wrote.

Where does TLS sit in the OSI model?#

TLS technically sits at OSI Layer 6 (Presentation) because it negotiates encoding and encryption between application and transport. In the TCP/IP model TLS is grouped inside the Application layer because it runs in user space above the TCP socket.

What is the difference between a layer 4 and layer 7 load balancer?#

A layer 4 load balancer routes by source/destination IP and TCP/UDP port without inspecting payload. A layer 7 load balancer terminates the application protocol such as HTTP and routes by hostname, path, header, cookie, or even body content.

What are the 7 layers of the OSI model in order?#

From bottom up: Physical, Data Link, Network, Transport, Session, Presentation, Application. From top down it reverses to Application, Presentation, Session, Transport, Network, Data Link, Physical.

What are the 4 layers of the TCP/IP model?#

Link, Internet, Transport, Application. Link covers OSI L1 and L2, Internet maps to L3, Transport maps to L4, and Application covers L5, L6, and L7 together.

Which layer does TCP belong to?#

TCP belongs to OSI Layer 4 (Transport) and to the Transport layer of the TCP/IP model. It provides reliable, ordered, congestion-controlled byte streams between two processes.

Is TLS a layer 6 or layer 7 protocol?#

OSI classifies TLS as Layer 6 (Presentation) because it handles encoding and encryption. The TCP/IP model groups TLS inside the Application layer because it runs as a user-space library above TCP.

Quick reference#

A condensed cheat sheet for the OSI vs TCP/IP layering model. Use this before a system design interview to refresh layer order, protocol placement, and L4 vs L7 talking points.

Layer mapping at a glance#

OSI # OSI name TCP/IP layer Example protocols
7 Application Application HTTP, gRPC, DNS, SSH, SMTP
6 Presentation Application TLS, gzip, Protobuf, ASCII
5 Session Application NetBIOS, RPC, SOCKS
4 Transport Transport TCP, UDP, QUIC
3 Network Internet IP, ICMP, BGP, OSPF
2 Data Link Link Ethernet, Wi-Fi, ARP
1 Physical Link Copper, fibre, radio 
flowchart LR
  subgraph OSI[OSI]
    direction TB
    O7[7 Application]
    O6[6 Presentation]
    O5[5 Session]
    O4[4 Transport]
    O3[3 Network]
    O2[2 Data Link]
    O1[1 Physical]
  end
  subgraph TCP[TCP/IP]
    direction TB
    T4[Application]
    T3[Transport]
    T2[Internet]
    T1[Link]
  end
  O7 --- T4
  O6 --- T4
  O5 --- T4
  O4 --- T3
  O3 --- T2
  O2 --- T1
  O1 --- T1

  classDef service fill:#fef3c7,stroke:#92400e,stroke-width:1px,color:#0f172a;
  classDef edge fill:#cffafe,stroke:#0e7490,stroke-width:1px,color:#0f172a;
  class O7,O6,O5,O4,O3,O2,O1 service;
  class T4,T3,T2,T1 edge;

Mnemonics#

  • Top to bottom: All People Seem To Need Data Processing.
  • Bottom to top: Please Do Not Throw Sausage Pizza Away.

One-liner per layer#

  • L1 Physical: bits on copper, fibre, or radio.
  • L2 Data Link: frames with MAC addressing between directly connected nodes.
  • L3 Network: IP packets routed across networks.
  • L4 Transport: ports, reliability, flow control between processes.
  • L5 Session: open / manage / close conversations.
  • L6 Presentation: encoding, encryption, compression.
  • L7 Application: the protocol the user-facing code speaks.

Where common protocols sit#

Protocol OSI layer Notes
HTTP, gRPC, WebSocket 7 On top of TCP (or QUIC for HTTP/3)
DNS 7 Usually UDP/53, TCP/53 for big answers
TLS 6 Between TCP and HTTP
TCP, UDP 4 Reliable vs best-effort
QUIC 4 UDP-based; also has L5/L6 traits
IP, ICMP 3 Routing and diagnostics
Ethernet, Wi-Fi, ARP 2 Local link addressing

Encapsulation cheat sheet#

Sender wraps; receiver unwraps:

HTTP message      (L7)
  + TCP header    (L4) -> segment
  + IP header     (L3) -> packet
  + Ethernet hdr  (L2) -> frame + CRC
  on the wire     (L1) -> bits
Layer Unit name
L7 message
L4 TCP segment
L4 UDP datagram
L3 packet
L2 frame
L1 bits / symbols

Typical header overhead for a small TCP/IP packet: 14 (Eth) + 20 (IP) + 20 (TCP) = 54 bytes plus 4-byte CRC.

L4 vs L7 load balancer#

Feature L4 LB L7 LB
Inspects IP + port HTTP method, path, headers, body
TLS termination No (passthrough) Yes
Route by URL path No Yes
Route by Host header No Yes
Header injection No Yes (X-Forwarded-For, etc.)
Speed Very high, low CPU Slower, parses HTTP
Examples AWS NLB, HAProxy TCP, IPVS Nginx, Envoy, AWS ALB
Use for TCP DBs, custom binary, raw scale HTTPS APIs, path routing, WAF

Pattern: L4 LB in front of L7 LB for connection scaling plus HTTP smarts.

Memorable facts#

  • TCP/IP is older than OSI (DARPA 1970s vs ISO 1984), but OSI dominates vocabulary.
  • A "packet" is L3; a "frame" is L2. Don't mix them in interviews.
  • ARP technically sits at "L2.5" because it bridges L2 and L3.
  • QUIC blurs layers: UDP at L4, but with TLS 1.3 and stream multiplexing baked in.
  • HTTP/2 streams behave like a session layer over a single TCP connection.

Troubleshooting ladder#

Walk OSI bottom-up when something is broken:

Layer Quick check
L1 Cable, link light, NIC up
L2 ARP entry, same broadcast domain
L3 ping gateway, ip route, MTU
L4 nc -vz host port, tcpdump TCP flags
L7 curl -v, app logs

Common interview questions#

  • Walk through what happens when a browser opens https://example.com. Name the layers and their headers.
  • Where does TLS sit? (L6 in OSI; inside Application in TCP/IP.)
  • Layer 4 vs Layer 7 load balancer: when do you pick which?
  • What is encapsulation? Show with HTTP -> TCP -> IP -> Ethernet.
  • Why does TCP/IP have 4 layers and OSI have 7?

Refs#

  • ISO/IEC 7498-1 (OSI reference model)
  • RFC 1122 (Internet host requirements, TCP/IP layering)
  • RFC 791 (IPv4), RFC 793 (TCP), RFC 768 (UDP), RFC 9000 (QUIC)
  • Tanenbaum, "Computer Networks", chapter 1