Networking Layers

How a GET request becomes a signal on the wire — and back.

At a Glance

Two models — The OSI 7-layer reference model (Physical → Application) is the teaching model; the TCP/IP 4-layer model (Link, Internet, Transport, Application) is what the internet actually runs.
Encapsulation — Each layer wraps the PDU from the layer above with a header (and sometimes a trailer). The receiver's stack strips one header per layer as the frame travels up.
Zoom visualizer — A single HTTPS request, unwrapped layer by layer from bits on the wire down to the plaintext HTTP bytes.
Per-layer PDUs — bit → frame → packet → segment/datagram → message. Each name maps to a layer and describes what "a unit of data" means there.
Why separation — Each layer only depends on the one below; you can swap Ethernet for Wi-Fi, IPv4 for IPv6, TCP for QUIC, or HTTP/1.1 for HTTP/3 without rewriting the others.

Zoom Into a Packet

A single HTTPS request — curl https://example.com/ — at every layer. Click the highlighted payload region to zoom one layer deeper, or use the controls below.

Layer 1

Physical

Bits on the medium. Voltage levels, light pulses, or radio symbols — no structure beyond the encoding.

Medium

1000BASE-T over Cat 5e

Line Coding

4D-PAM5, 125 MBaud

Pairs

4 (full-duplex)

Bit Rate

1 Gb/s

signal →

…10101010 10101010 10101010 10101010 10101011  [preamble + SFD]  10110100 01100010 … 11010011  [IFG gap]…

Framed bits → Ethernet frame

click to zoom in →

Layer 2 · Data Link

Ethernet II Frame

Delivers a payload to a physically adjacent interface identified by its MAC address. The FCS detects bit errors introduced by the medium.

08162431

Preamble + SFD (64 b)

0x55 55 55 55 55 55 55 D5

Dest MAC (32 b)

a4:b1:c1:00

Dest MAC (16 b)

00:01

Src MAC (16 b)

00:1a

Src MAC (32 b)

2b:3c:4d:5e

EtherType (16 b)

0x0800 → IPv4

Payload — IPv4 packet (46–1500 B)

click to zoom in →

FCS (4 B)

0xA1 B2 C3 D4 (CRC-32)

Layer 3 · Network

IPv4 Packet

Delivers the payload from a source IP to a destination IP, possibly across many physical networks. Routers forward packets hop-by-hop, decrementing TTL each time.

08162431

Ver

IHL

DSCP/ECN

0x00

Total Length

1500

Identification

0x1F84

Flg

Frag Offset

TTL

Protocol

6 → TCP

Header Checksum

0x5A4C

Source IP

192.0.2.42

Destination IP

93.184.216.34

Payload — TCP segment (1480 B)

click to zoom in →

Layer 4 · Transport

TCP Segment

Turns the best-effort datagram service of IP into a reliable, in-order byte stream between two ports. Sequence and ack numbers drive retransmission and flow control.

08162431

Source Port

51214

Destination Port

443 → HTTPS

Sequence Number

0x3F2A7B90

Acknowledgment Number

0x8C1D4E25

Data Off

Rsv

Flags

PSH, ACK

Window

65535

Checksum

0xE811

Urgent Pointer

Payload — TLS record (1460 B)

click to zoom in →

Layer 5–6 · Session / Presentation

TLS 1.3 Record

Authenticates the peers and encrypts the stream with an AEAD cipher. On the wire every record looks like opaque application_data; the type and plaintext only exist after decryption.

Content Type (1 B)

0x17 → app_data

Legacy Version (2 B)

0x0303 (TLS 1.2 for compat)

Length (2 B)

0x0138 (312 B)

ciphertext (AEAD) 8C 3D E4 91 7A F1 2B C5 9D 44 E0 8B 6F A2 … B3 9E 7C D1 nonce + encrypted payload + 16-byte auth tag

↓ AEAD decrypt with server_application_traffic_secret ↓

Plaintext — HTTP request (295 B) + inner type 0x17

click to zoom in →

Layer 7 · Application

HTTP/1.1 Request

The actual user-meaningful bytes. Everything from Layer 1 to Layer 5 exists only to deliver this to the right process on the right machine.

GET / HTTP/1.1
Host: example.com
User-Agent: curl/8.5.0
Accept: */*
Connection: keep-alive

You're at the innermost layer.

there's no further encapsulation — this is the payload being transmitted.

Layer 1 of 6

OSI vs TCP/IP

Two mental models for the same stack. OSI is pedagogically tidy; TCP/IP describes what's actually implemented. Most real protocols straddle one or two OSI layers.

OSI #	OSI Name	TCP/IP Layer	Example Protocols
7	Application	Application	HTTP, DNS, SMTP, SSH, gRPC
6	Presentation		TLS (encryption + serialization overlap), MIME, ASN.1
5	Session		TLS (session tickets), RPC framing
4	Transport	Transport	TCP, UDP, QUIC, SCTP
3	Network	Internet	IPv4, IPv6, ICMP, IPSec
2	Data Link	Link	Ethernet (802.3), Wi-Fi (802.11), PPP, ARP
1	Physical	Link	Cat 5e/6, fiber (SFP+), radio (OFDM)

Encapsulation

Sending side adds a header at each layer; receiving side strips them. The outermost frame on the wire contains every other header nested inside.

flowchart LR A1["HTTP request"] --> A2["+ TLS header, AEAD encrypt"] A2 --> A3["+ TCP ports, seq, flags"] A3 --> A4["+ IP src/dst, TTL"] A4 --> A5["+ Ethernet MACs, FCS"] A5 --> W(("bits on the wire")) W --> B5["- Ethernet: verify FCS"] B5 --> B4["- IP: route"] B4 --> B3["- TCP: reorder, ack"] B3 --> B2["- TLS: decrypt, verify"] B2 --> B1["HTTP request delivered"]

Per-Layer Summary

Layer	PDU	Addressing	Who owns it	Typical concern
7 Application	Message / stream	URL, hostname	App process	Semantics, content
6 Presentation	—	—	TLS / MIME libs	Encryption, encoding
5 Session	—	—	App / TLS	Conversation state
4 Transport	Segment (TCP) / Datagram (UDP)	Port	OS kernel	Reliability, ordering, flow control
3 Network	Packet	IP address	OS kernel, routers	Addressing, routing, fragmentation
2 Data Link	Frame	MAC address	NIC driver, switches	Local delivery, error detection
1 Physical	Bit / symbol	—	Cable, transceiver, radio	Encoding bits into signal

References

Wikipedia: OSI model — the 7-layer reference model.
Wikipedia: Internet protocol suite — the TCP/IP 4-layer model that the internet actually uses.
RFC 1122 — Requirements for Internet Hosts (the canonical description of the TCP/IP layering).
RFC 791 — Internet Protocol (IPv4) header definition.
RFC 8200 — Internet Protocol Version 6 (IPv6).
RFC 9293 — current TCP specification.
RFC 768 — User Datagram Protocol (UDP).
IEEE 802.3 — Ethernet standard.
RFC 8446 — TLS 1.3, the record format used in the visualizer.
RFC 9110 — HTTP semantics (the L7 message in the visualizer).
Wikipedia: Encapsulation — the general concept.
Wireshark — the best way to see real packets at every layer on your own machine.