OSI vs TCP/IP
Compare OSI’s seven-layer reference model with the Internet model’s four layers, map common protocols, and trace three concrete request failures.
Map the observed failure to communication responsibilities, then inspect the actual component and protocol. OSI uses seven layers; the Internet model commonly groups work into link, internet, transport and application layers. Neither diagram is executable code or a diagnosis by itself.
Two maps divide the same city into different districts. One separates seven kinds of work; another groups them into four. The maps help describe a journey, but you still need to inspect the actual road where it stopped.
A colleague calls an outage “a layer 4 problem”. The number is useful vocabulary, but it does not identify the failed component or prove its cause. OSI and the Internet model group communication responsibilities differently. Learn the mapping, then follow the actual request far enough to observe what failed.
Where the seven collapse into four#
The diagram is a common teaching correspondence, not an exact equivalence of specifications. OSI network responsibilities broadly correspond to the Internet layer; OSI transport broadly corresponds to Internet transport. The Internet model’s link layer groups work often described with OSI physical and data-link vocabulary. Different boundaries do not make framing and physical transmission the same operation.
The Internet model groups application, representation and session-related work more broadly than OSI. Encoding, authentication, encryption and session resumption still occur in concrete protocols and libraries. The TLS handshake explanation follows key exchange and authentication; TLS does not map neatly to one OSI box and runs above a transport in this TCP example. HTTP/3 instead uses QUIC, which incorporates TLS 1.3 into its transport. A model’s box is a responsibility grouping, not proof of one mandatory software module.
Why the seven-layer model survived anyway#
OSI’s reference model remains useful for distinguishing responsibilities such as physical links, frames, routing and application processing. It was developed for standardizing open-system interconnection, not merely as an after-the-fact teaching chart. Protocols associated with its suite also exist: RFC 1195 explicitly describes IS-IS routing supporting both IP and OSI’s CLNP. That is a counterexample to “nothing OSI ever shipped”.
Vendors and exams lean on the same numbers for the same reason. A “layer 3 switch” is marketing shorthand for a switch that also routes — the number is doing the work a sentence would otherwise have to do. Certification tracks that ask for OSI by number are testing a vocabulary you will need regardless of what you actually run, because incident channels and vendor spec sheets assume you already know what “layer 2” means.
Picking one on purpose#
Both models can help describe a fault. Neither runs by itself; implementations run Ethernet, IP, TCP, HTTP and other protocols. Start with the observation: was a link available, did a connection establish, or did the application return a refusal? A layer label narrows the question but does not replace packet traces, component logs or the configured deadline.
Follow a request to the first failed operation
Trace one HTTPS request over TCP. A layer name is a description of an observation, not a substitute for checking the failing component.
- Disconnected cable: no link.
- No TCP connection or HTTP reply follows.
Disconnected cable: OSI physical (1), within the Internet model's link layer. Check the link before debugging HTTP permissions.
Three fixed failures on one TCP-based request. No HTTP/3, tunnels or DNS failures. An HTTP gateway response can report an upstream transport failure; seeing a layer-7 reply does not establish a layer-7 root cause.
An HTTP load balancer can inspect paths and headers, often after terminating TLS. It can also enforce an application request deadline or an upstream connection timeout; those are different clocks. A gateway’s 502 or 504 can report an upstream problem even though it is an HTTP response. Find which component returned or interrupted the request, and whether the backend may still have completed work. A lost response needs a duplicate-safe retry contract.
Neither the count nor the names are settled, and the specification is the place that shows it. RFC 1122, which is where the four layers are actually written down, calls the bottom one the link layer — not “network access,” the name the boxes above use because it is the one most courses and diagrams teach. Other texts split that same layer into link and physical and call the model five, closer to OSI’s own bottom pair. The boxes help compare responsibilities; the actual implementation determines which components carry them out. The distributed-systems path is taking shape around the layer failures that show up once more than one machine has to agree on anything.
| Situation | Take | Because |
|---|---|---|
| Naming where a fault sits, with colleagues | OSI | Shared vocabulary, no implementation implied. |
| Reading what a socket or router does | TCP/IP | Relate the model to the actual protocol and component. |
| Studying for a certification | OSI | The exam asks for seven. |
| Debugging a timeout | TCP/IP | Inspect the component and whether its clock is idle or total. |
- Situation
- Naming where a fault sits, with colleagues
- Take
- OSI
- Because
- Shared vocabulary, no implementation implied.
- Situation
- Reading what a socket or router does
- Take
- TCP/IP
- Because
- Relate the model to the actual protocol and component.
- Situation
- Studying for a certification
- Take
- OSI
- Because
- The exam asks for seven.
- Situation
- Debugging a timeout
- Take
- TCP/IP
- Because
- Inspect the component and whether its clock is idle or total.
IF YOU REMEMBER ONE THING
OSI and TCP/IP are not two versions of the same answer. Both group responsibilities; the implementation and observed failure decide what to inspect next — and an argument about the wrong one spends the time the other could have spent on the fix.
Questions people also ask
5 QUESTIONSDoes anything actually implement OSI?
Yes, protocols associated with the OSI suite have been implemented. RFC 1195 specifies integrated IS-IS routing for IP and OSI CLNP, for example. The reference model is not itself an implementation; TCP/IP’s widespread use does not mean every OSI protocol never shipped.
Which model should I learn first?
TCP/IP, if you are building or debugging systems — it explains what the machine in front of you is actually doing. Learn OSI's seven-layer order on top of that once you need the vocabulary, or immediately if a certification exam is what is asking.
Where does TLS sit?
It does not map neatly to one OSI layer. In HTTPS over TCP, TLS works above TCP and handles encryption and session-related work. QUIC instead integrates TLS 1.3 into its transport handshake. Describe the actual protocol stack before assigning a teaching layer.
What is a layer 7 load balancer really doing?
Inspecting application data such as an HTTP path or header and routing on it, often after terminating encryption. The underlying transport and clocks depend on the implementation: HTTP/1.1 and HTTP/2 commonly use TCP, while HTTP/3 uses QUIC. Identify which component's connection or request deadline expired.
Why do people still say "layer 8"?
As a joke that borrows OSI's numbering without being part of OSI: layer 8 means the user, or the organisation, or whichever human process sits above every layer that actually moves bytes. It is shorthand for "this failure was not a protocol problem," using a model built for protocol problems to say so.