the session presentation and application layers are the support layers

The OSI Model – The 7 Layers of Networking Explained in Plain English

This article explains the Open Systems Interconnection (OSI) model and the 7 layers of networking, in plain English.

The OSI model is a conceptual framework that is used to describe how a network functions. In plain English, the OSI model helped standardize the way computer systems send information to each other.

Learning networking is a bit like learning a language - there are lots of standards and then some exceptions. Therefore, it’s important to really understand that the OSI model is not a set of rules. It is a tool for understanding how networks function.

Once you learn the OSI model, you will be able to further understand and appreciate this glorious entity we call the Internet, as well as be able to troubleshoot networking issues with greater fluency and ease.

All hail the Internet!

Prerequisites

You don’t need any prior programming or networking experience to understand this article. However, you will need:

• Basic familiarity with common networking terms (explained below)
• A curiosity about how things work :)

Learning Objectives

Over the course of this article, you will learn:

• What the OSI model is
• The purpose of each of the 7 layers
• The problems that can happen at each of the 7 layers
• The difference between TCP/IP model and the OSI model

Common Networking Terms

Here are some common networking terms that you should be familiar with to get the most out of this article. I’ll use these terms when I talk about OSI layers next.

A node is a physical electronic device hooked up to a network, for example a computer, printer, router, and so on. If set up properly, a node is capable of sending and/or receiving information over a network.

Nodes may be set up adjacent to one other, wherein Node A can connect directly to Node B, or there may be an intermediate node, like a switch or a router, set up between Node A and Node B.

Typically, routers connect networks to the Internet and switches operate within a network to facilitate intra-network communication. Learn more about hub vs. switch vs. router.

Here's an example:

For the nitpicky among us (yep, I see you), host is another term that you will encounter in networking. I will define a host as a type of node that requires an IP address. All hosts are nodes, but not all nodes are hosts. Please Tweet angrily at me if you disagree.

Links connect nodes on a network. Links can be wired, like Ethernet, or cable-free, like WiFi.

Links to can either be point-to-point, where Node A is connected to Node B, or multipoint, where Node A is connected to Node B and Node C.

When we’re talking about information being transmitted, this may also be described as a one-to-one vs. a one-to-many relationship.

A protocol is a mutually agreed upon set of rules that allows two nodes on a network to exchange data.

“A protocol defines the rules governing the syntax (what can be communicated), semantics (how it can be communicated), and synchronization (when and at what speed it can be communicated) of the communications procedure. Protocols can be implemented on hardware, software, or a combination of both. Protocols can be created by anyone, but the most widely adopted protocols are based on standards.” - The Illustrated Network.

Both wired and cable-free links can have protocols.

While anyone can create a protocol, the most widely adopted protocols are often based on standards published by Internet organizations such as the Internet Engineering Task Force (IETF).

A network is a general term for a group of computers, printers, or any other device that wants to share data.

Network types include LAN, HAN, CAN, MAN, WAN, BAN, or VPN. Think I’m just randomly rhyming things with the word can ? I can ’t say I am - these are all real network types. Learn more here .

Topology describes how nodes and links fit together in a network configuration, often depicted in a diagram. Here are some common network topology types:

A network consists of nodes, links between nodes, and protocols that govern data transmission between nodes.

At whatever scale and complexity networks get to, you will understand what’s happening in all computer networks by learning the OSI model and 7 layers of networking.

What is the OSI Model?

The OSI model consists of 7 layers of networking.

First, what’s a layer?

No, a layer - not a lair . Here there are no dragons.

A layer is a way of categorizing and grouping functionality and behavior on and of a network.

In the OSI model, layers are organized from the most tangible and most physical, to less tangible and less physical but closer to the end user.

Each layer abstracts lower level functionality away until by the time you get to the highest layer. All the details and inner workings of all the other layers are hidden from the end user.

How to remember all the names of the layers? Easy.

• Please | Physical Layer
• Do | Data Link Layer
• Not | Network Layer
• Tell (the) | Transport Layer
• Secret | Session Layer
• Password (to) | Presentation Layer
• Anyone | Application Layer

Keep in mind that while certain technologies, like protocols, may logically “belong to” one layer more than another, not all technologies fit neatly into a single layer in the OSI model. For example, Ethernet, 802.11 (Wifi) and the Address Resolution Protocol (ARP) procedure operate on >1 layer.

The OSI is a model and a tool, not a set of rules.

OSI Layer 1

Layer 1 is the physical layer . There’s a lot of technology in Layer 1 - everything from physical network devices, cabling, to how the cables hook up to the devices. Plus if we don’t need cables, what the signal type and transmission methods are (for example, wireless broadband).

Instead of listing every type of technology in Layer 1, I’ve created broader categories for these technologies. I encourage readers to learn more about each of these categories:

• Nodes (devices) and networking hardware components. Devices include hubs, repeaters, routers, computers, printers, and so on. Hardware components that live inside of these devices include antennas, amplifiers, Network Interface Cards (NICs), and more.
• Device interface mechanics. How and where does a cable connect to a device (cable connector and device socket)? What is the size and shape of the connector, and how many pins does it have? What dictates when a pin is active or inactive?
• Functional and procedural logic. What is the function of each pin in the connector - send or receive? What procedural logic dictates the sequence of events so a node can start to communicate with another node on Layer 2?
• Cabling protocols and specifications. Ethernet (CAT), USB, Digital Subscriber Line (DSL) , and more. Specifications include maximum cable length, modulation techniques, radio specifications, line coding, and bits synchronization (more on that below).
• Cable types. Options include shielded or unshielded twisted pair, untwisted pair, coaxial and so on. Learn more about cable types here .
• Signal type. Baseband is a single bit stream at a time, like a railway track - one-way only. Broadband consists of multiple bit streams at the same time, like a bi-directional highway.
• Signal transmission method (may be wired or cable-free). Options include electrical (Ethernet), light (optical networks, fiber optics), radio waves (802.11 WiFi, a/b/g/n/ac/ax variants or Bluetooth). If cable-free, then also consider frequency: 2.5 GHz vs. 5 GHz. If it’s cabled, consider voltage. If cabled and Ethernet, also consider networking standards like 100BASE-T and related standards.

The data unit on Layer 1 is the bit.

A bit the smallest unit of transmittable digital information. Bits are binary, so either a 0 or a 1. Bytes, consisting of 8 bits, are used to represent single characters, like a letter, numeral, or symbol.

Bits are sent to and from hardware devices in accordance with the supported data rate (transmission rate, in number of bits per second or millisecond) and are synchronized so the number of bits sent and received per unit of time remains consistent (this is called bit synchronization). The way bits are transmitted depends on the signal transmission method.

Nodes can send, receive, or send and receive bits. If they can only do one, then the node uses a simplex mode. If they can do both, then the node uses a duplex mode. If a node can send and receive at the same time, it’s full-duplex – if not, it’s just half-duplex.

The original Ethernet was half-duplex. Full-duplex Ethernet is an option now, given the right equipment.

How to Troubleshoot OSI Layer 1 Problems

Here are some Layer 1 problems to watch out for:

• Defunct cables, for example damaged wires or broken connectors
• Broken hardware network devices, for example damaged circuits
• Stuff being unplugged (...we’ve all been there)

If there are issues in Layer 1, anything beyond Layer 1 will not function properly.

Layer 1 contains the infrastructure that makes communication on networks possible.

It defines the electrical, mechanical, procedural, and functional specifications for activating, maintaining, and deactivating physical links between network devices. - Source

Fun fact: deep-sea communications cables transmit data around the world. This map will blow your mind: https://www.submarinecablemap.com/

And because you made it this far, here’s a koala:

OSI Layer 2

Layer 2 is the data link layer . Layer 2 defines how data is formatted for transmission, how much data can flow between nodes, for how long, and what to do when errors are detected in this flow.

In more official tech terms:

• Line discipline. Who should talk for how long? How long should nodes be able to transit information for?
• Flow control. How much data should be transmitted?
• Error control - detection and correction . All data transmission methods have potential for errors, from electrical spikes to dirty connectors. Once Layer 2 technologies tell network administrators about an issue on Layer 2 or Layer 1, the system administrator can correct for those errors on subsequent layers. Layer 2 is mostly concerned with error detection, not error correction. ( Source )

There are two distinct sublayers within Layer 2:

• Media Access Control (MAC): the MAC sublayer handles the assignment of a hardware identification number, called a MAC address, that uniquely identifies each device on a network. No two devices should have the same MAC address. The MAC address is assigned at the point of manufacturing. It is automatically recognized by most networks. MAC addresses live on Network Interface Cards (NICs). Switches keep track of all MAC addresses on a network. Learn more about MAC addresses on PC Mag and in this article . Learn more about network switches here .
• Logical Link Control (LLC): the LLC sublayer handles framing addressing and flow control. The speed depends on the link between nodes, for example Ethernet or Wifi.

The data unit on Layer 2 is a frame .

Each frame contains a frame header, body, and a frame trailer:

• Header: typically includes MAC addresses for the source and destination nodes.
• Body: consists of the bits being transmitted.
• Trailer: includes error detection information. When errors are detected, and depending on the implementation or configuration of a network or protocol, frames may be discarded or the error may be reported up to higher layers for further error correction. Examples of error detection mechanisms: Cyclic Redundancy Check (CRC) and Frame Check Sequence (FCS). Learn more about error detection techniques here .

Typically there is a maximum frame size limit, called an Maximum Transmission Unit, MTU. Jumbo frames exceed the standard MTU, learn more about jumbo frames here .

How to Troubleshoot OSI Layer 2 Problems

Here are some Layer 2 problems to watch out for:

• All the problems that can occur on Layer 1
• Unsuccessful connections (sessions) between two nodes
• Sessions that are successfully established but intermittently fail
• Frame collisions

The Data Link Layer allows nodes to communicate with each other within a local area network. The foundations of line discipline, flow control, and error control are established in this layer.

OSI Layer 3

Layer 3 is the network layer . This is where we send information between and across networks through the use of routers. Instead of just node-to-node communication, we can now do network-to-network communication.

Routers are the workhorse of Layer 3 - we couldn’t have Layer 3 without them. They move data packets across multiple networks.

Not only do they connect to Internet Service Providers (ISPs) to provide access to the Internet, they also keep track of what’s on its network (remember that switches keep track of all MAC addresses on a network), what other networks it’s connected to, and the different paths for routing data packets across these networks.

Routers store all of this addressing and routing information in routing tables.

Here’s a simple example of a routing table:

The data unit on Layer 3 is the data packet . Typically, each data packet contains a frame plus an IP address information wrapper. In other words, frames are encapsulated by Layer 3 addressing information.

The data being transmitted in a packet is also sometimes called the payload . While each packet has everything it needs to get to its destination, whether or not it makes it there is another story.

Layer 3 transmissions are connectionless, or best effort - they don't do anything but send the traffic where it’s supposed to go. More on data transport protocols on Layer 4.

Once a node is connected to the Internet, it is assigned an Internet Protocol (IP) address, which looks either like 172.16. 254.1 (IPv4 address convention) or like 2001:0db8:85a3:0000:0000:8a2e:0370:7334 (IPv6 address convention). Routers use IP addresses in their routing tables.

IP addresses are associated with the physical node’s MAC address via the Address Resolution Protocol (ARP), which resolves MAC addresses with the node’s corresponding IP address.

ARP is conventionally considered part of Layer 2, but since IP addresses don’t exist until Layer 3, it’s also part of Layer 3.

How to Troubleshoot OSI Layer 3 Problems

Here are some Layer 3 problems to watch out for:

• All the problems that can crop up on previous layers :)
• Faulty or non-functional router or other node
• IP address is incorrectly configured

Many answers to Layer 3 questions will require the use of command-line tools like ping , trace , show ip route , or show ip protocols . Learn more about troubleshooting on layer 1-3 here .

The Network Layer allows nodes to connect to the Internet and send information across different networks.

OSI Layer 4

Layer 4 is the transport layer . This where we dive into the nitty gritty specifics of the connection between two nodes and how information is transmitted between them. It builds on the functions of Layer 2 - line discipline, flow control, and error control.

This layer is also responsible for data packet segmentation, or how data packets are broken up and sent over the network.

Unlike the previous layer, Layer 4 also has an understanding of the whole message, not just the contents of each individual data packet. With this understanding, Layer 4 is able to manage network congestion by not sending all the packets at once.

The data units of Layer 4 go by a few names. For TCP, the data unit is a packet. For UDP, a packet is referred to as a datagram. I’ll just use the term data packet here for the sake of simplicity.

Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) are two of the most well-known protocols in Layer 4.

TCP, a connection-oriented protocol, prioritizes data quality over speed.

TCP explicitly establishes a connection with the destination node and requires a handshake between the source and destination nodes when data is transmitted. The handshake confirms that data was received. If the destination node does not receive all of the data, TCP will ask for a retry.

TCP also ensures that packets are delivered or reassembled in the correct order. Learn more about TCP here .

UDP, a connectionless protocol, prioritizes speed over data quality. UDP does not require a handshake, which is why it’s called connectionless.

Because UDP doesn’t have to wait for this acknowledgement, it can send data at a faster rate, but not all of the data may be successfully transmitted and we’d never know.

If information is split up into multiple datagrams, unless those datagrams contain a sequence number, UDP does not ensure that packets are reassembled in the correct order. Learn more about UDP here .

TCP and UDP both send data to specific ports on a network device, which has an IP address. The combination of the IP address and the port number is called a socket.

Learn more about sockets here .

Learn more about the differences and similarities between these two protocols here .

How to Troubleshoot OSI Layer 4 Problems

Here are some Layer 4 problems to watch out for:

• Blocked ports - check your Access Control Lists (ACL) & firewalls
• Quality of Service (QoS) settings. QoS is a feature of routers/switches that can prioritize traffic, and they can really muck things up. Learn more about QoS here .

The Transport Layer provides end-to-end transmission of a message by segmenting a message into multiple data packets; the layer supports connection-oriented and connectionless communication.

OSI Layer 5

Layer 5 is the session layer . This layer establishes, maintains, and terminates sessions.

A session is a mutually agreed upon connection that is established between two network applications. Not two nodes! Nope, we’ve moved on from nodes. They were so Layer 4.

Just kidding, we still have nodes, but Layer 5 doesn’t need to retain the concept of a node because that’s been abstracted out (taken care of) by previous layers.

So a session is a connection that is established between two specific end-user applications. There are two important concepts to consider here:

• Client and server model: the application requesting the information is called the client, and the application that has the requested information is called the server.
• Request and response model: while a session is being established and during a session, there is a constant back-and-forth of requests for information and responses containing that information or “hey, I don’t have what you’re requesting.”

Sessions may be open for a very short amount of time or a long amount of time. They may fail sometimes, too.

Depending on the protocol in question, various failure resolution processes may kick in. Depending on the applications/protocols/hardware in use, sessions may support simplex, half-duplex, or full-duplex modes.

Examples of protocols on Layer 5 include Network Basic Input Output System (NetBIOS) and Remote Procedure Call Protocol (RPC), and many others.

From here on out (layer 5 and up), networks are focused on ways of making connections to end-user applications and displaying data to the user.

How to Troubleshoot OSI Layer 5 Problems

Here are some Layer 5 problems to watch out for:

• Servers are unavailable
• Servers are incorrectly configured, for example Apache or PHP configs
• Session failure - disconnect, timeout, and so on.

The Session Layer initiates, maintains, and terminates connections between two end-user applications. It responds to requests from the presentation layer and issues requests to the transport layer.

OSI Layer 6

Layer 6 is the presentation layer . This layer is responsible for data formatting, such as character encoding and conversions, and data encryption.

The operating system that hosts the end-user application is typically involved in Layer 6 processes. This functionality is not always implemented in a network protocol.

Layer 6 makes sure that end-user applications operating on Layer 7 can successfully consume data and, of course, eventually display it.

There are three data formatting methods to be aware of:

• American Standard Code for Information Interchange (ASCII): this 7-bit encoding technique is the most widely used standard for character encoding. One superset is ISO-8859-1, which provides most of the characters necessary for languages spoken in Western Europe.
• Extended Binary-Coded Decimal Interchange Code (EBDCIC): designed by IBM for mainframe usage. This encoding is incompatible with other character encoding methods.
• Unicode: character encodings can be done with 32-, 16-, or 8-bit characters and attempts to accommodate every known, written alphabet.

Learn more about character encoding methods in this article , and also here .

Encryption: SSL or TLS encryption protocols live on Layer 6. These encryption protocols help ensure that transmitted data is less vulnerable to malicious actors by providing authentication and data encryption for nodes operating on a network. TLS is the successor to SSL.

How to Troubleshoot OSI Layer 6 Problems

Here are some Layer 6 problems to watch out for:

• Non-existent or corrupted drivers
• Incorrect OS user access level

The Presentation Layer formats and encrypts data.

OSI Layer 7

Layer 7 is the application layer .

True to its name, this is the layer that is ultimately responsible for supporting services used by end-user applications. Applications include software programs that are installed on the operating system, like Internet browsers (for example, Firefox) or word processing programs (for example, Microsoft Word).

Applications can perform specialized network functions under the hood and require specialized services that fall under the umbrella of Layer 7.

Electronic mail programs, for example, are specifically created to run over a network and utilize networking functionality, such as email protocols, which fall under Layer 7.

Applications will also control end-user interaction, such as security checks (for example, MFA), identification of two participants, initiation of an exchange of information, and so on.

Protocols that operate on this level include File Transfer Protocol (FTP), Secure Shell (SSH), Simple Mail Transfer Protocol (SMTP), Internet Message Access Protocol (IMAP), Domain Name Service (DNS), and Hypertext Transfer Protocol (HTTP).

While each of these protocols serve different functions and operate differently, on a high level they all facilitate the communication of information. ( Source )

How to Troubleshoot OSI Layer 7 Problems

Here are some Layer 7 problems to watch out for:

• All issues on previous layers
• Incorrectly configured software applications
• User error (... we’ve all been there)

The Application Layer owns the services and functions that end-user applications need to work. It does not include the applications themselves.

Our Layer 1 koala is all grown up.

Learning check - can you apply makeup to a koala?

Don’t have a koala?

Well - answer these questions instead. It’s the next best thing, I promise.

• What is the OSI model?
• What are each of the layers?
• How could I use this information to troubleshoot networking issues?

Congratulations - you’ve taken one step farther to understanding the glorious entity we call the Internet.

Learning Resources

Many, very smart people have written entire books about the OSI model or entire books about specific layers. I encourage readers to check out any O’Reilly-published books about the subject or about network engineering in general.

Here are some resources I used when writing this article:

• The Illustrated Network, 2nd Edition
• Protocol Data Unit (PDU): https://www.geeksforgeeks.org/difference-between-segments-packets-and-frames/
• Troubleshooting Along the OSI Model: https://www.pearsonitcertification.com/articles/article.aspx?p=1730891
• The OSI Model Demystified: https://www.youtube.com/watch?v=HEEnLZV2wGI
• OSI Model for Dummies: https://www.dummies.com/programming/networking/layers-in-the-osi-model-of-a-computer-network/

Chloe Tucker is an artist and computer science enthusiast based in Portland, Oregon. As a former educator, she's continuously searching for the intersection of learning and teaching, or technology and art. Reach out to her on Twitter @_chloetucker and check out her website at chloe.dev .

Read more posts .

If you read this far, thank the author to show them you care. Say Thanks

Learn to code for free. freeCodeCamp's open source curriculum has helped more than 40,000 people get jobs as developers. Get started

How-To Geek

The 7 osi networking layers explained.

The Open Systems Interconnection (OSI) networking model defines a conceptual framework for communications between computer systems.

Quick Links

• Physical Layer
• Data Link Layer
• Network Layer
• Transport Layer
• Session Layer
• Presentation Layer
• Application Layer

The Open Systems Interconnection (OSI) networking model defines a conceptual framework for communications between computer systems. The model is an ISO standard which identifies seven fundamental networking layers, from the physical hardware up to high-level software applications.

Each layer in the model handles a specific networking function. The standard helps administrators to visualize networks, isolate problems, and understand the use cases for new technologies. Many network equipment vendors advertise the OSI layer that their products are designed to slot into.

OSI was adopted as an international standard in 1984. It remains relevant today despite the changes to network implementation that have occurred since first publication. Cloud, edge, and IoT can all be accommodated within the model.

In this article, we'll explain each of the seven OSI layers in turn. We'll start from the lowest level, labelled as Layer 1.

1. Physical Layer

All networking begins with physical equipment. This layer encapsulates the hardware involved in the communications, such as switches and cables. Data is transferred as a stream of binary digits - 0 or 1 - that the hardware prepares from input it's been fed. The physical layer specifies the electrical signals that are used to encode the data over the wire, such as a 5-volt pulse to indicate a binary "1."

Errors in the physical layer tend to result in data not being transferred at all. There could be a break in the connection due to a missing plug or incorrect power supply. Problems can also arise when two components disagree on the physical encoding of data values. In the case of wireless connections, a weak signal can lead to bit loss during transmission.

2. Data Link Layer

The model's second layer concerns communication between two devices that are directly connected to each other in the same network. It's responsible for establishing a link that allows data to be exchanged using an agreed protocol. Many network switches operate at Layer 2.

The data link layer will eventually pass bits to the physical layer. As it sits above the hardware, the data link layer can perform basic error detection and correction in response to physical transfer issues. There are two sub-layers that define these responsibilities: Logical Link Control (LLC) that handles frame synchronization and error detection, and Media Access Control (MAC) which uses MAC addresses to constrain how devices acquire permission to transfer data.

3. Network Layer

The network layer is the first level to support data transfer between two separately maintained networks. It's redundant in situations where all your devices exist on the same network.

Data that comes to the network layer from higher levels is first broken up into packets suitable for transmission. Packets received from the remote network in response are reassembled into usable data.

The network layer is where several important protocols are first encountered. These include IP (for determining the path to a destination), ICMP, routing, and virtual LAN. Together these mechanisms facilitate inter-network communications with a familiar degree of usability. However operations at this level aren't necessarily reliable: messages aren't required to succeed and may not necessarily be retried.

4. Transport Layer

The transport layer provides higher-level abstractions for coordinating data transfers between devices. Transport controllers determine where data will be sent and the rate it should be transferred at.

Layer 4 is where TCP and UDP are implemented, providing the port numbers that allow devices to expose multiple communication channels. Load balancing is often situated at Layer 4 as a result, allowing traffic to be routed between ports on a target device.

Transport mechanisms are expected to guarantee successful communication. Stringent error controls are applied to recover from packet loss and retry failed transfers. Flow control is enforced so the sender doesn't overwhelm the remote device by sending data more quickly than the available bandwidth permits.

5. Session Layer

Layer 5 creates ongoing communication sessions between two devices. Sessions are used to negotiate new connections, agree on their duration, and gracefully close down the connection once the data exchange is complete. This layer ensures that sessions remain open long enough to transfer all the data that's being sent.

Checkpoint control is another responsibility that's held by Layer 5. Sessions can define checkpoints to facilitate progress updates and resumable transmissions. A new checkpoint could be set every few megabytes for a file upload, allowing the sender to continue from a particular point if the transfer gets interrupted.

Many significant protocols operate at Layer 5 including authentication and logon technologies such as LDAP and NetBIOS. These establish semi-permanent communication channels for managing an end user session on a specific device.

6. Presentation Layer

The presentation layer handles preparation of data for the application layer that comes next in the model. After data has made it up from the hardware, through the data link, and across the transport, it's almost ready to be consumed by high-level components. The presentation layer completes the process by performing any formatting tasks that may be required.

Decryption, decoding, and decompression are three common operations found at this level. The presentation layer processes received data into formats that can be eventually utilized by a client application. Similarly, outward-bound data is reformatted into compressed and encrypted structures that are suitable for network transmission.

TLS is one major technology that's part of the presentation layer. Certificate verification and data decryption is handled before requests reach the network client, allowing information to be consumed with confidence that it's authentic.

7. Application Layer

The application layer is the top of the stack. It represents the functionality that's perceived by network end users. Applications in the OSI model provide a convenient end-to-end interface to facilitate complete data transfers, without making you think about hardware, data links, sessions, and compression.

Despite its name, this layer doesn't relate to client-side software such as your web browser or email client. An application in OSI terms is a protocol that caters for the complete communication of complex data through layers 1-6.

HTTP, FTP, DHCP, DNS, and SSH all exist at the application layer. These are high-level mechanisms which permit direct transfers of user data between an origin device and a remote server. You only need minimal knowledge of the workings of the other layers.

The seven OSI layers describe the transfer of data through computer networks. Understanding the functions and responsibilities of each layer can help you identify the source of problems and assess the intended use case for new components.

OSI is an abstract model that doesn't directly map to the specific networking implementations commonly used today. As an example, the TCP/IP protocol works on its own simpler system of four layers: Network Access, Internet, Transport, and Application. These abstract and absorb the equivalent OSI layers: the application layer spans OSI L5 to L7, while L1 and L2 are combined in TCP/IP's concept of Network Access.

OSI remains applicable despite its lack of direct real-world application. It's been around so long that it's widely understood among administrators from all backgrounds. Its relatively high level of abstraction has also ensured it's remained relevant in the face of new networking paradigms, many of which have targeted Layer 3 and above. An awareness of the seven layers and their responsibilities can still help you appreciate the flow of data through a network while uncovering integration opportunities for new components.

What is the OSI Model?

OSI Model Explained

The Open Systems Interconnection (OSI) model is a framework that describes the functions of a networking system. The OSI model categorizes the computing functions of the different network components, outlining the rules and requirement needed to support the interoperability of the software and hardware that make up the network.

In addition to understanding what the OSI model is, note that the OSI model layers are particularly helpful when visualizing the flow of data from the sender to the receiver. The descriptions of the various levels, as well as their interdependency, make it easier to pinpoint networking issues. Also, programmers can use the OSI model to better understand how data gets to and from their applications or to write code specific for use at certain levels. 

In the following sections, you will see the OSI model explained.

What Are the 7 Layers of the OSI Model?

There are seven abstraction layers that make up the OSI model. Communication from one person to another goes from Layer 7 to Layer 1. Each layer performs a specific job before it sends the data on to the next layer.

Layer 7 - Application Layer

The application layer is the closest to the end-user. It initiates communication between the user and the applications they personally interact with. At this layer, data is translated from the syntax it was converted to into something the user can read.

Examples of Layer 7 applications include a web browser like Chrome, Safari, or Firefox, or an email application. Layer 7 can also identify communication partners, check to see which resources are available, and make sure communication is properly synced.

Layer 6 - Presentation Layer

The presentation layer takes care of getting data ready for the application layer. The two devices that are communicating may use different methods of encoding their data. Layer 6 therefore turns the incoming data into something that can be read at the application layer. This includes encrypting and decrypting data.

The presentation layer also compresses data that comes from the application layer before it sends it on to Layer 5, the session layer.

Layer 5 - Session Layer

The session layer handles opening and closing network communications between two interacting devices. The “session” refers to the time between the opening and closing of the interaction. The session layer makes sure the session is open for a long enough period of time for all the necessary data to be sent through. The session layer then closes the session to prevent expending unnecessary resources.

Also, it synchronizes the data transfer. If a large amount of data is being sent, the session layer can set up checkpoints. If the transmission gets interrupted before all the data is downloaded, the checkpoints allow the transmission to be resumed without it starting all over again.

Layer 4 - Transport Layer

The transport layer handles end-to-end communication between the devices interacting with each other. The management of the communication involves taking the data in the session layer and dividing it into pieces referred to as segments. The transport layer on the device receiving the communication handles the reassembly of the segments into data that is consumable by the session layer.

Also, the transport layer takes care of managing the flow and any necessary error messages that need to be sent in the event something goes wrong. To manage data flow, the transport layer makes sure it is not being sent so quickly that the receiver’s device cannot handle it. To control errors, the transport layer checks to see if the data transmitted was done so completely. If it is not, this layer will request a retransmission.

Layer 4 is where Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) port numbers work. Internet Protocol (IP) addresses operate at Layer 3, the network layer. TCP, UDP, and IP are protocols that facilitate how data is sent and received.

Layer 3 - Network Layer

The network layer facilitates the transfer of data when two networks are communicating with each other. If two communicating devices are using the same network, then there is no need for the network layer. The network layer divides the segments that come from the transport layer. These are referred to as packets. The division of the segments into packets happens on the sender’s device, and they are reassembled on the receiving device.

The network layer also functions as an efficiency tool. It figures out the optimal physical path needed to get the data to its destination. This function is called “routing.”

Layer 2 - Data Link Layer

The data link layer is like the network layer, except that the data link layer facilitates data transfer between two devices using the same network. In the data link layer, packets are broken into pieces referred to as frames. Similar to the network layer, the data link layer handles flow and error control. The transport layer is different in that it only manages the flow of data and errors when two networks are communicating with each other.

Within the data link layer, you have two sublayers, the media access control (MAC) and logical link control (LLC) layers. The majority of switches perform their duties at Layer 2. In some cases, switches work at Layer 3 because they are facilitating communication between two networks or virtual local-area networks (VLANs). This has to happen at Layer 3 because, in these situations, the data needs to be routed, which is a Layer 3 task.

Layer 1 - Physical Layer

The physical layer involves the physical equipment that transfers data, like switches and cables. In this layer, the data is converted into strings of 1s and 0s. In the physical layer, the devices have to agree on a method of distinguishing the 1s from the 0s, which enables the digital data to be properly interpreted by each device.

The physical layer includes a variety of components, such as cables, the radio frequency used to transmit data, Wi-Fi, and the other physical structures for transmitting data, such as pins, necessary voltages, and types of ports.

How data flows through different OSI Model Layers

Each of the seven OSI model layers communicates with layers below and above it. For example, the application layer interacts with software applications, while the presentation layer provides encryption and data compression. Likewise, the session layer creates communications between devices. The transport layer breaks data into chunks (called segments) to send them, then the receiving device reassembles the segments before the network layer breaks them into smaller packets to send to other networks. The data link layer facilitates data transfer between devices on the same network, and, finally, the physical layer transfers data in machine language (ones and zeros).

How Fortinet Can Help

Firewalls typically work on the network layer, the transport layer. However, some are also capable of working as high as the application layer, Layer 7.

A firewall performs the task of inspecting network activity, looking for cyber threats by comparing data against an extensive catalog of known threats. They can also detect abnormal activity, which may signal a potential threat. Layers 4 and 7 are optimal locations for intercepting data and inspecting its contents, as is Layer 7 if the activities of an application are of interest.

FortiGate  firewalls performs functions at Layers 3 (network), 4 (transport), and 7 (application. At Layer 3, FortiGate sits between two interconnected networks. As data is transmitted from one network to the other, FortiGate performs in-depth packet inspection, checking whether the connection is being used to send cyber threats.

At Layer 4, FortiGate is positioned between two devices, inspecting each data segment before it reaches the receiving device. In this way, FortiGate prevents one device from being used to infect another. FortiGate also interacts with Layer 7 in that it has the ability to inspect the behavior of an application, including how it uses its data resources. At Layer 7, FortiGate can detect suspicious activity within the application and act accordingly.

FortiGate can identify the source, position, and content of the data, comparing it against a constantly evolving collection of threat signatures. If something suspicious is detected, the data can be discarded before it infects the receiving device.

Frequently Asked Questions about OSI Model

1. what is osi model, 2. why do we use the osi model, 3. what are 7 layers of the osi model.

Get A Cyber Threat Assessment Today

Get Insights into your Network Vulnerabilities with Cyber Security and Threat Assessment.

There are 2-ways to find the state of your network security - wait for a breach to happen or proactively carry out a security threat assessment. Sign up today to get a zero cost assessment done on your security landscape and network utilization.

Related Reads

White papers, case studies, quick links.

Free Product Demo

Explore key features and capabilities, and experience user interfaces.

Resource Center

Download from a wide range of educational material and documents.

Free Trials

Test our products and solutions.

Contact Sales

Have a question? We're here to help.

Presentation layer and Session layer of the OSI model

There are two popular networking models: the OSI layers model and the TCP/IP layers model. The presentation layer and session layer exist only in the OSI layers models. The TCP/IP layers model merges them into the application layer.

The Presentation Layer

The presentation layer is the sixth layer of the OSI Reference model. It defines how data and information is transmitted and presented to the user. It translates data and format code in such a way that it is correctly used by the application layer.

It identifies the syntaxes that different applications use and formats data using those syntaxes. For example, a web browser receives a web page from a web server in the HTML language. HTML language includes many tags and markup that have no meaning for the end user but they have special meaning for the web browser. the web browser uses the presentation layer's logic to read those syntaxes and format data in such a way the web server wants it to be present to the user.

On the sender device, it encapsulates and compresses data before sending it to the network to increase the speed and security of the network. On the receiver device, it de-encapsulates and decompresses data before presenting it to the user.

Examples of the presentation layer

Example standards for representing graphical information: JPEG, GIF, JPEG, and TIFF.

Example standards for representing audio information: WAV, MIDI, MP3.

Example standards for representing video information: WMV, MOV, MP4, MPEG.

Example standards for representing text information: doc, xls, txt, pdf.

Functions of the presentation layer

• It formats and presents data and information.
• It encrypts and compresses data before giving it to the session layer.
• It de-encrypts and decompresses the encrypted and compressed data it receives from the session layer.

Session layer

The session layer is the fifth layer of the OSI layers model. It is responsible for initiating, establishing, managing, and terminating sessions between the local application and the remote applications.

It defines standards for three modes of communication: full duplex, half-duplex, and simplex.

In the full duplex mode, both devices can send and receive data simultaneously. The internet connection is an example of the full duplex mode.

In the half duplex mode, only one device can send data at a time. A telephone conversation is an example of the half-duplex mode.

In the simplex mode, only one device can send data. A radio broadcast is an example of the simplex mode.

Functions of the session layer

• It is responsible for terminating sessions, creating checkpoints, and recovering data when sessions are interrupted.
• It opens and maintains logical communication channels between network applications running on the local host and network applications running on the remote host.
• If a network application uses an authentication mechanism before it opens a logical communication channel (session) with the remote host, it handles the authentication process.

Examples of the session layer

Structure Query Language (SQL), Remote Procedure Call (RPC), and Network File System (NFS) are examples of the session layer.

By ComputerNetworkingNotes Updated on 2023-10-30 05:30:01 IST

ComputerNetworkingNotes CCNA Study Guide Presentation layer and Session layer of the OSI model

We do not accept any kind of Guest Post. Except Guest post submission, for any other query (such as adverting opportunity, product advertisement, feedback, suggestion, error reporting and technical issue) or simply just say to hello mail us [email protected]

• Partner Login
• Find a Partner
• Become a Partner
• Global Partner Program
• Technology Partners
• Find a Distributor
• Support Login
• Professional Services
• Work With Us
• Forcepoint Trust Hub

You are here

What is the OSI Model?

• The OSI Model Defined

The OSI Model (Open Systems Interconnection Model) is a conceptual framework used to describe the functions of a networking system. The OSI model characterizes computing functions into a universal set of rules and requirements in order to support interoperability between different products and software. In the OSI reference model, the communications between a computing system are split into seven different abstraction layers: Physical, Data Link, Network, Transport, Session, Presentation, and Application.

Created at a time when network computing was in its infancy, the OSI was published in 1984 by the International Organization for Standardization (ISO). Though it does not always map directly to specific systems, the OSI Model is still used today as a means to describe Network Architecture.

Protect Your Network Layers with Forcepoint Secure SD-WAN

• The 7 Layers of the OSI Model
• Physical Layer

The lowest layer of the OSI Model is concerned with electrically or optically transmitting raw unstructured data bits across the network from the physical layer of the sending device to the physical layer of the receiving device. It can include specifications such as voltages, pin layout, cabling, and radio frequencies. At the physical layer, one might find “physical” resources such as network hubs, cabling, repeaters, network adapters or modems.

• Data Link Layer

At the data link layer, directly connected nodes are used to perform node-to-node data transfer where data is packaged into frames. The data link layer also corrects errors that may have occurred at the physical layer.

The data link layer encompasses two sub-layers of its own. The first, media access control (MAC), provides flow control and multiplexing for device transmissions over a network. The second, the logical link control (LLC), provides flow and error control over the physical medium as well as identifies line protocols.

• Network Layer

The network layer is responsible for receiving frames from the data link layer, and delivering them to their intended destinations among based on the addresses contained inside the frame. The network layer finds the destination by using logical addresses, such as IP (internet protocol). At this layer, routers are a crucial component used to quite literally route information where it needs to go between networks.

• Transport Layer

The transport layer manages the delivery and error checking of data packets. It regulates the size, sequencing, and ultimately the transfer of data between systems and hosts. One of the most common examples of the transport layer is TCP or the Transmission Control Protocol.

• Session Layer

The session layer controls the conversations between different computers. A session or connection between machines is set up, managed, and termined at layer 5. Session layer services also include authentication and reconnections.

• Presentation Layer

The presentation layer formats or translates data for the application layer based on the syntax or semantics that the application accepts. Because of this, it at times also called the syntax layer. This layer can also handle the encryption and decryption required by the application layer.

• Application Layer

At this layer, both the end user and the application layer interact directly with the software application. This layer sees network services provided to end-user applications such as a web browser or Office 365. The application layer identifies communication partners, resource availability, and synchronizes communication.

eBook Four Steps to Future-Ready Network Security

Datasheet Forcepoint Next Generation Firewall (NGFW) Datasheet

Webcast Securing the Edge in Higher Education: A Fireside Chat with SUNY Plattsburgh

In This Doc:

Cyberratings: forcepoint enterprise firewall, more from cyber edu.

What is a Software Defined Perimeter?

What is a Secure Web Gateway (SWG)?

What is a Next-Generation Secure Web Gateway?

Fundamentals of Communications and Networking, 3rd Edition by Michael G. Solomon, David Kim

Get full access to Fundamentals of Communications and Networking, 3rd Edition and 60K+ other titles, with a free 10-day trial of O'Reilly.

There are also live events, courses curated by job role, and more.

Session, Presentation, and Application Layers

Recall that there are two popular network models in use: the OSI Reference Model and the TCP/IP Reference Model. In this chapter you’ll learn about the top three layers of the OSI model. Those three OSI layers correspond to the Application Layer (top layer) in the TCP/IP model. FIGURE 6-1 shows how the layers in each model (OSI and TCP/IP) relate to one another.

FIGURE 6-1 OSI model compared to the TCP/IP model.

The fact that the TCP/IP model groups these layers together should tell you something. Although each layer has its own responsibilities, they are closely related. The functions you’ll ...

Get Fundamentals of Communications and Networking, 3rd Edition now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.

Don’t leave empty-handed

Get Mark Richards’s Software Architecture Patterns ebook to better understand how to design components—and how they should interact.

It’s yours, free.

Check it out now on O’Reilly

Dive in for free with a 10-day trial of the O’Reilly learning platform—then explore all the other resources our members count on to build skills and solve problems every day.

Session and Presentation layers in the OSI model

Alessandro Maggio

• December 29, 2016

Share This Post

Session and presentation layers in the OSI stack can be considered fancy layers , as they are known only by a small part of Network Engineers. This is probably because all their features blend either in transport-layer protocols or in application-layer protocols. However, with this article, you will discover all the beauty of these two layers, learning what they do and how they are implemented.

UDP limitations

Back in the CCNA course, we found out that the only place we can see the session and presentation layers truly implemented is when they are based on UDP transport. UDP leaves some room to these two layers (if compared to TCP) because it is extremely simple and lacking features . These features can be then implemented in upper layers individually, adding modularity. Just to refresh your mind, UDP has the following two limitations.

UDP, all by itself, do not order packets, and therefore the receiver cannot guess in which order they were sent originally. Moreover, it is not reliable, what is lost is just lost, no UDP component will trigger a re-transmission. Adding these features, however, would increase the complexity of the algorithm behind UDP running on hosts and will add extra fields in the UDP header sent with every segment. All of that, and specifically the extra bytes added in the segment’s header, is called overhead : the extra amount of information that allows application data to be delivered correctly. Our goal is to obtain the delivery of application data as we want it with the least overhead possible .

In the article about advanced TCP , we already explained the ways we can reduce the TCP overhead using selective ACK and header compression, but all of these complex items cannot reduce the TCP header to the size of a UDP header. Instead, with UDP we follow a different approach: we start from almost no features (only delivery to the correct application using port numbers) and we add the features we need in upper layers.

Session layer

The session layer is the one implementing one-to-one application sessions: it defines the re-transmission of data, the segment ordering method, and control the communication in general. All these features are covered by TCP for applications using that transport protocol, but applications that leverage UDP have to implement these features autonomously (within the application) or rely on an extra protocol specifically sitting at the session layer. Many applications (such as TFTP) rely on the first option, while the second alternative is the privileged one for VoIP. For VoIP traffic, the protocol we rely on for the session is the Real-time Transport Protocol (RTP) . As we are talking about applications using UDP as their underlying transport, spending some time on RTP is certainly well-worth since Voice and Video are the king applications among all UDP-based applications .

The RTP header in the picture is inserted just after the UDP header, and add extra features such as the reordering of segments and their timing, which are extremely important for an application that must run real-time. Here’s the explanation of its fields.

• Version – Version of RTP, the up-to-date one is version 2
• P (Padding) – Flag used to indicate whether padding is present or not in the segment
• X (Extension) – Flag used to indicate whether extension header is present or not
• CC (CSRC count) – Number of CSRC identifiers contained in the header
• M (Marker) – Flag that, if set, indicates that this segment has some special relevance for the application
• PT (Payload Type) – Indicates the type of RTP payload (e.g. for VoIP/Video stream)
• Sequence number – Used from the receiver to reorder packets, incremented by one each segment sent
• Timestamp – Time the segment was created, used to allow the receiver to play the content of the segment (assuming that it is audio or video) at the proper interval
• SSCS – Synchronization Source Identifier, identifies a stream of UDP/RTP segments
• CSRC – Contributing Source IDs, indicates the source of the audio stream, multiple CSRCs can be specified if there are multiple sources (e.g. in a three-party conference)
• Header extension – extra header, optional and profile-specific

These fields are the minimum needed to allow the transmission and are specifically designed for real-time streams, audio, and video mainly. Looking at the header, you can still find the Sequence number as in TCP, but no acknowledgment number . This is because RTP allows the receiver to reorder segments , but not to arrange a re-transmission. This behavior is purposefully designed this way, as a VoIP call or a video stream needs to be delivered now. In case something is lost, there is no time to re-transmit it, the show must go on. If we re-transmit it, it would arrive too late so there is no point in the retransmission at all. Another interesting field adding a feature UDP is lacking is the timestamp, with that field you can know when the content was generated and reproduce the sound and video at the same interval it was generated. Otherwise, you would have audio and video streams increasing and decreasing speed according to the network connection available.

A question I’ve been asked several times when talking about reordering packets is “How they arrive in the wrong order in the first place?” and this is surely a good question. The answer has a lot to do with routing , so it lays at the Network Layer in the OSI Stack. Routers work independently from the upper layer protocols and applications, they run based on IP addressing and routes. It might happen that a node fails over the network and traffic takes a different path to avoid falling on the faulty link, or simply a router discovers a better path to a destination. Since all of this happens dynamically, at a given moment the traffic might go over a link and one second later over another. Not all links have the same speed, so it is possible that a segment sent later but over a fast link will arrive before a segment sent previously but on a slow link. Let’s have a look at the following picture.

Edge devices (computers, servers) do not know about the network infrastructure, so they just know that there is the possibility that segments are disordered during the transmission by taking different ways. Because of that, they have to implement mechanisms for reordering . Reordering is crucial to almost any application, to transfer a file we need to know the order of its part, and to transfer audio stream we need to know in which order to play the sounds.

Presentation for Real-Time applications

The presentation layer is probably the most mysterious one. This is because almost no application implements it, neither among the UDP applications. What this layer does, is to define how data should be presented to the application. Once again, coming to rescue us we have VoIP and Video stream, the ones leveraging this layer the most. Basically, when you make a VoIP call there are some parameters involved in the audio stream, such as the bitrate or the compression rate just to name a few. To have the smoothest audio stream possible, all the parties involved must agree on how they are going to exchange audio and video. RTP is the common ground that cannot be changed, here we are talking about how to write the payload of the RTP segment. In other words, we are defining the codec.

Some codecs may privilege the compression, using less bandwidth but more computational resources, others may use a lot of bandwidth but almost no computational resources or other ones require fewer resources sacrificing audio quality. No choice can be right on all occasions, the best codec for any situation depends on your needs.

Session and presentation layers in the shadow

We now know what these two layers are truly about, but let’s take a moment to check out why they are not famous like the other OSI layers. Even previously we had the chance to understand how there is almost no need to implement them, as their features are covered elsewhere, however it is time to give some examples, as in the following picture.

What the picture says is also listed below in a little more detail.

• HTTP (Hyper-Text Transfer Protocol) – Used to transfer web-pages, the session layer is handled by TCP while there is no need for a presentation layer as the information is sent in simple text or raw binary
• FTP (File Transfer Protocol) – Used to transfer files to and from a server, the session layer is handled by TCP while there is no need for a presentation layer as the information is sent in raw binary
• SMTP (Simple Mail Transfer Protocol) – Used to send emails from a server o another, the session layer is handled by TCP while there is no need for a presentation layer as the information is sent in simple text
• SSH (Secure Shell) – Used to connect to a remote device and control it via textual commands using encryption, the session layer is handled by TCP while there is no need for a presentation layer as the information is sent in simple text
• IMAP (Internet Message Access Protocol) – Used to connect to an email server and check emails, the session layer is handled by TCP while there is no need for a presentation layer as the information is sent in simple text
• VoIP (Voice over IP) – This is not a real protocol, but instead a type of application, RTP manages the session layer while the presentation layer exists and is managed at the application layer

This article was really lightweight, as UDP is. With this knowledge, you know all the differences between UDP and TCP and you are ready to discuss the technologies implemented in a network to support modern applications. In the following articles, we will start to see some application layer protocols before we can dive into the configuration items.

Never Stop Learning...

6 amazing generative ai use cases for the real world, 6 amazing large business ideas (+ come up with your own), don't fail the ccna exam, failing the ccna exam equals wasting $300. don't do that, be prepared instead., together with our free course, we offer a companion book with questions and answers. and it's only $27.50 if you are following the course..

Join the Newsletter to Get Ahead

Revolutionary tips to get ahead with technology directly in your inbox..

2016-12-29T16:30:49+00:00

Unspecified

Free CCNA Course

Want Visibility from Tech Professionals?

If you feel like sharing your knowledge, we are open to guest posting - and it's free. find out more now..

Accessibility

Free courses.

  Layer 5 Session Layer

Build and control sessions

The layer 5 (control of logical connections; also session layer) provides inter-process communication between two systems. Here you can find among others the protocol RPC (Remote Procedure Call). To resolve failures of meeting and similar problems, the session layer services for an organized and synchronized data exchange. To this end, recovery points, so-called fixed points (check points) introduced, where the session can be synchronized after a failure of a transport connection again without the transfer must start from the beginning again.

OSI Layer 5 - Session Layer

In the seven-layer OSI model of computer networking, the session layer is layer 5. The session layer provides the mechanism for opening, closing and managing a session between end-user application processes, i.e., a semi-permanent dialogue. Communication sessions consist of requests and responses that occur between applications. Session-layer services are commonly used in application environments that make use of remote procedure calls (RPCs). An example of a session-layer protocol is the OSI protocol suite session-layer protocol, also known as X.225 or ISO 8327. In case of a connection loss this protocol may try to recover the connection. If a connection is not used for a long period, the session-layer protocol may close it and re-open it. It provides for either full duplex or half-duplex operation and provides synchronization points in the stream of exchanged messages. Other examples of session layer implementations include Zone Information Protocol (ZIP) – the AppleTalk protocol that coordinates the name binding process, and Session Control Protocol (SCP) – the DECnet Phase IV session-layer protocol. Within the service layering semantics of the OSI network architecture, the session layer responds to service requests from the presentation layer and issues service requests to the transport layer. Wikipedia

• Authentication
• Authorization
• Session restoration

Popular Session Layer Protocols

Layer 7   application layer, layer 6   presentation layer, layer 5   session layer, layer 4   transport layer, layer 3   network layer, layer 2   data link layer, layer 1   physical layer.

Want to create or adapt books like this? Learn more about how Pressbooks supports open publishing practices.

9 The Application Layer

Chapter objectives.

• Explain the role of client–server architectures at the application layer.
• Analyze an  HTTP header , request , and  response .
• Summarize the security functions of HTTPS protocol.
• Explain the purpose of the SSH protocol.
• Describe the functions and major features of the Domain Name System (DNS) .
• Describe the functions and major features of the Dynamic Host Configuration Protocol (DHCP) .
• Summarize the functions of the FTP , IMAP , LDAP , POP , SMTP , and SNMP protocols.
• Explain the elements of the TLS 1.3 protocol, including the TLS handshake, perfect forward secrecy (PFS) , and the TLS cipher suite .

Introduction

As we learned earlier in this text, in the client-server architecture , a server provides services to clients that exchange information with it.

Client-Server Overview (MDN). https://developer.mozilla.org/en-US/docs/Learn/Server-side/First_steps/Client-Server_overview.

Clients and servers communicate by exchanging two types of messages (as opposed to a stream of data). The messages sent by the client, such as a Web browser, are called requests and the messages sent by the server as an answer are called responses.

Various types of servers and clients are part of this ecosystem. A web server provides information in response to the query sent by its clients. A print server prints documents sent as queries by the client. When queried, an email server forwards email messages to the designated recipient, while a music server delivers the music requested to the client.

Networked applications do not exchange random messages. In order to ensure that the server is able to understand the queries sent by a client, and also that the client is able to understand the responses sent by the server, they must both agree on a set of syntactic and semantic rules. These rules define the format of the messages exchanged as well as their ordering. This set of rules at the application layer make up an application-level protocol.

An application-level protocol is similar to a structured conversation between humans. Assume that Alice wants to know the current time but does not have a watch. If Bob passes close by, the following conversation could take place:

Alice: Hello Bob: Hello Alice: What time is it ? Bob: 11:55 Alice: Thank you Bob: You’re welcome

Request messages are sent by the client to the server to ask for a service or a resource. Response messages are sent by the server to the client to provide the requested service or resource, or to indicate an error or a status. For example, in the HTTP protocol, the client sends a GET request message to the server to ask for a web page, and the server sends a response message with the web page content or an error code. A complete document is reconstructed from the different sub-documents fetched, for instance, text, layout description, images, videos, scripts, and more.

Source: An Overview of HTTP. https://developer.mozilla.org/en-US/docs/Web/HTTP/Overview.

Most applications exchange strings that are composed of fixed or variable numbers of characters. A common solution to define the character strings that are acceptable is to define a grammar using a Backus-Naur Form (BNF) such as the Augmented BNF defined in RFC 5234 . A BNF is a set of production rules that generate all valid character strings, and describes the rules and formats (i.e., the syntax) for exchanging messages between applications on different hosts. BNF can help to ensure that the messages are well-formed and unambiguous, and that they can be parsed and interpreted correctly by the applications. BNF can also help to document and standardize application protocols, making them easier to understand and implement by different parties. BNF is widely used to describe the syntax of many common application protocols. We will cover a few of these in this chapter.

Application Layer Protocols

Some common application layer protocols include HTTP, DNS, DHCP, FTP, SMTP SNMP, IMAP/POP, and FTP. HTTPS, TLS, SSL, and DNSSEC are also related to application layer protocols, enabling encryption and authentication between applications on different hosts.

Hypertext Transfer Protocol (HTTP)

Hypertext Transfer Protocol (HTTP) is a text-based protocol that governs the movement of web traffic and is the foundation of any data exchange on the Web. A typical request has a method and a path, such as GET /index.html , which retrieves the landing page of a website. Responses have a response code, message, and optionally, some data.

Both requests and responses can take advantage of headers, arbitrary lines of text following the initial request or response. Because headers were designed to be open-ended, many new headers have been added over time. A modern web request/response usually has far more information in the headers than just the basics defined in HTTP 1.1.

HTTP messages, as defined in HTTP/1.1 and earlier, are human-readable. In HTTP/2, these messages are embedded into a binary structure, called a frame , allowing optimizations such as the compression of headers and multiplexing. Even if only part of the original HTTP message is sent in this version of HTTP, the semantics of each message is unchanged and the client reconstitutes (virtually) the original HTTP/1.1 request. Therefore, we find it useful to comprehend HTTP/2 messages in the HTTP/1.1 format.

Unencrypted HTTP traffic is sent over port 80 and is vulnerable to attack as all information is sent in cleartext .

When a client wants to communicate with a server, either the final server or an intermediate proxy, it performs the following steps:

• Open a TCP connection : The TCP connection is used to send a request, or several, and receive an answer. The client may open a new connection, reuse an existing connection, or open several TCP connections to the servers.
• Send an HTTP message : HTTP messages (before HTTP/2) are human-readable. With HTTP/2, we cannot read the messages directly, but the principle remains the same. For example: GET / HTTP/1.1 Host : developer.mozilla.org Accept-Language : fr
• Read the response sent by the server. Here is an example. HTTP/1.1 200 OK   Date : Sat, 09 Oct 2010 14:28:02 GMT Server : Apache Last-Modified : Tue, 01 Dec 2009 20:18:22 GMT ETag : "51142bc1-7449-479b075b2891b" Accept-Ranges : bytes Content-Length : 29769 Content-Type : text/html <! DOCTYPE html > … (here come the 29769 bytes of the requested web page)
• Close or reuse the connection for further requests.

Below is the format of an example HTTP request:

Source: An Overview of HTTP (https://developer.mozilla.org/en-US/docs/Web/HTTP/Overview)

Requests consist of the following elements:

• An HTTP method, usually a verb like GET or POST , or a noun like OPTIONS or HEAD. These defines the operation the client wants to perform. Typically, a client wants to fetch a resource (using GET) or post the value of an HTML form (using POST), though more operations may be needed in other cases.
• The path of the resource to fetch, which is the URL of the resource stripped from elements that are obvious from the context, for example, the domain (developer.mozilla.org), or the TCP port (here, 80).
• The version of the HTTP protocol.
• Optional headers that convey additional information for the servers.
• A body, for some methods like POST, similar to those in responses, which contain the resource.

Below is the format of an HTTP response:

An Overview of HTTP (https://developer.mozilla.org/en-US/docs/Web/HTTP/Overview)

Responses consist of the following elements:

• The version of the HTTP protocol they follow.
• A status code , indicating if the request was successful or not, and why.
• A status message, a non-authoritative short description of the status code.
• HTTP headers, similar to those for requests.
• Optionally, a body containing the fetched resource.

Some standard response codes are shown below.

Hypertext Transfer Protocol Secure (HTTPS)

Hypertext Transfer Protocol Secure (HTTPS) solves the problem of unencrypted traffic by wrapping HTTP requests in TLS, which we will cover at the end of this section. HTTPS traffic uses port 443 and is typically signified in a browser with a lock icon in the upper left-hand corner. By clicking on the icon, users can learn more about the certificates being used for communication. Utilizing a robust PKI (public key infrastructure), HTTPS allows for safe HTTP communication between client and server.

The Domain Name System (DNS)

Assuming the DNS server cannot find the name, it will query a root server for a top level domain (TLD) server, which maintains a listing of authoritative nameservers for that particular domain (edu, com, net, org, gov, etc.). Finally once an authoritative nameserver is found, it will respond with the IP address for that particular hostname, which will be cached and sent back through the user’s primary DNS server to the user.

While RFC 819 discussed the possibility of organizing the names as a directed graph, the Internet opted for a tree structure to contain all names. In this tree, the top-level domains are those that are directly attached to the root. The set of top-level domain-names is managed by the Internet Corporation for Assigned Names and Numbers ( ICANN ), which holds ongoing discussions to increase the number of top-level domains.

Each top-level domain is managed by an organization that decides how sub-domain names can be registered. Most top-level domain names use a first-come first served (FCFS) system, and allow anyone to register domain names, but there are some exceptions. For example, .gov is reserved for the United States government, and .int is reserved for international organizations.

Watch an overview for the DNS tree structure by Barry Brown (CC-BY).

The syntax of the domain names has been defined more precisely in  RFC 1035 . This document recommends the following  BNF for a fully qualified domain name (the domain names themselves have a much richer syntax).

This grammar specifies that a host name is an ordered list of labels separated by the dot ( . ) character. Each label can contain letters, numbers and the hyphen character ( – ). Fully qualified domain names are read from left to right. The first label is a hostname or a domain name followed by the hierarchy of domains and ending with the root implicitly at the right. The top-level domain name must be one of the registered TLDs.

The Domain Name System was created at a time when the Internet was mainly used in North America. The initial design assumed that all domain names would be composed of letters and digits RFC 1035 . As Internet usage grew in other parts of the world, it became important to support non-ASCII characters. For this, extensions have been proposed to the Domain Name System  RFC 3490 . In a nutshell, the solution that is used to support Internationalized Domain Names works as follows. First, it is possible to use most of the Unicode characters to encode domain names and hostnames, with a few exceptions (for example, the dot character cannot be part of a name since it is used as a separator). Once a domain name has been encoded as a series of Unicode characters, it is then converted into a string that contains the xn-- prefix and a sequence of ASCII characters. More details on these algorithms can be found in  RFC 3490  and  RFC 3492 .

The possibility of using all Unicode characters to create domain names opened a new form of attack called the homograph attack . This attack occurs when two character strings or domain names are visually similar but do not correspond to the same server. A simple example is  https://G00GLE.COM  and  https://GOOGLE.COM . These two URLs are visually close but they correspond to different names (the first one does not point to a valid server). With other Unicode characters, it is possible to construct domain names that are visually equivalent to existing ones.

DNS Resolution

How do client hosts or applications retrieve the mapping for a given name?

DNS resolution of namespaces is the process of finding the IP address of a host based on its domain name. A domain name is a human-readable name that identifies a host on a network, such as www.example.com. Each nameserver stores part of the distributed database and answers the queries sent by clients. There is at least one nameserver that is responsible for each domain. A sub-domain may contain both host names and sub-domains. A namespace is a collection of domain names that are organized in a hierarchical tree structure, such as the DNS namespace. The DNS namespace consists of different levels of domains, such as top-level domains (TLDs), second-level domains, and subdomains. Each domain has one or more name servers that store information about the hosts in that domain. For example, the name server for the .com TLD stores information about all the second-level domains that end with .com, such as example.com.

To resolve a domain name into an IP address, a client needs to query a DNS server. The DNS server can be either a recursive resolver or an authoritative server. A recursive resolver is a server that acts as an intermediary between the client and the authoritative servers. It follows a chain of referrals from the root nameserver to the TLD server to the authoritative server for the queried domain name, and returns the IP address to the client. An authoritative server is a server that hosts a zone, which is a portion of the DNS namespace. It can answer queries for any name in its zone directly, without contacting other servers.

For example, suppose a client wants to resolve www.yahoo.com into an IP address. The client sends a query to its recursive resolver, which then contacts the root nameserver for the DNS namespace. The root nameserver responds with a referral to the .com TLD server. The recursive resolver then contacts the .com TLD server, which responds with a referral to the example.com authoritative server. The recursive resolver then contacts the example.com authoritative server, which responds with the IP address of www.example.com. The recursive resolver then sends the IP address back to the client, which can then connect to the host.

DNS resolvers have several advantages over letting each Internet host directly query nameservers. Firstly, regular Internet hosts do not need to maintain the up-to-date list of the addresses of the root servers. Secondly, regular Internet hosts do not need to send queries to nameservers all over the Internet. Furthermore, as a DNS resolver serves a large number of hosts, it can cache the received answers. This allows the resolver to quickly return answers for popular DNS queries and reduces the load on all DNS servers [JSBM2002] .

See how DNS resolution works, step by step, in this video by Barry Brown (CC-BY).

Benefits of Names

In addition to being more human friendly, using names instead of addresses inside applications has several important benefits. Let’s consider a popular application that provides information stored on servers. The server provides information upon requests from client processes. A first deployment of this application would be to rely only on addresses. In this case, the server process would be installed on one host and the clients would connect to this server to retrieve information. Such a deployment has several drawbacks :

If the server process moves to another physical server, all clients must be informed about the new server address. If there are many concurrent clients, the load of the server will increase without any possibility of adding another server without changing the server addresses used by the clients.

Using names solves these problems. In addition, if the clients are configured with the name of the server, they will query the name service before contacting the server. The name service will resolve the name into the corresponding address. If a server process needs to move from one physical server to another, it suffices to update the name to address mapping on the name service to allow all clients to connect to the new server. The name service also enables the servers to better sustain the load. Assume a very popular server is accessed by millions of users. This service cannot be provided by a single physical server due to performance limitations. Thanks to the utilization of names, it is possible to scale this service by mapping a given name to a set of addresses. When a client queries the name service with the server’s name, the name service returns one of the addresses in the set. Various strategies can be used to select one particular address inside the set of addresses. A first strategy is to select a random address in the set. A second strategy is to maintain information about the load on the servers and return the address of the less loaded server. Note that the list of server addresses does not need to remain fixed. It is possible to add and remove addresses from the list to cope with load fluctuations . Another strategy is to infer the location of the client from the name request and return the address of the closest server.

Mapping a single name onto a set of addresses allows popular servers to dynamically scale. There are also benefits in mapping multiple names, possibly a large number of them, onto a single address. Consider the case of information servers run by individuals or SMEs. Some of these servers attract only a few clients per day. Using a single physical server for each of these services would be a waste of resources. A better approach is to use a single server for a set of services that are all identified by different names. This enables service providers to support a large number of server processes, identified by different names, onto a single physical server. If one of these server processes becomes very popular, it will be possible to map its name onto a set of addresses to be able to sustain the load. This can be done dynamically if needed.

Names provide a lot of flexibility compared to addresses. For the network, they play a similar role as variables in programming languages. No programmer using a high-level programming language would consider using hardcoded values instead of variables. For the same reasons, all networked applications depend on names and abstract the addresses as much as possible.

The official list of top-level domain names is maintained by  IANA  at  http://data.iana.org/TLD/tlds-alpha-by-domain.txt . Until February 2008, the root DNS servers only had IPv4 addresses. IPv6 addresses were slowly added to the root DNS servers to avoid creating problems as discussed in  http://www.icann.org/en/committees/security/sac018.pdf . As of February 2021, a few DNS root servers are still not reachable using IPv6. The full list is available at http://www.root-servers.org/.

DNS operates mostly via UDP on port 53. This means that although DNS is designed to be resilient and decentralized but unfortunately, the traffic is not authenticated or encrypted . This has made it a target for MitM attacks. Likewise, cache hits and misses can yield information as to what names have been recently resolved (e,g., as with the Sony Rootkit). The recursive nature of DNS has also allowed for DoS attacks in the past, but much of that has been solved by limiting recursive queries to the user-facing DNS servers (i.e., the one given to you by your DHCP request). 

Domain Name System Security Extensions (DNSSEC) is a suite of extension specifications designed to authenticate responses to domain name lookups. This can help prevent MitM attacks by checking the digital signature of the responding server. While this is certainly helpful, it is important to note that DNSSEC does not provide confidentiality. DNS resolutions can still be monitored by anyone who has access to the traffic.

Dynamic Host Configuration (DHCP)

Dynamic Host Configuration Protocol (DHCP) is used to allow new clients on a network obtain an IP address and information about the services provided. IPv4 addresses can be thought of as being in two groups: static addresses and dynamic addresses. Dynamic addresses are distributed by a DHCP server for a particular lease time. When the time is up, the DHCP server may distribute the address to another client. DHCP servers can also give information about proxies, domain name servers (DNSs), gateways, and more.

The DHCP protocol consists of four basic steps:

• Discover : The host sends a broadcast message to the network, called a DHCPDISCOVER, to find a DHCP server that can offer an IP address.
• Offer : The DHCP server responds to the host with a message, called a DHCPOFFER, that contains an IP address and other parameters, such as subnet mask, default gateway, DNS server, etc.
• Request : The host chooses one of the offers and sends a message, called a DHCPREQUEST, to the DHCP server to request the IP address and parameters.
• Acknowledge : The DHCP server confirms the request and sends a message, called a DHCPACK, to the host with the IP address and parameters. The host then configures its network interface with the IP address and parameters.

The DHCP protocol also allows hosts to renew or release their IP addresses, and DHCP servers to inform hosts of changes in configuration.

After the discover message and the offer message , more than one server could reply with an offer message. The offer messages include IP addresses but also other options like default gateways, leased time, expiration time, etc. The client must make a decision as to which address or which information to take, and reply with a request message to the chosen server. Finally, the selected server will say, “Okay. I acknowledge your request. Here is the information. Now we start a lease time, and you are the owner of the address temporarily.” This is a DHCP acknowledgment message. The client will see the acknowledgement and will start operating.

If you place a router in the middle of the conversation, routers will not forward local broadcasts. So you must configure that router so that requests and replies can travel back and forth across that router. If you are going to configure a router as a DHCP server, then the router must support DHCP and perform all of these calls.

The process of relaying a message from a host to a remote DHCP server is shown 

DHCP Address Allocation

Providing an IP address to a client is the most important task performed by a host configuration protocol. Together with that, we receive information for the network segment, default gateway, DNS servers, domain name, TFTP servers (important in the IP telephony) and so on. To provide flexibility for configuring addresses on different types of clients, the DHCP standard includes three different address allocation mechanisms:

• Manual Allocation : Also known as a reservation . A particular IP address is pre-allocated to a single device by an administrator. DHCP only communicates the IP address to the device. The IP address is mapped to the MAC address of the requesting device.
• Automatic Allocation : DHCP automatically assigns an IP address permanently to a device, selecting it from the predefined pool of available addresses.
• Dynamic Allocation : DHCP assigns an IP address from a pool of addresses for a limited period of time chosen by the server, or until the client tells the DHCP server that it no longer needs the address (for example, by executing the command “ipconfig /release” under a Windows OS).

In the case where DHCP dynamically assigns IP addresses to hosts, hosts cannot keep addresses indefinitely, as this would eventually cause the server to exhaust its address pool. At the same time, a host cannot be depended upon to give back its address, since it might have crashed, been unplugged from the network, or been turned off. This is why DHCP allows addresses to be leased for some period of time. Once the lease expires, the server is free to return that address to its pool. A host with a leased address clearly needs to renew the lease periodically if in fact it is still connected to the network and functioning correctly.

DHCP illustrates an important aspect of the scaling of network management. While discussions of scaling often focus on keeping the state in network devices from growing too fast, it is important to pay attention to the growth of network management complexity. By allowing network managers to configure a range of IP addresses per network rather than one IP address per host, DHCP improves the manageability of a network.

Note that DHCP may also introduce some more complexity into network management, since it makes the binding between physical hosts and IP addresses much more dynamic. This may make the network manager’s job more difficult if, for example, it becomes necessary to locate a malfunctioning host.

From a security standpoint, someone impersonating a DHCP server can wreak havoc on a network. These rogue DHCP servers can cause traffic to be redirected to initiate MitM attacks or cause DoS attacks. DHCP relies on broadcast Address Resolution Protocol (ARP) messages and does not make use of authentication, meaning that once an attacker is on the same Ethernet segment as the victim machines, all bets are off.

Remote Desktop Protocol (RDP) is build into Windows and is typically used to control a machine remotely. It works over port 3389 via TCP or UDP. While RDP can be quite useful for performing remote administration on a remote machine, it can also be a large security hole if a bad actor gains access. RDP use in ransomware attacks is on the rise as ransomware programs may use RDP to find other machines to attack.

Telnet is an antiquated remote administration tool that gives access to a shell via a cleartext channel. Telnet runs on port 23 and while still occasionally in use, it should largely be phased out. You will still find telnet in embedded applications and legacy systems. You may also see the client being used to inspect other types of traffic. For example, you can use a telnet client to submit HTTP requests or send email via SMTP.

Lightweight Directory Access Protocol (LDAP) is used for accessing and maintaining directory information services. It’s primary use is with Windows Active Directory (AD), where it can be used to obtain information regarding users and resources from an AD server. Clients can authenticate through the server and obtain privileges to read or read/write certain entries. LDAP did not originally support encryption, until LDAP over SSL (LDAPS) was developed. LDAP uses TCP and UPD over port 389 and LDAPS uses TCP over port 636.

Internet Message Access Protocol (IMAP) and Post Office Protocol 3 (POP3) are two protocols used to retrieve email from a server. IMAP is the more recent protocol, and supports saving mail on the server and folders. POP3 is more primitive, supporting only the retrieval (and subsequent deletion from the server) of emails. Both protocols use cleartext and are now commonly run over TLS. POP3 defaults to TCP port 110 or 995 if using TLS. IMAP defaults to TCP port 143 or 993 if using TLS. In the age of webmail, it is easy to forget about these protocols, but a security specialist must keep them in mind as they may still be used in support of corporate devices.

Simple Mail Transfer Protocol (SMTP) is used for sending/forwarding email. As it states, it is a simple protocol consisting of lines of text. Basic SMTP used TCP on port 25. SMTP was later expanded to support authentication and finally wrapped in TLS still using TCP on port 587. SMTP servers accept outgoing mail from (hopefully) authenticated clients, route mail to other SMTP servers based on the Mail Exchange (MX) information in DNS records, and accept mail for their domain from other SMTP servers. Various checks have been implemented in SMTP servers to ensure that messages from domains actually come from those domains. This is largely used to combat spam, which continues to be a problem.

Network Time Protocol (NTP) uses UDP over port 123 to sync the system time with a time server. NTP servers are layered in stratums, with the lowest stratums being closest to the most accurate sources of time, atomic clocks, GPS, etc. NTP is important as many protocols, including several key exchanges, require system clocks to be in sync. System clocks are also used to check when certificates expire and used in logs to indicate when something happened. Without an accurate, synchronized system clock, many things will fail in surprising ways.

File Transfer Protocol is a relatively simple, text-based protocol for sending files between machines. FTP uses TCP on port 21 and traditionally establishes two channels: one for protocol messages, and one binary channel for data. The interesting thing about this setup is that the FTP server would initiate the connection of the data channel from server to client, meaning that in many NAT situations where the client couldn’t be easily reached behind a firewall, it would fail. The solution to this problem was passive FTP, which uses one channel established by the client.

Despite this initial shortcoming, FTP has proven to be incredibly popular and is still used in many corporate environments. You may see FTP being used to transmit bulk data for import to systems or used to update firmware in embedded systems. You can use FTP with a commandline ftp client, a graphical client such as Filezilla or SecureFX, or even in most web browsers with the  ftp://  URL scheme.

Unfortunately, FTP does not support authentication systems other than passwords and the passwords are sent in plaintext. As such Secure FTP (SFTP) is recommended. SFTP uses an SSH connection to send and receive files over an encrypted channel. SFTP also supports all SSH authentication methods.

Simple Network Management Protocol (SNMP) is used for gathering information about the workings of a network. It is broken into two groups: clients using UDP port 161 (TLS 10161) and a manager using UDP port 162 (TLS 10162). The manager collects messages from the clients regarding the operations of the network and uses this information to take actions as necessary. SNMP can be used to pass information about the temperature of a machine, how many current connections, real-time channel capacity utilization, etc. SNMP is currently up to version 3, which is encrypted and requires authentication. This is particularly important because SNMP is a very powerful protocol that could exchange potentially valuable information to an attacker. Access to SNMP should be limited and its usage on a network should be monitored.

Secure Shell (SSH) is the most widely deployed remote administration tool. SSH provides access to a shell via an encrypted connection. SSH supports many options including SOCKS5 proxies, port forwarding, and the usage of multiple authentication schemes: password, key, hardware device, etc. SSH uses TCP on port 22.

The Transport Layer Security (TLS) family of protocols were initially proposed under the name Secure Socket Layer (SSL). The first deployments used this name and many researchers still refer to this security protocol as SSL [FKC1996] . In this chapter, we use the official name that was standardized by the IETF: TLS for  Transport Layer Security. TLS allows cleartext protocols used on the web to be encrypted. It is a general purpose protocol, designed as a layer through which other protocols communicate. The TLS protocol was designed to be usable by a wide range of applications that use the transport layer to reliably exchange information.

TLS is mainly used over the TCP protocol. TLS is responsible for the encryption and the authentication of the SDUs exchanged by the application layer protocol, while TCP provides the reliable delivery of this encrypted and authenticated bytestream. TLS is used by many different application layer protocols. The most frequent ones are HTTP (HTTP over TLS is called HTTPS), SMTP RFC 3207  or POP and IMAP  RFC 2595 , but proprietary application-layer protocols also use TLS  [AM2019] .   There are also variants of TLS that operate over SCTP RFC 3436  or UDP  RFC 6347 , but these are outside the scope of this chapter. 

TLS 1.3 is the most current version, but not all websites support it. TLS 1.2 is still considered safe if best practices are followed and TLS 1.1 or lower is considered depreciated.

A TLS session can be initiated in two different ways. First, the application can use a dedicated TCP port number for application layer protocol x-over-TLS. This is the solution used by many HTTP servers that reserve port 443 for HTTP over TLS. This solution works, but it requires reserving two ports for each application: one where the application-layer protocol is used directly over TCP and another one where the application-layer protocol is used over TLS. Given the limited number of TCP ports that are available, this is not a scalable solution. The table below provides some of the reserved port numbers for application layer protocols on top of TLS.

A second approach to initiate a TLS session is to use the standard TCP port number for the application layer protocol and define a special message in this protocol to trigger the start of the TLS session. This is the solution used for SMTP with the  STARTTLS  message. This extension to SMTP  RFC 3207  defines the new STARTTLS command. The client can issue this command to indicate to the server that it wants to start a TLS session as shown in the example below captured during a session on port 25.

For the remainder of this chapter, we assume that the TLS session starts immediately after the establishment of the TCP connection. This corresponds to the deployments on web servers. We focus our presentation of TLS on this very popular use case. TLS is a complex protocol that supports other features than the one used by web servers. A more detailed presentation of TLS may be found in [KPS2002]  and  [Ristic2015] .

A TLS session is divided in two phases: the handshake and the data transfer . During the handshake, the client and the server negotiate the security parameters and the keys that will be used to secure the data transfer. During the second phase, all the messages exchanged are encrypted and authenticated with the negotiated algorithms and keys.

The TLS Handshake

TLS uses a handshake process to establish a secure session between the server and the browser. During a session, the server and client exchange messages that contain information such as the supported TLS versions, cipher suites, random numbers, certificates, and keys. The basic process is outlined below.

• The browser starts the handshake by sending a message to the server with its preferences and a random number. This random number is called a nonce , which means it is only used once in this communication. A nonce helps to prevent replay attacks, where an attacker could reuse old messages to impersonate the browser or the server.
• The server replies with its choices and another random number. The server also sends its certificate , which proves its identity and contains its public key .
• The browser checks the validity of the server’s certificate and generates a secret key , which it encrypts with the server’s public key. The browser also sends a message that verifies the integrity of the previous messages. The server decrypts the secret key with its private key , and both parties use it to create more keys for encryption and authentication.
• The browser and the server exchange messages to confirm that they have the same keys, and that they are ready to encrypt their communication. This is called the Finished message.
• The browser and the server can now exchange application data, such as HTTP requests and responses, using symmetric encryption and authentication with the keys they have generated.

The TLS four-way handshake is illustrated in the figure below.

https://en.m.wikipedia.org/wiki/File:Full_TLS_1.2_Handshake.svg

Perfect Forward Secrecy

Perfect Forward Secrecy (PFS) is an important property for key exchange protocols. A protocol provides PFS if its design guarantees that the keys used for former sessions will not be compromised even if the private key of the server is compromised. Recent implementations of TLS  prefer  ECDHE_RSA  or  ECDHE_ECDSA encryption when Perfect Forward Secrecy is required.

Two important messages will be sent by the client and the server to conclude the handshake and start the data transfer phase.

The client sends the  ChangeCipherSpec  message followed by the  Finished  message. The  ChangeCipherSpec message indicates that the client has received all the information required to generate the security keys for this TLS session. This message can also appear later in the session to indicate a change in the encryption algorithms that are used. The Finished  message is more important. It confirms to the server that the TLS handshake has been performed correctly and that no attacker has been able to modify the data sent by the client or the server. This is the first message that is encrypted with the selected security keys. It contains a hash of all the messages that were exchanged during the handshake.

The server also sends a  ChangeCipherSpec  message followed by a  Finished  message.

TLS Cipher Suites

A TLS cipher suite is usually represented as an ASCII string that starts with TLS and contains the acronym of the key exchange algorithm, the encryption scheme with the key size and its mode of operation and the authentication algorithm. For example,  TLS_DHE_RSA_WITH_AES_128_GCM_SHA256  is a TLS cipher suite that uses the  DHE_RSA key exchange algorithm with 128 bits AES in GCM mode for encryption and SHA-256 for authentication. The official list of TLS cipher suites is maintained by IANA. The NULL acronym indicates that no algorithm has been specified. For example,  TLS_ECDH_RSA_WITH_NULL_SHA  is a cipher suite that does not use any encryption but still uses the  ECDH_RSA  key exchange and  SHA  for authentication.

The TLS Record

After the handshake is completed, the client and the server will exchange authenticated and encrypted records. TLS defines different formats for the records depending on the cryptographic algorithms that have been negotiated for the session. A detailed discussion of these different types of records is outside the scope of this introduction. For illustration, we briefly describe one record format.

As other security protocols, TLS uses different keys to encrypt and authenticate records. These keys are derived from the MasterSecret that is either randomly generated by the client after the  RSA  key exchange or derived from the Diffie Hellman parameters after the  DH_RSA  key exchange. The exact algorithm used to derive the keys is defined in  RFC 5246 .

A TLS record is composed of four different fields :

Type : The most frequent type is application data which corresponds to a record containing encrypted data. The other types are handshake, change_cipher_spec and alert. Protocol Version : This version is composed of two sub fields : a major and a minor version number. Length : A TLS record cannot be longer than 16,384 bytes. TLSPlainText : This contains the encrypted data

TLS supports several methods to encrypt records. The selected method depends on the cryptographic algorithms that have been negotiated for the TLS session. A detailed presentation of the different methods that can be used to produce the TLSPlainText from the user data is outside the scope of this text.

Improving TLS

In 2014, the IETF TLS working group began to develop version 1.3 of the TLS protocol. Their main objectives [Rescorla2015] for this new version were as follows.

Simplify the design by removing unused or unsafe protocol features. Improve the security of TLS by leveraging the lessons learned from TLS 1.2 and documented attacks. Improve the privacy of the protocol. Reduce the latency of TLS.

Since 2014, latency has become an important concern for the performance of web services. With TLS 1.2, the download of a web page requires a minimum of four round-trip-times, one to create the underlying TCP connection, one to exchange the ClientHello/ServerHello, one to exchange the keys and then one to send the HTTP GET and retrieve the response. This can be very long when the server is not near the client. TLS 1.3 aimed at reducing this handshake to one round-trip-time and even zero by placing some of the cryptographic handshake in the TCP handshake.

To simplify both the design and the implementations, TLS 1.3 uses only a small number of cipher suites. Five of them are specified in  RFC 8446  and TLS_AES_128_GCM_SHA256 must be supported by all implementations. To ensure privacy, all cipher suites that did not provide Perfect Forward Secrecy have been removed. Compression has also been removed from TLS since several attacks on TLS 1.2 exploited its compression capability  RFC 7457 .

By supporting only cipher suites that provide Perfect Forward Secrecy in TLS 1.3, the IETF aims at protecting the privacy of users against a wide range of attacks. However, this choice has resulted in intense debates in some enterprises. Notably in financial organizations, who have deployed TLS, but wish to be able to decrypt TLS traffic for various security-related activities. These enterprises tried to lobby within the IETF to maintain RSA-based cipher suites that do not provide Perfect Forward Secrecy. Their arguments did not convince the IETF. Eventually, these enterprises moved to ETSI, another standardization body, and convinced the IETF to adopt entreprise TLS , a variant of TLS 1.3 that does not provide Perfect Forward Secrecy  [eTLS2018] .

There are many more differences between TLS 1.2 and TLS 1.3. Additional details may be found in their respective specifications,  RFC 5246  and  RFC 8446 .

The sections above are adapted from Computer Systems Security: Planning for Success  by  Ryan Tolboom  is licensed under a  Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License , except where otherwise noted.

An architecture for computing that enables the separation of functions between front-end data entry and display (client) and back-end request processing (server) in order to bolster the productivity and efficiency of each. This form of distributed computing aims to spread the workload between two devices connected via a network. A smartphone or computer web browser communicating with a Google web server to return results for a query requesting "what is client-server computing" is an example of the client-server architecture in action.

Sulyman, Shakirat. (2014). Client-Server Model. IOSR Journal of Computer Engineering. 16. 57-71.  10.9790/0661-16195771 .

Refers to information that is not  encrypted, and is not expected to be encrypted. An important distinction between cleartext and plaintext is that cleartext is not encrypted at any stage. This is why HTTP traffic sent over port 80 is considered vulnerable.

“What is Cleartext? | Security Encyclopedia.” [Online]. Available:  https://www.hypr.com/security-encyclopedia/cleartext . Accessed: Oct. 10, 2023.

The server’s way of responding to the client. The code response is a three-digit integer. The first integer defines the type of response, and the last two are the role of the response. Examples of first value codes are 1xx informational, 2xx success, 3xx redirection, 4xx client error, and 5xx server error.

“A Complete Guide and List of HTTP Status Codes.” Kinsta®, 24 Feb. 2020,  https://kinsta.com/blog/http-status-codes/ . Accessed 9 Oct. 2023.

Converts domain names into IP addresses, which allow browsers to get to websites and other Internet resources. Every device on the internet has an IP address, which other devices can use to locate the device. Instead of memorizing a long list of IP addresses, people can simply enter the name of the website, and the DNS gets the IP address for them.

“What is domain name system (DNS)?,” Fortinet, https://www.fortinet.com/resources/cyberglossary/what-is-dns . Accessed Oct. 2, 2023.

An attack leveraged by mistyping or mistakenly entering a domain name that looks the same, but is missing a letter or some other mistake. This attacks occurs when an error in the domain name arrives to a different than expected website, that might contain malicious intentions, leveraging a domain name look-a-like. Umawing, Jovi. “Out of Character: Homograph Attacks Explained | Malwarebytes Labs.” Malwarebytes, 6 Oct. 2017, www.malwarebytes.com/blog/news/2017/10/out-of-character-homograph-attacks-explained . Accessed 10 Oct. 2023.

With a load fluctuation, the load refers to the amount of traffic or activity received by a server. Fluctuations in the amount of data flowing into and out of a server can cause service issues. Often, the term load balancing will be used to address load fluctuation issues, which consists of adding additional servers to a domain.

Tadić, Bosiljka. “Cyclical Trends of Network Load Fluctuations in Traffic Jamming.” Dynamics, vol. 2, no. 4, Dec. 2022, pp. 449–61.  DOI.org  (Crossref),  https://doi.org/10.3390/dynamics2040026 .

A protocol on the application level that allows for the modification and access to emails on a server. IMAP allows for access to the email without download, keeping the email on the server, and preventing potentially compromising downloads.

Glossary — Computer Networking : Principles, Protocols and Practice.  https://beta.computer-networking.info/syllabus/default/glossary.html . Accessed 10 Oct. 2023

A group of protocols that provide authentication and encryption for communication between a client and web server. TLS is commonly implemented on the server side to conduct the authentication. Most ecommerce websites use TLS to help protect financial or transactional information that is sent between the client and server.

Regenscheid, Andrew, and Geoff Beier. Security Best Practices for the Electronic Transmission of Election Materials for UOCAVA Voters. NIST Internal or Interagency Report (NISTIR) 7711, National Institute of Standards and Technology, 15 Sept. 2011.  csrc.nist.gov ,  https://doi.org/10.6028/NIST.IR.7711 . Accessed 16 Oct 2023.

Telecommunications and Networking Copyright © by Rita Mitra; Glenn Brown; Melanie Huffman; and Hongyi Zhu is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License , except where otherwise noted.

Share This Book

• Engineering Mathematics
• Discrete Mathematics
• Operating System
• Computer Networks
• Digital Logic and Design
• C Programming
• Data Structures
• Theory of Computation
• Compiler Design
• Computer Org and Architecture
• IPsec (Internet Protocol Security) Tunnel and Transport Modes
• Cryptography in Wireless Sensor Networks
• Differentiated Services (DiffServ) and Traffic Classification
• Microwaves in Computer Networks
• BGP (Border Gateway Protocol) Advanced Features and Route Reflectors
• DNS Load Balancing: Round Robin, Global Server Load Balancing
• Network Troubleshooting Techniques: Ping, Traceroute, PathPing
• Shortest Path Algorithm in Computer Network
• Minimum Hamming Distance
• Advanced NAT Techniques: Port Address Translation (PAT)
• Functions of Physical layer in OSI Model
• WebSockets Protocol and Long Polling
• Token Bucket Algorithm
• Chosen Ciphertext Attacks on RSA
• SMTP Extensions: STARTTLS, and DANE
• What is Multicast Source Discovery Protocol?
• What is Network Port?
• What is Smart DNS?
• What are Gateways in Computer Network?

Functions of Session Layer

The Session layer is the fifth layer of the OSI (Open System Interconnection) model. The session layer is responsible for maintaining, establishing, synchronizing, and terminating sessions between them. A connection is being established among the session entities by the session layer. The data received from the presentation layer is handled by the session layer. Various protocols such as PPTP , PAP , RTCP , ADSP, and SDP are used by the session layer. The below article covers the functions of the session layer in detail.

The session layer is responsible for various tasks that are mentioned below:

1. Session Establishment

The basic and most important function of the session layer is to establish a connection between the communicating parties known as sessions. This connection helps to transfer the data such as files, remote login, and communication over these sessions in a more ordered and reliable way. The session layer can establish connection-oriented as well as connectionless sessions. Whenever any session is released, the transport connection is also released. Sessions can be mapped onto transport connections in three ways. They are:

• One-to-one mapping: In one-to-one mapping, one transport connection is being used by one session.
• Many-to-one mapping: In many-to-one mapping, the same transport connection is being used by the consecutive sessions.
• One-to-many mapping: In one-to-many mapping, multiple transport connections are used by one session.

2. Communication Synchronization

The session layer provides proper connectivity among the systems, during this if any occurs, a recovery option known as the state is provided. For using the known state session layer adds synchronization bits in every state of the error and these bits are then used as checkpoints. For longer and complex communications the checkpoints are added to the data stream. It makes sure that data streams are received successfully and acknowledged up to the checkpoints. If any failure occurs then only the stream is retransmitted after the checkpoints. The functionality is being provided by the session layer because transport layer can mask only the communication errors, not the upper layer errors.

3. Activity Management

The session layer provides with the feature for users to differentiate among the activities that are performed during the session. The message stream can split into logical units and these logical units are known as an activities. Activity management is defined as a process of splitting of message stream into activities.

4. Dialog Management

Dialog management is defined as a process of keeping log data for the connections established for transmitting and receiving data. It is required for establishing, synchronization, preserving and ending of the conversation between the communicating parties namely sender and the receiver. For this a mechanism known as token mechanism is being used in which a user that is sharing the data is given a token if it is in half duplex mode and after the exchange it is transferred to the the another device. If the operation is in full duplex mode then no token is used for transmission of data. The efficiency of the connection is maintained if token mechanism is used.

5. Data Transfer

Data transfer is also one of the basic and important function of session layer. Session layer handles the exchange of data between the communicating systems. This exchange of data between the users can be in two modes of transmission. They are:

• Half-duplex mode: In half duplex mode of transmission of data only one user has right for initiating the data transfer.
• Full- duplex mode: In full duplex mode of transmission data can be transmitted in both the directions simultaneously.

6. Resynchronization

Resynchronisation is also known as backward synchronization. Resynchronisation is defined as a process in which the state of dialog is being restored to its previously defined state. After the resynchronization all the tokens are restored to the positions that were set during synchronization. There are various options of resynchronisation. They are:

• Set: Set option is being used for setting the synchronization point serial number to any value that is being chosen by the user.
• Abandon: Abandon option is being used for setting the synchronization point serial number to an unused value.
• Restart: Restart option is being used for setting the synchronization point serial number o any of the used value that is grater than the synchronization point serial number which identifies the last acknowledged major synchronization point.

Frequently Asked Questions

Q.1: which layer lies above the session layer of osi model.

Presentation layer lies above the session layer of OSI model. Presentation layer prepares the data for its upper layer. It states about how the devices should encode, encrypt and compress the data.

Q.2: Which layers of OSI model are known as software layers or upper layers?

The session layer, presentation layer and application layer are known as the software or upper layers of OSI model.

Q.3: What is meant by session termination?

Session termination is defined as a process of ending the session communication. This process of session termination is important because it releases the resources and makes sure that both the communicating devices know that session has been ended.

Q.4: Can applications interact directly with session layer?

No, applications cannot directly interact with the session layer. They interacts with other higher layers namely presentation layer and application layer.

Please Login to comment...

Similar reads.

• Geeks Premier League 2023
• Geeks Premier League
• 5 Reasons to Start Using Claude 3 Instead of ChatGPT
• 6 Ways to Identify Who an Unknown Caller
• 10 Best Lavender AI Alternatives and Competitors 2024
• The 7 Best AI Tools for Programmers to Streamline Development in 2024
• 30 OOPs Interview Questions and Answers (2024)

Improve your Coding Skills with Practice

What kind of Experience do you want to share?

Snapsolve any problem by taking a picture. Try it in the Numerade app?