Where do the layers of the OSI Model operate in the operating system?

Question

The OSI model describes them as layers. But where do these layers actually operate in the operating system? For example, where and what actually does TCP? All these layers are described as using protocols or "rules", but how is the rule implemented? Does it all happen at the NIC? Is there a specific service running in the background that handles each protocol?

I can see that DHCP and DNS are run by services in the background of the windows operating system when I open up task manager. That's nice and easy to understand. Does TCP have its own background service or is it actually implemented in the code of an application using a network library? The same goes with ARP, IP and Ethernet. Does the NIC have a program running that handles ARP, IP, and Ethernet and where exactly?

Answer 1

First off the OSI model is a theoretical model, it doesn't nessacerally exactly match up with reality. Also generally layer models only show layers that actually add or remove something from the packet.

The following answer omits some minor details. Also some details may vary between operating systems, I have the most experiance with linux, some stuff may be different on other operating systems.

This answer also focuses on the basic set-up, many modern network controllers have "offload" features where features that were traditionally the responsibility of the OS kernel are taken over by the network controller.

---

The network controller is logically divided into two parts, the "MAC" and the "PHY". In some cases MAC and PHY may be integrated into the same chip.

The PHY does the following.

• Converting between the wire-level encoding and a stream of binary data units.
• Detecting when the line is busy (for half-duplex physical layers).
• Detecting the start and of incoming frames.
• Generating special wire-level encodings for the start and end of frames.

The MAC does the following.

• Translating between data streams at wire-rate and frames in a buffer that the OS can read/write.
• Generating/checking/stripping the preamble and FCS.
• Notifying the OS through interrupts when incoming frames have been delivered to the buffer.
• Implementing Medium access control if needed.
• Fitering incoming frames by destination MAC address.

The Kernel implements the following.

• Talking to the MAC (using a driver module).
• Building and interpreting Ethernet frames (minus the preamble and FCS).
• Implementing ARP (or ND for IPv6) to translate between IP and MAC addresses.
• Implementing building and interpretation of IP packets.
• Forwarding packets to the correct interface based on a routing table.
• Packet filtering, NAT etc.
• Major transport protocols like TCP and UDP.
• Some parts of ICMP.

Daemons and tools running outside the kernel but considered to be part of the OS implement.

• DHCP
• DNS cache (if used).
• Diagnostics like ping and traceroute.
• Configuration of kernel features.

Libraries loaded by the application are generally used to implement stuff that runs on top of TCP/UDP including:

• SSL/TLS
• DNS
• HTTP

Answer 2

The OSI model is a theoretical representation or guideline. The real world is often very different.

You are not going to get an answer that doesn't change depending on the circumstances. A lot depends on the OS itself since different OSes do things differently.

It is easy to relate some of the layers to different parts of a computer (e.g. the physical layer as the NIC, but even that doesn't encompass the entirety of layer-1). Layer-7 looks easy as the actual application application, but it is often more complicated than that; sometimes the OS itself or some add-on is the ultimate layer-7 source/destination.

Many times, the lines between the OSI layers are blurred, or multiple layers are encompassed in one. Sometimes things have a foot in one layer while operating in a different layer.

Answer 3

The "NIC" Hardware just sends ethernet-frames onto the wire and recieves them. The operation-system has a "driver" to programm the NIC since that is a hardware-specific task.

Then there is software in the Operation-system (modules in the kernel) which handles common "ethernet" tasks. It sends ethernet-frames of know type to "customers" which have an abonnement for it. The helper-protocol ARP is one of them, IP is the popular used one.

TCP and UDP Modules are customers of IP. ICMP is also customer of IP (but IP also uses it as a "client" of icmp, that is a little bit confusing).

All of them have programming-interfaces from the kernal to the user-application-level ( often the "socket-library" ).

A Programms like a "webserver" runs as an background-application and connectes to the tcp-module asking for every ip-paket with Destination TCP-Port 80.

A Programm like an Internet-Browser usese the tcp-module to connect to remote servers with TCP-Port 80, local Port does not matter here.

When TCP/IP was created, the OSI-Model was non-existing, so the relations beetween the OSI-layers are not so clear as in newer Networkprotocols (appletalk, for example :-)