The OSI model: seven layers, and what attacks each one

A common way to remember the order from layer 1 up is “Please Do Not Throw Sausage Pizza Away”: physical, data link, network, transport, session, presentation, application.

Each layer serves the one above and uses the one below. A web request is built at layer 7, cut into TCP segments at layer 4, wrapped in IP packets at layer 3 and sent as frames and signals at layers 2 and 1; the receiver unwraps it in the opposite order. The network and transport layers have their own page, layers 3 and 4, and the application layer is on layer 7.

The physical layer turns bits into something that can travel: voltage on copper, light in fibre, radio waves. The data link layer groups those bits into frames and moves them between devices that share a network, such as a laptop and a Wi-Fi access point, using hardware addresses.

Attacks here need nearness: access to the building, the cable or the local network. Pretending to be the router on a shared network, or flooding a switch until it forwards everything everywhere, are layer 2 attacks. They matter for offices and data centres, and almost never for a public website reached over the internet.

The network layer gets packets from one address to another across many networks, which is what IP does. The transport layer gets data from one program to another on those machines: TCP with connections and delivery checks, UDP without either.

This is where volumetric and protocol floods aim: filling the link, or exhausting the state a server keeps for connections, before any request is read. Forged source addresses, explained on IP spoofing, also live here. The detail is on layers 3 and 4, and the attacks by layer on layer 3, 4 and 7 attacks.

The session layer manages ongoing dialogues between programs and the presentation layer the form of the data, such as encoding and encryption. In internet protocols these jobs are mostly done inside the application or by the protocols around it, so the two layers exist more in teaching than in software.

The application layer is where requests become meaningful: a method, a path, headers and a body that a program will act on. Injection, credential stuffing, scraping and HTTP floods all happen at layer 7, and only a defence that reads complete requests can tell them apart from ordinary traffic. That is the subject of layer 7 and of web application firewall.

The internet was built on a simpler model. RFC 1122 describes four layers: link, internet, transport and application. The link layer covers OSI layers 1 and 2, internet matches layer 3, transport matches layer 4, and the application layer takes in everything from 5 to 7.

So the OSI model is a reference for naming, and the TCP/IP model is a description of the protocols in use. People say “layer 7” and “layer 4” from OSI even when they mean internet protocols, which is why both models appear side by side.

A defence can only judge what it reads. A network firewall reads addresses and ports at layers 3 and 4, so it cannot see an injection hidden in a form field. A request filter reads complete requests at layer 7, so it cannot help with a flood that fills the link before a request exists. Naming the layer of an attack is the quickest way to name the defence that can see it.

That is also why “layer 7 firewall” and “layer 4 load balancer” are useful labels: they say how deep a device looks. The comparison is laid out on WAF vs firewall.