Demystifying Computer Networking: The OSI 7-Layer Model Explained with Wireshark Dissections

Developed by the International Organization for Standardization (ISO) in 1984, the Open Systems Interconnection (OSI) reference model provides a conceptual framework to describe how data travels across a network from an application on one device to an application on another.

While modern networks run on the simplified TCP/IP stack, the 7-layer OSI model remains the foundational blueprint for protocol design, network architecture, and structured troubleshooting.

OSI Layer	Protocol Data Unit (PDU)	Examples
7. Application	Data	HTTP, DNS, SSH, SMTP
6. Presentation	Data	SSL/TLS, ASCII, JPEG
5. Session	Data	NetBIOS, RPC, SOCKS
4. Transport	Segment (TCP) / Datagram (UDP)	TCP, UDP
3. Network	Packet	IPv4, IPv6, ICMP
2. Data Link	Frame	Ethernet, Wi-Fi, ARP
1. Physical	Bits	Cables, Fiber, RF

Detailed Breakdown of the 7 Layers

Layer 7: Application Layer

Function: Serves as the window through which software applications interact with network services. It generates human-readable data intended for network transmission.
PDU: Data
Key Protocols: HTTP/HTTPS, DNS, FTP, SMTP, SSH, DHCP.
Real-World Usage: Requesting a webpage in a web browser, querying a domain name, or transferring files over SFTP.

Layer 6: Presentation Layer

Function: Handles data syntax translation, data formatting, encryption/decryption, and compression. It ensures that data sent from the application layer of one system is readable by the destination application layer.
PDU: Data
Key Standards: SSL/TLS, ASCII, JPEG, PNG, MPEG, MP3.
Real-World Usage: Encrypting user credentials using TLS before sending them over HTTPS, or decompressing an incoming zip archive.

Layer 5: Session Layer

Function: Establishes, coordinates, maintains, and terminates communication sessions between endpoints. It controls full-duplex or half-duplex operations and manages session checkpoints.
PDU: Data
Key Protocols: NetBIOS, PPTP, RPC, SOCKS.
Real-World Usage: Maintaining a logged-in state across multiple HTTP requests without forcing the user to re-authenticate on every sub-page.

Layer 4: Transport Layer

Function: Manages end-to-end transport control, segmentation, error detection, and flow control. It uses process-specific port numbers to route data to the correct application on the host machine.
PDU: Segment (TCP) or Datagram (UDP)
Key Protocols: TCP (Reliable, connection-oriented), UDP (Fast, connectionless).
Real-World Usage: TCP guarantees lossless delivery during a web file download, whereas UDP handles low-latency live video streaming.

Layer 3: Network Layer

Function: Handles logical addressing (IP addresses) and path determination across routing domains. It determines the optimal route for data packets to traverse multiple interconnected networks.
PDU: Packet
Key Protocols: IPv4, IPv6, ICMP, IPsec, OSPF, BGP.
Real-World Usage: A router inspecting the destination IP address of an incoming packet to determine which outbound interface to use across the internet.

Layer 2: Data Link Layer

Function: Facilitates node-to-node transfer across a local physical medium. It manages physical addressing (MAC addresses), frame construction, and error detection on the local link.
PDU: Frame
Key Standards: Ethernet (IEEE 802.3), Wi-Fi (IEEE 802.11), ARP, PPP.
Real-World Usage: A local network switch reading the destination MAC address of an Ethernet frame to deliver it to the correct port within a local subnet.

Layer 1: Physical Layer

Function: Converts digital bits into physical signals (electrical pulses, light signals, or radio waves) and transmits them across physical media.
PDU: Bits (1s and 0s)
Key Hardware/Standards: Category 6 Ethernet Cables, Single-mode/Multi-mode Fiber Optics, Network Interface Cards (NICs), Signal Repeaters.
Real-World Usage: High-frequency electrical impulses traversing a twisted-pair copper cable or light pulses passing through a fiber cable.

Wireshark Packet Dissection Guidelines

Wireshark captures network frames and organizes protocol headers hierarchically. Although Wireshark displays data using the practical TCP/IP implementation, every layer in the frame details pane directly corresponds to a specific layer in the OSI reference model.

Below is a detailed dissection of an unencrypted HTTP GET Request captured in Wireshark.

Sample Wireshark Packet Capture Details

Frame 42: 524 bytes on wire (4192 bits), 524 bytes captured on interface eth0
Ethernet II, Src: Micro-Star_01:02:03 (00:11:22:33:44:55), Dst: Router_aa:bb:cc (66:77:88:99:aa:bb)
Internet Protocol Version 4, Src: 192.168.1.50, Dst: 93.184.216.34
Transmission Control Protocol, Src Port: 54321, Dst Port: 80, Seq: 1, Ack: 1, Len: 458
Hypertext Transfer Protocol
    GET /index.html HTTP/1.1\r\n
    Host: example.com\r\n
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)\r\n
    Accept: text/html,application/xhtml+xml\r\n
    \r\n

Mapping Wireshark Output to the OSI Model

1. Layer 1 (Physical)

Wireshark Line: Frame 42: 524 bytes on wire (4192 bits), 524 bytes captured on interface eth0
Dissection Analysis: This metadata block represents Physical Layer properties captured by the Network Interface Controller (NIC). It shows frame length in bits/bytes, arrival timestamps, and the hardware interface used (eth0).

2. Layer 2 (Data Link)

Wireshark Line: Ethernet II, Src: Micro-Star_01:02:03 (00:11:22:33:44:55), Dst: Router_aa:bb:cc (66:77:88:99:aa:bb)
Dissection Analysis:
- Source MAC Address (00:11:22:33:44:55): Hardware address of the originating machine.
- Destination MAC Address (66:77:88:99:aa:bb): Hardware address of the next hop (e.g., local gateway router).
- EtherType (0x0800): Indicates that the encapsulated payload inside this frame belongs to the IPv4 protocol.

3. Layer 3 (Network)

Wireshark Line: Internet Protocol Version 4, Src: 192.168.1.50, Dst: 93.184.216.34
Dissection Analysis:
- Source IP (192.168.1.50): Logical IP address of the originating local host.
- Destination IP (93.184.216.34): Logical IP address of the web server (example.com).
- Time to Live (TTL): Prevents infinite routing loops across autonomous systems.
- Protocol (6): Signals Layer 3 that the enclosed payload is governed by TCP.

4. Layer 4 (Transport)

Wireshark Line: Transmission Control Protocol, Src Port: 54321, Dst Port: 80, Seq: 1, Ack: 1, Len: 458
Dissection Analysis:
- Source Port (54321): An ephemeral port assigned dynamically by the host operating system.
- Destination Port (80): Well-known target port reserved for HTTP services.
- Sequence / Acknowledgment Numbers: Controls byte stream ordering, integrity verification, and retransmissions.

5, 6 & 7. Layers 5, 6, and 7 (Session, Presentation, Application)

Wireshark Line: Hypertext Transfer Protocol
Dissection Analysis:
- Layer 5 (Session): Managed implicitly through the ongoing TCP state machine and persistent connection keep-alives.
- Layer 6 (Presentation): Interprets plain-text ASCII encoding and header structures (or TLS handshake negotiation fields in encrypted HTTPS sessions).
- Layer 7 (Application): The actual application payload displaying the method GET /index.html, target host header (example.com), and client User-Agent string.

Troubleshooting Workflow Using the OSI Model

When diagnosing network disruptions, adopting an OSI-guided isolation path prevents guesswork:

Physical / Link Layer Failures (Layers 1–2): Look for interface status errors, excessive CRC frame collisions, or missing ARP resolution table entries in Wireshark.
Network Address Failures (Layer 3): Look for ICMP Destination Host Unreachable responses or misconfigured IP routing tables.
Transport / Port Failures (Layer 4): Search Wireshark captures for TCP RST (Reset) flags or excessive retransmissions indicating closed ports or firewall drops.
Application / Data Integrity Failures (Layers 5–7): Analyze application status responses, such as HTTP 404 Not Found, HTTP 500 Internal Server Error, or TLS certificate handshake failures.