SkarpSkarp

Chapter 3 of 27

Models and Media: OSI, TCP/IP, and Ethernet Foundations

Trace a packet through the OSI and TCP/IP models, then ground the theory in real cables, connectors, and Ethernet framing used in every CCNA lab.

27 min readen

Big Picture: Why Models and Media Matter for CCNA

From Theory to Cables

In this module you connect abstract models (OSI and TCP/IP) to the physical world (cables, connectors, Ethernet frames) that you will touch in every CCNA lab.

Key Exam Skills

You must recite OSI layers in order, map them to the 4-layer TCP/IP model, explain encapsulation/de-encapsulation, and recognize key Ethernet frame fields and MAC address behavior.

Maps vs Roads

Think of models as maps and cables/frames as roads and cars: OSI is a 7-layer teaching map, TCP/IP is a 4-layer practical map, and Ethernet is one of the main roads at the bottom.

End Goal

By the end, you should be able to trace a piece of data from an app on your laptop, down the layers, across a switch, and up to another device, using correct CCNA terminology.

The OSI Model: 7 Layers, Top to Bottom

OSI: The 7-Layer Map

The OSI model is a conceptual framework. You must know the 7 layers in order, top to bottom: Application, Presentation, Session, Transport, Network, Data Link, Physical.

Top 3 Layers

Application: interfaces for user apps. Presentation: data formats and transformations like encryption and compression. Session: starts, maintains, and ends communication sessions.

Middle Layer: Transport

Transport provides end-to-end delivery, reliability, segmentation, and flow control. Key protocols here are TCP and UDP, which you will see in almost every CCNA lab.

Network and Data Link

Network handles logical addressing and routing (IPv4/IPv6). Data Link handles local delivery on a segment, MAC addressing, framing, and error detection (Ethernet, Wi‑Fi MAC).

Physical Layer

Physical is about bits on the medium: voltages, light pulses, radio waves, cables, connectors. A broken cable is a classic Layer 1 problem.

Devices and Layers

Switches are mainly Layer 2 devices. Routers are Layer 3. Ethernet standards cover both Layer 1 and Layer 2. Cisco exam questions often test these mappings.

The TCP/IP Model and Mapping to OSI

TCP/IP: 4 Practical Layers

The TCP/IP model has 4 layers: Application, Transport, Internet, Network Access. It reflects how real protocol stacks are implemented today.

Top of TCP/IP

TCP/IP Application maps to OSI Application, Presentation, Session. In practice, we usually just say Application layer for HTTP, DNS, SSH, etc.

Middle Layers

TCP/IP Transport maps directly to OSI Transport. TCP/IP Internet maps to OSI Network, handling IP addressing and routing between networks.

Bottom Layer Mapping

TCP/IP Network Access maps to OSI Data Link plus Physical. It covers Ethernet, Wi‑Fi, PPP, and the actual media used to send bits.

Exam Mapping Examples

IP operates at the TCP/IP Internet layer. The OSI layers corresponding to TCP/IP Network Access are Data Link and Physical.

Step-by-Step: Tracing a Packet Through the Models

Ping Scenario Overview

Scenario: your PC (Host A) pings your router (Host B) on the same LAN. We follow the packet down and up the OSI and TCP/IP models.

Application Step

You type `ping 192.168.1.1`. The ping program is triggered at the Application layer, using ICMP to request an echo from the router.

Transport Step

Ping does not use TCP or UDP, so no Transport header is added. ICMP is carried directly inside IP. This is a common exam trap.

Network/Internet Step

The OS creates an IPv4 packet: source IP 192.168.1.10, destination 192.168.1.1, protocol ICMP. This is the Network/Internet layer unit.

Data Link Step

Your PC learns the router’s MAC via ARP, then builds an Ethernet frame: destination MAC router, source MAC PC, EtherType IPv4, payload the IP packet.

Physical Step

The Ethernet frame becomes bits on a cable (e.g., Cat6 with RJ-45). The switch forwards it to the router, which later sends an echo reply back.

Encapsulation and De-encapsulation: Wrapping the Data

What Is Encapsulation?

Encapsulation is adding headers (and sometimes trailers) as data moves down the stack. De-encapsulation is removing them as data moves up at the receiver.

Nested Envelopes Analogy

Think nested envelopes: the inner letter is application data, and each layer adds its own envelope with addressing and control information.

Typical HTTP Encapsulation

Application data → TCP adds ports (segment) → IP adds IP addresses (packet) → Ethernet adds MACs and FCS (frame) → Physical sends bits on the medium.

Reverse at the Receiver

The receiver converts bits to frame (Physical), frame to packet (Data Link), packet to segment (Network), and segment to data (Transport) before handing it to the application.

Key Terms and Traps

Know: segment = Transport, packet = Network, frame = Data Link, bits = Physical. Some protocols like ICMP skip the Transport header entirely.

Ethernet at Layer 1 and 2: Cables, Connectors, and Media

Ethernet and the Physical Layer

Ethernet dominates wired LANs. At Layer 1, common media are twisted-pair copper (Cat5e, Cat6, Cat6a) with RJ-45, and fiber optic with LC or SC connectors.

Copper Speed Standards

Recognize 100BASE-TX (100 Mbps), 1000BASE-T (1 Gbps), and 10GBASE-T (10 Gbps). These run over Cat5e or better, with Cat6a recommended for 10GBASE-T.

Ethernet at Layer 2

At Data Link, Ethernet defines framing, MAC addressing, and media access control. Classic CSMA/CD is historical with full-duplex switching but still tested.

Lab Relevance

In CCNA labs you plug cables, set speed/duplex, and check status with `show interfaces`. Think: no link light = Layer 1, link up but ARP/neighbor issues = Layer 2.

Ethernet Frame Structure and MAC Addressing

Ethernet Frame Fields

An Ethernet II frame has: preamble + SFD, destination MAC, source MAC, EtherType, payload, and FCS. These define how data is carried at Layer 2.

MAC Address Basics

A MAC address is 48 bits in hex (e.g., 00:1A:2B:3C:4D:5E). The first 24 bits form the vendor OUI, the last 24 bits identify the specific device.

Switch Forwarding Logic

Switches use a MAC address table mapping MACs to ports. Known unicast frames go out a single port; unknown or broadcast frames are flooded within the VLAN.

MAC vs IP and Hop Behavior

MAC addresses are Layer 2 and typically change at each router hop. IP addresses are Layer 3 and usually stay the same from source host to destination host.

Layer Mapping and Encapsulation Thought Exercise

Work through this exercise mentally (or jot notes) to solidify the models and encapsulation.

Scenario: A user on PC1 browses `https://example.com`. PC1 is connected to a switch, which connects to a router, which connects to the internet.

  1. List the OSI layers top to bottom.
  • Say them out loud in order. Do not peek. Then check:
  • Application, Presentation, Session, Transport, Network, Data Link, Physical.
  1. Map each OSI layer to the TCP/IP model for this scenario.
  • Which OSI layers are covered by the TCP/IP Application layer?
  • Which OSI layers are covered by the TCP/IP Network Access layer?
  1. Encapsulation path for the HTTP request:
  • Start with the HTTP GET request. At which OSI and TCP/IP layer does it originate?
  • Which Transport protocol is used (TCP or UDP)? What header is added?
  • Which Network/Internet protocol is used (IPv4 or IPv6 in your imagined network)? What addressing is added?
  • Which Data Link technology is used on the first hop (likely Ethernet). What addressing and trailer are added?
  1. Identify where each address is used:
  • Which address is used by switches to forward the frame?
  • Which address is used by routers on the path to the web server?
  1. De-encapsulation at the server:
  • Imagine the server receiving the bits. Describe, in your own words, what each layer strips away until the web server process sees the HTTP request.

If any step feels fuzzy, pause and re-read the earlier steps on OSI/TCP-IP mapping and encapsulation, then try again without looking.

Quick Check: OSI and TCP/IP Layers

Test your recall of the models and mappings.

Which option correctly lists the OSI model layers from top (closest to the user) to bottom (closest to the wire)?

  1. Application, Presentation, Session, Transport, Network, Data Link, Physical
  2. Physical, Data Link, Network, Transport, Session, Presentation, Application
  3. Application, Session, Presentation, Transport, Network, Data Link, Physical
  4. Application, Transport, Internet, Network Access
Show Answer

Answer: A) Application, Presentation, Session, Transport, Network, Data Link, Physical

The required OSI order from top to bottom is: Application, Presentation, Session, Transport, Network, Data Link, Physical. Option 2 is bottom-to-top, option 3 has Session and Presentation swapped, and option 4 is the TCP/IP model, not OSI.

Quick Check: Encapsulation and Ethernet

Test your understanding of encapsulation and Ethernet framing.

A web browser on Host A sends an HTTP request to a server on a remote network over Ethernet. Which statement is MOST accurate about encapsulation on the first hop?

  1. The HTTP request is placed directly into an Ethernet frame with source and destination MAC addresses; no other headers are used.
  2. The HTTP request is encapsulated in a TCP segment, then an IP packet, then an Ethernet frame with source/destination MAC addresses and FCS.
  3. The HTTP request is encapsulated only in an IP packet, then sent as raw bits on the wire; Ethernet does not add its own header.
  4. The HTTP request is encapsulated in a UDP segment, then an Ethernet frame; IP is only used on router-to-router links.
Show Answer

Answer: B) The HTTP request is encapsulated in a TCP segment, then an IP packet, then an Ethernet frame with source/destination MAC addresses and FCS.

For HTTP over Ethernet, the correct encapsulation is: HTTP data → TCP segment (Transport) → IP packet (Network/Internet) → Ethernet frame (Data Link) with source/destination MAC and FCS → bits (Physical). Option 1 skips TCP/IP, option 3 ignores Ethernet framing, and option 4 incorrectly uses UDP and misplaces IP.

Core Terms: Models, Encapsulation, and Ethernet

Use these flashcards to reinforce key terms and distinctions.

List the OSI model layers from top to bottom.
Application, Presentation, Session, Transport, Network, Data Link, Physical.
List the TCP/IP model layers.
Application, Transport, Internet, Network Access.
Define encapsulation in networking.
Encapsulation is the process of adding protocol-specific headers (and sometimes trailers) to data as it moves down the protocol stack from higher to lower layers.
At which OSI layer do MAC addresses operate, and what are they used for?
MAC addresses operate at the Data Link (Layer 2) and are used for local forwarding on the same network segment, allowing switches to deliver frames to the correct device.
What is the typical unit name at each of these layers: Transport, Network, Data Link, Physical?
Transport: segment. Network: packet. Data Link: frame. Physical: bits.
Which TCP/IP layer corresponds to the OSI Network layer?
The TCP/IP Internet layer corresponds to the OSI Network layer.
Name two common copper Ethernet standards and their speeds.
100BASE-TX: 100 Mbps. 1000BASE-T: 1 Gbps. (Also know 10GBASE-T: 10 Gbps.)
What is the purpose of the FCS field in an Ethernet frame?
The Frame Check Sequence (FCS) is a 4-byte CRC used for error detection to check whether the frame was corrupted in transit.
Do IP addresses or MAC addresses usually change when a packet crosses a router? Briefly explain.
MAC addresses usually change at each router hop because a new Ethernet frame is built for each link. IP addresses usually stay the same end-to-end between source and destination hosts.

Key Terms

EtherType
A 2-byte field in an Ethernet frame that indicates the protocol of the encapsulated payload, such as 0x0800 for IPv4 or 0x86DD for IPv6.
OSI model
A conceptual 7-layer framework (Application, Presentation, Session, Transport, Network, Data Link, Physical) used to describe and standardize network communication functions.
MAC address
A 48-bit hardware address used at the Data Link layer to uniquely identify network interfaces on a local network segment.
TCP/IP model
A practical 4-layer networking model (Application, Transport, Internet, Network Access) that reflects how the TCP/IP protocol suite is implemented in real networks.
encapsulation
The process of adding protocol headers (and sometimes trailers) to data as it passes from higher to lower layers in a protocol stack.
Ethernet frame
The Layer 2 data unit used on Ethernet networks, consisting of fields such as destination MAC, source MAC, EtherType, payload, and Frame Check Sequence (FCS).
Internet layer
The TCP/IP layer responsible for logical addressing and routing between networks, corresponding to the OSI Network layer.
de-encapsulation
The process of removing protocol headers and trailers from received data as it passes from lower to higher layers in a protocol stack.
Network Access layer
The lowest layer of the TCP/IP model, corresponding to the OSI Data Link and Physical layers, responsible for access to the physical network medium.
FCS (Frame Check Sequence)
A 4-byte CRC value at the end of an Ethernet frame used for error detection.

Finished reading?

Test your understanding with a custom practice exam on this chapter.

Test yourself