The Architecture of Conversation

Every conversation has structure. When people communicate, there is more happening than the words being spoken. There is who is speaking, which language is being spoken, is the message clear, including how can we encapsulate the message to ensure understanding?

Network communication works the same way. The OSI model gives us a way to observe those conversations by separating them into seven responsibilities. Each layer has a job. Each layer stays in its own lane.

How to remember the layers:
All People Seem To Need Data Processing.

Layer 7 Application (All)

Responsibility: Provides network services to applications. Protocols such as HTTP, SMTP, DNS, and many others live here. This is where software communicates using application-specific protocols.

Observes: The application data (payload) exchanged between users and applications.

Layer 6 Presentation (People)

Responsibility: Formats, translates, encrypts, and compresses information so applications can understand it. Presentation is responsible for making sure both sides of the conversation speak the same language. Character encoding (ASCII, UTF-8), compression, and encryption are all examples of this responsibility. TLS is commonly associated with this layer, even though modern TCP/IP implementations don't separate it into its own layer.

Observes: Data format, Character encoding, Encryption, and Compression.

Layer 5 Session (Seem)

Responsibility: Creates, manages, synchronizes, resumes, and terminates communication sessions between applications. This layer manages the conversation. It keeps track of ongoing communication and knows when conversations begin, pause, resume, or end.

Observes: Session management information, such as session identifiers, dialog state, synchronization points, and whether a session is being established, maintained, resumed, or terminated.

Layer 4 Transport (To)

Responsibility: For TCP, this layer establishes a connection using the three-way handshake (SYN, SYN-ACK, ACK) before data is exchanged. It provides end-to-end delivery using either TCP or UDP. It handles port numbers, sequencing, error detection, retransmissions (TCP), and flow control, ensuring data reaches the correct application on the destination device.

Observes: Port numbers (TCP/UDP) and TCP flags like SYN, ACK, and FIN. It reads transport-layer information such as port numbers and, for TCP, flags like SYN, ACK, and FIN. It carries the application data but doesn't interpret its contents.

Layer 3 Network (Need)

Responsibility: Handles logical addressing and routing of data across networks. This is where IP addresses live. Routers operate at this layer, determining the best path to send data from source to destination.

Observes: Source IP, Destination IP, TTL, and Protocol type

Layer 2 Data Link (Data)

Responsibility: Handles hardware (MAC) addressing and error detection for data transmission between directly connected devices. This is where MAC addresses live. Ethernet switches operate at this layer, forwarding frames within a local network.

Observes: MAC addresses (source and destination). It checks for errors using CRC.

Layer 1 Physical (Processing)

Responsibility: Transmits raw bits (1s and 0s) over the physical medium — copper cables, fiber optics, or radio waves. This layer defines voltage levels, data rates, and physical connectors. Everything eventually becomes ones and zeros moving across a physical medium. The Physical layer doesn't understand the conversation. It simply moves the bits.

Observes: Electrical signals, light pulses, or radio waves.

The Packet Journey

When information travels through the network, each layer adds its own information before passing it downward. This process is called encapsulation. Each layer wraps the data like an envelope inside an envelope. Each layer only adds what it is responsible for before handing the packet to the next layer.

What This Looks Like in tcpdump

One reason I appreciate the OSI Model is that it becomes visible almost immediately when analyzing packet captures. A command such as: sudo tcpdump -X -i eth0 shows multiple layers of the same conversation.

Layer 2 (Data Link): b8:27:eb:12:34:56 > 00:1a:2b:3c:4d:5e (MAC addresses — only visible with -e flag)

Layer 3 (Network): 192.xxx.x.xxx > 8.8.8.8 > 8.8.8.8 (an actual digit would be where the x is) (IP addresses)

Layer 4 (Transport): 54321 > 53 (Port numbers — 53 is DNS)

Layer 7 (Application): A? google.com. (The actual DNS query)

The hex dump (-X) shows the raw bytes. The right side shows the ASCII translation. Each layer reads only what it needs — and minds its own !*%' in business.

The hexadecimal view shows the raw bytes. The ASCII column shows a human-readable interpretation of many of those bytes. The packet hasn't changed. You're simply observing the same conversation from different perspectives.

Wrapping This Conversation Up...

The OSI model is often taught as seven layers to memorize. I don't think that's what makes it valuable. I see seven participants in the same conversation. The browser doesn't route packets. Routers don't render webpages. Switches don't read emails. Network cables don't understand HTTP. Every layer contributes exactly what it was designed to contribute, trusting every other layer to do the same. Each layer stays within its responsibility. Each layer minds its own business. Together, they make communication possible.

Why This Matters

The OSI Model isn't useful because you'll memorize seven layers. It's useful because it teaches you where to look. When a packet capture doesn't make sense... When an application behaves unexpectedly... When a connection fails... When something invisible suddenly becomes visible... The OSI Model provides a way to organize your observations. Networks aren't magic. They're conversations happening one responsibility at a time. Once you understand where those conversations take place, you can begin asking better questions. And better questions lead to better observations.

Encoding Cookies