OSI and TCP/IP models

A layer model answers one question about a protocol or a box: which headers can it read, and so what can it decide? OSI is ISO’s seven-layer reference model (ISO/IEC 7498-1); the Internet runs the TCP/IP suite, which RFC 1122 (1989) describes in four layers. The OSI protocols lost, but the numbering survived as vocabulary, so engineers say “L4” for TCP and “L7” for HTTP on a stack that has no layer 5 or 6.

Treat OSI as a teaching tool. Real systems cross layers constantly: TLS sits between TCP and HTTP, QUIC fuses transport and encryption, NAT rewrites L4 ports inside an L3 box, and an L7 load balancer terminates TCP. RFC 3439 (2002) titled a section “Layering Considered Harmful”. For one request traced through every layer, see What happens when you enter a URL.

Layers, jobs and units

Each layer wraps what the layer above hands it in a header of its own, and the wrapped unit - the protocol data unit (PDU) - has a name interviewers use:

Textbooks often teach a five-layer hybrid that splits Physical out of Link. Layers 2, 3, 4 and 7 mean the same in every version, and they are the only numbers anyone uses in conversation.

Three mechanisms behind the table

• Each header names the next parser. EtherType in the Ethernet header says what the payload is (0x0800 IPv4, 0x86DD IPv6, 0x0806 ARP), the IP protocol field does the same one layer up (6 TCP, 17 UDP, 1 ICMP), and the port picks the socket. Receiving is that chain of lookups.
• Addresses have a scope. A MAC address is valid on one link and every router rewrites it; an IP address is end to end and changes only at a NAT; a port means something only inside one host. A packet that crosses ten routers travels in ten different frames.
• The layers run in different places. L1-L2 in the NIC and its driver, L3-L4 in the kernel, everything above in your process - TLS included, since Python’s ssl module is OpenSSL running in-process. QUIC moves the transport itself into user space.

Encapsulation, in bytes

Going down the stack each layer prepends its header; going up each strips its own and passes the rest along:

HTTP  GET /users HTTP/1.1 ...                  message
        │ TLS: +5 header, +1 type byte, +16 tag
TLS   [5][ ciphertext of message + 1 ][16]     record
        │ TCP: +20 to 60, slices the byte stream
TCP   [20-60][ bytes of one or more records ]  segment
        │ IP: +20 (IPv4) or +40 (IPv6)
IP    [20][ segment ]                          packet
        │ Ethernet: +14 header, +4 checksum
Eth   [14][ packet, at most the MTU ][4]       frame

Records and segments do not line up. A TLS record holds up to 16 KB, so it spans about a dozen segments, and one segment can carry the tail of one record and the head of the next: TCP moves bytes, not messages.

Header sizes

MTU, MSS and what is left

MTU (maximum transmission unit) is the largest IP packet a link carries: 1500 bytes on Ethernet, counting the IP header but not Ethernet’s 14 + 4. MSS (maximum segment size) is the largest TCP payload a host accepts, announced once, in its SYN. RFC 6691 sets the arithmetic: announce the MTU minus the fixed IP and TCP headers, then subtract each segment’s options.

   14    20     20    12        1448        4
┌─────┬──────┬──────┬────┬───────────────┬─────┐
│ Eth │  IP  │ TCP  │ TS │  TCP payload  │ FCS │
└─────┴──────┴──────┴────┴───────────────┴─────┘
      │◀─────────── MTU 1500 ───────────▶│
                    │◀──── MSS 1460 ────▶│

So IPv4 announces 1460 and, once both sides use the 12-byte timestamp option (TS), carries 1448 per segment; IPv6 announces 1440 and carries 1428. On the wire each frame also costs 38 bytes of preamble, header, FCS and gap, so efficiency is payload / (MTU + 38):

The WireGuard row is IPv4 with timestamps inside an 80-byte IPv6 outer header. 1448 / 1538 = 94.1% is the ~941 Mbit/s iperf3 shows on a clean gigabit link, not a slow NIC.

TLS barely registers: 22 bytes per 16 KB record is 0.13%. The costs that matter are per packet, which is why jumbo frames help, tunnels hurt, and QUIC, which seals every packet with its own 16-byte tag, pays per packet what TLS over TCP pays per record.

What your Python process sees

The kernel strips L2 to L4 and OpenSSL, inside the interpreter, strips TLS. What survives of the lower layers is metadata you have to ask for:

import socket
import ssl

HOST = "example.com"
raw = socket.create_connection((HOST, 443))
print("L3/L4", raw.getpeername())  # peer IP and port: all that is left of L2-L4
print("MSS  ", raw.getsockopt(socket.IPPROTO_TCP, socket.TCP_MAXSEG))

ctx = ssl.create_default_context()
ctx.set_alpn_protocols(["http/1.1"])
tls = ctx.wrap_socket(raw, server_hostname=HOST)  # SNI + ALPN go in the ClientHello
print("TLS  ", tls.version(), tls.cipher()[0], tls.selected_alpn_protocol())

tls.sendall(b"GET / HTTP/1.1\r\nHost: example.com\r\nConnection: close\r\n\r\n")
print("L7   ", tls.recv(17))  # plaintext: OpenSSL, in this process, removed TLS

L3/L4 ('172.66.147.243', 443)
MSS   1400
TLS   TLSv1.3 TLS_AES_256_GCM_SHA384 http/1.1
L7    b'HTTP/1.1 200 OK\r\n'

This side announced 1460 (1500-byte Ethernet), and a connection uses the smaller offer, so 1400 was the server’s. A value under 1460 means the server reserves room for extra headers - a tunnel, an encapsulating load balancer - instead of betting on path MTU discovery. Never hard-code 1460.

When large responses hang: path MTU discovery

TCP sends full-size segments with the IP DF (don’t fragment) bit set. When a link on the path has a smaller MTU - a VPN, a tunnel, an overlay - the router in front of it drops the packet and returns ICMP “fragmentation needed” (type 3 code 4; ICMPv6 type 2, Packet Too Big) carrying the smaller MTU. The sender caches it and resends in smaller segments. That is path MTU discovery (RFC 1191; RFC 8201 for IPv6, whose routers never fragment).

The black hole

It works only if the ICMP message gets back. Drop it - a NACL with no ICMP rule, a firewall told to “block ping” - and every full-size packet vanishes silently while the sender retransmits the same oversized segment. The signature: the TCP handshake and small responses work, large responses stall after the first bytes. Two commands prove it from the client side:

ping -M do -s 1472 api.example.com   # DF set; 1472 + 8 ICMP + 20 IP = 1500
ping -M do -s 1372 api.example.com   # 1400 on the wire
tracepath -n api.example.com         # reports the pmtu per hop

If the 1500-byte probe vanishes without an error while the 1400-byte one is answered, something drops by size and says nothing; tracepath may even be fooled into reporting 1500. On macOS the probe is ping -D -s 1472; on Windows, ping -f -l 1472.

Fixes, in the order to try them

1. Clamp the MSS where the tunnel starts, so every forwarded SYN asks for segments that fit: iptables -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu. TCP only.
2. Let the ICMP through: IPv4 type 3 code 4 and ICMPv6 type 2. Never deny all ICMPv6; IPv6 runs neighbour discovery over it.
3. Give the tunnel the right MTU. WireGuard’s default 1420 is 1500 minus 80 (IPv6 40, UDP 8, WireGuard 32); AWS Site-to-Site VPN carries at most MTU 1446 / MSS 1406.
4. Let hosts probe. net.ipv4.tcp_mtu_probing=1 (RFC 4821) shrinks segments after a black-hole timeout without any ICMP. Off by default.

Two cloud twists. Inside one AWS VPC instances use 9001-byte jumbo frames, while traffic through an internet gateway or a VPN is capped at 1500 - so two jumbo hosts across a VPN hit exactly this (VPN). And an ECMP router or L4 balancer hashes a flow’s 5-tuple to pick a server, but the ICMP error has no ports of its own and can land on a server that never saw the connection; Cloudflare’s fix was to broadcast it to every server.

Protocols that do not fit

OSI files encryption under L6, so TLS gets called “L6”; TCP/IP has no slot and calls it application. It talks to both neighbours: SNI names the host and ALPN picks the L7 protocol (h2, http/1.1) during the handshake, before any HTTP byte exists (TLS, HTTPS, Certificates).

Is QUIC layer 4 or layer 7?

Both answers are defensible, which is the point of the question. By function QUIC is a transport: streams, ordering, loss recovery, congestion control (RFC 9000). By position it is application code, a user-space library sending UDP datagrams. And it absorbs TLS 1.3: the handshake rides in QUIC’s own CRYPTO frames, with no TLS record layer (RFC 9001).

The keys then hide what TCP keeps in its header - ACKs, windows, stream offsets travel encrypted, and the packet number is masked. HTTP/3 is HTTP over QUIC (HTTP versions: 1.1, 2 and 3). What an on-path box loses:

With nobody on the path able to clamp it, QUIC sizes its own packets: it needs a path that carries 1200-byte UDP payloads and probes for more. A client moving from Wi-Fi to cellular keeps its connection ID but changes its 5-tuple, breaking L4 balancers that hash addresses; the QUIC-LB draft, not an RFC as of 2026-10, puts a server ID in the connection ID for that reason. Where UDP 443 is blocked, browsers fall back to HTTP/2 over TCP.

Where the boxes sit

Two rows break the picture. NAT is filed under L3, but the common kind rewrites ports, and even address-only NAT must fix the TCP checksum, which covers the IP addresses through a pseudo-header (NAT (Network Address Translation)). An L7 balancer is two TCP endpoints glued by an HTTP parser: two connections, two MSS negotiations, two sets of timeouts (HTTPS Handshake, mTLS, Keepalive, and the Reverse-Proxy Edge).

L4 vs L7, the question behind the question

“Is it L4 or L7?” asks what the box can see, and so what it can do:

The gRPC row is the trap: every call shares one long-lived HTTP/2 connection, an L4 balancer places that connection once, and one backend takes all of the client’s calls, even after you scale out. Use an HTTP/2-aware L7 balancer or client-side balancing (gRPC's HTTP/2 Basis). L4 suits databases, raw TCP and TLS passthrough.

An L4 proxy can still peek one layer up. The hostname crosses in cleartext in the ClientHello, so nginx ssl_preread, HAProxy req.ssl_sni and Envoy’s TLS inspector route by SNI while relaying encrypted bytes. Encrypted Client Hello (RFC 9849) hides the real name from boxes without the ECH keys.

What the backend loses behind an L7 balancer

Ending TCP and TLS costs the backend the client IP (its TCP peer is the balancer) and the scheme (the request arrives as plain HTTP). An L7 hop restores them as X-Forwarded-For and X-Forwarded-Proto, or Forwarded (RFC 7239).

An L4 hop cannot add headers to a stream it does not parse, so it prepends a PROXY protocol line before the client’s first byte: PROXY TCP4 203.0.113.7 10.0.1.20 51234 443\r\n (AWS NLB sends version 2, the same data in binary).

Those headers are text the client can also write, and each trusted proxy appends the address it saw: read X-Forwarded-For from the right, skipping exactly your trusted hops. Behind one ALB, 6.6.6.6, 203.0.113.7 means the client is 203.0.113.7, and 6.6.6.6 is whatever the client sent. The count holds only if nothing reaches the backend except through those hops.

Uvicorn trusts the headers only from --forwarded-allow-ips (default 127.0.0.1 and ::1); * on a backend reachable another way hands the client IP to the client. More in Proxies: Forward vs Reverse.

Debugging by layer

Bisect rather than walk the stack: if nc -vz connects, L1 to L4 work and the fault is TLS or above. Refused means a RST came back, so the host is reachable and nothing listens (or a firewall rejects); timed out means silence, so something dropped the SYN. Full toolbox: Network Troubleshooting Tools.

Related

• TCP vs UDP - the transport layer: handshake, states, framing.
• VPN - tunnels, and the MTU they cost.
• Load Balancers - algorithms, health checks, ALB vs NLB.
• Network Troubleshooting Tools - the commands in the table above.
• gRPC's HTTP/2 Basis - why gRPC needs L7 or client-side balancing.
• What happens when you enter a URL - every layer in one request.