The OSI & TCP/IP Models

Every packet you will ever attack or defend travels through a stack of layers. The OSI model describes seven of them; the TCP/IP model collapses these into four. Understanding the layers lets you reason precisely about where a vulnerability or defense lives.

OSI layers, bottom to top: (1) Physical — cables, radio, voltages. (2) Data Link — MAC addresses, switches, ARP. (3) Network — IP addresses, routing. (4) Transport — TCP/UDP ports, reliability. (5) Session — connection state. (6) Presentation — encoding, TLS. (7) Application — HTTP, DNS, SMTP.

When you see an attack, name its layer. ARP spoofing is Layer 2. IP spoofing and routing attacks are Layer 3. SYN floods and port scanning are Layer 4. TLS stripping is Layer 6. SQL injection and XSS are Layer 7. This mental habit makes triage far faster.

Key takeaway: TCP is connection-oriented and reliable (three-way handshake: SYN, SYN-ACK, ACK). UDP is connectionless and fast. Attackers abuse both — learn their handshakes cold.