NetSec How Data Travels
Every time you send an email, stream a video, or open a web page, data makes a journey across a network. That journey follows a strict set of rules called the OSI model. Understanding how data moves helps you spot exactly where attackers interfere and where defenses need to sit.
The OSI Model — A Seven-Layer Post Office
Imagine a parcel delivery system with seven departments. Each department adds its own label to the package before handing it down to the next. At the destination, each department peels off its label and passes the content up. The OSI model works the same way.
SENDER SIDE RECEIVER SIDE ------------------- ------------------- Layer 7: Application --- DATA ---> Layer 7: Application Layer 6: Presentation | Layer 6: Presentation Layer 5: Session | Layer 5: Session Layer 4: Transport | Layer 4: Transport Layer 3: Network | Layer 3: Network Layer 2: Data Link | Layer 2: Data Link Layer 1: Physical ---[cable/air]--> Layer 1: Physical
Layer 1 – Physical
This is the actual wire, fiber-optic cable, or radio wave that carries the signal. Security concern: an attacker can tap a cable or jam a wireless signal at this layer.
Layer 2 – Data Link
This layer handles communication between devices on the same local network using MAC addresses (like a serial number burned into every network card). Security concern: MAC spoofing and ARP poisoning attacks happen here.
Layer 3 – Network
This layer uses IP addresses to route packets from one network to another. Routers operate here. Security concern: IP spoofing and routing attacks target this layer.
Layer 4 – Transport
This layer breaks data into segments and manages delivery using either TCP (reliable, confirms delivery) or UDP (fast, no confirmation). Security concern: port scanning and SYN flood attacks target this layer.
Layer 5 – Session
This layer opens, manages, and closes a conversation between two devices. Security concern: session hijacking (stealing a logged-in session) happens here.
Layer 6 – Presentation
This layer handles data formatting, compression, and encryption. HTTPS encryption (SSL/TLS) works at this layer. Security concern: if encryption is weak or missing, data is readable in transit.
Layer 7 – Application
This is the layer your browser, email client, and apps use directly. HTTP, DNS, FTP, and SMTP operate here. Security concern: most web attacks (SQL injection, phishing pages, malicious downloads) happen at this layer.
How a Web Request Actually Travels
Here is what happens when you type a web address and press Enter:
Step 1: Your browser (Layer 7) creates an HTTP request
"GET /index.html from estudy247.com"
Step 2: Layer 4 wraps it in a TCP segment
Adds port number (443 for HTTPS)
Step 3: Layer 3 adds IP header
From: 192.168.1.5 To: 203.0.113.10
Step 4: Layer 2 adds MAC address for the next hop
From: AA:BB:CC To: Router's MAC
Step 5: Layer 1 converts to electrical signal
Travels through cable or Wi-Fi
--- Crosses the internet through multiple routers ---
Step 6: Server reverses the process, layer by layer
Reads the HTTP request, sends back the page
TCP vs UDP — Two Different Delivery Styles
Think of TCP as a registered postal service. The sender keeps a receipt. If the package is not confirmed delivered, it gets resent. UDP is like dropping a flyer in a mailbox — fast, no tracking, no guarantee.
TCP (Reliable) UDP (Fast) ------------------------------ ---------------------------- Web browsing (HTTP/HTTPS) Video streaming Email (SMTP) Online gaming File transfer (FTP) Voice calls (VoIP) Banking apps Live broadcasts
Attackers exploit UDP's lack of confirmation to launch amplification attacks, where a small request generates a huge response that floods a target.
Where Attackers Strike Along the Journey
Journey Stage | Attack Type -----------------------|------------------------------- Physical cable | Cable tapping (wiretap) Local network switch | ARP poisoning Internet routing | BGP hijacking Transport layer | SYN flood, port scanning Session layer | Session hijacking, MITM Encryption layer | SSL stripping Application layer | Phishing, SQLi, XSS
Each layer is a security checkpoint. Defenders place controls at each one: firewalls at Layer 3, intrusion detection at Layer 4, web application firewalls at Layer 7, and encryption across Layers 4–6.
Encapsulation — The Wrapping Process
Each layer wraps the data from the layer above it. This wrapping is called encapsulation. At the destination, each layer unwraps its portion and hands the inner content upward. The term for the data unit at each layer has a specific name:
Layer 7 Application → Data Layer 4 Transport → Segment (TCP) / Datagram (UDP) Layer 3 Network → Packet Layer 2 Data Link → Frame Layer 1 Physical → Bits (0s and 1s)
When a firewall examines traffic, it looks inside these layers. A deep packet inspection (DPI) firewall reads all the way up to Layer 7 to detect harmful content hidden inside legitimate-looking packets.