Questions? Call 1.800.716.8955

Chapter 2

The OSI and TCP/IP Models

Exam topics covered

1.1 Explain the role and function of network components (which layer each device works at)

1.5 Compare TCP to UDP (header fields introduced here; detailed in Chapter 5)

Foundation for 1.6 Configure and verify IPv4 addressing and 1.13 Describe switching concepts (ARP and Layer 2 rewrite)

Foundation. Networking models give everyone a shared vocabulary. When an engineer says “it's a Layer 2 problem” or “the firewall filters at Layer 4”, they are using the OSI model to say precisely where in the communication process something happens. This chapter walks through the seven OSI layers and the TCP/IP model that the internet actually uses, shows how data is wrapped in headers on the way down the stack and unwrapped on the way up, and dissects the three headers you will meet constantly: Ethernet, IPv4 and TCP. It finishes by following a single packet across a router, showing why IP addresses stay the same end to end while MAC addresses change at every hop, and how ARP connects the two.

2.1 Why Use a Layered Model?

Network communication involves many separate jobs: generating application data, splitting it into manageable pieces, addressing it to a remote host, choosing a path, putting bits on a wire and detecting errors. A layered model assigns each job to a layer with a defined interface to the layers above and below. The benefits are practical:

Modularity — a layer can change without affecting others. Moving from copper to fibre, or from IPv4 to IPv6, does not require rewriting web browsers.

Interoperability — vendors build products that implement a layer's standard and work with everyone else's.

Troubleshooting — you can test layer by layer: is the link up (L1)? Is the MAC learned (L2)? Is there a route (L3)? Is the port open (L4)?

Learning — complex behaviour is broken into understandable pieces.

2.2 The OSI Reference Model

The Open Systems Interconnection (OSI) model was published by the International Organization for Standardization (ISO) in 1984. The OSI protocol suite itself never caught on, but its seven-layer model became the industry's reference vocabulary. Layers are numbered from the bottom (1, Physical) to the top (7, Application). A popular mnemonic from the top down is “All People Seem To Need Data Processing”; from the bottom up, “Please Do Not Throw Sausage Pizza Away”.

Table 2-1 The seven OSI layers

Dhcp, smtp, ssh,

Telnet, FTP, TFTP,

Snmp

Hosts, servers,

Ngfw

  • (inspection)
  • 6 Presentation Data formats,
  • encoding,
  • compression,
  • encryption

Ascii, jpeg, mpeg,

The Physical layer defines how bits are represented as signals: voltage changes on copper, pulses of light in fibre, or modulated radio waves. It also defines cables, connectors, pinouts and data rates. A hub or repeater is a Layer 1 device: it regenerates bits out of every port without understanding them.

The Data link layer organises bits into frames and delivers them across a single link or LAN segment. It adds a header with source and destination MAC addresses and a trailer with a frame check sequence (FCS) to detect corruption. IEEE splits Layer 2 into the upper Logical Link Control (LLC) sublayer (802.2), which identifies the Layer 3 protocol, and the lower Media Access Control (MAC) sublayer, which handles addressing and access to the medium. Switches and access points are Layer 2 devices.

2.2.2 Layers 3 and 4: end to end across many links

The Network layer provides logical addressing (IP addresses) and routing so a packet can cross many links of different types from source host to destination host. Routers are Layer 3 devices. ICMP, used by ping and traceroute , also lives here.

The Transport layer delivers data between applications on the two hosts, identified by port numbers. TCP adds reliability (sequencing, acknowledgments, retransmission), flow control and connection setup; UDP provides lightweight, connectionless delivery. The transport layer also performs segmentation, dividing a large stream into pieces that fit in packets.

2.2.3 Layers 5 to 7: the application's view

The Session layer manages dialogues between applications, the Presentation layer handles data representation, encryption and compression, and the Application layer provides network services such as name resolution (DNS), web access (HTTP) and file transfer. In real implementations these three layers are rarely separate: a web browser and its TLS library together do the work of all three.

Exam alert

Know the PDU names cold: bits (L1), frames (L2), packets (L3), segments (L4 TCP; UDP's PDU is often called a datagram) and data (L5–7). Also know the classic device mapping: hub = L1, switch = L2, router = L3. Note that the Application layer is not the application itself (a browser), but the protocol (HTTP) it uses.

2.3 The TCP/IP Model

The TCP/IP model describes the protocol suite the internet actually runs, defined by the IETF in RFCs. Older texts (and RFC 1122) show four layers, merging physical and data link into a single Link (or Network Access) layer. Most modern references, including Cisco's courseware, use a five-layer “updated” TCP/IP model that keeps physical and data link separate. Either way, the top three OSI layers collapse into a single Application layer.

Http, dns, dhcp, ssh

Transport

Tcp, udp

Upper OSI layers 5–7 map to the single TCP/IP Application layer

Figure 2-1 The OSI model compared with the five-layer and original four-layer TCP/IP models.

Tip

Engineers use OSI numbers even when talking about TCP/IP protocols. “Layer 3” means IP, “Layer 4” means TCP/UDP, and “Layer 7” means the application protocol. You will rarely hear anyone talk about Layers 5 and 6 in daily work.

2.4 Encapsulation and Decapsulation

When an application sends data, each layer on the way down adds its own control information, normally as a header in front of the data (and at Layer 2 also a trailer). This process is called encapsulation. The unit of data at each layer, header plus payload, is that layer's protocol data unit (PDU). Follow a web request in Figure 2-2:

  • 1. Application: the browser creates an HTTP GET request. This is the data.
  • 2. Transport: TCP adds a header with source port (for example 49832) and destination port 443, plus sequence and acknowledgment numbers. The result is a segment.
  • 3. Network: IP adds a header with source and destination IP addresses and a TTL. The result is a packet.
  • 4. Data link: Ethernet adds a header with destination and source MAC addresses and an EtherType, plus an FCS trailer. The result is a frame.
  • 5. Physical: the NIC transmits the frame as a stream of bits.

At the receiver, decapsulation reverses the process. Each layer reads and acts on its own header, removes it, and passes the payload up to the layer identified by a field in that header: the EtherType says “this is IPv4” (0x0800), the IP Protocol field says “this is TCP” (6), and the TCP destination port says “this is for the web server” (443).

  • L7 Data HTTP request (data)
  • L4 Segment TCP hdr Data
  • L3 Packet IP hdr TCP hdr Data
  • L2 Frame Eth hdr IP hdr TCP hdr Data FCS
  • L1 Bits 0101011101001010111010100101110100101011101
  • encapsulation (sender)

The receiver reverses the process (decapsulation), stripping one header per layer.

Figure 2-2 Encapsulation: each layer adds its header; Ethernet also adds the FCS trailer.

2.4.1 Same-layer and adjacent-layer interaction

Two kinds of interaction make the layered model work. Adjacent-layer interaction happens within one device: each layer provides a service to the layer above and uses the service of the layer below. TCP asks IP to deliver a segment to an address; IP asks Ethernet to deliver a packet to the next-hop MAC. Same-layer interaction happens between devices: a layer on one host communicates with the same layer on the other host through the header it adds. The TCP header written by the client is read only by TCP on the server; the IP header is read by IP on each router and on the server.

Figure 2-3 Adjacent-layer interaction occurs inside a host; same-layer interaction occurs between hosts through headers.

2.5 Three Headers You Must Know

You do not need to memorise every bit of every header for the CCNA, but you must recognise the important fields and what they do. The diagrams below follow the RFC convention: each row is 32 bits wide, and the number in each field is its size in bits (or bytes for Ethernet).

2.5.1 The Ethernet II frame

Ethernet adds a 14-byte header and a 4-byte trailer, 18 bytes of overhead in total. The preamble and start frame delimiter (SFD) precede the frame to synchronise the receiver; they are usually not counted as part of the frame. The EtherType identifies the payload: 0x0800 for IPv4, 0x86DD for IPv6, 0x0806 for ARP. (In the original IEEE 802.3 format this field holds a length when its value is 1500 or less.) The payload must be 46 to 1500 bytes, so a full frame is 64 to 1518 bytes; shorter payloads are padded. The FCS carries a 32-bit CRC computed over the frame; a receiver that calculates a different value discards the frame and increments its CRC error counter.

Preamble

Sfd

Destination

Mac 6

Source

Mac 6

Type

Data (payload)

46–1500

Fcs

  • field sizes in bytes
  • not counted in frame 14-byte header trailer
  • Frame size (Destination MAC through FCS): 64–1518 bytes

Figure 2-4 The Ethernet II frame. EtherType 0x0800 = IPv4, 0x86DD = IPv6, 0x0806 = ARP.

2.5.2 The IPv4 header

The IPv4 header is normally 20 bytes (up to 60 with options). The fields you should know are: Version (4); IHL, header length in 32-bit words (5 with no options); DSCP, the 6-bit QoS marking (Chapter 27); Total Length of header plus data (max 65,535); Identification, Flags and Fragment Offset, used for fragmentation; Time to Live (TTL), decremented by each router, with the packet discarded at 0 to stop loops; Protocol, identifying the payload (1 = ICMP, 6 = TCP, 17 = UDP, 89 = OSPF); a Header Checksum; and the 32-bit Source and Destination addresses.

0 8 16 24 31

Version

Ihl

Dscp

Ecn

Total Length

Identification

Flags

Fragment Offset

Time to Live

Protocol

Header Checksum

Source IP Address

Destination IP Address

Options (variable, rarely used) + padding

Minimum header = 5 rows x 32 bits = 20 bytes

Figure 2-5 The IPv4 header. Numbers show field widths in bits.

2.5.3 The TCP header

The TCP header is also normally 20 bytes. The 16-bit source and destination ports identify the applications (so ports range from 0 to 65,535). The 32-bit sequence and acknowledgment numbers provide ordering and reliable delivery. Data Offset gives the header length. The flags control the connection: SYN starts it, ACK acknowledges, FIN closes it gracefully, RST aborts it, and PSH and URG affect delivery. The Window field implements flow control by telling the sender how many bytes the receiver can accept. UDP, by contrast, has a tiny 8-byte header: source port, destination port, length and checksum. Chapter 5 covers TCP and UDP behaviour in detail.

0 8 16 24 31

Source Port

Destination Port

Sequence Number

Acknowledgment Number

Offset

Reserved

Cwr ece urg ack

PSH RST SYN FIN (8)

Window

Checksum

Urgent Pointer

Options (e.g., MSS, window scale) + padding

Minimum header = 20 bytes. Compare UDP: 8 bytes (ports, length, checksum)

Figure 2-6 The TCP header. Numbers show field widths in bits.

Exam alert

Header sizes to remember: Ethernet header 14 bytes + 4-byte FCS; IPv4 20 bytes minimum; IPv6 40 bytes fixed; TCP 20 bytes minimum; UDP 8 bytes. The default Ethernet MTU (maximum IP packet size) is 1500 bytes.

2.6 A Packet's Journey Across Routers

Now combine everything. In Figure 2-7, PC1 (10.1.1.10) opens a web page on Server (10.3.3.20). The two are on different subnets, so PC1 must send the packet to its default gateway, R1. Watch what changes and what stays the same.

10.1.1.10

Mac 0050.7966.6800

Ttl 128

IP src 10.1.1.10

IP dst 10.3.3.20

Ttl 127

IP src 10.1.1.10

IP dst 10.3.3.20

Ttl 126

new L2 header per link

MAC addresses change at every hop; IP addresses stay the same; TTL decreases by 1 per router.

Figure 2-7 A packet crossing two routers. Each router removes the old frame and builds a new one for the next link.

  • 1. PC1 decides where to send. It compares the destination 10.3.3.20 with its own subnet (10.1.1.0/24). The destination is remote, so the next hop is the default gateway 10.1.1.1. PC1 uses ARP (Section 2.7) to learn R1's MAC address, then sends a frame addressed to R1's MAC but carrying a packet addressed to the server's IP.
  • 2. R1 receives the frame. It checks the FCS, sees that the destination MAC is its own, reads the EtherType (IPv4) and discards the Ethernet header and trailer. It looks up 10.3.3.20 in its routing table and finds next hop 10.0.12.2 out G0/1. It decrements TTL (and recalculates the header checksum).
  • 3. R1 builds a new frame with its G0/1 MAC as source and R2's MAC (from its ARP cache) as destination, and sends it.
  • 4. R2 repeats the process. The destination is on its directly connected G0/0 subnet, so R2 ARPs for the server itself and delivers the frame to the server's MAC.
  • 5. The server decapsulates up to TCP port 443 and hands the request to the web service. The reply follows the same logic in reverse.

Watch out

A host never puts a remote host's MAC address in a frame. If the destination is in another subnet, the destination MAC is always the default gateway's MAC. Without NAT, the source and destination IP addresses do not change along the path.

2.7 ARP: Linking Layer 3 to Layer 2

To build a frame, a device needs the next hop's MAC address, but it usually knows only the IP address. The Address Resolution Protocol (ARP), defined in RFC 826, solves this for IPv4. (IPv6 uses Neighbor Discovery instead; see Chapter 9.)

  • 1. The sender checks its ARP cache. If an entry exists, it uses it.
  • 2. If not, it broadcasts an ARP Request in a frame with destination MAC ffff.ffff.ffff and EtherType 0x0806: “Who has 10.1.1.1? Tell 10.1.1.10.” The request includes the sender's own IP and MAC.
  • 3. Every device in the broadcast domain receives the request, but only the owner of 10.1.1.1 answers, with a unicast ARP Reply containing its MAC. It also caches the requester's mapping.
  • 4. The sender stores the mapping and sends the queued packet.

PC1 10.1.1.10 R1 10.1.1.1

PC3 (ignores request)

  • 1. ARP Request (broadcast)

dst ffff.ffff.ffff · Who has 10.1.1.1?

  • 2. ARP Reply (unicast)

Figure 2-8 ARP resolves R1's IP address to its MAC: a broadcast request and a unicast reply.

ARP entries age out so the cache does not hold stale data: Cisco IOS keeps dynamic entries for 4 hours by default, while Windows and Linux typically keep them for well under a minute to a few minutes unless refreshed. A router's own interface addresses appear in its ARP table with no age (shown as - ). Related behaviours worth recognising are gratuitous ARP, an unsolicited reply a device sends to announce or update its own mapping (used by FHRPs after failover), and proxy ARP, where a router answers on behalf of a host in another subnet. R1 — console / PC1 — Command Prompt

R1# show ip arp
  • Protocol Address Age (min) Hardware Addr Type Interface
  • Internet 10.0.12.1 - 5254.0012.3457 ARPA GigabitEthernet0/1
  • Internet 10.0.12.2 12 5254.00ab.cd01 ARPA GigabitEthernet0/1
  • Internet 10.1.1.1 - 5254.0012.3456 ARPA GigabitEthernet0/0
  • Internet 10.1.1.10 3 0050.7966.6800 ARPA GigabitEthernet0/0
C:\> arp -a
  • Interface: 10.1.1.10 --- 0xb
  • Internet Address Physical Address Type
  • 10.1.1.1 52-54-00-12-34-56 dynamic
  • 10.1.1.255 ff-ff-ff-ff-ff-ff static
  • 224.0.0.22 01-00-5e-00-00-16 static
  • 255.255.255.255 ff-ff-ff-ff-ff-ff static

Figure 2-9 The ARP cache on R1 and on PC1. Note the different MAC formats: Cisco uses dotted groups of four hex digits;

Windows uses hyphen-separated pairs. Output is illustrative of IOS 15/IOS XE and Windows 10/11.

LAB Watch encapsulation and ARP in action

Goal: Observe ARP and see which headers change as a packet crosses a router. Topology: PC1 — SW1 — R1 — R2 — Server, addressed as in Figure 2-7, with a static route on each router (or use the routers' preconfigured routes from the lab file). In Packet Tracer the routers can be 4331 or 2911 models.

Steps:

  • 1. On R1, clear the cache and confirm it holds only local entries:
R1# clear ip arp 10.1.1.10
R1# show ip arp
  • 2. On PC1, run arp -d (Packet Tracer: arp -d ) and then arp -a to confirm the cache is empty.
  • 3. Switch to Simulation mode, filter for ARP and HTTP, and browse from PC1 to http://10.3.3.20 .
  • 4. Step through the events. Open the first ARP frame and confirm the destination MAC is FFFF.FFFF.FFFF . Open the HTTP PDU on each link and record the Ethernet source/destination, IP source/destination and TTL.

Verify: show ip arp on R1 now lists PC1's MAC; arp -a on PC1 lists R1's MAC (not the server's).

Expected result: Your recorded values match Figure 2-7: three different pairs of MAC addresses, one constant pair of IP addresses, and a TTL that drops by one at each router. Chapter review

Mtu

  • Time to Live (TTL)
  • Protocol field
  • port number
  • TCP flags
  • default gateway

Arp

  • ARP cache
  • gratuitous ARP
  • proxy ARP
  • 1. Which OSI layer is responsible for logical addressing and path selection?
  • A. Data link
  • B. Network
  • C. Transport
  • D. Session
  • 2. What is the PDU at the data link layer called?
  • A. Segment
  • B. Packet
  • C. Frame
  • D. Bits
  • 3. Which two OSI layers are combined into the Link layer of the original four-layer TCP/IP model? (Choose two.)
  • A. Physical
  • B. Network
  • C. Data link
  • D. Transport
  • E. Session
  • 4. A receiving host reads a frame with EtherType 0x0800. To which protocol does it pass the payload?
  • A. ARP
  • B. IPv6
  • C. IPv4
  • D. TCP
  • 5. Which IPv4 header field prevents packets from looping forever?
  • A. Identification
  • B. Header Checksum
  • C. Protocol
  • D. Time to Live
  • 6. What is the minimum size of an IPv4 header without options?
  • A. 8 bytes
  • B. 14 bytes
  • C. 20 bytes
  • D. 40 bytes
  • 7. Which two fields are found in the TCP header but not in the UDP header? (Choose two.)
  • A. Source port
  • B. Sequence number
  • C. Checksum
  • D. Window
  • E. Destination port
  • 8. A TCP segment on a client is read only by TCP on the server. Which concept does this describe?
  • A. Adjacent-layer interaction
  • B. Same-layer interaction
  • C. Decapsulation
  • D. Segmentation
  • 9. PC1 (10.1.1.10/24) sends a packet to 10.3.3.20. Which destination MAC address does PC1 put in the frame?
  • A. The server's MAC address
  • B. ffff.ffff.ffff
  • C. The MAC address of its default gateway
  • D. Its own MAC address
  • 10. As a packet is routed from source to destination without NAT, which two values change at each router hop? (Choose two.)
  • A. Source IP address
  • B. Destination MAC address
  • C. Destination IP address
  • D. Source MAC address
  • E. TCP destination port
  • 11. How is an ARP Request delivered?
  • A. Unicast to the default gateway
  • B. Multicast to all routers
  • C. Broadcast to all devices in the broadcast domain
  • D. Unicast to the DNS server
  • 12. In show ip arp output, an entry shows a hyphen ( - ) in the Age column. What does that indicate?
  • A. The entry has expired
  • B. The address belongs to one of the router's own interfaces
  • C. The entry was learned by proxy ARP
  • D. The entry is incomplete
  • 13. Which device type operates primarily at OSI Layer 1?
  • A. Hub
  • B. Switch
  • C. Router
  • D. Firewall

Answers

  • 1. B. The network layer (Layer 3) provides IP addressing and routing. Data link handles delivery on one link; transport handles end-to-end application delivery.
  • 2. C. Layer 2 PDUs are frames. Segments are Layer 4, packets Layer 3, bits Layer 1.
  • 3. A, C. RFC 1122's Link (Network Access) layer covers both physical and data link functions.
  • 4. C. 0x0800 is IPv4. ARP is 0x0806 and IPv6 is 0x86DD; TCP is identified by the IP Protocol field, not the EtherType.
  • 5. D. Each router decrements TTL and discards the packet when it reaches 0, so routing loops cannot circulate packets forever.
  • 6. C. IPv4 headers are 20 bytes minimum. 8 bytes is UDP, 14 bytes the Ethernet header, 40 bytes the IPv6 header.
  • 7. B, D. Sequence numbers and the window field support TCP's reliability and flow control. Both headers have ports and a checksum.
  • 8. B. Same-layer interaction is communication between the same layer on two devices through that layer's header.
  • 9. C. The destination is in another subnet, so the frame goes to the default gateway's MAC. A host never uses a remote host's MAC.
  • 10. B, D. Each router builds a new Ethernet header with new source and destination MACs. IP addresses and ports stay the same (TTL also decrements).
  • 11. C. ARP Requests are broadcast to ffff.ffff.ffff ; the Reply is unicast.
  • 12. B. The router's own interface addresses are listed without an age because they never time out.
  • 13. A. A hub repeats bits out all ports without reading addresses, so it is a Layer 1 device. Switches are Layer 2 and routers Layer 3.
Use ← → to move between sections