1.3 OSI Model and TCP/IP Stack, TCP vs UDP and Switching

The OSI and TCP/IP models provide a structured framework for understanding network communication. TCP ensures reliable, connection-oriented data delivery, while UDP provides lightweight, connectionless communication without guaranteed delivery. Ethernet switching enables efficient communication within a LAN by learning MAC addresses and forwarding frames toward their intended destinations.

Together, these concepts establish a strong foundation for understanding routing, VLANs, network services, security, and advanced networking technologies covered in subsequent CCNA lessons.

1. Introduction to OSI and TCP/IP Models

Computer networks allow devices such as computers, servers, routers, and switches to communicate and exchange information. To ensure that devices from different manufacturers can communicate effectively, networking relies on standardized protocols and layered communication models.

The OSI (Open Systems Interconnection) Model and TCP/IP (Transmission Control Protocol/Internet Protocol) Model are two fundamental networking models that explain how data is transmitted from one device to another across a network.

These models divide network communication into different layers, with each layer performing specific functions. This layered approach simplifies network design, protocol development, interoperability, and troubleshooting.

Networking models divide the communication process into smaller logical layers.

The two most important models are:

1. OSI Model
2. TCP/IP Model

1.1 OSI Model (Open Systems Interconnection)

The OSI Model is a seven-layer conceptual framework developed by the International Organization for Standardization (ISO). It describes how data moves between applications on different network devices.

• Divides network communication into seven functional layers.
• Assigns specific responsibilities to each layer.
• Promotes compatibility between different networking systems.
• Simplifies network design, implementation, and troubleshooting

Each layer has specific responsibilities and interacts with adjacent layers to support end-to-end communication.

The OSI Model (7 Layers) — Top to Bottom

Mnemonic (top→bottom): "All People Seem To Need Data Processing"

Layer 7 — Application

• What it does: The interface between the network and the actual software you use (browser, email client, etc.). It's not the application itself — it's the layer that lets the application talk to the network.
• PDU (data unit): Data
• Examples: HTTP/HTTPS (web), SMTP/IMAP (email), FTP (file transfer), DNS (name resolution), DHCP (IP assignment)
• Think: "What am I trying to do?" (load a webpage, send an email)

Layer 6 — Presentation

• What it does: Formats, translates, encrypts/decrypts, and compresses data so the receiving application can understand it, regardless of what system sent it.
• PDU: Data
• Examples: SSL/TLS encryption, JPEG/PNG/MPEG formatting, ASCII/EBCDIC character encoding
• Think: "Translator and security guard" — makes sure data is in a readable, safe format.

Layer 5 — Session

• What it does: Establishes, manages, and terminates the conversation (session) between two devices. Keeps track of whose turn it is to talk (dialogue control) and can restart a session if it's interrupted.
• PDU: Data
• Examples: NetBIOS, RPC (Remote Procedure Call), PPTP, session checkpoints in file transfers
• Think: "The phone call" — sets up the call, keeps it alive, hangs up when done.

Layer 4 — Transport

• What it does: Breaks application data into smaller pieces (segments), adds port numbers so it reaches the right application on the destination, and (depending on protocol) guarantees delivery.
• PDU: Segment (TCP) / Datagram (UDP)
• Examples:
• TCP — connection-oriented, reliable, uses a 3-way handshake (SYN, SYN-ACK, ACK), retransmits lost data. Used for web, email, file transfer.
• UDP — connectionless, fast, no guarantee of delivery. Used for video streaming, VoIP, DNS queries.
• Think: "Reliable courier vs. postcard" — TCP confirms delivery, UDP just sends it and hopes.

Layer 3 — Network

• What it does: Handles logical addressing (IP addresses) and routing — deciding the best path for a packet to travel across multiple networks.
• PDU: Packet
• Examples: IP (IPv4/IPv6), ICMP (ping/traceroute), routing protocols (OSPF, EIGRP), routers
• Think: "The GPS" — figures out which roads (networks) to take to get from source to destination.

Layer 2 — Data Link

• What it does: Handles physical/MAC addressing and gets data across a single physical link (e.g., one Ethernet segment). Detects (but doesn't always fix) transmission errors. This is where switches operate — the topic from your CCNA lesson.
• PDU: Frame
• Examples: Ethernet, MAC addresses, switches, VLANs, ARP (technically straddles L2/L3)
• Think: "Local delivery within one building" using the door number (MAC address), not the street address (IP).

Layer 1 — Physical

• What it does: The actual electrical, optical, or radio signals and physical hardware — voltages on a copper wire, light pulses on fiber, or radio waves for Wi-Fi.
• PDU: Bits (1s and 0s)
• Examples: Ethernet cables, fiber, hubs, connectors, NICs, radio frequencies
• Think: "The wire itself" — no addressing, no logic, just raw signal transmission.

1.2 TCP/IP Model (Transmission Control Protocol/Internet Protocol)

The TCP/IP Model is a practical networking architecture used for communication across modern networks, including the Internet. It is based on the TCP/IP protocol suite and is commonly represented using four layers.

Unlike the OSI Model, which primarily serves as a conceptual reference, TCP/IP describes the protocols and processes used in real-world network communication.

How Data Actually Travels — Encapsulation

When you send data, it travels down the stack on your device, gets wrapped in headers at each layer (like nesting envelopes), crosses the wire, then gets unwrapped back up the stack on the receiving device:

1. Application creates the data (e.g., an HTTP request)
2. Transport wraps it into a Segment (adds source/destination port numbers)
3. Network wraps that into a Packet (adds source/destination IP addresses)
4. Data Link wraps that into a Frame (adds source/destination MAC addresses)
5. Physical converts the frame into Bits and transmits it as electrical/light/radio signals

On the receiving end, this happens in reverse (decapsulation) — each layer strips off its corresponding header and passes the rest up, until the original application data is reassembled.

2. TCP vs UDP

Both are Layer 4 (Transport layer) protocols responsible for delivering data between applications, but they take very different approaches.

TCP (Transmission Control Protocol)

Connection-oriented — establishes a connection before sending data and tears it down afterward.

Key characteristics:

• Three-way handshake – Establishes the connection before data transfer: SYN → SYN-ACK → ACK.
• Reliable delivery – Uses acknowledgments (ACKs) to confirm data was received. If a segment is lost, TCP retransmits it.
• Sequencing – Segments are numbered so the receiver can reassemble them in the correct order, even if they arrive out of order.
• Flow control – Uses a "sliding window" mechanism so the sender doesn't overwhelm the receiver.
• Error checking and recovery – Detects lost/corrupted segments and recovers automatically.
• Slower / more overhead – All this reliability comes at the cost of additional header size (20+ bytes) and processing delay.

Use cases: Applications where reliability and data integrity matter more than speed — web browsing (HTTP/HTTPS), email (SMTP), file transfer (FTP), SSH, database connections.

UDP (User Datagram Protocol)

Connectionless — no handshake, no session setup. Data is just sent ("fire and forget").

Key characteristics:

• No handshake – Data is sent immediately without establishing a connection first.
• Unreliable delivery – No acknowledgments, no retransmission. If a packet is lost, UDP doesn't know or care — it's up to the application to handle that if needed.
• No sequencing – Packets may arrive out of order, and UDP won't reorder them.
• No flow control – Sends as fast as the application generates data.
• Lower overhead – Much smaller header (just 8 bytes), so it's faster and more efficient.

Use cases: Applications where speed matters more than perfect reliability, or where the application handle's reliability itself — video/audio streaming, VoIP calls, DNS queries, DHCP, SNMP, online gaming.

Comparison Table

Why Both Exist

The choice between TCP and UDP is a trade-off: TCP guarantees delivery but is slower, while UDP is fast but offers no guarantees. Applications choose based on their needs — a web page must load completely and correctly (TCP), but a live video call would rather drop a frame than pause to retransmit it (UDP), since a delayed frame is more disruptive than a missing one.

TCP and UDP Handshake

3. Network Switching — Introduction and Fundamentals

3.1 What is Network Switching?

Network switching is the process of forwarding data between devices within a Local Area Network (LAN). A network switch connects devices such as computers, servers, printers, wireless access points, and IP phones, allowing them to communicate efficiently.

A traditional Layer 2 Ethernet switch operates at the Data Link Layer (Layer 2) of the OSI Model. It uses MAC (Media Access Control) addresses to identify devices and determine the appropriate interface for forwarding Ethernet frames.

Unlike an Ethernet hub, which repeats incoming signals to other ports, a switch learns the source MAC addresses of connected devices and builds a MAC address table (CAM table) to make intelligent forwarding decisions.

3.2 How Does a Network Switch Work?

When an Ethernet frame arrives on a switch interface, the switch examines the source and destination MAC addresses to determine how to process and forward the frame.

The switching process involves several important operations:

1. MAC Address Learning: The switch records the source MAC address and the incoming interface in its MAC address table.

2. MAC Address Lookup: The switch checks whether the destination MAC address exists in its MAC address table.

3. Frame Forwarding: If the destination MAC address is known on another interface, the switch forwards the frame through that interface.

4. Frame Flooding: If the destination MAC address is unknown, the switch floods the frame through other forwarding interfaces belonging to the same VLAN.

5. Frame Filtering: If the destination MAC address is associated with the same interface on which the frame arrived, the switch does not forward the frame back through that interface.

6. MAC Address Aging: The switch automatically removes dynamically learned MAC address entries when they have not been refreshed within the configured aging period.

3.3 MAC Address Table (CAM Table)

A switch maintains a MAC address table that maps learned MAC addresses to specific switch interfaces and VLANs.

Example network topology:

• PC1 — MAC: AAAA.AAAA.AAAA — Interface Gi0/1

• PC2 — MAC: BBBB.BBBB.BBBB — Interface Gi0/2

• PC3 — MAC: CCCC.CCCC.CCCC — Interface Gi0/3

After learning the devices' MAC addresses, the switch maintains entries similar to the following:

Switch# show mac address-table

Vlan    Mac Address       Type       Ports
----    -----------       --------   -----
10      aaaa.aaaa.aaaa    DYNAMIC    Gi0/1
10      bbbb.bbbb.bbbb    DYNAMIC    Gi0/2
10      cccc.cccc.cccc    DYNAMIC    Gi0/3

When PC1 sends a frame to PC2, the switch looks up PC2's destination MAC address and forwards the frame through Gi0/2 rather than flooding it to every port.

Switch# show mac address-table
Switch# show mac address-table dynamic
Switch# show interfaces status
Switch# show vlan brief
Switch# show interfaces switchport
Switch# show interfaces counters errors

4.6 On-Premises and Cloud

Describes where infrastructure and services physically live and who manages them.

On-Premises:

• Hardware (servers, storage, switches, routers) is physically located inside the organization's own building/data center.
• The organization owns and fully manages the hardware, software, security, and maintenance.
• Pros: Full control, no dependency on internet connectivity for internal access, can meet strict data residency/compliance requirements.
• Cons: High upfront capital cost (CapEx), ongoing maintenance burden, harder to scale quickly.

Cloud:

• Infrastructure and services are hosted by a third-party provider (AWS, Microsoft Azure, Google Cloud) and accessed over the internet.
• Common service models:
• IaaS (Infrastructure as a Service) – rent virtual servers/storage/networking (e.g., AWS EC2).
• PaaS (Platform as a Service) – rent a platform to build/run applications without managing underlying infrastructure.
• SaaS (Software as a Service) – use fully-hosted applications (e.g., Microsoft 365, Google Workspace).
• Pros: Pay-as-you-go (OpEx model), rapid scalability, provider handles hardware maintenance.
• Cons: Ongoing dependency on internet connectivity, less direct control, shared responsibility for security.

Hybrid Approach:

• Combines both — e.g., sensitive data/databases stay on-premises, while web-facing apps run in the cloud.
• Requires reliable, secure connectivity between the two environments — often via VPN or a dedicated cloud interconnect (e.g., AWS Direct Connect, Azure ExpressRoute).

Exam-relevant point: Understand the trade-off spectrum — on-premises (control, cost, compliance) vs. cloud (flexibility, scalability, less control) — and that hybrid is increasingly the real-world norm rather than an either/or choice.

Quick knowledge check