../foundations

// foundations · 01 / 09

Layers that matter

OSI / TCP-IP as an attacker reads them

You don't debug "the internet." You debug which layer failed — name, port, route, or cable.

L7 Application HTTP · DNS · TLS · SSH

L4 Transport TCP · UDP · ports

L3 Network IP · ICMP · routing

L2 Data link MAC · ARP · Ethernet

L1 Physical cable · Wi‑Fi · NIC

  • TCP/IP — model you actually use
  • 5 — layers worth memorizing
  • L7 — where most vulns live

Symptom

  • Site loads forever → often DNS or TCP
  • Connection refused → port closed / no listener
  • Timeout → filter, blackhole, or no route

First question

  • Did the name resolve?
  • Is the port open from here?
  • Do I have a route to that IP?

// check yourself

curl returns "Could not resolve host". Which layer broke first?

Networking fundamentals — Prashant Dangi