The Network Stack (OSI / TCP-IP)

Five layers you reason with, two you argue about

The 7-layer OSI model is a reference diagram, not how real systems are built. In practice you reason about a 5-layer stack, and the only two layers you will argue about in interviews are L4 and L7.

Bottom to top, the practical stack:

  L7  HTTP / gRPC / app semantics   (methods, headers, paths, request bodies)
  L6  TLS                            (encryption, identity, SNI)   <- sits between
  L4  TCP / UDP                      (ports, connections, reliability)
  L3  IP                             (addresses, routing, MTU)
  L2  Link                           (Ethernet, MAC, the wire)

Each layer has one job. IP (L3) moves packets between hosts by address and decides routing hop by hop; it knows nothing about ports or requests, and it is where MTU and fragmentation live (jumbo frames, the classic 1500-byte Ethernet MTU). TCP and UDP (L4) address a specific process on a host via a port number and, for TCP, add reliability. TLS secures the byte stream. HTTP (L7) carries the application meaning: this is a POST /orders, this is Authorization: Bearer ..., this is a 404.

L4 versus L7: the decision that matters

An L4 load balancer (AWS NLB, IPVS, a hardware LB) forwards packets or TCP connections. It sees the 4-tuple and that is roughly all: it cannot read a URL path, a Host header, or a cookie, so it cannot route /api to one pool and /images to another. It is cheap, extremely fast, and protocol-agnostic (it will happily proxy a database connection). An L7 load balancer or reverse proxy (Envoy, NGINX, AWS ALB, HAProxy in HTTP mode) terminates the connection, parses the request, and can route on path, header, or method, do TLS termination, retries, and rate limiting. That power costs CPU and adds latency.

A connection is identified by its 4-tuple: (source IP:source port, destination IP:destination port). This is why one client can hold many simultaneous connections to the same server (each uses a different ephemeral source port) and why a NAT gateway can multiplex thousands of internal hosts behind one public IP by rewriting ports. It is also why L4 load balancing has to keep a connection pinned to the same backend: the 4-tuple is the only identity it has.

Interview nuance: interviewers probe whether you conflate an L4 LB with L7 routing. If you say "the load balancer routes /checkout to the payments service," you have quietly assumed an L7 proxy. Say so, and note the cost: TLS termination and request parsing on every request.

Interview nuance: TLS does not have a clean OSI number (people say L5, L6, or "between 4 and 7"). Do not die on that hill. Say "TLS sits on top of TCP and below HTTP" and move on.

Recap: Reason in a practical 5-layer stack, remember IP routes packets and TCP/UDP address processes by port, and know that L4 sees only the 4-tuple while L7 can read and route on request content.