The OSI Model — Troubleshooting Layer by Layer
"The site is down" can mean a cut cable, a wrong IP address, a closed port, an expired certificate or a crashed app. Guessing wastes hours. The OSI model gives you an order to check things in, so each test rules out a whole layer.
The rule
Troubleshoot bottom-up: link, then IP, then port, then application.
The OSI model splits networking into seven layers, each relying on the one below:
| # | Layer | What lives there | Example |
|---|---|---|---|
| 7 | Application | what the program says | HTTP, DNS, SSH |
| 6 | Presentation | encoding, encryption | TLS is often placed here |
| 5 | Session | keeping a conversation going | |
| 4 | Transport | ports, reliable or fast delivery | TCP, UDP |
| 3 | Network | addresses and routing between networks | IP, routers |
| 2 | Data link | delivery on the local network | Ethernet, MAC addresses, switches |
| 1 | Physical | signals on a wire or radio | cables, Wi-Fi |
In daily work, layers 5 to 7 blur into "the application", and people say "layer 4 load balancer" (routes by IP and port) or "layer 7 load balancer" (reads HTTP paths and headers).
Each layer has a quick test tool:
ip addr # L2/L3: does this machine have an address?
ping -c 3 203.0.113.10 # L3: can packets reach that IP?
traceroute 203.0.113.10 # L3: where along the route do they stop?
nc -zv notes.example.com 443 # L4: is the TCP port open?
curl -v https://notes.example.com/health # L7: does the app answer?The shortcut
Climb the stack and stop at the first failure. If a lower layer fails, nothing above it can work, so there is no point debugging HTTP when ping gets nothing back. Once a layer passes, never go back below it.
Layer 3
pingto the server's IP gets replies. Addressing and routing work.
One caution: some networks block ping (ICMP) on purpose. A failed ping is a clue, not proof; a successful TCP connection at layer 4 proves layer 3 works too.
Drills
Answer fast — trust the rule.
At which OSI layer does TCP operate?
A router forwards packets between networks using IP addresses. Which layer is that?
ping to the server works, but nc -zv server 443 fails. Where is the problem most likely?
A load balancer sends /api requests to one pool and /images to another. What kind is it?
Remember
- Troubleshoot bottom-up: link, then IP, then port, then application.
- Shortcut: climb the stack with one tool per layer and stop at the first failure.
- Trap: a blocked ping is not proof the server is down.