Back to Cisco & Networking CyberPatriot Hub

Cisco & Networking · Lesson 02

Networking Foundations & the OSI Model

Learn how hosts, switches, routers, protocols, frames, packets, transport ports, and applications fit together so the OSI model becomes a practical troubleshooting tool instead of a memorization chart.

Strong networking work comes from understanding what each layer is responsible for, what evidence belongs there, and how traffic changes as it moves from one host to another.

Lesson Snapshot

OSI layers7

TCP/IP layers4

Core terms8

Main goalLayered troubleshooting

Learning objectives

Understand the network as layers of responsibility

Explain why networking models are useful for troubleshooting instead of treating them as memorization charts.

Distinguish hosts, switches, routers, frames, packets, segments, ports, protocols, and services.

Map practical network activity to the OSI and TCP/IP models.

Explain how MAC addresses, IP addresses, and transport-layer ports serve different purposes.

Trace a client-to-server exchange across local switching, routing, transport, and application layers.

Use layered reasoning to narrow a network problem before changing configuration.

Core idea

The OSI model is a troubleshooting map

Instead of asking "What random command should I try?", ask which layer must succeed for the observed behavior to work and what evidence can confirm that layer.

Important distinction

Models simplify reality

Real devices and protocols can span multiple layers. Use the model to organize reasoning, not to force every technology into one perfect box.

Core vocabulary

Know what is moving and which device makes the decision

Host

An endpoint such as a workstation, server, printer, phone, or virtual machine that sends or receives network traffic.

Switch

A Layer 2 device that forwards Ethernet frames inside a local network primarily by using MAC-address information.

Router

A Layer 3 device that forwards IP packets between different networks by using routing information.

Frame

The Layer 2 data unit used on technologies such as Ethernet. Frames contain source and destination MAC addresses.

Packet

The Layer 3 data unit that carries source and destination IP addresses across routed networks.

Segment

A transport-layer unit commonly associated with TCP. UDP uses datagrams, but both rely on transport-layer port numbers.

Protocol

A defined set of rules for communication, such as Ethernet, IPv4, TCP, UDP, DNS, HTTP, or SSH.

Port number

A transport-layer identifier used to distinguish applications or services on a host, such as TCP 22 for SSH or TCP 443 for HTTPS.

OSI model

Seven layers, seven troubleshooting questions

Application

What service or application is the user trying to use?

HTTP/HTTPS, DNS, SSH, DHCP application behavior

Application errors, service configuration, DNS responses, server logs

Presentation

How is the data represented, encoded, compressed, or encrypted?

TLS encryption, data formats, character encoding

Certificate/TLS errors, format mismatches, application negotiation

Session

How is the communication session established, maintained, or resumed?

Session establishment, authentication context, application conversations

Session drops, repeated reconnects, authentication/session logs

Transport

Which host process should receive the traffic, and how is delivery handled?

TCP, UDP, source ports, destination ports

Port availability, TCP handshake behavior, service listeners

Network

How does the packet reach a different IP network?

IPv4, IPv6, routers, routing tables, gateways

IP addressing, routes, traceroute, router interfaces

Data Link

How is traffic delivered across the local link?

Ethernet, MAC addresses, VLANs, switches, trunks

MAC tables, VLAN membership, switchport mode, frame forwarding

Physical

Can bits physically move across the connection?

Cabling, radio, connectors, speed, signal, interface link state

Link lights, interface status, cable type, physical connection

TCP/IP model

The practical Internet stack

Application

Roughly OSI Layers 5-7

User-facing and infrastructure protocols such as HTTPS, SSH, DNS, and DHCP.

Transport

OSI Layer 4

TCP and UDP, ports, reliability, sequencing, and multiplexing between applications.

Internet

OSI Layer 3

IP addressing and routing between networks.

Network Access

Roughly OSI Layers 1-2

Local-link delivery such as Ethernet, MAC addressing, switching, and the physical medium.

Addressing roles

MAC, IP, and port numbers solve different problems

MAC address

Layer 2

Identifies a network interface for local Ethernet delivery.

Primarily meaningful on the local Layer 2 segment.

00:1A:2B:3C:4D:5E

IP address

Layer 3

Identifies a host or interface logically so packets can be routed between networks.

Used across routed network boundaries.

192.168.10.25

Port number

Layer 4

Identifies the application or service endpoint on a host.

Used by TCP or UDP within an IP communication flow.

TCP 443

Do not confuse two meanings of "port"

A physical switch interface such as GigabitEthernet0/1 is different from a TCP or UDP port such as TCP 443. One identifies a device interface; the other identifies a transport-layer service endpoint.

Encapsulation

Building data for transmission

Application creates data

A user or service produces application data, such as an HTTPS request.

Transport adds ports

TCP or UDP identifies the source application and destination service using port numbers.

Network adds IP addressing

The IP header identifies the source and destination IP networks or hosts.

Data Link adds local delivery information

Ethernet adds source and destination MAC addresses for the next local link.

Physical layer transmits bits

The frame is represented as signals across the physical or wireless medium.

De-encapsulation

Delivering data to the application

Physical signal is received

The destination interface receives the transmitted bits.

Frame is processed

Layer 2 examines the frame and its local delivery information.

IP packet is processed

Layer 3 evaluates the destination IP and routing context.

Transport identifies the service

TCP or UDP uses the destination port to deliver data to the intended application.

Application handles the data

The server application processes the request and may generate a response.

Device roles

Different devices make different forwarding decisions

Ethernet switch

Layer 2

MAC learning, forwarding, filtering, flooding, VLAN membership, trunking

Multilayer switches can also perform Layer 3 functions, but basic switch reasoning begins at Layer 2.

Router

Layer 3

IP forwarding, route lookup, next-hop selection, inter-network connectivity

Routers may also enforce ACLs, NAT, VPN, DHCP, and management services.

Host

All relevant layers

Application, transport session, IP addressing, default gateway, local frame delivery

A host problem can look like a network problem, so endpoint configuration must be checked too.

Firewall

Often Layers 3-7 depending on platform

Traffic policy based on addresses, protocols, ports, state, or application information

In this pathway, Cisco ACLs provide an important policy example even without a dedicated firewall appliance.

TCP vs UDP

Two transport approaches

Connection behavior

TCP

Connection-oriented. Establishes a session before normal data transfer.

UDP

Connectionless. Sends datagrams without a TCP-style connection setup.

Reliability

TCP

Supports acknowledgments, retransmission, sequencing, and ordered delivery.

UDP

Does not provide TCP's built-in delivery confirmation or retransmission.

Overhead

TCP

Higher due to connection state and reliability mechanisms.

UDP

Lower, making it useful where speed or simplicity matters.

Typical examples

TCP

HTTPS, SSH, many web and administrative applications.

UDP

DNS queries, DHCP, voice/video transport, and other latency-sensitive uses.

Troubleshooting clue

TCP

A handshake failure can help distinguish reachability from service-listener or policy problems.

UDP

Not TCP/UDP

Common port: No transport port

Network control and diagnostic messages, including many ping operations.

Port numbers are conventions, not proof

A service can be configured on a non-default port. Treat common ports as clues and confirm the actual configuration when troubleshooting.

Same subnet

Local traffic does not need the router

Source checks the destination IP

The host compares the destination address with its own address and subnet mask.

Source decides the destination is local

Because the destination is in the same IP subnet, the source does not send the packet to the default gateway.

Source learns the destination MAC

The host uses local neighbor-resolution behavior such as ARP for IPv4 to learn the destination's Layer 2 address.

Switch forwards the frame

The switch uses its MAC-address table to deliver the Ethernet frame toward the destination port.

Destination processes the packet

The destination removes Layer 2 information, processes the IP packet, and passes the transport data to the correct service.

Different subnet

Remote traffic uses the default gateway

Source checks the destination network

The host determines that the destination IP is outside the local subnet.

Source chooses the default gateway

The IP packet still targets the remote destination IP, but the local Ethernet frame is addressed to the gateway's MAC address.

Switch forwards to the router

The local switch forwards the gateway-bound frame toward the router interface.

Router performs a route lookup

The router removes the incoming Layer 2 frame, examines the destination IP, and chooses the next-hop or outgoing interface.

Router builds a new Layer 2 frame

Is DNS configured? Can the client reach the resolver? Does the name resolve correctly?

Only one subnet cannot reach a server

Start near

Layer 3 / Policy

Is routing present for that subnet? Does an ACL or VLAN path affect only that source?

Packet Tracer

Use simulation to make the layers visible

Realtime mode

Observe the network in its normal operating state and test connectivity interactively.

Simulation mode

Step through protocol events and inspect how traffic moves across devices.

Simple PDU

Quickly generate test traffic between devices in a practice topology.

Device CLI

Inspect and configure supported Cisco IOS behavior from within the simulation.

Desktop tools

Use endpoint utilities such as IP Configuration, Command Prompt, browser, or terminal depending on the simulated host.

Event list

That router is definitely broken.

Better reasoning

The device may not respond to the diagnostic traffic even while forwarding other packets. Correlate with routes, ACLs, interfaces, and destination behavior.

Common mistakes

Networking shortcuts that weaken troubleshooting

Treating the OSI model as a rigid device-label chart

Real devices can operate across multiple layers. The model is most useful for reasoning about functions and evidence.

Assuming a successful ping proves an application works

ICMP reachability does not verify TCP/UDP ports, service state, authentication, or application behavior.

Confusing MAC addresses with IP addresses

Leads to incorrect reasoning about local switching versus routed delivery.

Confusing port numbers with switch ports

Transport-layer ports identify services; physical switch ports identify interfaces on a network device.

Troubleshooting every problem from Layer 1 upward mechanically

A known symptom can justify starting at a more relevant layer. The goal is structured reasoning, not ritual.

Changing multiple layers before retesting

Makes root-cause analysis difficult and can create additional failures.

Defensive lab

Trace a fictional HTTPS request through the stack

Use a fictional topology with one client, one access switch, one router, and one HTTPS server on a different subnet.

Label the client's MAC address, IP address, default gateway, temporary source TCP port, and destination TCP port 443.

Describe the first Ethernet frame leaving the client: destination IP remains the server, while the destination MAC is the local default gateway.

Trace the packet through the switch and router and explain which header information each device primarily uses to make its forwarding decision.

Use Packet Tracer simulation mode to observe a practice packet and identify Layer 2, Layer 3, and transport information.

Introduce a fictional failure such as the wrong gateway, wrong VLAN, missing route, ACL block, or stopped HTTPS service.

Use the layered troubleshooting table to identify the most likely layer and collect evidence before changing anything.

Apply one controlled fix and verify both network reachability and the actual HTTPS service.

Lesson checklist

Before moving on

I can explain the practical purpose of the OSI model.

I can distinguish a host, switch, router, frame, packet, protocol, and port number.

I understand the difference between MAC addressing, IP addressing, and transport-layer ports.

I can map common network functions to the OSI and TCP/IP models.

I can explain encapsulation and de-encapsulation at a useful troubleshooting level.

I can explain how same-subnet traffic differs from routed traffic.

I understand that routers rebuild Layer 2 framing as packets move between networks.

I can compare TCP and UDP without assuming one is always better.

I know that ping tests only part of the network stack.

I can use Packet Tracer simulation tools to observe traffic behavior.

I choose troubleshooting evidence based on the symptom instead of making random changes.

I verify the application or service after fixing network connectivity.

Reflection

Check your reasoning

Question 1

Why does a host need both an IP address and a MAC address?

Question 2

Why does the destination MAC change across routed hops while the destination IP normally remains the same?

Question 3

What does a successful ping prove, and what does it not prove?

Question 4

Why is TCP 443 different from a physical switch port numbered 443?

Question 5

When would a Layer 2 problem prevent a Layer 3 test from succeeding?

Question 6

How can Packet Tracer simulation mode help identify where a communication path fails?

Carry this forward

Use the layers to locate responsibility: local link, IP path, transport service, or application. Gather evidence at the layer the symptom points to, then verify the complete path after the fix.

Back to Cisco & Networking CyberPatriot Hub

← Previous Lesson Next Lesson →