Blue Team · Networking reference
The OSI model,
layer by layer.
Seven layers, from the physical wire to the application a person actually uses. Real stacks are messier than the model, but the OSI layers are the shared language: they tell you where a protocol lives, what a piece of data is called there, and which attacks and controls belong to each floor of the building. Read it top to bottom the way an application sees the world, or bottom to top the way a packet is built.
The seven layers
What happens at each layer.
Each floor does one job and hands its result to the floor below (sending) or above (receiving). The protocol data unit (PDU) is what the data is called at that layer.
-
7 Application PDU · Data The network services a program or person actually uses.
- Protocols
- HTTP/HTTPS, DNS, SMTP, IMAP, FTP, SSH, DHCP, SNMP
- Devices & addressing
- Hosts, application gateways, WAFs, proxies; named by hostname / URL
- Attacks → controls
- Phishing, injection (SQLi/XSS), API abuse, app exploits → WAF, input validation, HSTS, strong authentication and authorisation
-
6 Presentation PDU · Data Translation, encryption and encoding so both sides agree on format.
- Protocols & formats
- TLS/SSL, ASCII/Unicode, MIME, JPEG/PNG, character and compression encodings
- Devices & addressing
- Endpoints and TLS terminators; no addressing of its own
- Attacks → controls
- TLS downgrade / stripping, weak ciphers, certificate mis-issuance → TLS 1.3, certificate validation, Certificate Transparency, HSTS
- See it
- TLS handshake scenario
-
5 Session PDU · Data Opening, maintaining and tearing down conversations between hosts.
- Protocols
- TLS session, RPC, SMB session, NetBIOS, SOCKS, PPTP
- Devices & addressing
- Endpoints; session identifiers rather than network addresses
- Attacks → controls
- Session hijacking, fixation and replay → unpredictable session tokens, timeouts and re-authentication, cookie flags (Secure, HttpOnly, SameSite)
- See it
- Web session scenario
-
4 Transport PDU · Segment / Datagram End-to-end delivery between programs, using ports.
- Protocols
- TCP (reliable, ordered), UDP (fast, best-effort), QUIC
- Devices & addressing
- Layer 4 load balancers, stateful firewalls; addressed by port number
- Attacks → controls
- SYN flood, port scanning, UDP amplification → SYN cookies, rate limiting, stateful inspection, closing unused ports
- See it
- TCP handshake scenario
-
3 Network PDU · Packet Logical addressing and routing between different networks.
- Protocols
- IPv4 / IPv6, ICMP, IPsec, OSPF, BGP
- Devices & addressing
- Routers, layer 3 switches; addressed by IP address
- Attacks → controls
- IP spoofing, BGP hijack, route leaks, ICMP tunnelling → RPKI route-origin validation, ACLs, uRPF, IPsec
-
2 Data link PDU · Frame Framing and delivery across one physical link, with error detection.
- Protocols
- Ethernet, ARP, 802.1Q VLAN, STP, PPP, 802.1X
- Devices & addressing
- Switches, bridges, NICs, wireless access points; addressed by MAC address
- Attacks → controls
- ARP spoofing, MAC flooding, VLAN hopping, rogue access point → Dynamic ARP Inspection, port security, DHCP snooping, 802.1X
-
1 Physical PDU · Bits Moving raw bits over a medium as electricity, light or radio.
- Media & devices
- Copper, fibre, radio; cables, hubs, repeaters, transceivers
- Addressing
- None — signals and voltages, not addresses
- Attacks → controls
- Wiretapping, fibre tapping, jamming, physical theft → physical access control, fibre over copper, shielding, disabling unused ports
Encapsulation
How the data is wrapped on the way down.
Going down the stack, each layer wraps the layer above in its own header (and the data-link layer adds a trailer too). The receiver unwraps them in the reverse order. The same bytes are called by different names at each layer.
A note on honesty: the middle layers are fuzzy in practice. TLS spans presentation and session ideas, and the internet's own TCP/IP model collapses layers 5 to 7 into one "application" layer. The Blue Team Scenarios show these steps as they really happen, as numbered protocol exchanges.