Network failures have a habit of impersonating one another. A page that will not load could be a loose cable, a bad route, a blocked port, an expired certificate, or an application error. The OSI model does not identify the culprit for us, but it gives the investigation an order: how far did the communication get before it failed?

Real systems do not divide neatly into seven independent programs. The Internet protocol suite combines several OSI layers, and one tool may exercise more than one layer at once. The examples below therefore show practical signals associated with each layer rather than pretending that a short Python script can isolate it completely.

Layer 1: Physical

The physical layer carries bits as electrical, optical, or radio signals. It includes cables, connectors, transceivers, frequencies, and link signaling. An Ethernet switch is normally discussed at Layer 2, even though its ports and transceivers also have physical-layer properties.

Useful checks include:

  • link lights and cable seating;
  • Wi-Fi signal and interference;
  • negotiated speed and duplex;
  • interface counters for carrier loss or physical errors.

On Linux, ip link show reports whether an interface has carrier, while ethtool eth0 can show negotiated Ethernet settings. A successful or failed ping does not identify Layer 1 by itself: ICMP uses the network layer, and many routing or firewall problems can produce the same result.

The data-link layer moves frames across one local link. Ethernet uses MAC addresses; switches learn which source addresses appear on which ports and forward frames accordingly. VLAN tags can divide one switched network into separate broadcast domains.

Practical tools include:

Terminal window
ip link show
ip neigh show
bridge fdb show

Packet-capture tools such as Wireshark or tcpdump -e can display Ethernet headers. Capturing or injecting frames may require elevated privileges and should only be done on a network where you have permission.

Common Layer 2 problems include the wrong VLAN, a switching loop, an address-resolution failure, or a port-security rule. Ordinary switched full-duplex Ethernet does not suffer the collisions associated with old shared hubs.

Layer 3: Network

The network layer provides logical addressing and routing between networks. IP, ICMP, and routing protocols belong here.

Terminal window
ip address show
ip route show
ping -c 3 192.0.2.1
traceroute example.com

The address and route tables show local configuration. ping tests whether ICMP echo traffic can make a round trip, if both ends and intervening firewalls allow it. traceroute uses TTL or hop-limit expiration to reveal some of the path, but silent hops do not necessarily indicate a broken router.

Layer 4: Transport

TCP and UDP deliver data between application endpoints identified by ports. TCP provides an ordered byte stream with retransmission and congestion control. UDP provides independent datagrams without built-in delivery or ordering guarantees. Neither protocol is simply “fast” or “slow” in every workload.

To test a TCP service rather than only host reachability:

Terminal window
curl -v https://example.com/
nc -vz example.com 443
ss -tulpn

nc can test whether a TCP connection is accepted. ss shows listening and established sockets on the local host. A timeout can still come from routing, a firewall, the remote service, or packet loss, so interpret it with the lower layers.

Layers 5 and 6: Session and Presentation

The OSI session layer describes coordination of conversations, such as establishing, maintaining, and ending a logical session. The presentation layer describes representation concerns such as serialization, character encoding, compression, and encryption.

In the Internet stack, these responsibilities usually live in libraries and application protocols rather than in distinct network layers. An HTTP cookie maintained by a Python requests.Session, for example, is application state; it is not evidence that a separate OSI Layer 5 protocol is operating below HTTP.

Likewise, Base64 is an encoding that represents bytes as text. It provides no confidentiality. TLS provides encryption and integrity for an application connection, while formats such as JSON, JPEG, or UTF-8 handle representation.

Layer 7: Application

Application-layer protocols define the messages programs exchange. HTTP, DNS, SMTP, SSH, and MQTT are examples.

import requests


response = requests.get(
    "https://jsonplaceholder.typicode.com/todos/1",
    timeout=10,
)
response.raise_for_status()
print(response.json())

This example exercises far more than Layer 7—DNS, TLS, TCP, IP, and a local link all have to work—but HTTP status, headers, and response data are application-layer concerns.

Troubleshooting from the Bottom Up

A practical sequence might look like this:

  1. Physical: Does the interface have a link and a usable signal?
  2. Data link: Is the port in the right VLAN, and can the host resolve a local neighbor?
  3. Network: Does the host have the right address, subnet, gateway, and route?
  4. Transport: Is the required port reachable and is a service listening?
  5. Application: Did DNS, TLS, authentication, or the application request fail?

Layers 5 and 6 can still help describe a problem, but modern troubleshooting often discusses their functions as part of the application stack.

Conclusion

The OSI model is most useful as a shared vocabulary and a troubleshooting checklist. It does not prove the cause of a fault, and no single command maps perfectly to one layer. Used carefully, it keeps a team from debugging an HTTP header while the host has no route—or replacing a cable when the server is returning a clear application error.