Layers 4 to 7: Transport to Application

The upper layers in one sentence each

• Layer 4 delivers data to the right program on a host.
• Layer 5 keeps a conversation organized.
• Layer 6 makes sure both sides read the data the same way, and encrypts it.
• Layer 7 is the protocol the application actually speaks.

Layer 4, Transport: ports, and reliable versus fast

A host runs many programs at once. When a packet arrives, something has to say which program gets it. That is the port number. A web server listens on port 80, a mail server on 25. In the mailing analogy, the port is the apartment number inside the building.

Layer 4 also decides how careful to be:

• TCP is a phone call. Before talking, the two sides set up the call with the three-way handshake: SYN ("can we talk?"), SYN-ACK ("yes, can you hear me?"), ACK ("yes"). Every piece of data is numbered and acknowledged. Anything lost is resent. A receive window slows a fast sender so it does not flood a slow receiver. Web, email, and file transfers use TCP because a missing byte would corrupt the file.
• UDP is a postcard. No setup, no acknowledgment, no ordering. Fast and light. Voice, video, DNS lookups, and DHCP use UDP because a late packet is worse than a lost one, or because the application checks for itself.

The unit of data is a segment for TCP and a datagram for UDP.

Layer 5, Session: the conversation

Sets up, maintains, and tears down a dialog between two applications. Keeping the audio and video streams of a call in step is session work. The exam rarely goes deeper than recognizing the name.

Layer 6, Presentation: format and encryption

Both sides must agree on what the bytes mean: character encoding (ASCII, Unicode), image and video formats (JPEG, MPEG), compression, and encryption. When a question mentions TLS encrypting data, JPEG formatting, or ASCII versus Unicode, the answer is Presentation.

Layer 7, Application: what programs speak

Not the program itself, but the protocol it uses: HTTP, HTTPS, SMTP, DNS, DHCP, FTP, SSH, SNMP, Telnet. Devices that inspect this content, such as a proxy or a web application firewall, work at Layer 7.

The part that trips people up

• "HTTPS is Layer 7, so why is TLS Layer 6?" Answer by what the question is really about. If it is about the encryption or the formatting of the data itself: Layer 6. If it is about the service or protocol being used: Layer 7.
• Firewalls appear at more than one layer. A firewall that filters by port number works at Layer 4. A next-generation firewall or proxy that reads URLs works at Layer 7.
• Ports always point to Layer 4. If the question mentions a port number, the layer is 4.

Mnemonics

Bottom up: Please Do Not Throw Sausage Pizza Away. Top down: All People Seem To Need Data Processing.

Keyword translation

port number, TCP, UDP, segment,          4
handshake, flow control
session, dialog, keep streams in step    5
encryption, TLS, compression,            6
JPEG, ASCII, formatting
HTTP, SMTP, DNS, FTP, SSH, proxy, WAF    7

What to memorize

• SYN, SYN-ACK, ACK. TCP reliable, UDP fast.
• Ports at 4, encryption and formatting at 6, named protocols at 7.