Network Layers and Why They Matter

Lesson 1: Network Layers and Why They Matter

A Network is a set of devices that can send and receive data. That's the simple version. The useful version is that networks are designed in layers, where each layer solves a specific problem and trusts the layer below it to handle its own concerns. Understanding the layered model isn't academic. It is the framework that makes everything else in networking comprehensible.

Why layers exist

When data leaves your browser and reaches a web server, a lot is happening: your application creates a request, your operating system wraps it in transport information, the network stack adds addressing, the physical link carries actual signals, and then the whole process reverses on the other side. Instead of one enormous system that tries to do all of that at once, engineers split the problem into layers.

The benefits of layered design:

• Each layer has a clear job. The transport layer doesn't worry about which physical cable carries the bits; the physical layer doesn't worry about which application sent the data.
• Layers can be replaced independently. Wi-Fi replaced Ethernet at the physical layer without changing how applications work.
• Defenders can reason at the right level. A firewall rule operates at the network/transport layer; a web application firewall operates at the application layer. Knowing which layer you're at clarifies what you can and can't see.
• Problems decompose cleanly. "DNS is broken" and "the network cable is unplugged" are problems at very different layers, with very different fixes.

The layer abstraction is one of computing's most important ideas. It shows up everywhere. Operating systems, programming languages, security architectures, but networking is where most people first encounter it.

The OSI model

The OSI Model is a 7-layer reference model used heavily in textbooks and certifications. From bottom to top:

1. Physical - actual signals on cables, fiber, or radio.
2. Data Link - frames between directly connected devices (Ethernet, Wi-Fi).
3. Network - addressing and routing across networks (IP).
4. Transport - end-to-end communication (TCP, UDP).
5. Session - managing connections (less commonly referenced).
6. Presentation - data formatting (less commonly referenced).
7. Application - what users actually interact with (HTTP, DNS, SSH).

Real networks don't strictly follow OSI's 7 layers. The model is a teaching tool. The ones that matter most in practice are layers 1-4 and 7.

The TCP/IP model

The TCP/IP Model (also called the Internet model) has 4 layers and matches actual implementations more closely:

1. Link - physical and data link combined (Layer 1-2 of OSI).
2. Internet - IP addressing and routing (Layer 3 of OSI).
3. Transport - TCP, UDP (Layer 4 of OSI).
4. Application - HTTP, DNS, SSH, etc. (Layers 5-7 of OSI).

For most defensive work, TCP/IP layers are the practical model. When someone says "Layer 3 firewall," they mean a firewall operating at the network layer (IP addresses). When someone says "Layer 7 inspection," they mean looking at application-layer content.

Encapsulation

Encapsulation is the mechanism by which layered networking actually works. As data moves down the stack at the sender:

• Application creates the data ("GET /index.html HTTP/1.1").
• Transport wraps it with a header (TCP source port, destination port, sequence number).
• Internet layer wraps that with another header (source IP, destination IP).
• Link layer wraps that with yet another header (source MAC, destination MAC).
• Physical layer transmits the resulting signals.

At the receiver, each layer unwraps its header and passes the contents up. The final application sees just the original data ("GET /index.html HTTP/1.1"). The layers below were transparent.

This wrapping is why you'll see different terms for the same data at different layers:

• A Packet is what data looks like at the IP layer.
• A Frame is what it looks like at the link layer.
• A segment is what it looks like at the TCP layer.
• A datagram is what it looks like at the UDP layer.

These aren't different things. They are the same data with different headers depending on which layer you're looking at.

Protocols

A Protocol is the set of rules for communication at a particular layer. IP is a protocol. TCP is a protocol. HTTP is a protocol. DNS is a protocol. Each defines what the messages look like and what the participants are supposed to do.

Some protocols you'll encounter constantly as a defender:

• IP (Internet Protocol) - the network layer, handles addressing and routing.
• TCP (Transmission Control Protocol) - reliable, connection-oriented transport.
• UDP (User Datagram Protocol) - unreliable, connectionless transport.
• ICMP (Internet Control Message Protocol) - control messages (ping is the most familiar).
• HTTP/HTTPS - web traffic.
• DNS - name resolution.
• SSH - secure remote access.
• TLS - encryption layer used by HTTPS, modern email, and many other things.

You don't need to memorize protocols. You'll learn them by encountering them in real evidence. Log lines, packet captures, firewall rules. What matters is recognizing that each protocol does a specific job at a specific layer, and that defensive tools work at specific layers.

Why layers matter for defenders

A few practical implications:

• What can you see at this layer? A firewall at Layer 3 sees IPs and ports but not application content. To inspect content, you need Layer 7 capability.
• What does this control affect? Network segmentation operates at Layer 2-3; SSL inspection at Layer 7. Different controls produce different security properties.
• Where does encryption apply? TLS encrypts at the application layer (technically session/presentation in OSI). Network-layer telemetry sees that traffic is happening and to whom, not what's inside.
• Where do attackers operate? Some attacks happen at low layers (ARP spoofing at Layer 2, DDoS at Layer 3-4). Most modern attacks happen at the application layer where the business logic lives.

The mental model: when you encounter a security control, ask what layer it operates at and what visibility it has. When you encounter an attack, ask what layer it targets and what defenses at that layer would catch it.

Worked example: tracing a simple HTTP request

You type https://example.com in your browser. What happens?

Application layer:

• Browser determines it needs to connect to example.com on port 443 (HTTPS).
• Application layer prepares an HTTP request.

Transport layer:

• TCP creates a connection to example.com:443.
• The TCP segment is built with source port (random high port) and destination port (443).

Internet layer:

• The TCP segment is wrapped in an IP packet.
• DNS resolution determined example.com's IP address (a separate process at application layer).
• IP packet has source IP (your address) and destination IP (example.com's address).

Link layer:

• IP packet is wrapped in an Ethernet frame (or Wi-Fi frame).
• Frame goes to the local router (your default gateway), which figures out where to send it next.

Physical layer:

• Frame is transmitted as actual signals on cable or radio.

Then the whole thing reverses at the destination. The web server's network stack unwraps each layer and delivers the HTTP request to the web server software, which generates a response that goes back through the same layers in reverse.

For a defender, this means:

• A network capture (tcpdump) sees the IP packets and TCP segments.
• A web proxy sees the HTTP request (after TLS termination if applicable).
• A firewall might allow or block based on IP/port (Layer 3-4).
• A DNS server log would show the resolution that happened first.
• An EDR might see the application that initiated the request.

Each tool sees a slice of what happened. Combining them produces the full picture.

NB: The layered model is the foundation of every other networking concept. Get comfortable with it now and the rest of this course is straightforward; struggle with it and everything downstream will feel arbitrary. When you encounter a tool, control, or attack, ask "what layer does this operate at?". The answer often clarifies what's possible and what isn't.

Concepts taught: Network, Network Layer Model, OSI Model, TCP/IP Model, Encapsulation, Packet, Frame, Protocol.