Network fundamentals

What actually happens, layer by layer.

The OSI model, taught the way I actually think about it - what's really happening at each layer, and what breaks when someone attacks it.

Scroll to start

This page, right now

Layer

Application

Where the actual software lives: browsers, mail clients, the HTTP request this very page just made.

Security angleSQL injection, XSS, CSRF - literally what LynxGate and the CTF terminal elsewhere on this site demonstrate.

In practice

GET /osi HTTP/2
Host: justcagla.com

That's the literal request line this page just sent. A SQL-injection payload like ' OR '1'='1 targets this exact layer - it rides inside a normal-looking request.

Layer

Presentation

Data gets encrypted, compressed, or translated into a format both ends actually understand.

Security angleDowngrade attacks (forcing a weaker cipher) and misconfigured or expired certificates.

In practice

TLS 1.3
TLS_AES_128_GCM_SHA256

A downgrade attack tries to force this handshake back to TLS 1.0 or a null cipher, resurrecting decade-old flaws like BEAST or POODLE that modern ciphers were built to close.

Layer

Session

Opens, manages, and closes the conversation between two applications - who's talking, and for how long.

Security angleSession hijacking (stealing someone else's session token) and session fixation (tricking them into using yours).

In practice

Set-Cookie: session_id=8f3a1c...; HttpOnly; Secure

That cookie *is* the session. Steal it (hijacking) or trick someone into using one you already control (fixation), and you're logged in as them without ever touching a password.

Layer

Transport

End-to-end delivery: TCP for reliable, ordered delivery; UDP for speed with no such promises.

Security anglePort scanning, SYN floods, and this is where network segmentation earns its keep.

In practice

SYN     ->
        <- SYN-ACK
ACK     ->

That's the TCP three-way handshake, every connection's opening move. A SYN flood sends the first step thousands of times and never finishes it, leaving the server holding open connections until it runs out of room.

Layer

Network

Frames become packets, given IP addresses, and routed across different networks toward their destination.

Security angleIP spoofing, routing attacks, and where most stateless packet-filtering firewalls do their first pass.

In practice

1  10.0.0.1        0.6 ms
2  172.16.4.1      4 ms
3  203.0.113.9    11 ms

Each hop is a router deciding, packet by packet, which network to forward you toward next. Spoof the source IP on one of those packets and you can hide who's really asking - or trick a server into replying to someone else.

Layer

Data Link

Raw bits get organized into frames, addressed by hardware (MAC) address, on one local network segment.

Security angleMAC spoofing, ARP poisoning (redirect traffic by lying about who owns an IP), and VLAN hopping.

In practice

192.168.1.1  ->  aa:bb:cc:dd:ee:ff

That's an ARP table entry, mapping an IP to the physical hardware address that owns it on this local network. ARP poisoning is just lying about that mapping - convince everyone your machine owns the gateway's IP, and their traffic comes to you first.

Layer

Physical

Bits become electricity, light, or radio waves and travel across real, physical media.

Security angleWiretapping, cable tampering, and rogue devices plugged into an exposed jack. No firewall config helps if someone can physically reach the wire.

In practice

This is the layer with no packets to inspect - just physics. A fiber tap can bend the cable just enough to leak light out without breaking the signal passing through it. If someone can physically reach the wire, no firewall rule downstream matters.

Note

OSI vs. what the internet actually runs on

In practice, the internet runs on the simpler four-layer TCP/IP model - TLS and HTTP don't map cleanly onto OSI's "presentation" and "session" boxes the way textbooks imply. OSI still earns its keep as a teaching tool, because it forces you to ask where a security control actually lives. It's a study aid, not a wire protocol.

This page, right now

Here's what actually happened, layer by layer, to get this page in front of you:

Layer 7 - Application: Your browser sent an HTTP request over -
Layer 6 - Presentation: That request was -
Layers 1-3: From there, it was IP-routed across the internet and carried the rest of the way as electrical or radio signals. A browser can't actually see its own physical path or routing hops - but that part happened too.

Layers 7 and 6 above are read directly from this connection. Layers 1-3 are described generally, honestly, rather than guessed at.

The real request behind this page

What happened when you visited this site?

The full round trip - DNS, the request, the handshake, and where the content actually comes from.