OSI and TCP/IP Models
Layer questions are usually device questions or troubleshooting questions in disguise. Knowing which layer a device operates at tells you what it can and cannot see, which is what the question is really asking.
OSI and TCP/IP Models · firsttry.app/cheatsheets/osi-model · original reference written from published exam objectives. Not affiliated with any certification body.
The seven layers
| Layer | Name | Data unit | What lives here |
|---|---|---|---|
| 7 | Application | Data | HTTP, DNS, SMTP, FTP, SNMP |
| 6 | Presentation | Data | TLS, encryption, compression, encoding |
| 5 | Session | Data | Session setup and teardown, NetBIOS, RPC |
| 4 | Transport | Segment (TCP) / Datagram (UDP) | TCP, UDP, port numbers |
| 3 | Network | Packet | IP, ICMP, routers, layer 3 switches |
| 2 | Data link | Frame | MAC addresses, switches, ARP, VLANs |
| 1 | Physical | Bit | Cables, hubs, repeaters, connectors |
Device to layer
| Device | Layer | Decides on |
|---|---|---|
| Hub / repeater | 1 | Nothing. Repeats every bit to every port |
| Switch | 2 | MAC address |
| Bridge | 2 | MAC address, joins two segments |
| Wireless access point | 2 | MAC address |
| Router | 3 | IP address |
| Layer 3 switch | 3 | IP, with switching performance |
| Firewall (stateful) | 3 to 4 | IP, port, connection state |
| Next-generation firewall / WAF | 7 | Application content |
| Load balancer | 4 or 7 | Connection, or application content |
| Proxy | 7 | Application request |
TCP/IP model mapping
| TCP/IP layer | OSI layers | Examples |
|---|---|---|
| Application | 5, 6, 7 | HTTP, DNS, SMTP |
| Transport | 4 | TCP, UDP |
| Internet | 3 | IP, ICMP, ARP |
| Link / Network access | 1, 2 | Ethernet, Wi-Fi |
TCP against UDP
| Property | TCP | UDP |
|---|---|---|
| Connection | Three-way handshake | Connectionless |
| Delivery | Guaranteed, retransmits | Best effort |
| Ordering | Sequenced | No ordering |
| Overhead | 20-byte header minimum | 8-byte header |
| Flow control | Windowing | None |
| Used by | HTTP, SSH, SMTP, FTP | DNS, DHCP, TFTP, SNMP, VoIP |
Exams covered
Now test yourself
Memorizing a table is a start. Practice questions are what make it stick, and every answer carries the full explanation.