The OSI Model and TCP/IP: What Layers Actually Mean

Imagine a seven-story mail-sorting building. Every parcel that arrives climbs to the top floor, and each floor does exactly one job: one floor checks the street address, another decides which truck it rides, another opens the box and checks nothing broke in transit, another hands the letter to the right person at the right desk. Nobody on any floor does anyone else's job — and that division is the whole secret of how big systems get fixed fast. When a package goes missing, you don't search the entire building. You ask which floor handles the step where it vanished — and you walk straight there. Computer networks work the same way, and the floors have names you will use for the rest of your career.

Here's the puzzle.

Scenario. You're the on-call tech at a small company on a Monday morning. Three users report three different problems within thirty minutes, and the help desk hands you three exhibits — a light report, an address listing, and a short capture. The boss wants one thing: for each symptom, which floor of the building is broken, and what single line proves it.

Given artifacts. The office network (hover any device for details):

The three exhibits:

Exhibit A — Monday 8:02 AM, Alice's desk (PC-A)
  Alice's screen: "Network cable unplugged."
  SW-1 link lights: Port 1 (PC-A): OFF · Port 2 (PC-B): ON · Port 3 (PC-C): ON · Port 24 (uplink): ON

Exhibit B — Monday 8:15 AM, Bob's desk (PC-B)
  PC-B:  address 192.168.2.50, mask 255.255.255.0, gateway 192.168.1.1
  PC-C:  address 192.168.1.75, mask 255.255.255.0, gateway 192.168.1.1
  R-1 LAN: address 192.168.1.1, mask 255.255.255.0
  Bob: "My cable is plugged in and the light is on, but I can't reach anyone — not even the printer."

Exhibit C — Monday 8:31 AM, Carol's desk (PC-C), short capture on the office LAN
  1  0.000  192.168.1.75 → 192.168.1.10  TCP  [SYN] Seq=0        (Carol knocks)
  2  0.001  192.168.1.10 → 192.168.1.75  TCP  [RST, ACK]         (server slams the door)
  Carol: "The server answers my knock by slamming the door."

Your task: For each of the three symptoms (A, B, C), write down (1) the layer number (1–7) where the fault lives, and (2) the single exhibit line that proves it. Three symptoms → three layer numbers + three quoted lines.

Workspace: Analyze-and-answer — type your three answers below (e.g. A → Layer __, proof: "..."), then check the commitment box to reveal the worked answer.

☐ I've attempted this challenge and thought it through. (Checking reveals the worked answer in S7 — honor system: the page hides it until you commit.)

The seven floors, one job each

The OSI model (a standard map that splits all of networking into seven stacked jobs, so engineers everywhere mean the same thing by "layer 3") reads top to bottom like this — each floor does exactly one job and trusts the floors below it:

• Layer 7 — Application: the program's own data. A web page, an email, a file. This floor belongs to the software, not the network.
• Layer 6 — Presentation: translating and protecting the data — turning it into an agreed format, scrambling it so snoopers can't read it.
• Layer 5 — Session: managing the conversation itself — who talks when, and how to resume if it drops.
• Layer 4 — Transport: chopping data into pieces, numbering them, and making sure every piece arrives (or admitting it didn't). This is also where the port lives — the number that says which program on the computer should get the data (you met ports in Lesson 1.2; think of them as apartment numbers inside one street address).
• Layer 3 — Network: addressing and finding paths between networks. The IP address lives here, and so does the decision of which road a packet takes.
• Layer 2 — Data Link: delivering between machines that are directly connected — same cable, same switch. The hardware (MAC) address lives here, and so does the frame (the envelope that carries a packet across one hop, from Lesson 1.2).
• Layer 1 — Physical: raw bits as signals — electricity on copper, light in fiber, radio waves in the air. Cables, plugs, and link lights.

Why this matters for the challenge: the three Monday-morning symptoms each break on a different floor. You'll match them in the worked answer — for now, just notice how different a dead light looks from a wrong number.

The four-floor version engineers actually use

Nobody troubleshoots with all seven floors every day. Working engineers use the simpler TCP/IP model (the practical four-layer map the real internet was built on), which merges some floors:

When someone says "that's a layer 3 problem," they mean the Internet layer — addressing and paths. When they say "layer 2," they mean the local link — the switch, the cable, the hardware addresses. You'll hear both models; they describe the same building, one with seven floors and one with four.

Why this matters for the challenge: your answers only need the seven-floor numbers, but the four-floor map is what you'll actually use on the job — learn to translate between them now.

Down the stack: wrapping. Up the stack: unwrapping.

Encapsulation (wrapping each message in layer after layer of envelopes, which you built by hand in Lesson 1.2) is the floors doing their jobs in order. On the sending computer, the message starts at the top and travels down: the Transport floor adds its header (ports, piece numbers) making a segment (a chopped-up piece of the conversation with a transport header); the Network floor adds its header (source and destination IP addresses) making a packet; the Data Link floor adds its header (hardware addresses) making a frame; the Physical floor turns it all into signals.

On the receiving computer the journey runs in reverse — up the stack. Each floor reads only its own header, strips it off, and hands what's left upward. The Transport floor never looks at IP addresses; the Network floor never looks at ports. That strict "read only your own envelope" rule is what makes the whole system debuggable: any header in a capture belongs to exactly one floor.

Why this matters for the challenge: when you read a capture line, the field names tell you which floor you're standing on — IP addresses mean floor 3, port numbers mean floor 4.

The troubleshooting ladder: always start at the bottom

Here's the working rule that turns the model into a tool: check from the bottom up, and never blame a high floor until the low floors are proven healthy. The intuition, floor by floor:

• Floor 1 broken (cable unplugged, dead port, no light): nothing can work, and no address or program setting will fix it. Symptom: total silence.
• Floor 2 broken (wrong cable type, switch port misbehaving): neighbors can't reach each other even though everything is plugged in.
• Floor 3 broken (wrong IP address, wrong subnet, missing gateway): the machine is on the wire but has the wrong "street address" — it can't be found, or it can't find the way out. Routing (choosing the path a packet takes between networks) lives here too.
• Floor 4 broken (the conversation itself rejected): addresses are correct and the path works, but the two programs can't agree — a refused connection, a reset.
• Floors 5–7 broken: the network delivered everything perfectly and the program itself is misbehaving — a login failure, a corrupt file.

Notice the pattern: each floor's symptoms assume the floors below it work. That's what makes the ladder powerful — you climb until the symptoms stop matching, and the fault is on the rung where they start.

Why this matters for the challenge: you'll climb this exact ladder three times in the worked answer (S7) — once per symptom.

Layers vs. protocols: the table

A protocol (an agreed set of rules for doing one specific job — like the rules of a handshake) lives on exactly one floor. That's why "which protocol?" and "which layer?" are nearly the same question:

So "TCP" isn't a layer — it's a protocol that lives on layer 4. "IP" isn't a layer — it's a protocol on layer 3. Keeping that straight is half the battle: layers are the floors, protocols are the workers on each floor.

Why this matters for the challenge: the proof lines in the exhibits name protocols and fields (TCP, RST, addresses) — this table converts those names into floor numbers.

• Troubleshoot bottom-up: prove the physical path before suspecting addresses, and addresses before suspecting conversations.
• Each layer wraps on the way down and strips only its own wrapper on the way up — so every header field in a capture belongs to exactly one layer.
• Layer 3 moves packets between networks with IP addresses; layer 2 moves frames between direct neighbors with hardware addresses.
• A refused connection (a reset answering a knock) means the path and addresses worked and the conversation itself was rejected — that's layer 4, not a dead cable.
• The 4-layer TCP/IP map is the working tool; the 7-layer OSI map is the shared vocabulary — both describe the same journey.

Next: TCP vs UDP and the Three-Way Handshake — You now know which floor every problem lives on; next you'll step onto floor 4 and watch two computers shake hands — agreeing on the rules — before they trust each other with a single byte.