Intro

In this lesson, we explore both the OSI model and the TCP model. These models are needed for better understanding of how computer communication works. They're also important for ensuring that all products like network devices use standardized approaches and to make sure that what we purchase and implement, and also use, standardized approaches. You can download the script for this video from above or at the end of the video.

Why do we need models?

So why do we need models for system communication? Many vendors create products that need to communicate over the network. These products must be standardized, or we end up with a complex environment of a mix of devices that work differently or fail to work at all. Network and server engineers need to understand how things work for proper design and implementation of security. Models help with this understanding and provide information about what happens when, where, and how it might be protected. Finally, vendors can design products using the models without having to worry about whether they will be compatible with basic communications protocols. Further, products can focus on a specific level of a model to provide specialized solutions.

OSI vs TCP/IP Model

The TCP model, created in the 1970s, does not break the communication stack into as many layers as the OSI model. Consequently, it's useful for looking at a single system's communication, but it falls short when defining where and when protocols are used, and how to implement solutions. In this lesson, I focus on the more detailed OSI model, and then I show how the OSI layers map to the TCP/IP model.

OSI Layers

This is the OSI model. It consists of seven layers that all infrastructure engineers and security teams must understand. One way to remember the layers is the sentence to the left of the layers: Please Do Not Throw Sausage Pizza Away. There are other memory helps for the model, but this is the one I've used for many years. Before continuing, it's important to understand the OSI model. The OSI model is just that: a model. It's an abstracted theoretical look at where and how different TCP/IP operations occur. Each packet of data sent to or received by a system using TCP/IP must go through these layers. At each layer, specific operations are done to the data so it is effectively communicated across one or more networks, and eventually finds the target system. Note that protocols like TCP can stretch across layers and so can functionality. To execute required tasks, certain protocols exist at each layer, as shown in this slide. Again, engineers and security personnel need to understand the layers, what happens in each, and how. So let's step through an Ethernet example.

Outgoing Ethernet OSI Example

When an application, a user, or server application wants to communicate with another resource on the network, it communicates with the appropriate application layer app, such as HTTP or POP3. Applications at the application layer might not understand the format needed for communicating the data. The purpose of the presentation layer is to translate the data from the application layer to a form usable for the required session. Translations include addressing formats like GIF, JPEG, encryption, and compression. The data, or the payload, is now passed to the session layer. The session layer is responsible for setting up, managing, and dismantling sessions between devices. When an application makes a request to communicate with an external resource, the session layer checks to ensure that connection with the external resource is possible. If a session is not possible, an error message is returned. Otherwise, the session layer establishes communication between the local and external resources. When communication is completed, the session layer terminates the connection. When transmitting large amounts of data, the data must be broken into blocks that will form sequential payloads sent to the external system. The segmentation is done at the transport layer. Note that in Ethernet networks the sent data is divided into 1500 character payloads. Each payload is inserted into its own Ethernet frame. The transport layer manages the session traffic with TCP and UDP. When the connection is TCP, the transport layer ensures the correct and sequential passing of packets. This enables the receiving system to determine if it has received all packets and to manage packet sequence. UDP is used for transmissions that don't require precision, such as printing. When using UDP, sequencing and packet loss detection are not typically included. The transport layer also manages the ports on which the packets are sent and received. The port number is assigned or read at this layer. Finally, the transport layer manages communication with multiple external devices by multiplexing payloads. This layer adds a TCP/UDP header and moves the emerging packet to the network layer. At the network layer, the protocol stack begins wrapping information around the payload and transport-layer sequence information. It does this by adding an IP header that includes the source and target IP addresses. At this point, we have an Ethernet frame that is passed to the data link layer. The data link layer consists of two major functions: media access control, or mac, and logical link control, or LLC. The MAC function provides information to the packet that includes the target and source MAC addresses. If the packet is sent to a device on a different network segment, the mac address used will be for a gateway. The gateway, such as a router, will read the packet and forward the packet to the next step in the required network path. The LLC adds header information that specifies the network protocol used. For example, it's necessary for the target system to know if the packet was sent with Ethernet and what version. Traffic control header information is added, and the frame becomes a packet. Part of this control information is a frame check sequence, or CRC, also known as cyclic redundancy check. The CRC value is created based on the content of the frame. Another CRC is created at the destination and compared to the CRC value in the sent frame. If the two CRC values differ, the frame integrity is in question. Finally, the data link layer places ones and zeros on the communication medium represented by the physical layer. And the physical layer it's just the actual wired or wireless connection between network resources. This is a sample completed Ethernet frame that would be placed on the network by the data link layer. Note the traffic control header data provided in OSI layers 1 and 2. Most of the frame and packet structure elements are used to get the payload safely from one system to another. Again, note that each frame or packet only contains up to 1500 characters as its data payload. The rest of the information in the frame is used by the protocols across the OSI model for proper delivery of the frame to the recipient.

Incoming Ethernet OSI Example

The receiving system sees the packet at the data link layer, which looks at the destination MAC address. If the destination MAC address matches its own MAC address, the system strips the address header information and moves the payload into the network layer. If the Ethernet packet is intended for this device, the IP address will match the receiving system's IP address. If not, the packet is likely being read by a gateway that uses this information to place the packet back on the network with a new MAC address. If the frame is for this device, it's passed from the network layer to the transport layer. At the transport layer, the received packet is reviewed for TCP or UDP protocol. The port number used is also extracted. This enables the transport layer to understand how to manage the reliability of the traffic being received and the port to which to send the payload. The transport layer using TCP can keep the packets received in sequence and ensure all packets are received. If there are problems, the transport layer has the capability to work through those. The payload makes its way to the proper session channel by using the port number. The presentation layer translates the payload for use by the requesting user or server application via the appropriate application layer app.

OSI to TCP/IP Mapping

Finally, this is how the OSI model on the left maps to the TCP/IP model. When speaking about how and where security controls and other network-connected devices work, we almost always use the OSI model. However, it's always important to understand how the two models map to each other. Well, that's it for this lesson. If you have questions, please ask. ...and until next time be careful once you click.