Networking Models

OSI splits networking into seven layers: physical, data link, network, transport, session, presentation and application. TCP/IP, the model the internet actually runs on, folds them into four: link, internet, transport and application.

Where things live: Ethernet and MAC addresses at the link layer, IP at the network layer, TCP and UDP at transport, and HTTP, DNS and TLS-protected traffic at the top.

Why it matters: attacks and defences map to layers. ARP spoofing is layer 2, IP spoofing layer 3, SYN floods layer 4, and a WAF works at layer 7.