The OSI model has seven layers and works as a common vocabulary. The TCP/IP model has four layers and describes the protocols the internet actually runs. Application in TCP/IP covers OSI's top three layers, and link in TCP/IP covers OSI's bottom two. Engineers use OSI numbers as shorthand.
What are the layers in the TCP/IP model?
RFC 1122, the host requirements standard, lays out the internet protocol suite in four layers: application, transport, internet and link.
- Application: user protocols such as Telnet, FTP and SMTP, and support protocols for name mapping, booting and management, including DNS and SNMP.
- Transport: end to end communication. TCP is the reliable, connection oriented service with resequencing and flow control. UDP is the connectionless datagram service.
- Internet: IP, ICMP and IGMP. This layer routes packets between networks.
- Link: the protocols for a particular network, such as Ethernet. RFC 1122 notes there are many link layer protocols for the many types of networks.
RFC 1122 also says the application layer of the Internet suite essentially combines the functions of the top two layers of the OSI reference model, presentation and application.
What are the seven OSI layers?
From the bottom: physical, data link, network, transport, session, presentation, application. The model comes from the ISO standards effort and was designed as a reference for open system interconnection rather than from running code.
How do they map?
- TCP/IP application layer: OSI application, presentation and session (RFC 1122 explicitly names the first two)
- TCP/IP transport layer: OSI transport
- TCP/IP internet layer: OSI network
- TCP/IP link layer: OSI data link and physical
Mappings differ between textbooks, particularly for the session layer, and nobody enforces one. Treat it as an aid to thinking, not a rule.
Why does the distinction matter for security?
People talk about "layer 3" and "layer 7" constantly. A packet filter works at the network and transport layers: it sees addresses and ports. An application firewall reads the HTTP request itself. A VPN built on IPsec operates at the network layer, while TLS operates above transport. Picking the right layer for a control decides what it can see and what it can block.
It also helps with diagnosis. If two hosts cannot connect, you walk the stack: is the cable or Wi-Fi up (link), do they have routes (internet), is the port reachable (transport), does the application respond (application).
A constructed example
A web page fails to load from a branch office. A ping to the server succeeds, so the internet layer is fine. A connection attempt to port 443 times out, so the transport layer is blocked, perhaps by a firewall rule. A different port works. The team finds a new rule that denies outbound connections to that address range. Walking the layers took two minutes. Arguing about the application, with nothing to go on, would have taken hours.
What do the layers do to a packet?
Each layer adds its own header as data moves down the stack on the sender, and each layer strips that header as the data moves up on the receiver. An HTTP request becomes a TCP segment with port numbers, which becomes an IP packet with addresses, which becomes an Ethernet frame with hardware addresses. This wrapping is called encapsulation. It is also why a VPN is possible: a tunnel takes a whole packet and carries it as the payload of another one. When you debug or filter traffic, knowing which header carries which piece of information tells you which device can see it and which cannot.
How to check or apply this
- Learn the four TCP/IP layers and the main protocol at each.
- Use OSI numbers only as shorthand, and say the protocol if there is any doubt.
- For each security control you own, write down which layer it works at and what it cannot see.
- When troubleshooting, test from the bottom up.
- When reading vendor material, check which model they use for "layer 4" or "layer 7".
Quick check
Which model is used on the internet?
The TCP/IP model describes the protocols the internet uses. OSI is a reference model used for teaching and as shared vocabulary.
Where does TLS fit?
It runs above the transport layer. The models do not give it an exact home, which is why textbooks disagree.
Sources
The OSI layer names are standard reference knowledge. The ISO standard itself was not fetched for this article.
Last reviewed: 18 October 2026.
