Cheat sheets / OSI model (colored)
OSI model (colored)
Ronbert-style one-page OSI table — PDU, TCP/IP mapping, protocols, hardware, and the attacks/defenses that live at each layer.
Top-down: All People Seem To Need Data Processing · Bottom-up: Please Do Not Throw Sausage Pizza Away
From class: encryption/decryption happens at the Presentation layer; Transport = ports; Network = IPsec. Reference page: ronbert.com/OSI.htm.
| # | Layer | PDU | TCP/IP | Protocols / services | Hardware | Security at this layer |
|---|---|---|---|---|---|---|
| 7 | Application user ↔ network | Data | Application | HTTP/HTTPS, DNS, DHCP, SMTP/POP3/IMAP, FTP/SFTP/TFTP, SSH, Telnet, SNMP, LDAP, RDP, NTP, SMB, SIP | L7 firewall / WAF, forward & reverse proxy, L7 load balancer, app-aware IDS/IPS | WAF (SQLi/XSS), DLP, content/URL filtering, SPF·DKIM·DMARC, S/MIME, phishing & malware delivery, DNS poisoning/pharming |
| 6 | Presentation format · encrypt | Data | TLS/SSL encryption & decryption, compression, encoding (ASCII, Unicode, JPEG, MPEG, MIME) | — | Encryption/decryption lives here; downgrade & SSL-stripping attacks; steganography hides in these formats | |
| 5 | Session dialog control | Data | NetBIOS, RPC, SIP, sockets, SQL sessions, PPTP/L2TP control, NFS | — | Session hijacking / session replay (SID), SSO tickets (Kerberos), session timeouts | |
| 4 | Transport end-to-end · ports | Segment (TCP) Datagram (UDP) | Transport | TCP (3-way handshake, flags SYN·ACK·PSH·URG·FIN·RST), UDP, port numbers, SCTP | L4 stateful firewall, L4 load balancer | Port scans (Xmas = FIN·URG·PSH), SYN flood, stateful inspection, open-port attack surface |
| 3 | Network logical addressing · routing | Packet | Internet | IPv4/IPv6, ICMP (ping), IPsec (AH/ESP, IKE), routing (OSPF, BGP, RIP), NAT/PAT, IGMP | Routers, L3 switches, packet-filtering firewalls | IPsec VPNs, ACLs, IP spoofing, ICMP DoS (ping of death, smurf), route hijacking |
| 2 | Data Link MAC · frames | Frame | Network Access (Link) | Ethernet 802.3, Wi-Fi 802.11, ARP, MAC addresses, VLAN 802.1Q, STP, PPP, 802.1X, MACsec, LLC/MAC sublayers | Switches, bridges, NICs, wireless access points | ARP poisoning (DAI), MAC spoofing/flooding (port security), VLAN hopping, DHCP snooping, evil twin / rogue AP, WPA2/WPA3 |
| 1 | Physical bits on the wire | Bits | Cables (UTP/fiber/coax), connectors (RJ45, SFP), radio (Wi-Fi, Bluetooth, NFC, cellular), RS-232, DSL, modem signaling | Hubs, repeaters, modems, media converters, cabling, transceivers, UPS/PDU | Wiretapping, jamming, cable locks, EMI shielding, air gap, physical security (locks, cameras, mantraps) |
TCP/IP (DoD) mapping
| TCP/IP layer | OSI layers | Examples |
|---|---|---|
| Application | 7 · 6 · 5 | HTTP, TLS, DNS, SMTP |
| Transport | 4 | TCP, UDP |
| Internet | 3 | IP, ICMP, IPsec |
| Network Access / Link | 2 · 1 | Ethernet, Wi-Fi, ARP |
Encapsulation (sending) → decapsulation (receiving)
Where the exam's devices sit
| Device | Layer | Why |
|---|---|---|
| Hub / repeater | 1 | Just repeats electrical signal |
| Switch / bridge / WAP | 2 | Forwards by MAC address |
| Router / L3 switch | 3 | Forwards by IP address |
| VPN concentrator (IPsec) | 3 | Network-layer tunnel |
| Stateful firewall | 4 (some 3–4) | Tracks TCP/UDP connections |
| TLS VPN | 6/7 | Application-layer tunnel over 443 |
| NGFW / WAF / proxy / L7 load balancer | 7 | Inspects application content |
| IDS/IPS | 2–7 | Depends on signatures (many inspect payload) |