OSI and TCP/IP

Why

Between the wire and your JSON endpoint, a dozen technologies have to work together, and they need some way to agree on how. The layer model exists for one reason: each layer solves its own job and stays out of the others'. TCP doesn't know how a packet physically travels over the cable. HTTP doesn't know how a packet reaches the host. That's where the isolation comes from: swap Wi-Fi for Ethernet, and HTTP won't even notice.

In DevOps work, layers come up constantly: "L4 load balancer", "L7 rules in Ingress", "at L3 everything gets through, but the port is closed". This lesson gives you the table that every networking topic in the course builds on.

Two models

The industry lives with two models. OSI (7 layers) shows up in textbooks and interviews. TCP/IP (4 layers) describes the stack that actually runs on Linux, Windows, and networking hardware; its layers are fixed in RFC 1122.

TCP/IP	What it does	OSI (equivalent)	Examples
Application	applications and their protocols	L7 Application, L6 Presentation, L5 Session	HTTP, SSH, DNS, SMTP
Transport	delivery between processes	L4 Transport	TCP, UDP
Internet	routing between hosts	L3 Network	IP, ICMP
Link	frames within one network and sending bits	L2 Data Link, L1 Physical	Ethernet, Wi-Fi; addresses here are MAC

In practice people say "L4", "L7". That's OSI numbering: it stuck around, even though the stack itself runs on TCP/IP. Layers L5 and L6 almost never come up in conversation; their job is done by the application and libraries like TLS.

What each layer adds

When a browser opens google.com, the HTTP request picks up headers on its way down. Each layer adds its own "envelope":

Adding headers on the sender's side is called encapsulation. On the other end, the receiver unpacks the frame in reverse order: strips Ethernet, IP, TCP, and HTTP is left. The reverse process is called decapsulation (de-encapsulation).

Each envelope has its own address:

Layer	What's in the header	Example
L2 Ethernet	sender's and receiver's MAC, content type (EtherType)	02:42:ac:12:00:05 > 02:42:ac:12:00:02, ethertype IPv4
L3 IP	sender's and receiver's IP addresses	172.18.0.5 > 172.18.0.2
L4 TCP	sender's port and receiver's port	51522 > 5000
L7 HTTP	method, path, headers	GET /login HTTP/1.1

All of this shows up in a single tcpdump line. The -e flag adds the L2 header (MAC addresses) to the output, -nn keeps addresses and ports from turning into names, and -A prints the packet's content as text:

tcpdump -i eth0 -nn -e -A 'tcp port 5000'

02:42:ac:12:00:05 > 02:42:ac:12:00:02, ethertype IPv4 (0x0800), length 170: 172.18.0.5.51522 > 172.18.0.2.5000: Flags [P.], ... length 104
...GET /login HTTP/1.1
Host: auth:5000
...

Read it left to right, top to bottom by layer: MAC addresses (L2), then IP addresses (L3), the port after the address's last dot (L4), and then the HTTP text (L7). In lab 01, you'll break down one such packet yourself.

Envelopes don't all change the same way. The IP header travels from sender to receiver almost unchanged. But the L2 header only lives within one network: every router strips the old Ethernet header and puts on a new one, with its own MAC in the sender field. That's why the server sees the client's MAC only when they're on the same network, like containers on the same Docker network.

L4 and L7 load balancer

This is the most common question about OSI that actually comes up at work.

An L4 load balancer (TCP/UDP) decides which backend to send a connection to based on IP and port. It doesn't parse what's inside: HTTP, gRPC, or a database's binary protocol all look the same to it. It does less work per connection, but it also sees less. It can't split /api from /static: there's simply no path in its headers.

Examples: AWS Network Load Balancer, HAProxy in mode tcp, nginx in the stream context.

An L7 load balancer (HTTP) parses the HTTP request and makes its decision based on the URL, headers, and cookies. It can pin a client to a backend by cookie (sticky session) and send /api/* to one backend and /static/* to another.

Examples: AWS Application Load Balancer, nginx in the http context, Ingress in Kubernetes. Traefik and Envoy can do both: TCP routers and HTTP routers in one product.

In nginx, you can see the layer right in the config. A stream { ... } block means L4, an http { ... } block with location means L7.

The choice in DevOps is simple: if you need to route by path or by Host, use L7. If you just need to spread TCP connections around (a database, a message broker, an arbitrary protocol), L4 is enough.

Common mistakes

• Expecting an L4 load balancer to route by path or header. It can't see them, so every request will go to the same upstream.
• Mixing up the client's port and the server's port. In the line 172.18.0.5.51522 > 172.18.0.2.5000, port 51522 is one the client gets freshly from the system on each connection, while 5000 is the port the server listens on.
• Looking for the client's MAC on the server through a router. After every hop, the L2 header is new, and the server sees the MAC of the last router.
• Looking for the Ethernet frame's trailer (FCS) in tcpdump. The network card usually checks it and strips it before the frame reaches the capture, so it's not in length.
• Calling TLS "an L7 layer" or "L4" as an immutable fact. Tables place it differently; what matters for work is that an L4 load balancer without TLS decryption sees neither the path nor the HTTP headers.

What you'll need for the tasks

• Docker 20.10 or newer with Compose v2, bash, curl.
• docker compose -f setup/docker-compose.yml exec <service> <command>: run a command inside a lab environment container.
• tcpdump -i eth0 -nn -e -A -c <N> '<filter>': capture N packets and show all headers. The filter tcp port 5000 keeps only traffic on that port.
• How to read a tcpdump line by layer (the "What each layer adds" section).
• The difference between the stream and http contexts in an nginx config, and the location directive (the "L4 and L7 load balancer" section).
• docker compose -f setup/docker-compose.yml restart <service>: reload a changed config.

In the next lesson, we'll get into L3 and L4 in detail: IP addresses, ports, private ranges.