OSI Model & Packet Flow

Overview

The OSI model is a troubleshooting map — when a connection fails, ask which layer broke. This guide covers PDUs, encapsulation, protocol vs port, end-to-end flows, and Jeremy's IT Lab bottom-up verification workflow.

Why the OSI model matters for CCNA

The OSI model is not a memorization exercise — it is a troubleshooting map. When Jeremy's IT Lab walks through a broken connection, the question is always: which layer failed? Cable errors live at Layer 1. VLAN and MAC problems live at Layer 2. Routing and subnet mistakes live at Layer 3. Port blocks and TCP retransmits live at Layer 4. DNS, HTTP, and application auth live at Layer 7.

CCNA still uses OSI language in exam questions even though production networks run the TCP/IP model. You need a practical mapping between the two, not a song about all seven layers.

OSI layers — responsibilities and examples

CCNA collapses layers 5–7 into "Application" for most questions. Focus on where a problem lives, not reciting layer names backward.

TCP/IP model vs OSI

The TCP/IP model is what networks run. The OSI model is how we talk about and isolate problems. Both are valid — exam questions may use either framing.

Protocol vs port — do not confuse them

These terms appear together constantly but mean different things:

• Protocol — a system of rules governing how two entities communicate. Defines syntax, semantics, timing, and error recovery. May be implemented in hardware, software, or both. Examples: TCP, IP, Ethernet, OSPF.
• Port — a 16-bit logical endpoint (0–65535) inside a host OS that identifies a specific process or service. TCP and UDP use port numbers so multiple applications can share one IP address.
• Ephemeral port — a short-lived client-side port allocated automatically (IANA suggests 49152–65535). Your browser picks an ephemeral source port when connecting to a web server's well-known port 443.

Encapsulation and decapsulation

When Host A sends data to Host B across a routed network, each layer adds its own header (and sometimes trailer) as the data moves down the stack. At each hop, the receiving device strips headers appropriate to its layer and passes the payload up.

Encapsulation (sender, top to bottom):

1. L7–L5 — Application data (e.g., HTTP GET request)
2. L4 — TCP header added → creates a segment (source/dest ports, seq/ack, flags, window)
3. L3 — IP header added → creates a packet (source/dest IP, TTL, protocol field)
4. L2 — Ethernet header + FCS trailer added → creates a frame (source/dest MAC, EtherType)
5. L1 — Bits transmitted on the wire or fiber

Decapsulation (receiver, bottom to top): Each device processes only what it understands. A switch reads the frame header (MAC addresses). A router strips the frame, reads the packet (IP addresses), makes a forwarding decision, then re-encapsulates in a new frame toward the next hop.

End-to-end traffic flow — same subnet

PC A (10.1.1.1/24) pings PC C (10.1.1.2/24) on the same Ethernet segment:

1. A checks the destination IP — same subnet, so the target is local
2. A checks its ARP cache for C's MAC address
3. If missing, A sends an ARP request (broadcast): "Who has 10.1.1.2? Tell 10.1.1.1"
4. C replies with an ARP reply (unicast) containing its MAC
5. A builds an ICMP echo inside TCP/IP, wraps it in a frame with DA = C's MAC, SA = A's MAC
6. The switch forwards based on MAC table (or floods if unknown)
7. C receives, decapsulates, replies — process reverses

End-to-end traffic flow — remote subnet

PC A (10.1.1.1/24, gateway 10.1.1.100) pings PC B (10.1.2.1/24):

1. A sees 10.1.2.1 is not on its /24 network → sends to default gateway
2. A ARPs for the gateway MAC (10.1.1.100)
3. A sends frame: L2 SA=A, DA=Gateway MAC | L3 SA=10.1.1.1, DA=10.1.2.1
4. Router receives, strips L2, reads L3 destination
5. Router checks routing table → 10.1.2.0/24 out Fa0/1
6. Router ARPs for 10.1.2.1 on the exit segment (if needed)
7. Router forwards with new L2: SA=Router Fa0/1 MAC, DA=B's MAC | L3 unchanged

Communication types

Multicast MAC addresses have the last bit of the first octet set to 1. Switches flood unknown multicast; routers handle multicast routing separately.

Jeremy's IT Lab troubleshooting workflow

Jeremy's approach maps directly to OSI layers. Use this sequence on every break:

1. Physical (L1) — Is the link up? Correct cable? show ip interface brief — admin/oper status?
2. Data link (L2) — ARP working? Correct VLAN? MAC table populated? show vlan brief, show mac address-table
3. Network (L3) — Can you ping the gateway? Routing table correct? show ip route, ping, traceroute
4. Transport (L4) — Is the port open? TCP handshake completing? telnet host 443 or equivalent
5. Application (L7) — DNS resolving? Correct URL? Certificate valid? nslookup, browser dev tools

Worked example: "I can ping google.com but Chrome won't load."

• Ping works → L3 routing and ICMP are fine
• DNS may still be broken for the browser → test nslookup google.com
• Browser uses TCP 443 → test connectivity to port 443
• Conclusion: likely L4/L7 (proxy, TLS, firewall on 443), not basic routing

Ethernet frame and IP packet essentials

802.3 Ethernet frame fields: Preamble, SFD, Destination MAC, Source MAC, EtherType/Length, Data, FCS. The FCS uses a CRC computed over all fields except FCS itself.

IPv4 header highlights: Version, IHL, DSCP (QoS marking), Total Length, Identification, Flags, Fragment Offset, TTL, Protocol (6=TCP, 17=UDP, 1=ICMP), Header Checksum, Source IP, Destination IP.

TCP three-way handshake: SYN → SYN-ACK → ACK. Window size advertises receive buffer. Flags (SYN, ACK, FIN, RST) control connection state.

Store-and-forward switching

Modern switches use store-and-forward: the entire frame is received, CRC checked, then forwarded. This catches corrupted frames before they propagate. Cut-through switching (exam awareness) begins forwarding before the frame fully arrives — lower latency, no CRC check on ingress.

Quick reference — layer isolation commands

show ip interface brief
show interfaces status
show arp
show mac address-table
show ip route
ping 10.1.1.1
traceroute 10.1.1.1

telnet 192.168.1.1 443
nslookup example.com
curl -I https://example.com

Legacy bus topology awareness

Early Ethernet (10BASE-2 coax) used a bus physical topology with terminators at each end. A single cable break isolated part of the network. CSMA/CD managed collisions because the entire segment was one collision domain. Modern switched star topologies eliminated this, but exam questions still reference bus/CSMA/CD concepts when contrasting hubs with switches.

Exam checklist

• Name the PDU at each layer (bits, frame, packet, segment)
• Explain encapsulation direction (down) and decapsulation (up)
• Describe what changes at L2 vs L3 when a packet crosses a router
• Distinguish protocol, port, and ephemeral port
• Map unicast, broadcast, and multicast to ARP and OSPF examples
• Apply the JITL bottom-up troubleshooting sequence to a scenario
• Contrast hub flooding behavior with switch MAC-based forwarding