The OSI model — machinageist

Real protocol stacks do not implement seven separate layers, and several protocols cross the boundaries. Given that, why is the model still worth keeping?

Because vendors are required to document their equipment against it
Because it describes the protocol architecture the Internet actually runs on
Because it narrows a problem down to which function failed, what information is available there, and which component handles it
Because each layer can be tested in isolation with a tool built for that layer alone

A switch reports a rising count of frames failing their frame check sequence. What has that CRC actually established?

The frames were corrupted in transit, and the switch repaired them before forwarding
The frames were corrupted in transit; the check detects the damage but does not repair it
The frames arrived out of order and were put back into sequence
The destination MAC address was unknown, so the frames were flooded to every port

A host has a link light, exchanges frames with its neighbours on the local segment without trouble, and cannot reach anything on a remote network. Which layer does the model point at first?

Layer 1, because reaching a remote network depends on signal strength over distance
Layer 2, because forwarding between networks is the switch’s job
Layer 4, because traffic to a remote network requires a completed TCP handshake before any packet leaves the host
Layer 3, because layers 1 and 2 can be entirely healthy while the address, prefix, gateway, or route is wrong

Someone describes TCP as providing error correction. What does TCP actually do about damaged and missing data?

Its checksum detects some corruption, and acknowledgements plus retransmission recover data it infers was lost
It repairs corrupted bytes in place from the checksum, so damaged data never has to be sent again
It recomputes the layer 2 frame check sequence and repairs the frame
It passes corrupted segments up with an error flag and leaves the application to repair them

A colleague proposes UDP for a bulk file transfer on the grounds that UDP is faster. What is wrong with the reasoning?

UDP is always slower than TCP because it has no windowing
UDP is restricted by specification to real-time traffic
UDP is a smaller transport rather than an inherently faster one, and it guarantees nothing about delivery, ordering, or duplicates
UDP cannot carry more than one datagram per exchange

An IP packet crosses a router between two Ethernet segments. What happens to the frame the router received?

The router forwards the same frame unchanged, having rewritten only the destination IP address
The router keeps the original frame and wraps a second frame around it for the next hop
The router strips the IP header and forwards the frame toward the destination MAC address
The router removes the incoming frame, acts on the layer 3 packet, and builds new layer 2 framing for the next link

Where does TLS sit in a working Internet stack, and what is SSL?

TLS does presentation-layer work but runs above a reliable transport such as TCP; SSL is TLS’s obsolete predecessor
TLS replaces TCP at layer 4; SSL is the name for its use with HTTP
TLS encrypts frames at layer 2; SSL is the same protocol under an older marketing name
TLS is an application protocol alongside HTTP at layer 7; SSL is the transport it depends on

A web application firewall rejects a request whose query string carries a SQL injection pattern. What makes that a layer 7 decision rather than a layer 4 one?

It matched the destination port against a rule
It reassembled the TCP stream, which only layer 7 systems can do
It terminated the TLS session, and TLS termination is what defines layer 7
It understood the structure and meaning of the HTTP request, not merely its addressing

Why is a hub placed at layer 1 while a switch is placed at layer 2?

A hub repeats signals to every port without reading addresses; a switch learns source MAC addresses and forwards toward the associated port
A hub is slower, and throughput is what separates the two layers
A hub runs half duplex, and duplex is a layer 1 property while speed is a layer 2 one
A hub cannot detect collisions, and collision detection is the defining layer 2 function

SMB relies on services that NetBIOS historically provided at the session layer. Does that make SMB a layer 5 protocol?

Yes — a protocol belongs to the layer whose services it consumes
No — SMB is normally treated as an application-layer file-sharing protocol
Yes, but only on networks where NetBIOS is still enabled
No — SMB is a transport-layer protocol, because it runs directly over TCP 445

In the four-layer TCP/IP view, which OSI layers does the single Application layer correspond to?

Layer 7 only
Layers 6 and 7
Layers 4 through 7
Layers 5 through 7

A troubleshooting guide insists that every investigation must begin at layer 1 and work upward. How should you treat that rule?

Follow it: without a signal, nothing above it can be meaningfully tested
Invert it and always start at layer 7, since that is where users report the problem
There is no such rule — the model’s value is in making the starting point and its assumptions explicit
Follow it on wired networks and ignore it on wireless ones