The OSI model explained: 7 layers, with the attacks on each

02The seven layers, their protocols and attacks

Each layer carries a named data unit and attracts its own attacks. The table reads bottom-up, the direction data is built as it leaves a host.

03Layers 1–4: packets, connections and volume

The lower four layers move bits and packets without understanding what they contain. This is where volumetric and protocol DDoS lives. A SYN flood exhausts transport-layer state; a UDP flood and DNS amplification saturate links with raw volume; a ping flood abuses ICMP at layer 3.

Defences here are blunt by design: you filter or absorb packets by their shape — source, protocol, flags, rate — because there is no request to reason about yet. The decisive factor is capacity. Once a layer 3/4 flood saturates the uplink, no host-level setting helps, because the packets are consuming the link before the machine processes them. This is why network-layer protection has to sit upstream, often on an Anycast network, and why BGP routing matters for getting traffic to it.

04Layers 5–7: sessions, encoding and requests

The upper layers understand meaning. By the application layer, the data is a real HTTP request, DNS query or email. Attacks here are not about volume but about expense and deception: an HTTP flood sends requests that each look legitimate but target the most costly endpoints, so a few thousand per second can exhaust an application while generating far too little traffic to register as a volumetric event.

Because the traffic is well-formed, packet filtering cannot tell it apart from real users. Defence at layer 7 means inspecting the request itself — a web application firewall, behavioural analysis, and challenges that cost automated clients more than humans. Techniques such as TLS fingerprinting reach down to layer 6 to tell a real browser's handshake from a forged one.

The upper layers are also where non-flooding attacks live. SQL injection and cross-site scripting target the application's logic rather than its capacity; session hijacking at layer 5 steals an authenticated dialogue; SSL stripping at layer 6 downgrades an encrypted connection. These are not denial-of-service attacks, but they share the layer, which is why an application-layer defence is usually asked to do more than absorb floods — it has to understand what a valid request looks like in the first place.

05How OSI maps to the TCP/IP model

The Internet does not run OSI protocols; it runs the TCP/IP suite, which RFC 1122 describes in four layers: Application (OSI layers 5 to 7), Transport (layer 4), Internet (layer 3) and Link (layers 1 and 2). The layer-by-layer mapping, with what each layer adds to a real packet, is in the TCP/IP model.

06Seeing the layers on a real host

You can observe each layer with ordinary read-only tools. Watching where a problem appears tells you which layer — and which defence — is in play.

# L2 (Data Link): neighbour/ARP table
ip neigh show

# L3 (Network): the path packets take
traceroute -n example.com

# L4 (Transport): socket summary by state
ss -s

# L7 (Application): the HTTP version and status actually served
curl -sS -o /dev/null -w '%{http_version} %{http_code}\n' https://example.com/

07Why the model still matters for DDoS

The OSI model is decades old, but it remains the clearest way to describe what an attack targets and what a defence covers. "Layer 3/4 protection" is a precise claim: it absorbs packet and connection floods. "Layer 7 protection" is a different precise claim: it inspects requests. A service that needs both — most websites do — should confirm both, not assume one implies the other.

For the full breakdown of the two families and what each stops, see Layer 3/4 vs Layer 7 and the overview of DDoS mitigation.

The layers also give you a checklist for evaluating any protection service. Ask one concrete question per layer and expect a concrete answer:

• Layer 3: is filtering always on, and is it applied upstream of your own uplink rather than on your server?
• Layer 4: how are SYN floods and connection exhaustion handled before traffic reaches the origin?
• Layer 6: is TLS terminated at the edge, and which protocol versions and ciphers are accepted?
• Layer 7: can rules match paths, headers and per-client request rates, and how are automated clients told apart from people?
• Every layer: is the origin's real address kept private, so attackers cannot bypass the edge? See how to hide your origin IP.