// foundations · 01 / 09
Layers that matter
OSI / TCP-IP as an attacker reads them
You don't debug "the internet." You debug which layer failed — name, port, route, or cable.
L7 Application HTTP · DNS · TLS · SSH
L4 Transport TCP · UDP · ports
L3 Network IP · ICMP · routing
L2 Data link MAC · ARP · Ethernet
L1 Physical cable · Wi‑Fi · NIC
- TCP/IP — model you actually use
- 5 — layers worth memorizing
- L7 — where most vulns live
Symptom
- Site loads forever → often DNS or TCP
- Connection refused → port closed / no listener
- Timeout → filter, blackhole, or no route
First question
- Did the name resolve?
- Is the port open from here?
- Do I have a route to that IP?
// check yourself
curl returns "Could not resolve host". Which layer broke first?