When most networking students first learn about the OSI model, they spend a great deal of time trying to figure out which layer of the model a particular protocol fits into. We get a lot of questions about OSI layers on this forum, and they are usually like:

  • Which OSI layer does IS-IS operate at?
  • Is HTML a presentation or application protocol?
  • Are VPN tunnels layer 2 or 3?

How should a student (or professional for that matter) understand the relationship between the OSI model and protocols he/she works with?

  • 1
    As an OSI+TCP/IP implementor for over 30 years, the answer is simple: Use the model to understand the big picture. After that, especially for anything that doesn't fit neatly, focus on the services provided and the services used. That rarely fails to provide a clear picture. Commented Dec 18, 2020 at 3:06

7 Answers 7


There are two important facts about the OSI model to remember:

  1. It is a conceptual model. That means it describes an idealized, abstract, theoretical group of networking functions. It does not describe anything that someone actually built (at least nothing that is in use today).

  2. It is not the only model. There are other models, most notably the TCP/IP protocol suite (RFC-1122 and RFC-1123), which is much closer to what is currently in use.

A bit of history: You’ve probably all heard about the early days of packet networking, including ARPANET, the Internet’s predecessor. In addition to the U.S. Defense Department’s efforts to create networking protocols, several other groups and companies were involved as well. Each group was developing their own protocols in the brand new field of packet switching. IBM and the telephone companies were developing their own standards. In France, researchers were working on their own networking project called Cyclades.

Work on the OSI model began in the late 1970s, mostly as a reaction to the growing influence of big companies like IBM, NCR, Burroughs, Honeywell (and others) and their proprietary protocols and hardware. The idea behind it was to create an open standard that would provide interoperability between different manufacturers. But because the OSI model was international in scope, it had many competing political, cultural, and technical interests. It took well over six years to come to consensus and publish the standards.

In the meanwhile, the TCP/IP model was also developed. It was simple, easy to implement, and most importantly, it was free. You had to purchase the OSI standard specifications to create software for it. All the attention and development efforts gravitated to TCP/IP. As a result, the OSI model was never commercially successful as a set of protocols, and TCP/IP became the standard for the Internet.

The point is, all of the protocols in use today, the TCP/IP suite; routing protocols like RIP, OSPF and BGP; and host OS protocols like Windows SMB and Unix RPC, were developed without the OSI model in mind. They sometimes bear some resemblance to it, but the OSI standards were never followed during their development. So it’s a fools errand to try to fit these protocols into OSI. They just don’t exactly fit.

That doesn’t mean the model has no value; it is still a good idea to study it so you can understand the general concepts. The concept of the OSI layers is so woven into network terminology, that we talk about layer 1, 2 and 3 in everyday networking speech. The definition of layers 1, 2 and 3 are, if you squint a bit, fairly well agreed upon. For that reason alone, it’s worth knowing.

The most important things to understand about the OSI (or any other) model are:

  • We can divide up the protocols into layers
  • Layers provide encapsulation
  • Layers provide abstraction
  • Layers decouple functions from others

Dividing the protocols into layers allows us to talk about their different aspects separately. It makes the protocols easier to understand and easier to troubleshoot. We can isolate specific functions easily, and group them with similar functions of other protocols.

Each “function” (broadly speaking) encapsulates the layer(s) above it. The network layer encapsulates the layers above it. The data link layer encapsulates the network layer, and so on.

Layers abstract the layers below it. Your web browser doesn’t need to know whether you’re using TCP/IP or something else at at the network layer (as if there were something else). To your browser, the lower layers just provide a stream of data. How that stream manages to show up is hidden from the browser. TCP/IP doesn’t know (or care) if you’re using Ethernet, a cable modem, a T1 line, or satellite. It just processes packets. Imagine how hard it would be to design an application that would have to deal with all of that. The layers abstract lower layers so software design and operation becomes much simpler.

Decoupling: In theory, you can substitute one specific technology for another at the same layer. As long as the layer communicates with the one above and the one below in the same way, it shouldn’t matter how it’s implemented. For example, we can remove the very well-known layer 3 protocol, IP version 4, and replace it with IP version 6. Everything else should work exactly the same. To your browser or your cable modem, it should make no difference.

The TCP/IP model is what TCP/IP protocol suite was based on (surprise!). It only has four layers, and everything above transport is just “application.” It is simpler to understand, and prevents endless questions like “Is this session layer or presentation layer?” But it too is just a model, and some things don’t fit well into it either, like tunneling protocols (GRE, MPLS, IPSec to name a few).

Ultimately, the models are a way of representing invisible abstract ideas like addresses and packets and bits. As long as you keep that in mind, the OSI or TCP/IP model can be useful in understanding networking.

  • 2
    I've always wondered why we refer to the OSI model when, in all reality, the TCP/IP model fits the bill better.
    – Ryan Foley
    Commented Feb 20, 2014 at 8:01
  • 5
    @RyanFoley, true in many cases. However when it comes to troubleshooting (and especially teaching it) it is better to have separate physical and data layers to address the issues at each separately. For example, it is good to know the difference in a Cisco device between an interface that is up/up, one that is up/down and one that is down/down.
    – YLearn
    Commented May 30, 2014 at 22:51
  • "For example, we can remove the very well-known layer 3 protocol, IP version 4, and replace it with IP version 6. Everything else should work exactly the same. To your browser or your cable modem, it should make no difference." Unfortunately it does make a difference because the abstractions are leaky. Applications and transport protocols need to know about the addressing used by the internet protocol. Commented Jul 28, 2016 at 16:11
  • 2
    joelonsoftware.com/2002/11/11/the-law-of-leaky-abstractions We build abstractions to hide the ugly details of the underlying thing, but some details of the underlying thing leak though and cause problems. One such thing that leaks right through to the top of the stack is the addressing system. Commented Feb 8, 2019 at 17:22
  • 1
    @Truth I mean the function(s) of the layer.
    – Ron Trunk
    Commented May 8, 2021 at 17:40

There is some confusion here. Just because a function doesn't seem to fit a layer doesn't mean it doesn't. OSI is flexible and allows objects and sublayers where practical implementations map onto the model. Some of the functions of a layer may also be duplicated at other layers. Also processing doesn't have to happen at the Application layer. Finally, OSI was more than a model, it was implemented in its entirety by some manufacturers. I worked on the DEC project. Practicality has meant that only certain parts of OSI are used today.


All IGP (Interior gateway protocols) routing protocols works at layer 3. External BGP works at layer 4, while internal works at layer 3.

Physical Layer - Deals with hardware network devices, i.e laptops, mobile phones, desktops. Layer 1 is known to be a collision domain, Layer 1 PDU (protocol data unit is bits).

Data/link layer - This layer concerns with layer 2 switches, broadcast domains, VLANS, STP, VTP. The protocol data unit of this layer is called frames.

Network Layer - This is when routing occurs, most routing protocols works at this layer. This is also known as the IP layer, where VLANS communicate. The PDU for this layer is known as packets.

Transport layer - Transport layer deals with TCP and UDP ports, these is where the packets from layers 3 are sent to their destination ports. It is important to remember that TCP is a connection-oriented protocol while UDP is connection-less oriented protocol (non guranteed delivery of data). The PDU for this layer is datagrams.

Session layer - Session layer is where the packets are encapsulated from being decapsulated from layer 3. This layer deals with multiple server side programming languages where you can create software-based applications and convert them into ->

The Presentation layer - This layer is about the client-side codes you see on your web browser, or when you do a right-click and view the source, these are mainly HTM/CSS/Javascript codes that allows you to view your ->

The Application layer - This is where the GUI (Graphical user interface) translates the HTML/CSS codes from layer 6 to this layer. What you see on your web browser is the front end GUI. Layer 5,6,7 PDU is called message.

I hope these answer all OSI-related questions.

Which OSI layer does IS-IS operate at? - Layer 3
Is HTML a presentation or application protocol? - Presentation
Are VPN tunnels layer 2 or 3? -> L2TP is layer 2 -> VPN tunnels typically works at layer3 such as IPSEC.

  • 1
    This doesn't answer the OP; he never asked what each layer did, he asked what someone should understand about the underlying concepts.
    – Ryan Foley
    Commented Feb 20, 2014 at 7:51
  • 1
    Informative is great, but this is a problem/solution site. Your answer is great if the question was "What are the different layers of the OSI model, and what does each do?". The question is about the fundamentals backing the OSI model, not the OSI model directly. Great insight, but bad answer for this specific question.
    – Ryan Foley
    Commented Feb 20, 2014 at 8:57
  • 5
    Chris, I appreciate your answers, and to a large extent, you are correct. But ISIS runs on top of IP, does that make it layer 4? How about BGP? It runs on top of TCP. Is it layer 5? My point is although you can squeeze protocols into the layers, they don't really fit. If you were to look at the OSI presentation layer specification, I don't think HTML would quite qualify. Even OSI admitted that layer 2 was too broad and they had to divide it into two sublayers.
    – Ron Trunk
    Commented Feb 20, 2014 at 11:23
  • 2
    OSI model is just a theoretical model. Even if routing protocol <name here> uses (L2|L3) packets, it is also a part of L7, since it's an application, and it has to calculate the routing table, and maybe same layer inbetween. Not everything is black and white.
    – mulaz
    Commented Feb 20, 2014 at 12:14
  • 3
    @Ron, ISIS is not a native IP protocol. OSPF is. (Just to add more confusion. :-) ) Commented Feb 20, 2014 at 16:19

HTTP (not HTML) has both presentation and application layer. VPN Tunnels add overlay layers to the existing stack: it could be either Layer 2 or Layer 3 depends of their kind. Then you will be able to see this added layer(s) twice in the packet.

  • 1
    You can certainly label things as you see fit, but HTTP was developed without regard to the OSI model, and it doesn't conform to the specifications. The same is true about VPNs -- the OSI standards never anticipated them. So any resemblance is, as they say, completely coincidental.
    – Ron Trunk
    Commented Feb 19, 2017 at 15:25
  • @RonTrunk - IP wasn't designed to the OSI model, but it fits pretty neatly in layer 3. OSI has a model, and it has detailed specifications of lots of services. HTTP doesn't match any of the OSI service specifications, not even close. But I would assert that it does handle issues that are addressed in the OSI application and presentation model layers. Now, I don't know whether that assertion is very helpful, but it's valid. Commented Dec 18, 2020 at 3:03

The best way to use the OSI model is a general model and keeping in mind that it often doesn't fit. Rather than stressing about "layer", for anything that doesn't seem to easily fit, focus on the service provided and the services used. For example, a tunnel protocol can provide link layer services using transport layer services. Which layer is it? To its user it looks like 2. To the layer it uses it looks like layer 3. But it's neither and/or both. To try to squish it into any single layer misses the point completely.

ISIS is layer 3. It helps the network layer protocol (IP or CLNP) do its job. It uses the services of layer 2. OSPF is also layer 3. It helps the network layer protocol (IP) do its job. It uses IP to do its job and doesn't use layer 2 directly.

Regarding the upper layers (session, presentation, ACSE), it's probably best to forget about them unless they help in a specific issue. As it turned out, it's better to do the things they do using a different, non-layered organization.


One of the very few things that actually are from the OSI model are the X.509 certificates and big chunks of LDAP coming from X.500. The other thing is X.400 for messaging, MS Exchange had this at least in 5.5, not sure if later versions included it.

So, OSI is a model, in the network domain it lost the race against TCP/IP and I really dont understand why this is still teached to students. Trying to put things like MPLS in this model does not make any sense.

Digging deeper there will lead you to the pain of big organisations trying to enforce standards, horrible things like ASN.1 and BER ... overengineering everything.

  • For the lower 4 layers, it definitely helps to understand the OSI model, or the IP services model (which are similar enough at the academic level.) But I wish teachers would focus more on services than on layers. The layers are just the big map simple case. Once you understand that, then you look at all the interesting exceptions, based on services provided and services used. Commented Dec 18, 2020 at 2:54
  • Interesting to hear that x.400 might still be alive. I thought it was the last to die (with only X.5xx and ISIS remaining.) Commented Dec 18, 2020 at 2:56

I'd like to concentrate on this part of the question:

Are VPN tunnels layer 2 or 3?

The OSI model is what the name says: A model.

In general, models are simplified representations of the reality. The simplification of a model often has the consequence that some aspects of the reality cannot be described by the model.

(A completely different example for a "model" would be a world map: It is impossible to draw a two-dimensional map that represents all distances correctly!)

This is also true for the OSI model: There are some aspects which cannot be described correctly using that model.

Tunneling (this means: VPN) is one of these aspects.

However, I'd say that it depends on the point of view which protocol belongs to which layer:

Let's say IP packets are tunneled in UDP packets.

For your internet provider, the IP packets inside the UDP packets are just payload data. For this reason, the "inner" IP packets are layer 5.

For your local network, the surrounding UDP packets (in the internet) are just a method to transport the IP packets (just like Ethernet frames). For this reason, the UDP packets are layer 2.

The following drawing makes this clearer:

Internet provider's       Actual protocols        Local network's idea
idea of the OSI layers    (Reality)               of the OSI layers

| (outer)         |       | ...          |        | (inner)         |
| Layers 5-7      |       | HTTP         |        | Layers 5-7      |
|                 |       +--------------+--------+-----------------+
|                 |       | TCP          |        | (inner)         |
|                 |       |              |        | Layer 4         |
|                 |       +--------------+--------+-----------------+
|                 |       | IP           |        | (inner)         |
|                 |       |              |        | Layer 3         |
| (outer)         |       | UDP          |        | (inner)         |
| Layer 4         |       |              |        | Layer 2         |
+-----------------+-------+--------------+        |                 |
| (outer)         |       | IP           |        |                 |
| Layer 3         |       |              |        |                 |
+-----------------+-------+--------------+        |                 |
| (outer)         |       | PPPoE        |        |                 |
| Layer 2         |       +--------------+        |                 |
|                 |       | Ethernet     |        |                 |
|                 |       +--------------+        |                 |
|                 |       | ATM cells    |        |                 |
| Layer 1         |       | ...          |        | Layer 1         |
  • While I do get your point, the "UDP: Layers 1-2" is way off. Just because it's below layer 3 doesn't make UDP layer 2 - there's an intermediate service (your VPN) that looks like L2 for IP while it at the same time sits on top of UDP/L4 like an application. Tunneling screws with the layer order, so it's L7-5 <=> inner L4 <=> inner L3 <=> VPN <=> outer L4 <=> outer L3 <=> outer L2 and so on. Of course, there's another (outer) layer 3 under your "UDP: Layer 1-2" that's actually (outer) L4.
    – Zac67
    Commented May 11, 2021 at 19:23
  • Also, there could be another tunnel that would bring your count to negative layer numbers...
    – Zac67
    Commented May 11, 2021 at 19:28
  • @Zac67 The problem is that the "traditional" OSI model does not cover use-cases like tunneling and therefore different people will apply that model to that use-case differently: In the edited ASCII art, I use your terms "inner L4" and "outer L3". My point of view is that the "inner L2" consists of "outer L2-L4"... The updated example shows some protocol stack with more than one protocol below "outer L3". As far as I know, these layers would be called "L2a, L2b, L2c" but not "L2, L1, L0" so there will never be L0 or L(-1). We could ... Commented May 11, 2021 at 20:41
  • @Zac67 ... tunnel another VPN connection over the VPN connection. In this case we would have something like "inner L3", "middle L3" and "outer L3". In my view of the OSI model, "middle L3" would be both a part of "inner L2" and of "outer L5-L7". Commented May 11, 2021 at 20:43
  • @Zac67 By the way: As far as I know (I'm not sure), the ATM protocol used for ADSL internet connections consists of two protocols that are normally seen in OSI L4 and/or L3. However, when talking about internet connections, they are seen as part of OSI L2. If this information is correct, then it is already standard to consider some L4 protocol as L2 protocol when IP packets are carried inside that L4 packet. Commented May 11, 2021 at 20:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.