By Davy Rogers. Use these techniques only in environments you own or have explicit permission to test.

The OSI Model

The OSI (Open Systems Interconnection) Model is a conceptual framework that standardizes how different network systems communicate. Created in 1984, this 7-layer model is essential for understanding networking, troubleshooting connectivity issues, and identifying where security controls should be implemented. Every cybersecurity professional must master the OSI model—it's the foundation for understanding how attacks work and where to defend.

What You'll Learn

  • The 7 layers of the OSI model
  • What happens at each layer
  • Protocols and devices at each layer
  • How data encapsulation works
  • Security implications for each layer
  • How to use the OSI model for troubleshooting
  • Real-world pentesting applications

Why the OSI Model Matters

For Security Professionals:

Understanding Attack Vectors:

  • Layer 2: ARP poisoning, MAC flooding
  • Layer 3: IP spoofing, routing attacks
  • Layer 4: SYN floods, port scanning
  • Layer 7: SQL injection, XSS

Troubleshooting:

  • "Is this a physical cable issue?" (Layer 1)
  • "Is DNS working?" (Layer 7)
  • "Are packets being routed?" (Layer 3)

Defense in Depth:

  • Firewalls (Layer 3-4)
  • WAF - Web Application Firewall (Layer 7)
  • IDS/IPS (Multiple layers)
  • Network segmentation (Layer 2-3)

The 7 Layers

┌────────────────────────────────────────────────┐
│ 7. Application  │ End-user applications        │
├────────────────────────────────────────────────┤
│ 6. Presentation │ Data translation/encryption  │
├────────────────────────────────────────────────┤
│ 5. Session      │ Connection management        │
├────────────────────────────────────────────────┤
│ 4. Transport    │ Reliable data transfer       │
├────────────────────────────────────────────────┤
│ 3. Network      │ Routing and logical address  │
├────────────────────────────────────────────────┤
│ 2. Data Link    │ Physical addressing          │
├────────────────────────────────────────────────┤
│ 1. Physical     │ Transmission medium          │
└────────────────────────────────────────────────┘

Mnemonics to Remember:

Bottom to Top:

  • "Please Do Not Throw Sausage Pizza Away"
  • Physical, Data Link, Network, Transport, Session, Presentation, Application

Top to Bottom:

  • "All People Seem To Need Data Processing"
  • Application, Presentation, Session, Transport, Network, Data Link, Physical

Layer 1: Physical Layer

Function: Transmits raw bits over physical medium

What Happens Here:

  • Electrical signals (copper cables)
  • Light pulses (fiber optic)
  • Radio waves (wireless)
  • Bits (1s and 0s)

Hardware:

  • Cables: Ethernet (Cat5e, Cat6), Fiber optic, Coaxial
  • Hubs: Dumb repeaters (broadcast to all ports)
  • Repeaters: Amplify signals
  • Modems: Modulate/demodulate signals
  • Network Interface Cards (NICs)

Specifications:

  • Voltage levels
  • Cable types and lengths
  • Pin configurations (RJ45, etc.)
  • Physical topology (bus, star, ring)

Security Implications:

Attacks:

  • Physical access: Cut cables, tap connections
  • Jamming: Interfere with wireless signals
  • Cable sniffing: Physically tap into network cables

Defenses:

  • Physical security (locked server rooms)
  • Cable shielding
  • Monitoring physical access

Example:

Bit stream: 1 0 1 1 0 0 1 0
     ↓
Converted to electrical signals on cable

Troubleshooting:

# Check if cable is connected
# Linux
ethtool eth0 | grep "Link detected"

# Windows
netsh interface show interface

# Is the NIC working?
lspci | grep -i ethernet  # Linux

Function: Provides node-to-node data transfer and error detection

What Happens Here:

  • Frames data for transmission
  • MAC addressing
  • Error detection (CRC)
  • Flow control

Sublayers:

LLC (Logical Link Control):

  • Identifies network protocols
  • Error checking
  • Frame synchronization

MAC (Media Access Control):

  • Physical addressing
  • Controls access to transmission medium

Hardware:

  • Switches: Forward frames based on MAC addresses
  • Bridges: Connect network segments
  • Wireless Access Points
  • Network Interface Cards

Data Unit: Frame

┌──────────────────────────────────────────────┐
│ Preamble | Dest MAC | Src MAC | Type | Data │ FCS │
└──────────────────────────────────────────────┘

MAC Address:

  • 48-bit hardware address
  • Format: 00:1A:2B:3C:4D:5E
  • First 24 bits: Manufacturer (OUI)
  • Last 24 bits: Unique identifier
# View MAC address
# Linux
ip link show
ip addr show

# Windows
ipconfig /all
getmac

# macOS
ifconfig

Protocols:

  • Ethernet (IEEE 802.3)
  • Wi-Fi (IEEE 802.11)
  • PPP (Point-to-Point Protocol)
  • ARP (Address Resolution Protocol)

Security Implications:

Attacks:

  • ARP poisoning/spoofing: Intercept traffic (MITM)
  • MAC flooding: Overwhelm switch MAC table
  • MAC spoofing: Impersonate another device
  • VLAN hopping: Access unauthorized VLANs

Example ARP Poisoning:

# Tell victim that attacker's MAC is the gateway
arpspoof -i eth0 -t 192.168.1.5 192.168.1.1

# Tell gateway that attacker's MAC is the victim
arpspoof -i eth0 -t 192.168.1.1 192.168.1.5

# Now attacker intercepts all traffic between victim and gateway

Defenses:

  • Port security (limit MAC addresses per port)
  • DHCP snooping
  • Dynamic ARP Inspection (DAI)
  • 802.1X authentication

Troubleshooting:

# View ARP cache
arp -a         # Windows
ip neigh show  # Linux

# Ping to populate ARP cache
ping 192.168.1.1

# Monitor switch MAC table
show mac address-table  # Cisco

Layer 3: Network Layer

Function: Routes packets across different networks

What Happens Here:

  • Logical addressing (IP addresses)
  • Routing (path determination)
  • Packet forwarding
  • Fragmentation and reassembly

Hardware:

  • Routers: Route packets between networks
  • Layer 3 Switches: Routing + switching
  • Firewalls: Packet filtering

Data Unit: Packet

┌────────────────────────────────────────────────┐
│ IP Header | TCP/UDP Header | Data             │
└────────────────────────────────────────────────┘

IP Header (Simplified):

Source IP: 192.168.1.100
Destination IP: 8.8.8.8
Protocol: TCP (6) / UDP (17) / ICMP (1)
TTL: Time to Live (hops remaining)

Protocols:

  • IPv4 / IPv6: Addressing
  • ICMP: Error messages, ping
  • IGMP: Multicast group management
  • IPsec: Encryption at network layer
  • Routing protocols: OSPF, BGP, RIP

IP Addressing:

IPv4: 192.168.1.1 (32-bit)

  • Network portion + Host portion
  • Subnet mask defines boundary

IPv6: 2001:0db8:85a3::8a2e:0370:7334 (128-bit)

  • Fixes IPv4 address exhaustion
  • Built-in IPsec
# View IP address
ip addr show     # Linux
ipconfig         # Windows

# View routing table
ip route show    # Linux
route print      # Windows

# Test connectivity (ICMP)
ping 8.8.8.8

# Trace route
traceroute google.com  # Linux
tracert google.com     # Windows

Security Implications:

Attacks:

  • IP spoofing: Forge source IP address
  • Ping of Death: Oversized ping packets
  • Smurf attack: Amplified ping flood
  • Route poisoning: Corrupt routing tables
  • ICMP tunneling: Exfiltrate data via ping

Scanning:

# Network scan
nmap -sn 192.168.1.0/24  # Ping scan

# Host discovery
nmap -sn -PS 10.0.0.0/24  # TCP SYN ping

Defenses:

  • Anti-spoofing filters
  • Rate limiting ICMP
  • Firewalls with stateful inspection
  • Route authentication (BGP security)

Routing Example:

Your PC (192.168.1.100) wants to reach Google (8.8.8.8)

1. Check routing table: "8.8.8.8 is not local"
2. Send to default gateway (192.168.1.1 - your router)
3. Router forwards to ISP router
4. ISP router forwards to next hop
5. ... (multiple hops) ...
6. Eventually reaches Google's network

Layer 4: Transport Layer

Function: Provides reliable (or unreliable) end-to-end communication

What Happens Here:

  • Segmentation and reassembly
  • Flow control
  • Error correction
  • Port addressing

Data Unit: Segment (TCP) or Datagram (UDP)

Protocols:

TCP (Transmission Control Protocol)

Characteristics:

  • Connection-oriented: Three-way handshake
  • Reliable: Guarantees delivery
  • Ordered: Packets arrive in correct sequence
  • Error checking: Retransmits lost packets

Use cases: HTTP, HTTPS, FTP, SSH, email

TCP Header:

Source Port: 45678
Destination Port: 80
Sequence Number: 12345
Acknowledgment: 54321
Flags: SYN, ACK, FIN, RST, PSH, URG

Three-Way Handshake:

Client → Server: SYN (Synchronize, let's connect)
Server → Client: SYN-ACK (OK, I'm ready!)
Client → Server: ACK (Great, let's go!)
[Connection established]

UDP (User Datagram Protocol)

Characteristics:

  • Connectionless: No handshake
  • Unreliable: No delivery guarantee
  • Fast: Low overhead
  • Unordered: Packets may arrive out of order

Use cases: DNS, DHCP, streaming video, VoIP, gaming

UDP Header (simpler):

Source Port: 53
Destination Port: 12345
Length: 512
Checksum: 0xAB12

Port Numbers:

Well-Known Ports (0-1023):

  • 20/21: FTP
  • 22: SSH
  • 23: Telnet
  • 25: SMTP
  • 53: DNS
  • 80: HTTP
  • 443: HTTPS
  • 3389: RDP

Registered Ports (1024-49151):

  • 3306: MySQL
  • 5432: PostgreSQL
  • 8080: HTTP alternate

Dynamic/Private Ports (49152-65535):

  • Used for client-side connections
# View open ports
netstat -an      # Windows
ss -tuln         # Linux (modern)
netstat -tuln    # Linux (legacy)

# Scan ports
nmap -p- 192.168.1.5

Security Implications:

Attacks:

  • Port scanning: Enumerate services
  • SYN flood: DoS by exhausting connections
  • Session hijacking: Take over TCP session
  • UDP flood: Overwhelm with UDP packets

SYN Flood Attack:

Attacker sends thousands of SYN packets
Server responds with SYN-ACK (half-open connections)
Attacker never sends final ACK
Server runs out of connection slots → DoS

Defenses:

  • SYN cookies
  • Rate limiting
  • Firewall rules
  • Connection timeouts

Port Scanning:

# TCP SYN scan (stealthy)
nmap -sS 192.168.1.5

# TCP connect scan (full handshake)
nmap -sT 192.168.1.5

# UDP scan (slower)
nmap -sU 192.168.1.5

# Service detection
nmap -sV -p 80,443,22 192.168.1.5

Layer 5: Session Layer

Function: Establishes, manages, and terminates sessions

What Happens Here:

  • Session establishment
  • Session maintenance
  • Session termination
  • Synchronization
  • Dialog control

Functions:

  • Authentication: Verify users
  • Authorization: Grant permissions
  • Session restoration: Resume after interruption

Protocols:

  • NetBIOS: Name services
  • PPTP: VPN tunneling
  • RPC: Remote procedure calls
  • SQL: Database sessions
  • NFS: Network File System

Security Implications:

Attacks:

  • Session hijacking: Steal session tokens
  • Session fixation: Force known session ID
  • CSRF: Cross-Site Request Forgery

Example - Session Hijacking:

1. Victim logs into website (gets session cookie)
2. Attacker intercepts session cookie (network sniffing)
3. Attacker uses cookie to impersonate victim
4. Website thinks attacker is the victim

Defenses:

  • HTTPS (encrypt session data)
  • Secure session tokens (random, unpredictable)
  • Session timeout
  • Bind session to IP address
  • HTTPOnly and Secure cookie flags

Layer 6: Presentation Layer

Function: Translates data between application and network formats

What Happens Here:

  • Data translation
  • Encryption/Decryption
  • Compression/Decompression
  • Character encoding

Functions:

1. Data Translation:

  • Convert between different data formats
  • EBCDIC ↔ ASCII
  • Endianness conversion (big-endian, little-endian)

2. Encryption:

  • SSL/TLS encryption
  • Data confidentiality

3. Compression:

  • Reduce data size
  • Faster transmission

4. Serialization:

  • Convert data structures to transmittable format

Formats and Standards:

  • JPEG, GIF, PNG: Image formats
  • MPEG, AVI: Video formats
  • ASCII, Unicode, UTF-8: Character encoding
  • SSL/TLS: Encryption
  • MIME: Email attachments

Security Implications:

Attacks:

  • SSL/TLS vulnerabilities: POODLE, Heartbleed, BEAST
  • Weak cipher suites: DES, RC4
  • Certificate validation issues: MITM attacks
  • Compression attacks: CRIME, BREACH

Example - Weak SSL:

# Test SSL/TLS configuration
sslscan example.com
testssl.sh example.com

# Check for weak ciphers
nmap --script ssl-enum-ciphers -p 443 example.com

Defenses:

  • Use strong ciphers (AES-256, ChaCha20)
  • TLS 1.2 or 1.3 only
  • Proper certificate validation
  • HSTS (HTTP Strict Transport Security)

Layer 7: Application Layer

Function: Provides network services directly to end-users

What Happens Here:

  • User interaction
  • Application protocols
  • Data presentation to user

Protocols:

Web:

  • HTTP/HTTPS: Web browsing
  • WebSocket: Real-time communication

Email:

  • SMTP: Send email
  • POP3/IMAP: Receive email

File Transfer:

  • FTP/FTPS: File transfer
  • SFTP: Secure file transfer
  • SMB: Windows file sharing

Remote Access:

  • SSH: Secure shell
  • Telnet: Insecure remote access
  • RDP: Remote Desktop Protocol

DNS: Domain name resolution

DHCP: IP address assignment

Security Implications:

Attacks (Most common layer for attacks!):

  • SQL Injection: Exploit database queries
  • XSS: Cross-Site Scripting
  • CSRF: Cross-Site Request Forgery
  • Path Traversal: Access unauthorized files
  • Command Injection: Execute OS commands
  • Phishing: Social engineering via email
  • DNS poisoning: Redirect traffic

Web Application Attacks:

# SQL injection
sqlmap -u "http://example.com/page?id=1"

# XSS testing
# Input: <script>alert('XSS')</script>

# Directory brute-forcing
gobuster dir -u http://example.com -w wordlist.txt

# Nikto web scanner
nikto -h http://example.com

Defenses:

  • Input validation and sanitization
  • Web Application Firewall (WAF)
  • Security headers (CSP, X-Frame-Options)
  • Authentication and authorization
  • Rate limiting
  • HTTPS everywhere

Data Encapsulation Process

As data travels down the OSI stack, each layer adds its header:

Application:       [      Data      ]

Presentation:      [      Data      ]  (may encrypt)

Session:           [      Data      ]

Transport:         [ TCP | Data ]  (Segment)

Network:           [ IP | TCP | Data ]  (Packet)

Data Link:         [ Eth | IP | TCP | Data | FCS ]  (Frame)

Physical:          → Bits → Signals →

On the receiving end, each layer removes its header (de-encapsulation) and passes data up.

OSI Model in Penetration Testing

Reconnaissance (All Layers):

# Layer 1-2: Discover devices
arp-scan -l

# Layer 3: Network scan
nmap -sn 192.168.1.0/24

# Layer 4: Port scan
nmap -p- 192.168.1.5

# Layer 7: Service enumeration
nmap -sV 192.168.1.5

Exploitation by Layer:

Layer 2: ARP spoofing for MITM Layer 3: IP spoofing, packet injection Layer 4: SYN flood, port scanning Layer 7: Web attacks, protocol exploitation

OSI vs TCP/IP Model

OSI (7 Layers)          TCP/IP (4 Layers)
──────────────          ─────────────────
Application      ┐
Presentation     ├───→  Application
Session          ┘
Transport        ────→  Transport
Network          ────→  Internet
Data Link        ┐
Physical         └───→  Network Access

TCP/IP is simpler and what's actually implemented on the Internet.

OSI is more detailed and better for teaching/troubleshooting.

Troubleshooting with OSI Model

Bottom-Up Approach:

Problem: Can't access website

Layer 1: Is cable plugged in? ✓
Layer 2: Is switch working? ✓
Layer 3: Can I ping the gateway? ✓
Layer 4: Are ports open? ✓
Layer 5-7: Is the website down? ✗ (Found the issue!)

Commands by Layer:

# Layer 1: Physical
ethtool eth0

# Layer 2: Data Link
ip link show
arp -a

# Layer 3: Network
ping 8.8.8.8
ip route show

# Layer 4: Transport
netstat -an
telnet google.com 80

# Layer 7: Application
curl -I http://example.com
nslookup google.com

Try It Yourself

Exercise 1: Identify the Layer

Q: Where does each occur?

  1. MAC address → Layer 2
  2. IP address → Layer 3
  3. Port number → Layer 4
  4. HTTP GET request → Layer 7
  5. SSL encryption → Layer 6
  6. Ethernet cable → Layer 1

Exercise 2: Packet Analysis

# Capture traffic
tcpdump -i eth0 -c 10 -w capture.pcap

# Open in Wireshark
wireshark capture.pcap

# Identify:
# - Layer 2: Ethernet frame, MAC addresses
# - Layer 3: IP packet, IP addresses
# - Layer 4: TCP segment, port numbers
# - Layer 7: HTTP request, data

Exercise 3: Attack Mapping

Map these attacks to OSI layers:

  • ARP poisoning → Layer 2
  • SYN flood → Layer 4
  • SQL injection → Layer 7
  • IP spoofing → Layer 3

Resources

Interactive:

Reading:

Practice:

  • Analyze packet captures
  • Identify protocols at each layer
  • Map security controls to layers

Next Steps

  1. Next lesson: Learn about the three-way handshake in detail
  2. Practice with Wireshark: Capture and analyze traffic
  3. Memorize the layers: Use the mnemonics
  4. Map attacks: Identify which layer each attack targets
  5. Think in layers: When troubleshooting, work systematically

Remember: The OSI model is a framework for understanding, not a rigid implementation. Real protocols don't always fit perfectly into one layer, but the model helps organize our thinking!

"All People Seem To Need Data Processing" - The OSI Model (and we certainly do in cybersecurity!)

Up next

Hexadecimal

Understanding hexadecimal number system in networking.