The OSI and TCP/IP Models

A network exchange requires several jobs, from creating a message to sending signals. A layered model separates those jobs. Each layer uses the service directly below it and supplies a service to the layer directly above it.

Keep the jobs separate

A laptop can switch from Wi-Fi to Ethernet while its browser continues using the same web protocol. The local delivery method changes without changing the application service. Published standards also let different vendors' systems work together—interoperability—and give technicians a shared vocabulary such as “Layer 2 fault.” Designers and learners can examine one job at a time.

A protocol defines message formats, order, and responses. A protocol suite groups cooperating protocols, such as TCP/IP. A reference model describes communication functions without prescribing one implementation.

The Open Systems Interconnection (OSI) model comes from the International Organization for Standardization (ISO). Its first edition appeared as ISO 7498 in 1984; the later basic reference is ISO/IEC 7498-1:1994, also published as ITU-T X.200. Internet traffic uses the TCP/IP suite; OSI provides the seven-layer vocabulary used to describe it.

Follow the stack

Number the layers upward from the medium:

1. Physical
2. Data Link
3. Network
4. Transport
5. Session
6. Presentation
7. Application

“Please Do Not Throw Sausage Pizza Away” recalls 1–7. “All People Seem To Need Data Processing” recalls 7–1. Layers 1–3 are often called media layers and 4–7 host layers.

A sender works downward, from Application to Physical. Signals cross the medium, and the receiver works upward. Matching layers are logical peers: the two TCP implementations follow TCP rules even though the actual data travels through IP, local links, and signals between them.

Picture the handoff

A writer composes a letter, an addressed envelope supports delivery, and vehicles carry it. The driver can carry the sealed letter without understanding its contents. Similarly, each lower layer carries the upper layer's data as payload and adds control information, usually a header.

Real protocols can combine functions. TLS performs encryption associated with Presentation, while ARP connects local MAC delivery with IP addressing. Their placement depends on their job and the model being used.

The first three OSI layers move data through the network. They describe three different units of work: signals, local frames, and packets that can cross networks.

Layer 1: send bits as signals

The Physical layer represents bits using electrical signals on copper, light in fiber, or radio waves over Wi-Fi. It defines details such as connectors, pin layouts, signal levels, frequencies, and bit rates. A twisted-pair Ethernet connection might use an RJ45 connector and operate at 1 Gbit/s.

Physical transmission has no MAC or IP address decision. A signal carries a stream of bits; the higher layers decide how those bits form messages and where those messages belong.

Layer 2: deliver a frame on the local link

The Data Link layer puts data into frames for delivery on a local link or network segment. Ethernet and Wi-Fi use MAC addresses to identify interfaces. A usual MAC address is 48 bits, written as six hexadecimal pairs, such as 00:1A:2B:3C:4D:5E.

IEEE describes two Layer 2 sublayers. Logical Link Control (LLC) provides the interface toward Layer 3 and protocol identification functions. Media Access Control (MAC) handles local addressing and access to the medium. Ethernet is IEEE 802.3; Wi-Fi is IEEE 802.11. Both include Physical and Data Link functions. PPP is another Data Link protocol, used on point-to-point links.

Ethernet adds a frame check sequence (FCS) at the end of a frame. The receiver uses this check to detect corruption. A failed check causes the frame to be discarded. Standard Ethernet does not resend the frame to repair that loss; a higher-layer protocol such as TCP can recover missing data when reliability is required.

Layer 3: reach a host across networks

The Network layer packages data into packets. It uses logical addresses: IPv4 addresses contain 32 bits and IPv6 addresses contain 128 bits. Routing chooses how packets travel between networks. A router reads the destination IP address and selects a path toward it.

IPv4 and IPv6 belong here, along with ICMP, which carries control and error messages used by tools such as ping. IPsec protects IP traffic. IPv4's time to live (TTL) and IPv6's hop limit prevent endless forwarding loops: each router reduces the value by one, and a packet whose value expires is discarded.

Trace a wireless request

A laptop requests a page from a server on another network. The radio signal leaving the laptop is Layer 1. Its Wi-Fi frame reaches the access point at Layer 2. The access point bridges the traffic onto Ethernet, where a frame carries it toward the local router. The IP packet inside names the laptop and remote server as its endpoints.

A remote server's IP address can stay in a packet while each router builds a new frame for the next link. Treating the MAC address as an end-to-end destination confuses the local delivery job with routing.

The upper OSI layers describe delivery to programs and the services those programs use. A working IP route reaches a host; it does not by itself identify the receiving program or explain the message format.

Layer 4: reach the program

The Transport layer delivers data between processes—running programs—using port numbers. TCP supplies reliable, ordered byte-stream delivery and divides data into segments. UDP carries independent datagrams.

Transport multiplexing lets a browser, mail client, and call program share one interface while keeping their conversations distinguishable. The IP address identifies a host; transport information identifies the service or conversation on that host.

Layers 5 and 6: manage and represent

The Session layer, Layer 5, establishes, manages, and ends application dialogs. Dialog control determines which side sends when; checkpoints let an interrupted exchange resume from a recorded point. RPC and NetBIOS session service are common examples of session work.

The Presentation layer, Layer 6, handles representation, compression, and encryption. ASCII and UTF-8 represent text; JPEG and PNG represent images; MPEG represents video. Compression reduces the amount to send. TLS encryption is commonly mapped to Presentation in OSI descriptions.

Layer 7: supply a network service

The Application layer contains protocols programs use directly. HTTP and HTTPS serve the web; SMTP sends mail; IMAP and POP3 retrieve it. DNS resolves names, DHCP supplies automatic network settings, FTP and SFTP transfer files, and SSH supplies secure remote command-line access.

A browser is the program using HTTP. HTTP is its network protocol. Treating the entire program as the layer would include local browser actions that never communicate over a network.

Read an email exchange

TCP 587 is a common submission endpoint, normally upgraded to TLS with STARTTLS. In TCP/IP, the session and presentation work belongs to Application. These OSI rows describe functions, so they need not correspond to four separate software modules.

OSI and TCP/IP group the same communication jobs differently. Match the functions to compare their diagrams.

Four Internet layers

TCP/IP grew from research funded by the Defense Advanced Research Projects Agency (DARPA) in the 1970s. ARPANET adopted it on January 1, 1983. Specifications appear as Requests for Comments (RFCs), with Internet standards work through the Internet Engineering Task Force (IETF). TCP and IP name the suite, which also includes UDP, ICMP, ARP, DNS, and other protocols.

RFC 1122 describes four layers:

Application includes HTTP, DNS, and SMTP. Transport includes TCP and UDP; Internet includes IP and ICMP; Link includes Ethernet and Wi-Fi. Link is also called Network Access or Network Interface, and some books call Internet “Network.”

Matching TCP/IP Application only to OSI 7 would leave out session and presentation functions. They still happen, but TCP/IP groups them with the applications that need them.

Why a fifth layer appears

The five-layer teaching model splits Link into Data Link and Physical. Its full order is Application, Transport, Network, Data Link, Physical. Kurose–Ross and many networking courses use it to distinguish local framing from signaling. Its lower four layers match OSI 1–4 individually.

OSI was designed as a general reference framework before most associated protocols existed. TCP/IP's model describes a suite already in use. This helps explain why OSI gives separate upper-layer categories while Internet software often combines their work.

Map an HTTPS exchange

For HTTP/2 over HTTPS, HTTP and TLS belong to TCP/IP Application. TCP supplies Transport delivery to server port 443. IP supplies Internet addressing; Ethernet supplies Link framing and signaling.

Network staff still use OSI numbering for numbered descriptions: “Layer 3 routing,” “Layer 2 switch,” or “Layer 7 load balancer.” Counting Internet as the second box from the bottom of four-layer TCP/IP would misread that shorthand.

To place a protocol, first ask what work it performs. Then examine what carries its messages. The carrier often narrows the choice, but the function decides when a protocol combines jobs or is built above another transport.

Start with the main job

HTTP, DNS, DHCP, FTP, SFTP, TFTP, SSH, Telnet, SMTP, IMAP, POP3, SNMP, NTP, LDAP, SMB, RDP, SIP, and syslog supply services to applications. They belong to OSI Application and TCP/IP Application. Character encodings such as ASCII and UTF-8, media formats such as JPEG and MPEG, and encryption describe Presentation functions; RPC is a common Session example.

TCP and UDP perform Transport work. IPv4, IPv6, ICMP, ICMPv6, GRE tunneling, and IPsec's AH and ESP perform Network/Internet work. OSPF exchanges routing information directly inside IP and is also placed at Layer 3.

Ethernet framing, Wi-Fi MAC functions, PPP, VLAN tagging (802.1Q), and Spanning Tree Protocol (STP) are Data Link functions. Copper or fiber signaling, connectors, 1000BASE-T, and Wi-Fi radio transmission are Physical functions. Ethernet and Wi-Fi each span both lower layers.

Distinguish a service from the information it handles

DNS (Domain Name System) looks up information about names, including IP addresses, but it serves applications and travels over UDP or TCP port 53. DHCP (Dynamic Host Configuration Protocol) supplies IP settings, but its messages use UDP server port 67 and client port 68. Handling an IP address does not make either service a Network-layer protocol.

ICMP (Internet Control Message Protocol) reports on IP delivery and carries echo messages for ping. It is carried directly by IP and has no TCP or UDP ports. Its Network-layer placement follows its control role, not the presence of a separate header inside IP.

Place protocols that cross a boundary

ARP (Address Resolution Protocol) finds the MAC address associated with an IPv4 address on the local link. Its messages are carried directly in Ethernet frames, without an IP header. ARP supports IP delivery through local MAC delivery, so it is conventionally placed at Layer 2; the informal label “Layer 2.5” describes that boundary role.

TLS provides encryption. For HTTP/1.1 and HTTP/2, HTTPS carries HTTP inside TLS over TCP. TLS belongs to TCP/IP Application and is commonly mapped to OSI Presentation. The word “Transport” in its full name, Transport Layer Security, does not make TLS a peer of TCP or UDP.

QUIC is carried inside UDP but supplies transport functions, including reliable streams and connection management. HTTP/3 uses QUIC, with a TLS 1.3 handshake built into QUIC setup and encryption of QUIC packets. This is why “inside UDP” is a useful clue, not a universal test for Application-layer placement.

For the same reason, SSH remains Application-layer even though it includes encryption. A protocol's complete purpose matters: secure remote login is an application service, while encryption by itself is a Presentation function.

When data moves down a stack, each layer adds information needed for its own job. Encapsulation is this wrapping process. The upper layer's complete unit becomes the next layer's payload, meaning the contents being carried.

Build from the inside out

A header comes before the payload. A trailer comes after it. In an Ethernet/IP/TCP stack, TCP and IP each add a header; Ethernet adds both a header and an FCS trailer. Physical transmission represents the resulting frame as bits in signals.

The unit at a particular layer is its protocol data unit (PDU). Use these names as you trace a request:

Suppose a program sends an HTTP request over TCP. TCP adds its header, including ports and sequence information. IPv4 adds its header around that segment. Ethernet adds its header around the packet and an FCS after it. The request remains inside every larger unit; the layers are not replacing it with unrelated messages.

Identify the next protocol

The receiver needs a way to choose which protocol handles the payload. Ethernet's EtherType identifies IPv4 as 0x0800, IPv6 as 0x86DD, and ARP as 0x0806. ARP therefore goes directly from Ethernet to ARP processing, without passing through IP.

IPv4's Protocol field identifies TCP with 6, UDP with 17, and ICMP with 1. IPv6 calls its corresponding field Next Header. After transport processing, a destination port such as TCP 443 identifies the receiving service.

These are three different selectors. EtherType chooses the protocol inside a frame; the IP field chooses the protocol inside a packet; the destination port selects the receiving program. TCP and UDP ports do not appear in ICMP messages.

Unwrap at the receiver

Decapsulation removes the outermost layer first. The interface receives signals and recovers bits. Ethernet checks the FCS and uses EtherType to hand the payload to IP. IP checks delivery information and passes the payload to the named transport protocol. TCP processes its header and delivers application bytes to the receiving program.

The FCS is a 32-bit cyclic redundancy check (CRC) value for detecting damaged frames. It is removed with the local frame information, not delivered as part of the application's message.

Before each Ethernet frame, the Physical layer sends a 7-byte preamble and 1-byte start frame delimiter (SFD) for synchronization. These eight bytes are outside the counted Ethernet frame.

A switch reads frame information to forward locally. A router removes the incoming frame, examines IP, and makes another frame for the next link. An end host processes the stack all the way up to the application. Describing each layer's normal job helps explain why a router can forward encrypted content without reading the application's message.

Headers consume space along with application data. To calculate a transmitted size, name the stack, record its header sizes, and work outward. The largest permitted packet and the smallest permitted Ethernet frame both affect the result.

Know what each size counts

IPv4 and TCP headers can each grow to 60 bytes with options. The MTU, or maximum transmission unit, counts the Layer 3 packet. Standard Ethernet has a 1,500-byte MTU, producing a 1,518-byte frame with its 18 bytes of link overhead, or 1,522 bytes with a VLAN tag. Jumbo frames commonly use an MTU of 9,000 bytes when enabled.

MSS, maximum segment size, counts TCP application data. With no IP or TCP options, the available TCP payload is:

For IPv6 without extension headers or TCP options, it is:

Adding Ethernet overhead to the MTU would overstate the space available inside the packet.

Work one frame from the inside out

For 1,000 bytes of HTTP data over TCP, IPv4, and untagged Ethernet, with no options:

1. TCP segment: 1,020 bytes, from the data plus 20.
2. IP packet: 1,040 bytes, after adding another 20.
3. Ethernet frame: 1,058 bytes, after adding 18.

Overhead is 58 bytes. The useful-data share is:

With the same stack, a 4,000-byte application transfer using an MSS of 1,460 needs three segments: 1,460, 1,460, and 1,080 bytes of data. Their frames are 1,518, 1,518, and 1,138 bytes. The total is 4,174 bytes, including 174 bytes of headers and trailers. Each segment needs its own set of headers.

Small messages and minimum frames

A 40-byte DNS query over UDP and IPv4 becomes a 48-byte datagram, a 68-byte packet, and an 86-byte untagged Ethernet frame. Its useful-data share is about 46.5%. A full 1,460-byte TCP payload occupies about 96.2% of its 1,518-byte frame.

Ethernet frames must be at least 64 bytes, with at least 46 bytes of payload. A TCP acknowledgment carrying no application data has a 40-byte IPv4 packet with minimum headers. Ethernet adds 6 bytes of padding before its FCS, giving a 64-byte frame.

Keep the boundaries straight

TCP segmentation divides application data at Layer 4. IP fragmentation divides a packet at Layer 3 when it is too large for a link. IPv4 routers can fragment when permitted; IPv6 routers never fragment, so the sender must adapt to the path's size limit.

Frame sizes here exclude the preamble, SFD, and time between frames. To convert a frame's bytes to bits, multiply by eight: a 1,518-byte frame contains 12,144 bits.

A packet can cross several networks, but an Ethernet frame serves one local link. Following both units at once explains why a host needs the remote IP address and a nearby MAC address for the same exchange.

Address the next local receiver

Consider a laptop at 192.0.2.10, with MAC label AA. A router R1 joins its network to a server's network. R1 has MAC label R1-A on the laptop side and R1-B on the server side. The server is 198.51.100.20, with MAC label SS. These short MAC labels stand for full interface addresses.

The laptop recognizes that the server is remote. Its default gateway, R1, is the next receiver on the local link. ARP supplies the gateway's MAC address. For a TCP connection to server port 443, the nested addresses are:

The laptop does not use SS as the local destination MAC. SS belongs to the final host on a different network; R1-A belongs to the device that can receive this first frame.

Pass a switch and a router

A Layer 2 switch reads the destination MAC, finds the port toward R1-A, and forwards the frame. Ordinary switching does not replace the source and destination MAC addresses.

R1 checks the received frame's FCS and removes its header and trailer. It reads the destination IP, looks up the route, and reduces TTL by one. It then creates a new frame on the server-side link. That frame has source R1-B and destination SS, learned through ARP. Its FCS covers this new frame.

The source and destination IP addresses and TCP ports remain the same along this ordinary routed path. The IP header is not wholly unchanged: TTL decreases, and IPv4's header checksum is updated. Network address translation (NAT) is an exception to endpoint-address preservation because it rewrites IP addresses and often ports.

Count router hops with TTL

A packet sent with TTL 64 reaches the destination with TTL 61 after three router forwarding steps. If a router reduces TTL to zero, it discards the packet and normally returns ICMP Time Exceeded. IPv6 uses a hop-limit field for the same loop-limiting purpose.

traceroute on Linux or macOS and tracert on Windows use probes with changing TTL values to discover responding hops. A * means no reply arrived for that probe. The router might still forward traffic while filtering or limiting diagnostic replies, so compare later replies and service tests before naming a failure point.

Return to the client

The server removes the local frame and processes the packet and TCP segment up to the web service. A reply reverses the endpoint roles: the server's IP and port become the source, and the laptop's IP and client port become the destination. Routers again create frames for their outgoing links. The return path can use different routers, but each local frame still targets its next receiver.

TCP and UDP both use ports to carry data between programs at Layer 4. The choice depends on what the application needs when packets are delayed, lost, or delivered out of order.

What TCP supplies

Transmission Control Protocol (TCP) is connection-oriented. A three-way handshake—SYN, SYN-ACK, ACK—sets up the connection before normal data exchange. Acknowledgments tell the sender what has arrived, and retransmission recovers missing data. Sequence information allows TCP to present bytes in order.

Flow control protects a receiver from a sender that is too fast. Congestion control adjusts sending to network load. These are different problems: one concerns the receiving host's capacity; the other concerns the network carrying the traffic. TCP's header is 20 bytes without options and can reach 60 bytes.

TCP supplies a reliable, ordered byte stream, but a failed connection can still leave an application with an incomplete file. The application must handle the failure or resume the operation; TCP cannot make an unavailable path deliver data.

What UDP supplies

User Datagram Protocol (UDP) is connectionless. It sends independent datagrams without a transport handshake, acknowledgments, retransmission, or reordering. Its 8-byte header contains source port, destination port, length, and checksum.

UDP can support one-to-one, broadcast, and multicast traffic. A TCP connection joins two endpoints. UDP's smaller header and lack of built-in recovery reduce transport overhead, but “unreliable” describes its lack of delivery guarantees, not an expectation that most traffic will be lost.

Choose for the application's deadline

A live voice packet might contain 20 ms of sound. If it is lost, a replacement arriving 100 ms later is too late for its playback moment. A call can continue with a small gap, making UDP a useful fit. A downloaded document needs all its bytes in order, so TCP's recovery fits the task.

Short requests such as DNS, DHCP, NTP, and SNMP also commonly use UDP. DNS additionally uses TCP port 53 for zone transfers and when a response needs TCP. SIP call setup can use either UDP or TCP on port 5060.

Applications can add functions above UDP. TFTP acknowledges its blocks, and QUIC provides reliable encrypted connections over UDP. Consequently, seeing UDP on a capture does not tell you that the application lacks recovery.

On-demand video often buffers ahead and uses HTTPS over TCP or HTTP/3 over QUIC. “Video means UDP” misses the difference between a live conversation with an immediate deadline and stored video with time to recover missing data.

An IP address identifies a host, but many programs can use that host at once. TCP and UDP each add source and destination port numbers so incoming data can reach the correct service or conversation.

Separate services and client conversations

A port is a 16-bit number from 0 to 65,535. A server listens for traffic on a known port, such as TCP 443 for HTTPS. A client normally chooses a temporary source port, called an ephemeral port, when it opens a connection.

RFC 6335 groups the numbers as follows:

IANA assigns system and user ports; dynamic ports are not assigned. The dynamic range and an operating system's actual temporary-port range are separate concepts. Default Windows temporary ports use 49152–65535, while Linux commonly uses 32768–60999. An administrator can change these settings.

Identify an endpoint and a connection

A socket identifies a transport endpoint by IP address, port, and transport protocol. For example, TCP 198.51.100.20:443 identifies an HTTPS server endpoint. TCP 53 and UDP 53 are separate ports because TCP and UDP have separate number spaces.

A connection is identified using the 5-tuple: source IP, source port, destination IP, destination port, and transport protocol. Those values distinguish conversations even when several clients use one server port.

Suppose 192.0.2.10 opens two TCP connections to 198.51.100.20:443. One uses client port 51514 and the other uses 51515. Their server endpoint is identical, but their source ports differ. The server can therefore return each reply to the right connection. Some browsers reuse connections; the example describes two distinct connections that have been opened.

On a reply in the first conversation, the source becomes 198.51.100.20:443 and the destination becomes 192.0.2.10:51514. Port 443 does not become the client port simply because the direction has reversed.

Read port evidence carefully

A configured service can use a nonstandard port. HTTP might use 8080 and SSH might use 2222. The number suggests a conventional service but does not establish the content actually being sent. A firewall that looks only at ports makes a limited classification; application inspection can examine the traffic itself.

A physical switch port is a cable connection on an interface. A transport port is a number in a TCP or UDP header. Replacing a cable affects physical connectivity, while permitting TCP 443 changes which transport traffic may pass. The shared word “port” does not make these the same kind of object.

Learn a service's transport and port together. TCP 53 and UDP 53 are separate transport endpoints, even though both can serve DNS. Grouping related services also makes similar names easier to distinguish.

Web, remote access, and files

Explicit FTPS starts on 21 and upgrades to TLS. Implicit FTPS starts with TLS on 990. TCP 989 is registered for implicit FTPS data; passive transfers negotiate data ports. SFTP is a different protocol inside SSH, so changing FTP to port 22 does not turn it into SFTP.

Email and directory services

SMTP uses TCP 25 for server-to-server relay. Clients normally submit on TCP 587 with STARTTLS, or TCP 465 with TLS from the start. IMAP retrieval uses TCP 143, with implicit TLS on TCP 993. POP3 retrieval uses TCP 110, with implicit TLS on TCP 995.

LDAP directory queries use TCP 389; LDAP over implicit TLS, or LDAPS, uses TCP 636. A secure service may also upgrade an existing connection where supported, so a different port is not the only way protocols add TLS.

Infrastructure and management

Most ordinary DNS queries use UDP; zone transfers use TCP, and clients also need TCP for responses that require it. SNMPv3 can add authentication and encryption while retaining ports 161 and 162. Syslog can use other transports in deployed systems; UDP 514 is the common baseline listed here.

Do not confuse IP protocol numbers with ports

The IP header's Protocol field identifies what IP carries: ICMP 1, TCP 6, UDP 17, GRE 47, ESP 50, and AH 51. TCP and UDP then supply their own port fields. ICMP, GRE, ESP, and AH have no TCP or UDP ports. A rule permitting TCP port 1 therefore does not permit ICMP echo traffic.

For a web server using HTTP/2 over TLS, allow inbound TCP 443. If the same server offers HTTP/3, its QUIC traffic needs UDP 443. A DNS rule allowing only UDP 53 can pass small queries yet block required TCP exchanges. Match the rule to the actual transport and server destination port.

Place a device by the information it reads to decide how to handle traffic. The label describes a forwarding or inspection function. One physical box can contain several functions at different layers.

Signals, frames, and packets

Layer 1 devices handle signals. A repeater regenerates a signal; a hub repeats incoming signals to all other ports. A media converter connects media such as copper and fiber. A modem converts between digital data and signaling used on a provider's line. Power over Ethernet (PoE) supplies power through twisted-pair cabling to devices such as phones and access points, so it is a Physical-layer feature.

A Layer 2 switch learns source MAC addresses and their incoming ports. It uses the destination MAC to select an outgoing port. Broadcast frames and frames for unknown destinations are flooded to other ports in the same local network. A bridge performs the same basic job with fewer ports. A wireless access point bridges Wi-Fi and wired frames. A network interface card (NIC) handles Layers 1 and 2, including the interface's MAC address.

A router reads destination IP addresses and forwards packets between networks using a routing table. It separates the local broadcast domains. A Layer 3 switch combines local frame switching with routing, often between VLANs. The word “switch” alone does not establish whether the device can route.

Inspect transport or application information

A host such as a laptop, server, or phone handles all seven OSI functions. A home “router” commonly combines a router, switch, access point, firewall, and sometimes modem. Its Wi-Fi bridging and packet routing are separate jobs inside the same case.

Count shared domains

A collision domain is a region in which simultaneous transmissions can interfere. A hub shares one domain across its ports. A switch separates its attached links. Modern full-duplex switched links have no collisions; traditional domain counting still shows how hubs differ from switches.

A broadcast domain contains devices that receive one another's broadcast frames. Hubs and ordinary switches pass those frames through. Routers separate broadcast domains, and VLANs can divide a switch into several of them.

For a router joining two switches, switch A with five computers has six occupied links including its router link. Switch B with three computers and a hub has five occupied links: three computers, one hub, and one router link. The four computers on the hub share its single switch-link collision domain. Traditional counting gives 11 collision domains and two broadcast domains, with no VLAN divisions.

Begin by asking who is affected, which services fail, and what changed. That pattern helps select a troubleshooting starting point.

Choose a direction

Bottom-up verifies physical service, then local frames, routing, and higher services. It is thorough for an unknown cause, but can waste time when evidence already isolates an application fault. Top-down starts with the service and moves toward its lower-layer dependencies as needed.

Interpret the middle test

Divide and conquer commonly uses ping. A reply from the gateway supports the local IP/ICMP path to that gateway. A reply from a remote server supports the tested path to that server. Those results justify moving upward to names, transport ports, and the application.

A failed ping needs more investigation: the path may be broken, or ICMP may be filtered while the web service remains reachable. Confirm with a test of the actual service.

Follow the path examines devices along the route, often with traceroute or tracert. A silent hop may still forward traffic. Compare later replies and, where possible, tests from devices on either side before assigning a forwarding failure to that hop.

Let the symptoms guide the first check

Suppose every desk in one room loses all connectivity while nearby rooms work. Start bottom-up at shared equipment: switch power, its uplink, and link lights. Swapping a suspected cable for a known good one can test that dependency.

If one account cannot submit mail while browsing and other services work, start top-down with its server name, submission port, and error message. The narrower pattern points to a service-specific check.

Compare a failing device with a working one when possible. Change one item, repeat the same test, and record the result. Restore an unsuccessful change before trying another. Changing the cable, gateway, and DNS settings together can restore access without showing which change mattered.

A symptom suggests where to investigate; a test supplies evidence. Match the tool to the job you want to verify, and keep its destination, protocol, and result together when interpreting the answer.

Check signals and local delivery

At Layer 1, missing link lights, an unplugged cable, a powered-off device, excessive cable length, or interference can prevent communication. Inspect power and connectors, test the cable, or replace it with a known good cable.

At Layer 2, the physical link may be present while local frames fail. Wrong VLAN membership can separate devices that should share a local network. A duplex mismatch can cause poor performance and errors; rising CRC errors can also point toward signal or cabling trouble. Read switch interface statistics and compare both ends. arp -a shows learned IPv4-to-MAC mappings on a host.

On Cisco devices, show interfaces reports interface and line-protocol status. “up/up” indicates physical and data-link status are up. “down/down” often directs attention to power, cabling, or another physical problem. “up/down” means a physical link exists while the line protocol is down; an encapsulation mismatch is one possible cause.

Verify IP reachability and transport access

At Layer 3, check interface addresses and gateway settings with ipconfig on Windows, ip address on Linux, or ifconfig on macOS. Wrong settings or missing routes can prevent packets from reaching another network. Use ping for IP reachability and tracert on Windows or traceroute on Linux/macOS for responding hops.

At Layer 4, test the service's actual port. A server can answer ping while a firewall blocks TCP 443 or no web service is listening. In Windows PowerShell, use Test-NetConnection 203.0.113.25 -Port 443; on Linux or macOS, use nc -zv 203.0.113.25 443. On the server, ss on Linux or netstat can show listening ports and connections. A failed connection alone does not distinguish a firewall block from a stopped listener.

Inspect names and application behavior

At the upper layers, a failed name lookup, certificate error, incorrect server name, or failed login calls for application evidence. Use nslookup or dig to inspect DNS answers. Use a browser or curl to test HTTP/HTTPS and read the application's logs for service errors.

Work through a page failure

A laptop cannot open https://intranet.example.com. First, ping to its gateway succeeds. Next, ping to server IP 203.0.113.25 succeeds. These results support the local and routed paths used by those tests. If nslookup intranet.example.com cannot obtain an answer, investigate the DNS query and configuration at Application layer.

In a different result, the name resolves correctly and the server answers ping, but TCP 443 fails. Check the listener on the server and the relevant firewall rule. If TCP 443 connects and HTTPS reports a certificate error, move upward to the certificate and server-name configuration. Each test narrows the next question; it does not certify every kind of traffic on the network.