OSI and TCP/IP Models

Two layered models for “where does this protocol live.” OSI has 7 layers and is the textbook reference. TCP/IP has 4 layers and is what the actual Internet runs on. In interviews you’ll mix and match — most backend devs say “L4” (TCP) and “L7” (HTTP) without bothering with the rest of OSI.

OSI 7 layers

In practice, layers 5 and 6 are mostly absorbed into layer 7 (application) — TLS is technically L6 but everyone treats HTTPS as one thing.

TCP/IP 4 layers

L4 vs L7 — the only distinction backend devs use daily

Most APIs sit behind an L7 load balancer (ALB/nginx/Envoy). L4 is for things that aren’t HTTP (databases, gRPC streaming at scale, raw TCP).

Where Python code lives

Your Django / FastAPI app is L7. Below it:

HTTP request
       ↓
[L7 nginx / ALB]    ← path/host routing, TLS termination
       ↓
[L4 NLB / kube-proxy]  ← TCP forwarding to a pod IP:port
       ↓
[L3 IP routing]     ← VPC / subnet / route table
       ↓
[L2 Ethernet]       ← invisible at app level

When something breaks, you debug top-down: app → reverse proxy → load balancer → routing → TCP → IP. See 14_troubleshooting_tools.md.

“Layer 8” jokes

Not a real layer. Means the user / political / process problem above the stack. Usually invoked when an outage was a config typo, not a network issue.

Encapsulation

Each layer wraps the previous one’s payload in its own header:

[ Ethernet header [ IP header [ TCP header [ HTTP request body ] ] ] ]
                                              ↑ what your Python code sees

A 1500-byte Ethernet MTU minus headers leaves ~1460 bytes of TCP payload — this is why huge HTTP responses get split into many TCP segments and why MTU mismatches break things.

Common interview confusions

• “Is HTTPS layer 5 or 7?” — application layer (7); TLS is technically L6 but nobody breaks them apart in practice.
• “What layer is BGP?” — application (7) — it runs over TCP, even though it’s about routing.
• “What layer is a switch vs a router?” — switch = L2 (forwards Ethernet frames by MAC), router = L3 (forwards IP packets between networks). A “L3 switch” does both.
• “What layer is a load balancer?” — depends on the LB. NLB/HAProxy-TCP = L4; ALB/nginx/Envoy = L7. Many products do both.

Interview angle

• “Walk me through what happens when you type curl https://api.example.com/users in a terminal.” — DNS lookup (L7) → TCP handshake (L4) → TLS handshake (L6/L7) → HTTP request (L7), plus IP routing (L3) at every hop. See 05_dns.md, 12_tls_https_certificates.md.
• “What’s the difference between L4 and L7 load balancers?” — L4 routes by IP+port, L7 by URL/header. L7 can do TLS termination, content-based routing, and HTTP-aware health checks; L4 is faster and protocol-agnostic.
• “Where does TLS sit?” — between TCP (L4) and HTTP (L7); often called L6 in OSI but nobody enforces that separation.
• “What’s the MTU and why does it matter to your service?” — max payload per L2 frame (1500 bytes typical). MTU mismatches cause TCP retries, hung connections behind VPNs, and the classic “small requests work, large ones hang” symptom.