The OSI and TCP/IP models, encapsulation and ports

Objective

Be able to describe what happens when a branch workstation sends a request to the head office server: which layers are involved, what is added to the message at each step, and on which port the server answers. This is the basic vocabulary of the whole course.

Key points

• The OSI model splits communication into 7 layers; the TCP/IP model, the one actually used, into 4.
• Each layer adds a header to the message from the layer above: this is encapsulation. On arrival, each layer removes its own.
• IP (layer 3) carries packets from one machine to another; TCP and UDP (layer 4) deliver them to the right application thanks to the port.
• TCP is reliable and ordered (connection, acknowledgments); UDP is lightweight and connectionless (DNS, DHCP, VoIP, WireGuard).
• Remember a handful of ports: 22 SSH, 53 DNS, 80/443 HTTP(S), 25/587 SMTP, 67/68 DHCP, 3306 MySQL, 51820 WireGuard.

Why layers?

Picture Banque Atlas (a fictional bank that will follow us throughout the course): a head office in Casablanca, branches in Fès and Tangier, advisors working from home. When a teller in Fès looks up an account, a lot happens: the browser builds an HTTPS request, the system splits it up, the network card turns it into electrical or radio signals, carrier routers transport it to Casablanca…

Nobody could design all of this in one piece. So the problem was split into layers: each one provides a service to the layer above and uses the layer below, without knowing the details of the others. The browser does not know whether the link goes over fiber or 4G; the Wi-Fi card does not know that it carries HTTPS.

The OSI model (7 layers)

Mnemonic (from 1 to 7): "Please Do Not Throw Sausage Pizza Away".

Layers 5 and 6 exist mostly on paper: in practice, the application handles them itself. Yet technicians talk in layer numbers every day: "a layer 1 problem" (unplugged cable), "a layer 3 switch" (one that can also route), "a layer 7 load balancer" (one that reads URLs).

The TCP/IP model (4 layers)

This is the model that Linux, Windows and the cloud follow. In Azure, for example, a virtual network lets you choose IP addresses, subnets and routes (layer 3) and filter by port (layer 4); the physical layer is entirely managed by Microsoft.

Encapsulation, step by step

The teller in Fès opens https://compte.atlas.lan. Here is how the message goes down the layers:

[ HTTP data encrypted by TLS ]                                        layer 7
[ TCP header | Data ]                        source port 51544 → port 443   layer 4
[ IP header | TCP header | Data ]            10.21.10.25 → 10.20.1.10        layer 3
[ Ethernet header | IP | TCP | Data | FCS ]  workstation MAC → router MAC   layer 2
0101100101…                                   signals on the cable          layer 1

At each hop (branch router, carrier network, head office router), the frame (layer 2) is removed and rebuilt for the next link; the IP packet (layer 3), however, travels end to end. At the server, the path is reversed: each layer reads its header, removes it and passes the rest to the layer above. This is decapsulation.

Sizes to know

The largest piece of TCP data that fits in a frame is called the MSS: 1500 − 20 − 20 = 1460 bytes in IPv4. These calculations will come back with VPNs: a tunnel adds its own headers, so you must reduce the MTU inside the tunnel, otherwise large packets get fragmented or lost. Public clouds even publish their MTU recommendations for virtual machines.

TCP or UDP?

The TCP three-way handshake:

Fès workstation                    Head office server
   SYN  (I want to talk, port 443)  ─────────►
        ◄─────────  SYN-ACK (all right)
   ACK  (let's go)                  ─────────►
   … data …
   FIN / ACK to close

Why does WireGuard choose UDP? Because it carries TCP itself: putting TCP inside TCP causes cascading retransmissions as soon as a remote worker's 4G loses a few packets.

Ports

An IP address identifies a machine; a port (0 to 65535) identifies an application on that machine. The combination "IP address + port + protocol" is a socket.

• 0 to 1023: well-known ports, reserved for standard services (you must be root to open them on Linux).
• 1024 to 49151: registered ports (3306 MySQL, 5432 PostgreSQL, 1194 OpenVPN…).
• 49152 to 65535: ephemeral ports, chosen at random by the client for each outgoing connection.

On a Linux system, the /etc/services file maps names to numbers:

grep -w 443 /etc/services       # https 443/tcp
getent services ssh             # ssh 22/tcp

Seeing the layers on a Linux machine

ip link show                    # layer 2: interfaces, MAC addresses, MTU
ip address show                 # layer 3: IP addresses of each interface
ip route show                   # layer 3: where packets leave from
ss -tulpn                       # layer 4: listening TCP/UDP ports and their programs
curl -I https://exemple.ma      # layer 7: a real HTTP request

Effective troubleshooting follows the layers from the bottom up: is the cable or Wi-Fi connected (1-2)? Does the machine have an address and a route (3)? Does the port answer (4)? Does the service work (7)? This method is covered in detail in lesson 4.1.

Guided exercise: naming the layers

For each situation at the Tangier branch, name the layer involved.

1. The cashier's workstation cable was pulled out by a chair. → layer 1.
2. Two machines have the same IP address. → layer 3.
3. The firewall blocks port 3389. → layer 4.
4. The internal website answers "404 page not found". → layer 7.
5. The workstation is plugged into the wrong VLAN on the switch. → layer 2.

Common protocols at a glance

Exercise: reading a packet

Here is a simplified view of what a capture tool shows for a packet captured at the head office, just in front of the server:

Ethernet  src 52:54:00:aa:10:25  dst 52:54:00:bb:00:01
IPv4      src 10.21.10.25        dst 10.20.1.10       ttl 63  proto TCP
TCP       sport 51544            dport 443            flags [S]

Questions and answers:

1. Which machine sent the packet? → 10.21.10.25 (a branch workstation).
2. Which service is requested? → destination port 443, so HTTPS.
3. What does the [S] flag mean? → SYN: it is the first packet of the TCP handshake.
4. Is port 51544 a service? → no, it is an ephemeral port chosen by the client.
5. The TTL is 63: what happened? → the workstation sent it with a TTL of 64 (the usual value on Linux); each router crossed subtracts 1: one router has already forwarded it. In a VPN, the whole path through the carrier is hidden inside the tunnel and does not count.

Common pitfalls

• Confusing address and port: 10.20.1.10:443 means the HTTPS service of the machine 10.20.1.10. Opening the port on the firewall is useless if the service is not listening.
• Believing that DNS uses only UDP: large responses and zone transfers go over TCP 53. A firewall that only allows UDP 53 causes strange failures.
• Forgetting the MTU in a tunnel: the website opens but large files get stuck. It is almost always an MTU that is too large.
• Thinking "OSI" when configuring: you reason with OSI, but you configure with TCP/IP (interface, IP, route, port, service).

Lab

You will write your revision notes in /root/reseau: the list of the seven layers, the ports to know, the MSS calculation from the MTU, then a small shell script that gives the layer of a protocol. The check really runs the script: it must print the right number for each protocol.

Quiz

1. How many layers do the OSI model and the TCP/IP model have?
2. At which layer do a classic switch and a router work?
3. What is encapsulation?
4. Why does DNS mainly use UDP, and when does it switch to TCP?
5. What is the usual MSS of a TCP connection in IPv4 over Ethernet?

Reference sources: official Microsoft Learn documentation (Windows Server, Azure) and Red Hat documentation. Original MasterLinux text.