What are layers 3 and 4?

The OSI model has seven layers; the internet's own protocols map onto it loosely. Layers 3, 4 and 7 are the ones defenders talk about most.

Layer 3 gets a packet from one address to another across many networks. Each packet carries a source and destination IP address; routers read the destination and pass it on. The layer knows nothing about which program sent the packet or whether it belongs to a conversation.

Attacks at this layer are about volume and forgery: floods that fill links, and packets with forged sources used for reflection. See IP spoofing and volumetric attacks.

Layer 4 adds ports, so data reaches the right program, and, with TCP, connections: a handshake to open one, numbered segments so nothing is lost or reordered, and a close. UDP skips all of that and simply sends datagrams.

TCP's bookkeeping is what layer 4 attacks target. A SYN flood opens connections it never completes; other floods send packets that force lookups in connection tables. UDP has no state to exhaust, so UDP attacks are mostly about volume.

TCP opens a connection with a three-way handshake, numbers every segment, resends what was lost and closes the connection when done. That makes it reliable and ordered, and it is what HTTP traditionally runs on. It also means the server keeps state for every connection, which is exactly what state floods try to exhaust.

UDP sends each datagram on its own, with no handshake, no delivery check and no connection to remember. It suits lookups and real-time traffic such as DNS, voice and games, and the newer HTTP/3 runs over it. Because a UDP request can be sent with a forged source and answered with a larger reply, it is the usual carrier for amplification attacks.

Routers are layer 3 devices: they read destination addresses and forward packets. Network firewalls usually work at layers 3 and 4, allowing or refusing traffic by address, port and connection state. Layer 4 load balancers spread connections across servers by address and port without reading the requests inside them.

None of these looks at what a request asks for. That is the job of devices at layer 7, such as layer 7 load balancers and web application firewalls, and the reason the two kinds of device are used together rather than one instead of the other.

The internet's own model, the TCP/IP model, has four layers instead of seven. Its internet layer matches OSI layer 3 and its transport layer matches OSI layer 4, so the numbers survive even when people mean internet protocols.

That is why layer 3 is often simply called the IP layer and layer 4 the TCP layer. How the two models line up, layer by layer, is on OSI model.

A defence can only judge what it can see. Network equipment working at layers 3 and 4 sees addresses, ports and packet counts, so it can drop floods and malformed packets quickly but cannot tell a harmful request from a harmless one.

A request filter at layer 7 sees the request itself, but only after the layers below have delivered it. That is why floods are stopped in the network and application attacks in the request filter; the boundary is drawn on layer 3, 4 and 7 attacks.