The OSI model and TCP/IP stack are the conceptual frameworks for all network communication. Every network problem can be diagnosed by working through the layers. Knowing which protocols operate at which layer is fundamental to troubleshooting.
| Item | Syntax / Value | Description |
|---|---|---|
| Layer 7 Application | HTTP/S, DNS, SMTP, FTP, SSH, SNMP, NTP | User-facing protocols — what applications use |
| Layer 6 Presentation | TLS/SSL, encoding, compression, encryption | Data format translation and encryption |
| Layer 5 Session | NetBIOS, RPC, SQL sessions | Session establishment, maintenance, termination |
| Layer 4 Transport | TCP, UDP, SCTP — port numbers | End-to-end delivery, reliability, flow control |
| Layer 3 Network | IP, ICMP, IPsec, OSPF, BGP, RIP | Logical addressing and routing between networks |
| Layer 2 Data Link | Ethernet, Wi-Fi (802.11), ARP, MAC | Physical addressing, framing, error detection |
| Layer 1 Physical | Cables, fiber, radio waves, voltage | Raw bit transmission over physical medium |
| TCP/IP Stack | Application / Transport / Internet / Link | 4-layer model mapping to OSI |
| TCP | Transmission Control Protocol — reliable, ordered | 3-way handshake, retransmission, flow control |
| TCP handshake | SYN, SYN-ACK, ACK | Establish connection before data transfer |
| TCP FIN | FIN, FIN-ACK, ACK / RST | Graceful / forceful connection termination |
| UDP | User Datagram Protocol — fast, no guarantee | No handshake, no retransmit — DNS, video, gaming |
| IP | Internet Protocol — connectionless, best-effort | Packet routing with IP addresses |
| ICMP | Internet Control Message Protocol | ping, traceroute, error messages |
| ARP | Address Resolution Protocol — IP to MAC | Broadcast: who has IP 192.168.1.1? Reply: MAC 00:11:22:33 |
| Port numbers | 0-1023 well-known, 1024-49151 registered, 49152-65535 ephemeral | 22=SSH, 80=HTTP, 443=HTTPS, 53=DNS, 25=SMTP |
| Well-known ports | 22=SSH, 53=DNS, 80=HTTP, 110=POP3, 143=IMAP, 443=HTTPS, 993=IMAPS | Common service ports |
| More ports | 25=SMTP, 465=SMTPS, 587=SMTP+TLS, 3306=MySQL, 5432=PostgreSQL, 6379=Redis | Database and mail ports |
| Socket | IP:Port pair — uniquely identifies connection endpoint | 192.168.1.1:443 — server socket |
| Packet | IP header + TCP/UDP header + payload | Fundamental unit of network communication |
| MTU | Maximum Transmission Unit — 1500 bytes for Ethernet | Larger packets get fragmented |
| TTL | Time To Live — decremented at each hop | Prevents infinite routing loops — typically 64 or 128 |
| Loopback | 127.0.0.1 (IPv4) / ::1 (IPv6) | Local host — packets don't leave the machine |
# OSI Model — practical reference
# ── Layer 7: Application — HTTP test ─────────────────────────
curl -v http://www.mywebuniversity.com/ 2>&1 | head -30
# Shows HTTP request/response headers
# ── Layer 4: Transport — TCP port check ───────────────────────
# Check if port is open (nc = netcat)
nc -zv mywebuniversity.com 443 # TCP connect test
nc -zv mywebuniversity.com 22 # SSH port test
nc -zu mywebuniversity.com 53 # UDP test (DNS)
timeout 3 bash -c 'cat < /dev/null > /dev/tcp/mywebuniversity.com/443' && echo "Port 443 open"
# ── Layer 3: Network — IP and routing ─────────────────────────
ip route show # routing table
ip route get 8.8.8.8 # how to reach this IP
traceroute mywebuniversity.com # hop-by-hop path
traceroute -T -p 443 mywebuniversity.com # TCP traceroute (through firewalls)
mtr mywebuniversity.com # live traceroute + ping stats
# ── Layer 2: Data Link — ARP table ───────────────────────────
arp -n # ARP cache: IP to MAC mappings
ip neigh show # modern equivalent
ip link show # all network interfaces
# ── Protocol analysis with Python ─────────────────────────────
import socket
# Get hostname → IP
ip = socket.gethostbyname('www.mywebuniversity.com')
print(f"IP: {ip}")
# Reverse DNS
name = socket.gethostbyaddr('8.8.8.8')
print(f"Hostname: {name[0]}")
# TCP connection (Layer 4)
with socket.create_connection(('www.mywebuniversity.com', 443), timeout=5) as sock:
print(f"Connected via {sock.family.name}: {sock.getpeername()}")
# UDP socket (Layer 4)
with socket.socket(socket.AF_INET, socket.SOCK_DGRAM) as udp:
udp.settimeout(2)
udp.sendto(b'hello', ('8.8.8.8', 53))
# Check all ports in range
def scan_ports(host, start=1, end=1024):
open_ports = []
for port in range(start, end+1):
try:
with socket.create_connection((host, port), timeout=0.1):
open_ports.append(port)
except (ConnectionRefusedError, TimeoutError, OSError):
pass
return open_ports
print("Open ports 20-25:", scan_ports('localhost', 20, 25))
# Raw ICMP ping (Layer 3) — requires root
import struct, time
def ping(host):
try:
sock = socket.socket(socket.AF_INET, socket.SOCK_RAW, socket.IPPROTO_ICMP)
sock.settimeout(1)
# ICMP echo request: type=8, code=0, checksum, id, seq
packet = struct.pack('!BBHHH', 8, 0, 0, 1, 1)
sock.sendto(packet, (host, 0))
start = time.time()
sock.recv(1024)
return (time.time() - start) * 1000
except Exception:
return None
ms = ping('8.8.8.8')
print(f"Ping 8.8.8.8: {ms:.1f}ms" if ms else "Ping failed")
# python3 networking.py (some parts require root/sudo)