glucolte

OSI Model

The OSI (Open Systems Interconnection) Model is a conceptual framework that describes how data moves across a network. It breaks communication into seven layers, each with a distinct role—from physical signals up to human-facing applications.

By separating responsibilities, the OSI model makes it easier to design, troubleshoot, and scale networks. Each higher layer builds on the services of the one below, while remaining logically independent.

1. The 7 Layers

Layer Example Protocols Data Unit What It Adds / Handles Notes
L7 Application HTTP, DNS, SMTP, FTP Data User-facing services Browser → HTTP, Mail → SMTP.
L6 Presentation TLS/SSL, JPEG, JSON Record Data format, encryption, compression Often merged into L7.
L5 Session NetBIOS, RPC – Session setup & teardown Rarely explicit today.
L4 Transport TCP, UDP Segment Reliable (TCP) vs fast (UDP) TCP = handshake, ports, seq/ack. UDP = stateless.
L3 Network IP, ICMP Packet Logical addressing & routing Routers forward packets. Uses ARP for MAC resolution.
L2 Data Link Ethernet, Wi-Fi, PPP Frame Local delivery Frames = MAC headers + payload + CRC.
L1 Physical Copper, Fiber, Wi-Fi PHY Bits Transmission of raw signals Voltage, RF, or optical light.

🔁 Encapsulation order:
Application Data → Segment → Packet → Frame → Bits

ByteByteGo OSI Model
📖 Source: OSI Model Explained – Byte Byte Go

2. Devices at Each Layer

Device Layer What It Does Protocols Authentication
Load Balancer L4–L7 Distributes traffic TCP, HTTP/S, gRPC TLS certs, tokens
Firewall L3–L4 (sometimes L7) Filters packets/flows IP, TCP/UDP, HTTP Rules, TLS interception, VPN
Router L3 Routes IP packets IP, ICMP, BGP, OSPF BGP MD5, IPsec
Switch L2 Forwards frames by MAC Ethernet, VLAN, ARP 802.1X, MAC binding
Hub L1 Repeats bits blindly – None

3. Layer Interactions

3.1 Layer 2 – ARP

Maps IP → MAC via broadcast request and unicast reply.

L2 ARP Example
🖼️ ARP – Address Resolution Protocol Sequence

3.2 Layer 2 – VLANs & Trunks

VLANs, trunks, and QinQ are needed to segment traffic, reduce broadcast domains, and efficiently carry multiple logical networks over the same physical infrastructure.

3.3 Layer 3 – Routing

Routers strip old frames, keep IP header, attach new MAC header for next hop.

L3 Routing Example
🖼️ L3 Routing – Packet Routing Sequence

3.4 Layer 3 & 5–6 - IPsec

IPsec = encrypted network tunnels.

IPsec Example
🖼️ IPsec – IKE Handshake Sequence

Elliptic Curve Diffie–Hellman Ephemeral provides Perfect Forward Secrecy (PFS) by using a fresh, temporary key pair per session. Even if a server’s long-term private key is later compromised, past sessions remain confidential. Both TLS and IPsec commonly prefer ECDHE for key exchange.

3.5 Layer 5–6 - TLS

TLS = encrypted application sessions.

TLS Example
🖼️ TLS – Secure Handshake Sequence

3.6 Traffic Addressing Modes (Unicast, Broadcast, Multicast, Anycast, Geocast)

How frames/packets are addressed determines who receives them and how the network treats them.

Mode Who Receives OSI Context Typical Uses Key Notes
Unicast Exactly one host L2 (MAC→MAC), L3 (IP→IP) Web browsing, API calls, SSH Most traffic is unicast. Switched at L2, routed at L3.
Broadcast All hosts in the L2 broadcast domain L2 (FF:FF:FF:FF:FF:FF) ARP, DHCP DISCOVER Routers block broadcasts by default.
Multicast Members of a subscribed group L3 (224.0.0.0/4 IPv4; ff00::/8 IPv6) IPTV, conferencing, OSPF Uses IGMP/MLD (hosts), PIM (routers).
Anycast “Nearest” one of many identical endpoints L3 (same IP announced in multiple sites) CDNs, DNS resolvers Routing selects the closest service.
Geocast Hosts in a geographic region L3 concept Vehicular alerts, ITS Conceptual; app-layer in practice.

4. Commands by OSI Layer

Layer Command Purpose Example
L2 arp Show ARP cache arp -a
L3 ping Test ICMP reachability ping 8.8.8.8
L3 traceroute Show hop path mtr 8.8.8.8
L4 ss List sockets ss -ant
L4 tcpdump Capture packets tcpdump -i eth0 port 443
L7 dig DNS lookup dig example.com
L7 curl Test HTTP curl -vk https://site
Cross nmap Port scan nmap -sS 10.1.2.3

5. IP Addressing Basics

5.1 IPv4 Classes & Reservations

5.2 Convert Binary to Decimal

  1. Take the binary 10000100.

  2. Multiply each bit by its place value:

    • 1×128 + 0×64 + 0×32 + 0×16 + 0×8 + 1×4 + 0×2 + 0×1
  3. Add them up → 132.
Position 1 2 3 4 5 6 7 8 Sum
Decimal 128 64 32 16 8 4 2 1
Bit 1 0 0 0 0 1 0 0
Value 128 0 0 0 0 4 0 0 132

👉 So 10000100 in decimal = 132

5.3 Convert Decimal to to Binary

Take the first octet of 132.12.1.23.

  1. Start from 128 → 132 ≥ 128 → put 1, remainder = 132 − 128 = 4.
  2. Next (64) → 4 < 64 → 0.
  3. Next (32) → 4 < 32 → 0.
  4. Next (16) → 4 < 16 → 0.
  5. Next (8) → 4 < 8 → 0.
  6. Next (4) → 4 ≥ 4 → 1, remainder = 0.
  7. Next (2) → 0 < 2 → 0.
  8. Next (1) → 0 < 1 → 0.

Result row: 1 0 0 0 0 1 0 0

Position 1 2 3 4 5 6 7 8
Decimal 128 64 32 16 8 4 2 1
Representation 1 0 0 0 0 1 0 0

👉 So 132 in binary = 10000100

6. Advanced Networking Topics

6.1 NAT (Network Address Translation)

6.2 DDoS Attacks (3 categories)

  1. Volumetric → Flood bandwidth with massive traffic (e.g., UDP floods, DNS/NTP amplification).
  2. Protocol → Exploit L3/L4 weaknesses, exhausting connection state (e.g., SYN flood, Smurf attack, Ping of Death).
  3. Application → Target app layer (L7) with valid-looking requests that overwhelm servers (e.g., HTTP floods, Slowloris).

6.3 BGP (Border Gateway Protocol)

The internet is a network of networks (Autonomous Systems, or AS):

6.4 Jumbo Frames

6.5 Layer 7 Firewalls

7. Domain Name System (DNS)

7.1 What DNS Does

DNS (Domain Name System) maps human-readable names (e.g., example.com) to IP addresses or other service endpoints. Two roles often get conflated:

Some companies handle both functions (e.g., GoDaddy, Cloudflare), while others let you register in one place and host DNS somewhere else.

7.2 Common DNS Record Types

Record Type Purpose Example
A Maps domain → IPv4 address example.com. IN A 192.0.2.1
AAAA Maps domain → IPv6 address example.com. IN AAAA 2001:db8::1
CNAME Alias to another domain (not IP) www.example.com. IN CNAME example.globalcdn.com.
ANAME / Alias Provider-specific pseudo-record that behaves like a CNAME at the apex (e.g., Route 53 Alias, NS1 ANAME). example.com. IN ALIAS edge.globalcdn.net
MX Mail routing example.com. IN MX 10 mail1.google.com.
TXT Metadata (SPF, DKIM, domain verification) example.com. IN TXT "v=spf1 include:_spf.google.com ~all"
NS Authoritative name servers for a zone example.com. IN NS ns1.dnsprovider.com.
SOA Zone info (serial, refresh, retry) example.com. IN SOA ns1 hostmaster 2025010101 3600 1800 1209600 86400
PTR Reverse DNS (IP → domain) 1.2.0.192.in-addr.arpa. IN PTR example.com.
CAA Restricts which Certificate Authorities can issue TLS certs example.com. IN CAA 0 issue "letsencrypt.org"
SRV Service-specific record (SIP, LDAP, Kerberos) _sip._tcp.example.com. IN SRV 10 60 5060 sipserver.example.com.

7.3 Apex (Naked) Domains

7.4 DNS Resolution Flow

  1. A user queries example.com via a recursive resolver (ISP, Google Public DNS, Cloudflare, etc.).
  2. If the answer is uncached, the resolver asks the root servers which TLD (.com) server is authoritative.
  3. The resolver queries the TLD servers, which respond with the authoritative NS records for example.com.
  4. The resolver contacts the authoritative name servers for example.com (your DNS host) and retrieves the requested record (A, MX, TXT, …).
  5. The resolver caches the response based on its TTL and returns the answer to the user’s application, which then reaches out to the resolved endpoint.

7.5 DNSSEC Overview

DNSSEC (Domain Name System Security Extensions) protects against forged DNS data by cryptographically signing DNS responses. It ensures authenticity and integrity, but it does not encrypt traffic.

Without DNSSEC, attackers can poison resolver caches or spoof responses. With DNSSEC, resolvers reject tampered data because signatures fail validation.

7.5.1 Key Concepts

7.5.2 Roles and Responsibilities

7.5.3 Validation Flow

  1. Resolver requests the DS record for example.com from the TLD; verifies the response using the TLD’s signature.
  2. Resolver requests the DNSKEY record set from example.com’s authoritative servers and verifies it against the DS digest.
  3. Resolver fetches the desired record (e.g., A example.com) along with its RRSIG.
  4. Using the validated DNSKEY, the resolver checks the RRSIG. If it validates, the answer is accepted and cached; otherwise the response is discarded as suspicious.
DNSSEC Resolution Flow
🔐 DNSSEC Resolution – Validating DNS records with chain of trust

7.6 Route 53 Hosted Zone Resolution Flow

  1. You create a Hosted Zone in Route 53 for your domain (example.com).
  2. Route 53 assigns 4 authoritative name servers (NS records) for the domain.
  3. You add DNS records (A, CNAME, MX, TXT, etc.) inside the hosted zone.
  4. When a client queries example.com, the DNS resolver follows the chain:
    • Root → TLD → Route 53 authoritative NS (Amazon-managed).
  5. Route 53 authoritative servers return the DNS record (e.g., A record with an IP).
  6. Resolver caches and returns result to user → user connects to the target resource.
DNS Resolution Flow
🌐 DNS Resolution – Query to Answer

8. VPN

Note VPN builds on top of IPSec, for details on how IPSec works, see 3.4 Layer 3 & 5–6 - IPsec

8.1 Site-to-Site VPN

S2S VPN Example
🔐 Site-to-Site VPN – Communication Sequence

8.1.1 Connectivity Types

Keep in mind, VPN connections traverse the public Internet before reaching AWS’s network. Because of this, the routing path and how routes are exchanged are critical.

×
Contents