When troubleshooting, its best practice to think in terms of the OSI layer model to identify which layer the problem is in, then go a layer deeper

1. Physical layer (transmits raw bit stream over the physical medium)
   • Includes the physical equipment involved in the data transfer, such as the cables and switches. This is also the layer where the data gets converted into a bit stream, which is a string of 1s and 0s
   • Type of attack possible: sniffing
2. Data link layer (physical addressing, frames)
   • Ethernet, 802.11, MAC, etc..
   • Specifies how packets are sent to the communication link. It takes packets from the network layer and breaks them into smaller pieces called frames
   • Also responsible for node-to-node data transfer across a physical network segment. It packages raw bits from the Physical Layer (Layer 1) into logical units called frames
     • When we think about OSI Layer 2, we can think "switching”
   • Type of attack possible: spoofing
3. Network layer (path determination, logical addressing, packets, routing)
   • IP, ARP, ICMP, etc..
   • Defines end-to-end delivery of data. In order for computers to be identified, the network layer defines logical addressing
   • Also defines how routing works and how routes are learned by routers for packet delivery
   • Also defines fragmentation of packets, which is the process that breaks packets into smaller units to accommodate smaller maximum transmission unit (MTU) sizes
   • Type of attack possible: man in the middle
4. Transport layer (end to end connection)
   • TCP, UDP, etc..
   • responsible for end-to-end delivery of data between applications, ensuring accuracy, ordering, and flow control. It breaks large data into segments (segmentation) at the source and reassembles them at the destination, with key protocols being. Also it provides error correction and flow control (router can discard packets for many reasons), protocols may reorder the data stream if the packets arrive out of order
     • After the data is received, multiplexed, and reordered, it is given to the upper layer (session) for handling
     • Error correction is where a protocol provides retransmission of packets that the other host didn't receive
     • Flow control is where a protocol is responsible for limiting transmission speed so that the network doesn't get flooded
   • Type of attack possible: reconnaissance
5. Session layer (synch and send to port)
   • API, sockets, session establishment, SQL, NFS, RPC, etc..
   • Ensures inter-host communication that establishes ways to manage sessions between applications that provides a service to the upper layer (presentation)
     • For example, if only half the data is received on a particular session, Layer 5 will not pass the data to the upper layer
   • Type of attack possible: hijacking
6. Presentation layer (syntax layer)
   • SSL, FTP, IMAP, SSH, etc..
   • Defines the data formats in which data is represented. Data formats are usually standard formats like ASCII, JPEG, GIF, TIFF, etc.. and can be encrypted
     • When sending email, you usually send it plain text (ASCII) or HTML. If the receiving application doesn't know these data formats, your email will not be displayed correctly
   • Type of attack possible: phishing
7. Application layer (end user layer)
   • HTTP, FTP, DNS, SSH, etc..
   • Communication capabilities to that software regardless of what port or computer it may come from
   • Type of attack possible: exploits

OSI has 7 layers and is a theoretical model; TCP/IP has 4 layers and is practical, used in real networking

Notes

Take note that the OSI model is more of a theoretical model and it is very useful in the learning process. On the other hand, the Internet was built on the TCP/IP model

Differences between the two models are: TCP/IP combines the three upper layers of the OSI model in a single layer and the data link and physical layers from the OSI model are combined in a single layer

Layer 3 (IP/Network) is like the street address, it tells you which house (IP address) to deliver to. Layer 4 (TCP/UDP + Ports) is like the door of the house, port 443 is the front door, port 22 is the back door, port 25 is the mail slot. TCP vs UDP is like the difference between a door with a bell and a confirmed handshake. Layer 7 (Application) is reading the letter inside the envelope

So regarding firewalls, a Layer 3 firewall rule says: "no deliveries to this street." A Layer 4 rule says: "deliveries to this street are fine, but only through the front door." A Layer 7 rule says: "you can knock on the front door, but I'm opening the envelope first — and if I don't like what's written inside, you're turned away.”

Here’s what happens when a client communicates with a server through HTTPS step by step

1. Browser parses the URL — It sees https (use TLS), example.com (the host), and / (the path). This is purely Layer 7 (Application).

2. DNS resolution — The browser needs an IP address. It checks its cache, then asks the OS, then a resolver, which walks the DNS tree (root → .com → example.com) until it gets 93.184.216.34. This uses UDP on port 53, still Layer 7 but carried over Layer 4.