OSI-model

What is the OSI model?

The OSI model (Open Systems Interconnection) is an international reference model that divides network communication into seven layers, from the physical transmission of bits up to the services applications use, so that each layer has its own task and protocols from different vendors can fit together. The model is defined in ISO/IEC 7498-1 and the identical ITU-T Recommendation X.200. It is not a protocol you can install but a way of thinking: it gives you a shared language to place Ethernet, IP, TCP, Modbus TCP or PROFINET, to design networks and to track down faults systematically.

The OSI model helps you understand, structure and troubleshoot network protocols, devices and processes layer by layer.

🕰️ How did the OSI model come about?

In the 1970s every computer vendor had its own network architecture, such as IBM SNA and DECnet, so systems from different brands could barely talk to each other. ISO started a networking standards programme in 1977. The seven-layer idea grew out of Charles Bachman’s work at Honeywell, and the French engineer Hubert Zimmermann wrote the first rough definition in 1978.

The OSI protocols themselves lost out to the simpler TCP/IP stack, which grew with the internet. The reference model survived as a universal frame of reference. Some genuine OSI protocols are even still in use in OT: Siemens S7 Comm and MMS from IEC 61850 run over TPKT (RFC 1006) and COTP (ISO 8073) on TCP port 102, a bridge between OSI transport and TCP/IP.

🧱 What are the seven layers of the OSI model?

Each layer offers services to the layer above and uses the services of the layer below. The unit of data at each layer is called the PDU (Protocol Data Unit).

IEEE 802 splits the data link layer into two sublayers: LLC (Logical Link Control) and MAC (Medium Access Control). Wi-Fi under IEEE 802.11 therefore covers both layer 1 and the MAC part of layer 2. TLS is often shown at layer 6 in overviews, but in reality it sits between transport and application. Borderline cases like these show that the model is a tool, not a law.

🔧 How does encapsulation work in the OSI model?

When sending, each layer adds its own header to the data from the layer above (encapsulation); on receipt, each layer strips its header off again. A SCADA server reading a register from a PLC over Modbus TCP shows this clearly:

1. Layer 7 - the Modbus application builds a request: function code 03 (read holding registers), start address and count.
2. Layer 4 - TCP adds source and destination ports (destination 502) and handles sequence numbers and acknowledgements.
3. Layer 3 - IP adds the source and destination IP address; a router uses this to route between subnets.
4. Layer 2 - Ethernet wraps the packet in a frame with MAC addresses, EtherType 0x0800 (IPv4) and a CRC check; a switch forwards the frame based on the MAC address.
5. Layer 1 - the network interface turns the frame into signals on copper or fibre.

How this works physically and at frame level is covered in How Ethernet Works.

🔄 What is the difference between the OSI model and TCP/IP?

The TCP/IP model (defined in RFC 1122 and RFC 1123) is the model behind the internet and almost every modern industrial network. It has four layers and is less prescriptive.

In practice engineers use the OSI numbering (“a layer 2 switch”, “a layer 7 firewall”) and the TCP/IP protocols.

🏭 Where do industrial protocols sit in the OSI model?

Industrial protocols do not always follow the model in full. Fieldbuses such as Profibus and Foundation Fieldbus use a reduced model with only layers 1, 2 and 7, because routing and sessions are unnecessary on a single bus and every extra layer costs time. Real-time Ethernet protocols skip IP and TCP for the same reason and sit directly on layer 2.

The distinction between layer 2 and layer 3 is therefore not academic in OT. A layer 2 protocol such as PROFINET RT or GOOSE cannot pass a router and stays within one broadcast domain or VLAN. That limits how far it spreads, but it also means an ordinary layer 3 firewall never sees this traffic.

🔐 How do you use the OSI model for OT security?

For OT security the OSI model is a practical tool. In network segmentation and the zones and conduits model of IEC 62443, the model helps you decide which measure works at which layer:

• Layer 1 - physical access to cabinets and closing unused ports; a data diode enforces one-way traffic even physically
• Layer 2 - VLANs, port security and Dynamic ARP Inspection against ARP spoofing on a managed switch
• Layer 3 - routing between zones with access control lists, subnetting and possibly NAT
• Layer 4 - a firewall that only permits the ports you need, for example 502 from one SCADA server to one PLC
• Layer 7 - deep packet inspection and protocol filtering in an industrial firewall or next-gen firewall, which can, for example, allow Modbus read requests but block write requests

A common confusion is between the OSI model and the Purdue Model. Both have numbered layers, but the OSI model describes how a single connection works technically, whereas the Purdue Model describes the functional levels of a plant, from sensors (level 0) to ERP (level 4). A firewall between Purdue levels 2 and 3 can filter at OSI layer 3, 4 or 7; those are two independent choices. Segmentation as a principle uses both models.

🛠️ How do you troubleshoot layer by layer?

The bottom-up approach stops you from spending hours checking application settings when a cable is faulty. You investigate a PLC that has stopped responding like this:

1. Layer 1 - is the link LED on, is the cable intact, is the termination resistor correct on an RS-485 bus? If in doubt, check speed and duplex (PROFINET, for example, requires 100 Mbit/s full duplex).
2. Layer 2 - is the CRC error counter on the switch port rising, is the MAC address in the MAC table and in the right VLAN?
3. Layer 3 - is the IP address unique and in the right subnet? A ping (ICMP) confirms reachability, provided ICMP has not been blocked deliberately.
4. Layer 4 - is the port (502, 4840, 102) reachable, or is a firewall blocking the connection?
5. Layer 7 - are the unit ID, register addresses, certificates or namespace correct?

With Wireshark you see every layer of a single frame at once, which speeds up this analysis considerably. In a production network, prefer passive capture through a mirror port.

❓ Frequently asked questions

Why does the OSI model have seven layers?

The OSI model has seven layers because its designers wanted to give each distinct function, such as bit transmission, addressing, routing and session management, its own layer with clear boundaries. That way one layer can be replaced, for example copper by fibre, without the layers above having to change.

Is the OSI model still used?

The OSI model is still used every day as a reference framework and shared vocabulary, but hardly at all as a protocol stack. Networks run on TCP/IP, while engineers use OSI terms such as layer 2 switch and layer 7 firewall. It is also core material in networking courses such as CCNA. In OT a few OSI protocols live on, such as COTP beneath S7 Comm and MMS in IEC 61850.

At which layer does a switch work, and at which a router?

A classic switch works at layer 2 of the OSI model and forwards frames based on MAC addresses. A router works at layer 3 and forwards packets based on IP addresses. A layer 3 switch combines both functions in one device.

Which OSI layer is Modbus on?

Modbus is an application protocol at layer 7 of the OSI model. Modbus RTU uses a serial physical layer such as RS-485 underneath, while Modbus TCP runs over TCP/IP on port 502.

Is the Purdue Model the same as the OSI model?

The Purdue Model is not the same as the OSI model, even though both have numbered layers. The OSI model describes how network communication works technically, whereas the Purdue Model classifies industrial functions from field devices up to business systems. In OT security you use both models side by side.

Why does layer 2 matter for OT security?

Layer 2 matters for OT security because many real-time protocols, such as PROFINET RT, EtherCAT and GOOSE, run directly on Ethernet without IP. That traffic never passes a router or layer 3 firewall, so protection has to come from VLANs, port security and monitoring at switch level.

📌 In summary

The OSI model divides network communication into seven layers, each with its own task, from bits on the cable to application services.

Since 1984 the model has been the shared language of network engineers, even though practice runs on TCP/IP. For IT/OT convergence it is especially useful for placing industrial protocols, seeing which traffic is routable, choosing the right security measure per layer and solving faults systematically from the bottom up.