Map the OSI model to real protocols and traffic before moving to reading resources.

Opening Framing: A Framework for Thinking

The OSI (Open Systems Interconnection) model divides network communication into seven layers. Each layer has a specific job, specific protocols, and specific vulnerabilities.

Security professionals use the OSI model to systematically analyze where attacks occur and where defenses should be placed. When you hear "Layer 7 attack" or "Layer 2 segmentation," you'll know exactly what that means.

This week, we'll walk through each layer from a security perspective—not just what it does, but how it's attacked and defended.

Key insight: Attacks can target any layer. A comprehensive defense requires security controls at multiple layers—defense in depth.

1) The Seven Layers Overview

Memorize this model—you'll reference it throughout your career:

Layer 7: Application    - User-facing protocols (HTTP, DNS, SMTP)
Layer 6: Presentation   - Data formatting, encryption (SSL/TLS, JPEG)
Layer 5: Session        - Connection management (NetBIOS, RPC)
Layer 4: Transport      - End-to-end delivery (TCP, UDP)
Layer 3: Network        - Routing between networks (IP, ICMP)
Layer 2: Data Link      - Local network delivery (Ethernet, Wi-Fi)
Layer 1: Physical       - Bits on the wire (cables, signals)

Memory trick: "All People Seem To Need Data Processing"
(Application, Presentation, Session, Transport, Network, Data Link, Physical)

How Data Flows:

When you send data, it travels down the layers, getting wrapped in headers at each level (encapsulation). When received, it travels up, with each layer stripping its header (decapsulation):

Sending (encapsulation):
[Application Data]
[L6 Header][Application Data]
[L5 Header][L6][Data]
[TCP Header][L5][L6][Data]
[IP Header][TCP][L5][L6][Data]
[Ethernet Header][IP][TCP][Data][Ethernet Trailer]
→ Bits on wire

Receiving (decapsulation):
← Bits arrive
Strip Ethernet → Read IP → Strip IP → Read TCP → Strip TCP → Application Data

Key insight: Each layer only understands its own headers. This is why a firewall reading Layer 4 (ports) can't see Layer 7 (HTTP content) without deep packet inspection.

2) Physical & Data Link Layers (1-2): Local Attacks

Layer 1 - Physical:

The physical layer is about actual transmission: electrical signals, fiber optics, radio waves. Security at this layer is physical security.

Layer 1 Threats:

• Wiretapping: Physical access to cables
• Jamming: Disrupting wireless signals
• Physical destruction: Cutting cables, damaging equipment
• Rogue devices: Unauthorized hardware connections

Layer 2 - Data Link:

Layer 2 handles communication within a local network using MAC addresses. Ethernet and Wi-Fi operate here.

Layer 2 Threats:

• ARP Spoofing: Poisoning ARP caches to redirect traffic
• MAC Flooding: Overwhelming switch tables
• VLAN Hopping: Escaping network segmentation
• Rogue Access Points: Fake Wi-Fi networks

# ARP spoofing attack concept (attacker claims to be gateway)
Victim's ARP cache before attack:
  192.168.1.1 → AA:BB:CC:DD:EE:FF (real gateway)

After ARP poison:
  192.168.1.1 → 11:22:33:44:55:66 (attacker's MAC)

Result: Victim sends all traffic to attacker

Layer 2 Defenses:

• Port security (limit MACs per port)
• Dynamic ARP Inspection (DAI)
• 802.1X authentication
• Private VLANs

Key insight: Layer 2 attacks require local network access. If an attacker is on your LAN, they can do serious damage before touching Layer 3+.

3) Network Layer (3): Routing and IP

Layer 3 handles routing between networks using IP addresses. This is where the Internet operates—packets crossing routers to reach destinations.

Key Layer 3 Protocols:

• IP (IPv4/IPv6): Addressing and routing
• ICMP: Network diagnostics (ping, traceroute)
• IPsec: Encrypted IP tunnels (VPNs)
• Routing protocols: BGP, OSPF, RIP

Layer 3 Threats:

• IP Spoofing: Forging source IP addresses
• Route Hijacking: BGP attacks redirecting traffic
• ICMP Attacks: Ping floods, Smurf attacks
• Fragmentation Attacks: Exploiting reassembly

# IP header fields attackers manipulate:
┌─────────────────────────────────────────┐
│ Version │ IHL │ ToS │ Total Length      │
├─────────────────────────────────────────┤
│ Identification │ Flags │ Fragment Offset│
├─────────────────────────────────────────┤
│ TTL │ Protocol │ Header Checksum        │
├─────────────────────────────────────────┤
│ Source IP Address (can be spoofed!)     │
├─────────────────────────────────────────┤
│ Destination IP Address                  │
└─────────────────────────────────────────┘

Layer 3 Defenses:

• Ingress/egress filtering (block spoofed IPs)
• ACLs on routers
• IPsec for authentication and encryption
• BGP security (RPKI, route filtering)

Key insight: Layer 3 is where firewalls traditionally operate—permit or deny based on IP addresses. But IP addresses can be spoofed.

4) Transport Layer (4): TCP and UDP

Layer 4 provides end-to-end communication between applications using ports. TCP provides reliable, ordered delivery; UDP provides fast, connectionless delivery.

TCP vs UDP:

TCP (Transmission Control Protocol):
- Connection-oriented (3-way handshake)
- Reliable delivery (acknowledgments, retransmission)
- Ordered packets (sequence numbers)
- Flow control and congestion control
- Used by: HTTP, SSH, FTP, SMTP

UDP (User Datagram Protocol):
- Connectionless (fire and forget)
- No delivery guarantee
- No ordering
- Lower overhead, faster
- Used by: DNS, DHCP, VoIP, streaming, gaming

The TCP Three-Way Handshake:

Client              Server
  │                    │
  │───── SYN ─────────>│  "I want to connect"
  │                    │
  │<──── SYN-ACK ──────│  "OK, acknowledged"
  │                    │
  │───── ACK ─────────>│  "Connection established"
  │                    │
  │<════ DATA ════════>│  Communication begins

Layer 4 Threats:

• SYN Flood: Exhausting connection tables with half-open connections
• Port Scanning: Discovering services by probing ports
• Session Hijacking: Predicting sequence numbers
• UDP Amplification: DDoS using UDP protocols

Layer 4 Defenses:

• SYN cookies (stateless SYN flood protection)
• Stateful firewalls (track connection state)
• Rate limiting
• Port knocking

Key insight: Port numbers identify services. Port 22 = SSH, Port 443 = HTTPS. Firewalls use ports for access control, but ports can be changed.

5) Upper Layers (5-7): Sessions, Presentation, Application

Layer 5 - Session:

Manages sessions between applications. In practice, this layer is often merged with others in TCP/IP. Think of authentication sessions, RPC calls.

Layer 5 Threats: Session hijacking, session fixation, replay attacks.

Layer 6 - Presentation:

Handles data formatting, encryption, and compression. SSL/TLS operates here, as do data formats like JPEG, ASCII, encryption.

Layer 6 Threats: SSL stripping, downgrade attacks, malformed data exploits.

Layer 7 - Application:

User-facing protocols: HTTP, DNS, SMTP, FTP, SSH. This is where most attacks happen today because it's where applications live.

Layer 7 Threats:

• SQL Injection: Attacking through web forms
• Cross-Site Scripting: Injecting malicious scripts
• DNS Poisoning: Corrupting DNS responses
• Phishing: Social engineering via email
• Application DDoS: Overwhelming specific endpoints

Layer 7 Defenses:

• Web Application Firewalls (WAF)
• Input validation
• DNSSEC
• Email security (SPF, DKIM, DMARC)
• Application-aware proxies

Key insight: Layer 7 attacks bypass traditional firewalls because they use allowed ports (80, 443). You need application-layer inspection.

Real-World Context: OSI in Security Operations

The OSI model guides security architecture:

Defense in Depth: Don't rely on one layer. A good architecture has physical security (L1), port security (L2), firewalls (L3-4), and WAFs (L7). If one layer fails, others catch the attack.

Attack Classification: When analyzing an attack, identifying the layer helps choose the response. A SYN flood (L4) needs different mitigation than SQL injection (L7).

Tool Selection: Different tools operate at different layers. Wireshark sees L2-7, traditional firewalls see L3-4, WAFs see L7. Know what your tools can and can't see.

MITRE ATT&CK Reference:

• T1557 - Adversary-in-the-Middle: L2 ARP spoofing, L7 proxy attacks
• T1499 - Endpoint Denial of Service: L4 SYN floods, L7 application attacks
• T1071 - Application Layer Protocol: L7 C2 over HTTP/DNS

Key insight: Real attacks often span multiple layers. Understanding the OSI model helps you trace the complete attack chain.

Guided Lab: Identifying Layers in Wireshark

Let's examine real packets and identify each OSI layer in Wireshark.