Network Layer Models and Data Communication

Data travels with a header added at each layer on the sending side and stripped off at each layer on the receiving side.

Overview

Network communication is divided into layers, each operating independently. Understanding this layer model is essential for diagnosing network problems and designing system architecture. Mapping the OSI (Open Systems Interconnection) 7-layer model against the TCP/IP 4-layer model reveals how the two correspond. Data gains a header on the way down through the layers and loses one on the way up.

1. The OSI 7-layer model

What each layer does

Layer	Name	Role	PDU	Main equipment/protocols
7	Application	Provides user-facing services	Data	HTTP, FTP, SMTP, DNS, gRPC
6	Presentation	Data format conversion, encryption	Data	SSL/TLS, JPEG, MPEG, ASCII
5	Session	Session setup, management, teardown	Data	NetBIOS, RPC
4	Transport	Reliable end-to-end delivery	Segment	TCP, UDP, QUIC (Quick UDP Internet Connections)
3	Network	Logical addressing, routing	Packet	IP, ICMP, OSPF, BGP (Border Gateway Protocol)
2	Data Link	Physical addressing, frame delivery	Frame	Ethernet, Wi-Fi, ARP, switch
1	Physical	Bit transmission, electrical/optical signals	Bit	Cables, hubs, repeaters

How relevant each layer is to backend work

Layer	When backend work touches it directly
7 (Application)	Daily -- HTTP API design, gRPC, WebSocket
6 (Presentation)	Often -- TLS configuration, JSON/Protobuf serialization
5 (Session)	Occasionally -- session management, keep-alive
4 (Transport)	Often -- TCP tuning, port management, load balancers
3 (Network)	Occasionally -- subnet configuration, VPC routing, Kubernetes networking
2 (Data Link)	Rarely -- infrastructure level (MAC addresses, VLANs)
1 (Physical)	Almost never -- the data center operations team's domain

2. The TCP/IP 4-layer model

Mapping OSI to TCP/IP

Detailed mapping table

TCP/IP layer	OSI mapping	PDU	Main protocols	Main equipment
4. Application	7+6+5	Message (Data)	HTTP, HTTPS, DNS, FTP, SMTP, SSH, gRPC	Gateways, L7 load balancers
3. Transport	4	Segment / Datagram	TCP, UDP, QUIC, SCTP	L4 load balancers
2. Internet	3	Packet	IPv4, IPv6, ICMP, ARP, OSPF, BGP	Routers, L3 switches
1. Network Access	2+1	Frame / Bit	Ethernet, Wi-Fi (802.11), PPP	Switches, NICs, cables

3. Data encapsulation

The sending process

Data gains a header at each layer on the way down through the sending side, and loses one at each layer on the way up through the receiving side.

text

Sending side (encapsulation):
 
Application:  [HTTP header | HTTP body]
                    ↓ + add TCP header
Transport:    [TCP header | HTTP header | HTTP body]
                    ↓ + add IP header
Network:      [IP header | TCP header | HTTP header | HTTP body]
                    ↓ + add Ethernet header/trailer
Data link:    [Eth header | IP header | TCP header | HTTP data | Eth trailer]
                    ↓ convert to bits
Physical:     01001010110101010101001010101010...

Decapsulation (receiving side)

text

Physical:     receive bits → reconstruct frame
                    ↓ strip Ethernet header
Data link:    [IP header | TCP header | HTTP data]
                    ↓ strip IP header
Network:      [TCP header | HTTP data]
                    ↓ strip TCP header
Transport:    [HTTP data]
                    ↓ hand to the application
Application:  process HTTP response

PDU (Protocol Data Unit) reference

Layer	PDU name	Information carried
Application	Message	The actual application data
Transport	Segment (TCP) / Datagram (UDP)	Port numbers, sequence numbers, checksum
Network	Packet	Source and destination IP addresses, TTL
Data Link	Frame	Source and destination MAC addresses, CRC
Physical	Bit	Electrical, optical, or wireless signals

4. Key header structures by layer

TCP header (20-60 bytes)

text

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
├─────────────────────────┼─────────────────────────┤
│     Source Port (16)    │  Destination Port (16)  │
├─────────────────────────┴─────────────────────────┤
│              Sequence Number (32)                  │
├───────────────────────────────────────────────────┤
│           Acknowledgment Number (32)              │
├────────┬──────┬─┬─┬─┬─┬─┬─┼─────────────────────┤
│Offset  │Rsrvd │U│A│P│R│S│F│    Window Size (16)  │
│  (4)   │ (6)  │R│C│S│S│Y│I│                      │
│        │      │G│K│H│T│N│N│                      │
├────────┴──────┴─┴─┴─┴─┴─┴─┼─────────────────────┤
│     Checksum (16)          │   Urgent Pointer (16)│
├────────────────────────────┴─────────────────────┤
│              Options (variable)                   │
└───────────────────────────────────────────────────┘

IPv4 header (20-60 bytes)

text

├─────────┬─────────┬─────────────────────────────┤
│ Version │   IHL   │    Type of Service (8)       │
│  (4)    │  (4)    │                              │
├─────────┴─────────┼─────────────────────────────┤
│   Total Length (16)│     Identification (16)     │
├────────────────────┼──┬──────────────────────────┤
│  Flags (3)         │  │  Fragment Offset (13)    │
├────────────────────┼──┴──────────────────────────┤
│    TTL (8)         │  Protocol (8)  │ Header     │
│                    │  (6=TCP,17=UDP)│ Checksum   │
├────────────────────┴───────────────┴─────────────┤
│              Source IP Address (32)               │
├──────────────────────────────────────────────────┤
│           Destination IP Address (32)            │
└──────────────────────────────────────────────────┘

5. Network equipment mapped to layers

Equipment	Operating layer	Role	Backend relevance
Hub	L1 (Physical)	Amplifies signals, sends to every port	Hardly used today
Switch	L2 (Data Link)	Forwards frames by MAC address	VLAN configuration, network isolation
Router	L3 (Network)	Routes packets by IP address	VPCs, subnets, gateways
L4 load balancer	L4 (Transport)	Distributes load by TCP/UDP port	HAProxy (TCP mode), NLB
L7 load balancer	L7 (Application)	Distributes load by HTTP header/URL	Nginx, ALB, Envoy
Firewall	L3-L7	Access control by packet or session	Security groups, WAF

6. SDN (Software Defined Networking)

SDN separates the control plane from individual devices and moves it to a central controller.

Traditional networking vs SDN

Property	Traditional networking	SDN
Control plane	Distributed across devices	Centralized (controller)
Configuration	Per-device CLI/GUI	Programmable (API)
Flexibility	Low (hardware-bound)	High (software-defined)
Fault isolation	Difficult	Easier with central monitoring

SDN architecture

SDN in backend work

Use case	Description
Kubernetes CNI	Calico, Cilium and others manage Pod networking on SDN principles
AWS VPC	A software-defined virtual network
Service mesh	Istio and Envoy control traffic at the application level
OpenStack Neutron	Private cloud network management

7. NFV (Network Function Virtualization)

NFV implements network functions in software on general-purpose servers, functions that traditionally ran on dedicated hardware such as firewalls, load balancers, and IDS.

Traditional approach vs NFV

text

Traditional:  [dedicated firewall] [dedicated load balancer] [dedicated IDS]
                     ↓                      ↓                      ↓
              expensive hardware    expensive hardware    expensive hardware
 
NFV:   [general-purpose server]
       ├── VM/container: virtual firewall (vFW)
       ├── VM/container: virtual load balancer (vLB)
       └── VM/container: virtual IDS (vIDS)

Core NFV components

Component	Description
VNF (Virtual Network Function)	A virtualized network function (firewall, router, and so on)
NFVI (NFV Infrastructure)	The hardware plus virtualization layer where VNFs run
MANO (Management and Orchestration)	VNF lifecycle management and resource allocation

Combining SDN and NFV

SDN moves network control into software, and NFV moves network functions into software. Combining the two gives:

The entire network infrastructure becomes programmable
Network functions scale dynamically with demand
The technical foundation for 5G network slicing (network security and wireless communication)

8. Protocol stack practice: packet analysis

Analyzing packets with Wireshark

bash

# Capture packets with tcpdump (analyze in Wireshark)
sudo tcpdump -i eth0 -w capture.pcap port 80
 
# Capture only DNS packets for a specific host
sudo tcpdump -i eth0 -w dns.pcap port 53
 
# Print HTTP request text only
sudo tcpdump -i eth0 -A port 80

An actual packet structure (HTTP GET)

text

[Ethernet Frame]
  Dst MAC: aa:bb:cc:dd:ee:ff
  Src MAC: 11:22:33:44:55:66
  Type: 0x0800 (IPv4)
 
  [IPv4 Packet]
    Version: 4
    TTL: 64
    Protocol: 6 (TCP)
    Src IP: 192.168.1.100
    Dst IP: 93.184.216.34
 
    [TCP Segment]
      Src Port: 54321
      Dst Port: 80
      Seq: 1
      Ack: 1
      Flags: PSH, ACK
 
      [HTTP Request]
        GET /index.html HTTP/1.1
        Host: example.com
        Connection: keep-alive

9. Overlay networks

An overlay network builds a logical virtual network on top of the existing physical network (the underlay).

Main protocols

Protocol	Description	Used in
VXLAN	Encapsulates L2 frames in UDP (about 16 million segments, 24-bit VNI)	Docker overlay, VMware NSX
GENEVE	Successor to VXLAN, flexible metadata	OVN, AWS
WireGuard	Lightweight VPN tunneling	Security overlays
IPsec	Encrypted tunnel at the IP level	Site-to-site VPN

Kubernetes overlay networking

text

Pod 1 → Pod 3 communication:
  Original packet: Src=10.244.0.2, Dst=10.244.1.2
  Overlay: VXLAN encapsulation → Src=10.0.0.1, Dst=10.0.0.2 (UDP 4789)
  Decapsulated on Node B → original packet → delivered to Pod 3

10. P4 -- the programmable data plane

P4 (Programming Protocol-Independent Packet Processors) is a language that makes the packet processing logic of a network switch programmable.

The P4 code below is a simple data plane program that parses the IPv4 header and forwards based on the destination address. The header block defines packet fields, and the table in the control block specifies matching rules and actions.

// Simple P4 example: IPv4 forwarding
header ipv4_t {
    bit<4>  version;
    bit<8>  ttl;
    bit<32> srcAddr;
    bit<32> dstAddr;
}
 
control MyIngress(inout headers hdr, ...) {
    action forward(bit<9> port) {
        standard_metadata.egress_spec = port;
        hdr.ipv4.ttl = hdr.ipv4.ttl - 1;
    }
 
    table ipv4_lpm {
        key = { hdr.ipv4.dstAddr: lpm; }
        actions = { forward; drop; }
    }
 
    apply { ipv4_lpm.apply(); }
}

Why it matters

Before: a switch could only handle the protocols its manufacturer chose
P4: new protocols can be programmed without replacing the switch
Applications: in-band telemetry (INT), custom load balancing, cache acceleration

Summary

The layer model splits communication into independent stages, which narrows diagnosis to the question of which layer broke. Encapsulation, where each layer adds a header on the sending side and strips it in reverse order on the receiving side, is what supports that separation. In backend practice, the application, presentation, and transport layers come up daily (HTTP APIs, TLS, TCP tuning, load balancers). The network layer and below appear intermittently through VPCs, subnets, and Kubernetes networking.

SDN moves the control plane to a central controller and NFV moves network functions into software, making the infrastructure programmable. Overlay networks lay a virtual network over the physical one to support container and multi-tenant environments.

→ Next note: the transport layer - TCP, UDP, QUIC, and congestion control algorithms