The internet runs TCP/IP rather than the OSI protocol suite; why do engineers still use OSI layer numbers, and where does the seven-layer model mislead?

## A reference model and a shipped stack Two things carry the word "layer" in networking. The **OSI reference model** is a seven-layer description of where functions belong, from the ISO standards effort, and it came with its own OSI protocol suite. The **TCP/IP suite** is the set of protocols the internet actually runs; RFC 1122 describes its host layering in four layers: link, internet, transport and application. The internet's protocols are the ones that were deployed at scale, and the IAB's own account of how the internet evolves explains the spirit behind that. RFC 1958 (§2.4) says the internet's evolution "depends on rough consensus about technical proposals, and on running code", and that "engineering feed-back from real implementations is more important than any architectural principles". The two worlds were never sealed off: RFC 1122 relates its "host" and "gateway" to OSI's "End-System" and "Intermediate Systems", and notes that internet IP was the model for OSI's Connectionless Network Protocol. ## Why the OSI numbers survived anyway The OSI numbering gives a short, shared word for a function's position: - "**L2**" means framing and addressing on one network. - "**L3**" means addressing and forwarding between networks. - "**L4**" means end-to-end transport, with ports. - "**L7**" means the application protocol itself. Saying "this balancer works at L4" tells a colleague it sees addresses and ports but not requests, faster than listing header fields. That value is why the vocabulary outlived the OSI protocols. (What each kind of middlebox can see is its own subject; the point here is that the number is shorthand.) ## Where the seven-layer model misleads RFC 1122 (§1.3.1) is candid: "strict layering is an imperfect model, both for the protocol suite and for recommended implementation approaches", and implementations involve "creative 'breaking' of strict layering". Four places where the real stack departs from clean layers: | Assumption from the strict model | What the specifications actually do | |---|---| | Each layer reads only its own header | TCP's checksum covers a **pseudo-header** with the IP source and destination addresses and the protocol number (RFC 9293), so transport depends on internet-layer fields | | Each layer is a separate module behind a clean interface | RFC 1122 notes that many implementations give transport and IP "shared access to common data structures" | | A unit belongs to one fixed layer | In "X over Y" layering (RFC 3439 §3.4.1), such as Ethernet over L2TPv3, a link-layer frame travels as payload inside an IP-carried protocol; its layer depends on where you observe it | | Transport sits directly on the internet layer | QUIC (RFC 9000) is a connection-oriented protocol that integrates the TLS handshake, and its packets "are carried in UDP datagrams" to ease deployment: a transport running over a transport | RFC 3439 (§3, "Layering Considered Harmful") generalises the problem: layering hides information other layers need, layer N may need layer N-2 information such as lower-layer packet sizes, and a layer may duplicate lower-level functions. That is why TCP advertises a maximum segment size derived from the link's limits, and why the boxes on a slide never quite match the code. ## How to reason with the model without being fooled 1. Use the layer number to **communicate** where a function sits, then name the actual protocol and field you mean. 2. When a protocol seems to straddle two layers, ask what it **carries** and what **carries it**; that settles most arguments faster than a diagram. 3. Expect **cross-layer dependencies** — checksums over lower-layer addresses, segment sizes set from link limits, tunnels re-entering the stack — and check them first when a change at one layer breaks another. 4. Treat placement disputes as conventions, not facts: the OSI model is a teaching and communication tool, and RFC 1122 itself calls strict layering imperfect. ## Weak answers to avoid - "The internet runs the OSI protocols; TCP/IP is just the name of layers 3 and 4." - "Each layer only ever reads its own header." - "A packet always belongs to exactly one layer." - "Since OSI's protocols were not adopted, its layer numbers are meaningless."