The Layer Model: TCP/IP First, OSI as a Map

The internet runs on a stack that is best described with four layers, each of which is a real, separately implemented piece of software or hardware with a defined interface to its neighbours. Going down from your code: Application protocols (HTTP, DNS, TLS-as-used-by-HTTP, SMTP, SSH) define *what the bytes mean*. Transport protocols (TCP, UDP, and QUIC) deliver bytes between *processes*, identified by ports, and decide whether delivery is reliable and ordered. The Internet layer (IP, plus ICMP as its control channel) delivers packets between *machines* across many networks, best-effort. The Link layer (Ethernet, Wi-Fi, cellular, PPP) delivers frames between *directly connected* interfaces on one physical medium.

The contract between layers is the important part. Each layer takes an opaque payload from above, adds its own header, and hands the result down; each layer on the receiving side strips its header and passes the payload up. IP does not know whether it carries TCP or UDP beyond a protocol number; Ethernet does not know whether it carries IPv4 or IPv6 beyond an EtherType; TCP does not know whether its bytes are HTTP or SSH. This ignorance is deliberate: it is what let HTTP/3 replace TCP with QUIC without touching a single router, and what lets IPv6 replace IPv4 without touching HTTP.

The model is sometimes drawn with a fifth Physical layer below Link (signal levels, connectors, modulation). Engineers who write software rarely need it, but it is where "the cable is unplugged" and "the Wi-Fi signal is weak" live.

Each layer is defined as much by what it does *not* do. The link layer delivers a frame to a MAC address on the same segment; it makes no attempt to reach another network and (on Ethernet) no attempt to retransmit. IP reaches any network in the world but promises nothing about delivery: a packet may be lost, duplicated, reordered, or arrive with its neighbours missing, and IP will not tell anyone. TCP takes that and produces a reliable ordered byte stream — but knows nothing about messages, so an application that sends two write()s may read() them as one, or as three. UDP deliberately passes IP’s unreliability straight through, keeping only ports and a checksum, because DNS, real-time media and QUIC want to handle loss their own way.

This division is why the same symptom can come from different layers. "The connection dropped" might be the link (Wi-Fi roamed to another access point and got a new IP), IP (a route withdrawn), transport (a RST from a NAT that lost its mapping) or application (an idle timeout on the proxy). Debugging is the act of finding which layer’s promise was broken; see The Tools, and Which Layer Each One Answers for which tool answers which layer.

The OSI model (1984) divides the same work into seven layers: Physical (1), Data Link (2), Network (3), Transport (4), Session (5), Presentation (6), Application (7). No protocol suite in use today was built to it — TCP/IP predates it and won — but its numbers became the industry’s vocabulary. "L2 switch", "L3 routing", "L4 load balancer", "L7 proxy" all refer to OSI numbering, and you need to read them fluently even though the model behind them is a reference, not a specification.

The mapping to TCP/IP is straightforward at the bottom and fuzzy at the top. OSI 1–2 are TCP/IP’s Link layer; OSI 3 is Internet; OSI 4 is Transport. OSI 5–7 are collapsed into TCP/IP’s Application layer, because in practice Session and Presentation never existed as separate protocols — what OSI called "presentation" (encoding, encryption) is done by TLS and by the application’s own serialisation, and what it called "session" is done by TCP connections, cookies and application state. Do not spend energy assigning HTTP headers to layer 6.

The model is a map, and the territory has protocols that live on borders. TLS runs above TCP and below HTTP: it is addressed like an application protocol, carries a record layer with its own framing, and provides what OSI would call presentation and session services; the honest answer is "between transport and application". QUIC is a transport (it does reliability, ordering, congestion control and multiplexing) that runs *inside* UDP datagrams and has TLS 1.3 *built into its handshake* — so it is a layer-4 protocol carried by another layer-4 protocol, with layer-6 baked in. ARP carries IP addresses (a layer-3 concept) in frames that have no IP header (layer 2), to solve a problem that exists precisely at the seam between the two. ICMP is carried inside IP like a transport, but is part of IP’s own machinery.

The practical rule: "L4" and "L7" are jargon for *what information a device looks at* — ports and connections versus URLs, headers and content — not a law about where a protocol must sit. An "L4 load balancer" forwards on the 4-tuple without decrypting; an "L7 load balancer" terminates TLS and routes on the Host header. That distinction is real and useful; the layer numbers are just its shorthand. See Load Balancers: L4 vs L7.