kavklaw@llm $ cat osi-model.md
All 7 layers — protocols, devices, attacks, and how data flows through the stack.
┌─────────────────────────────────────────────┐
│ Layer 7 │ Application │ Data │ ← HTTP, DNS, FTP, SMTP
├───────────┼────────────────┼────────────────┤
│ Layer 6 │ Presentation │ Data │ ← SSL/TLS, JPEG, ASCII
├───────────┼────────────────┼────────────────┤
│ Layer 5 │ Session │ Data │ ← NetBIOS, RPC, SOCKS
├───────────┼────────────────┼────────────────┤
│ Layer 4 │ Transport │ Segments │ ← TCP, UDP
├───────────┼────────────────┼────────────────┤
│ Layer 3 │ Network │ Packets │ ← IP, ICMP, IPSec
├───────────┼────────────────┼────────────────┤
│ Layer 2 │ Data Link │ Frames │ ← Ethernet, ARP, PPP
├───────────┼────────────────┼────────────────┤
│ Layer 1 │ Physical │ Bits │ ← Cables, Hubs, Wi-Fi
└─────────────────────────────────────────────┘
Data flows DOWN the stack (encapsulation) when sending.
Data flows UP the stack (decapsulation) when receiving.Remember the layers top-down (7 → 1):
Please → Application (Layer 7)
Do → Presentation (Layer 6)
Not → Session (Layer 5)
Throw → Transport (Layer 4)
Sausage → Network (Layer 3)
Pizza → Data Link (Layer 2)
Away → Physical (Layer 1)
Bottom-up (1 → 7): All People Seem To Need Data ProcessingThe layer closest to the end user. Provides network services directly to applications.
HTTP/HTTPS Web browsing (TCP 80/443)
FTP File transfer (TCP 21/20)
SMTP Send email (TCP 25/587)
POP3/IMAP Receive email (TCP 110/143, 995/993)
DNS Name resolution (UDP/TCP 53)
DHCP IP address assignment (UDP 67/68)
SSH Secure shell (TCP 22)
Telnet Remote terminal (TCP 23)
SNMP Network management (UDP 161/162)
LDAP Directory services (TCP 389/636)
RDP Remote desktop (TCP 3389)
SMB/CIFS File sharing (TCP 445)Firewalls (Layer 7 / application-aware)
Load balancers
Proxy servers
Web Application Firewalls (WAFs)SQL Injection Manipulate database queries via input
XSS Inject scripts into web pages
Phishing Social engineering via email/web
Directory traversal Access files outside web root
Buffer overflow Overflow application memory
DNS poisoning Corrupt DNS cache entries
Brute force attacks Guess credentials
API abuse Exploit REST/SOAP endpointsTranslates data formats, handles encryption/decryption and compression.
SSL/TLS Encryption (now part of HTTPS)
MIME Email content encoding
JPEG/PNG/GIF Image formats
MPEG/AVI Video formats
ASCII/Unicode Character encoding
XDR External Data Representation
GZIP/DEFLATE CompressionSSL stripping Downgrade HTTPS to HTTP (e.g., sslstrip)
Man-in-the-Middle Intercept and modify encrypted traffic
Certificate spoofing Fake SSL certificates
Encoding attacks Exploit charset/encoding mismatches
Cryptographic attacks POODLE, BEAST, HeartbleedManages sessions — establishes, maintains, and tears down connections between applications.
NetBIOS Network Basic I/O System
RPC Remote Procedure Call
PPTP Point-to-Point Tunneling
SOCKS Proxy protocol
SIP Session Initiation Protocol (VoIP)
L2TP Layer 2 Tunneling Protocol
SMB Server Message Block (session setup)Session hijacking Steal or predict session tokens
Session fixation Force a known session ID on a user
NetBIOS enumeration Discover hosts, shares, users
RPC exploits Exploit remote procedure calls
Pass-the-hash Reuse NTLM hashes without crackingEnd-to-end communication, reliability, flow control. Data unit = segments.
TCP Transmission Control Protocol — reliable, connection-oriented
UDP User Datagram Protocol — fast, connectionless
SCTP Stream Control Transmission ProtocolPort numbers 0-65535 (well-known: 0-1023, registered: 1024-49151, dynamic: 49152-65535)
TCP handshake SYN → SYN-ACK → ACK
TCP teardown FIN → ACK → FIN → ACK
Flow control Sliding window mechanism
Error checking ChecksumsFirewalls (stateful inspection)
Load balancers (Layer 4)SYN flood Exhaust connection table with half-open connections
UDP flood Overwhelm target with UDP packets
Port scanning Probe open/closed/filtered ports
TCP reset attack Inject RST packets to kill connections
Session hijacking Predict TCP sequence numbersLogical addressing and routing. Data unit = packets.
IPv4/IPv6 Internet Protocol — logical addressing
ICMP Ping, traceroute, error messages
IGMP Multicast group management
IPSec Encrypted IP communication
OSPF Open Shortest Path First (routing)
BGP Border Gateway Protocol (routing)
RIP Routing Information Protocol
GRE Generic Routing Encapsulation (tunneling)Routers
Layer 3 switches
Firewalls (packet filtering)IP spoofing Forge source IP address
ICMP attacks Ping of death, smurf attack
Route poisoning Inject false routing table entries
Man-in-the-Middle Intercept packets in transit
Fragmentation attacks Exploit IP fragment reassembly
BGP hijacking Advertise false routes
Ping sweep Discover live hostsPhysical addressing (MAC), error detection, frame switching. Data unit = frames.
Ethernet (802.3) Wired LAN standard
Wi-Fi (802.11) Wireless LAN standard
ARP IP → MAC address resolution
PPP Point-to-Point Protocol
STP Spanning Tree Protocol
VLAN (802.1Q) Virtual LAN tagging
LLDP Link Layer Discovery ProtocolSwitches (Layer 2)
Bridges
NICs (Network Interface Cards)
Wireless Access PointsARP spoofing/poisoning Redirect traffic by faking ARP replies
MAC flooding Overwhelm switch CAM table → hub mode
VLAN hopping Escape VLAN isolation (double tagging)
STP manipulation Become root bridge, redirect traffic
MAC spoofing Impersonate another device's MAC
Rogue access point Set up fake Wi-Fi AP
Deauthentication Force Wi-Fi clients to disconnect (802.11)Raw bits on the wire. Electrical signals, light pulses, radio waves. Data unit = bits.
Ethernet cables Cat5e, Cat6, Cat6a, Cat7
Fiber optic Single-mode, multi-mode
Coaxial Legacy/cable TV
Wi-Fi radio 2.4 GHz, 5 GHz, 6 GHz
USB Physical connection
Bluetooth Short-range wireless
RS-232 Serial communicationHubs Broadcast all traffic (no intelligence)
Repeaters Amplify/regenerate signals
Modems Modulate/demodulate signals
Cables & connectors RJ45, fiber connectors, etc.
Patch panels Physical cable managementWiretapping Physical tap on cable
Jamming Radio frequency interference
Cable cutting Physical denial of service
Eavesdropping Sniff signals from the wire
Keyloggers Physical device on keyboard cable
Evil maid attack Physical access to hardware
Wardriving Scan for wireless networksLayer 7-5: [DATA]
Layer 4: [TCP/UDP Header] [DATA] → Segment
Layer 3: [IP Header] [TCP Header] [DATA] → Packet
Layer 2: [Frame Header] [IP] [TCP] [DATA] [FCS] → Frame
Layer 1: 01101001 01101110 ... → Bits
Each layer adds its own header (and sometimes trailer).
Reverse process (decapsulation) happens at the receiver.┌──────────────────┬─────────────────────┐
│ OSI Model │ TCP/IP Model │
├──────────────────┼─────────────────────┤
│ 7. Application │ │
│ 6. Presentation │ 4. Application │
│ 5. Session │ │
├──────────────────┼─────────────────────┤
│ 4. Transport │ 3. Transport │
├──────────────────┼─────────────────────┤
│ 3. Network │ 2. Internet │
├──────────────────┼─────────────────────┤
│ 2. Data Link │ 1. Network Access │
│ 1. Physical │ (Link) │
└──────────────────┴─────────────────────┘Port Protocol Service Layer
20/21 TCP FTP 7
22 TCP SSH 7
23 TCP Telnet 7
25 TCP SMTP 7
53 UDP/TCP DNS 7
67/68 UDP DHCP 7
80 TCP HTTP 7
110 TCP POP3 7
143 TCP IMAP 7
161 UDP SNMP 7
389 TCP LDAP 7
443 TCP HTTPS 7
445 TCP SMB 7
993 TCP IMAPS 7
995 TCP POP3S 7
3306 TCP MySQL 7
3389 TCP RDP 7
5432 TCP PostgreSQL 7
5985 TCP WinRM 7
8080 TCP HTTP Proxy 7