It is the end of September 2026, and you are in the Information Technology and Telecommunications track of an Italian technical school (istituto tecnico). In Year 3, Systems and Networks is a new subject compared with the first two years, and it has just started with the fundamentals (signals, transmission media, protocols). After this introduction, between October and November, comes the first real theory block: the layered model, OSI and TCP/IP. The first written test on this topic typically falls between late November and mid-December, six to ten weeks from now. The same protocol stack, with a more applied slant, also returns in Year 5 of the applied sciences liceo (Italian academic high school), when you get to networks, IP and cryptography. Understanding it well now, in the fundamentals, saves you from having to relearn it from scratch later.
If in Year 3 you have already dealt with the CPU and the machine cycle (I cover it in Von Neumann architecture and the CPU), here the jump is one of perspective. You no longer look inside a single computer, but at how two different computers agree to exchange data across a network that, in the middle, knows nothing about the content it is carrying.
Why we need a layered model
Making two devices communicate is a huge problem if you tackle it all at once: you have to deal with electrical signals, addressing, transmission errors and the meaning of application data, all at the same time. The layered model breaks the problem up into separate layers, each responsible for a precise task, which communicates only with the layer immediately above and below it through a defined interface. A layer does not need to know how the one below works: it is enough for it to know that, if it hands over data, that layer will get it to its destination. It is the same principle used in Systems when you design a program in modules: each module does one thing, and the others do not care how.
The seven OSI layers
The OSI model (Open Systems Interconnection, an ISO standard) is the theoretical reference, with seven layers. From the one closest to the user to the one closest to the cable:
| # | Layer | Function | Example protocol |
|---|---|---|---|
| 7 | Application | Provides network services to applications (mail, web, file transfer) | HTTP, FTP, SMTP, DNS |
| 6 | Presentation | Translates, encrypts, compresses data into a common format | SSL/TLS, formats such as JPEG |
| 5 | Session | Opens, manages and closes the communication session between two hosts | NetBIOS, RPC |
| 4 | Transport | Guarantees (or not) reliable delivery, handles ports and segmentation | TCP, UDP |
| 3 | Network | Routes packets between different networks using logical addresses | IP |
| 2 | Data Link | Organises bits into frames, handles physical addresses and local error control | Ethernet, Wi-Fi |
| 1 | Physical | Transmits individual bits as electrical, light or radio signals | cables, connectors, signals |
A common way to remember the order from layer 1 to 7 is a mnemonic. An English one is “Please Do Not Throw Sausage Pizza Away” (Physical, Data link, Network, Transport, Session, Presentation, Application). Italian students use a similar one, “Fatti Da Ridere, Tanti Sono Pazzi Ancora” (“made to laugh, so many are still crazy”), built on the Italian layer names. It helps you not to skip a layer when you have to list them from memory in a test.
The TCP/IP model: four layers, not seven
The TCP/IP model is the one actually used by the internet, and it is leaner: four layers instead of seven, because it merges some OSI functions that in practice do not need to be separate.
| TCP/IP layer | Corresponding OSI layers |
|---|---|
| Application | Application + Presentation + Session (7, 6, 5) |
| Transport | Transport (4) |
| Internet | Network (3) |
| Network access (or Host-to-network) | Data Link + Physical (2, 1) |
The point to fix in your mind for the test: OSI is a theoretical reference model, used above all for teaching and for comparing different architectures; TCP/IP is the model actually implemented, on which the internet runs. They are not two competing alternative stacks: TCP/IP is, historically and in practice, a more practical version of the same principle of separation into layers.
Data units: what the “packet” is called at each layer
A common mistake is to call “packet” whatever is exchanged at any layer. In fact the data unit (PDU, Protocol Data Unit) changes its name depending on the layer:
- Application layer: data (or message)
- Transport layer: segment (TCP) or datagram (UDP)
- Network layer: packet
- Data Link layer: frame
- Physical layer: bits
“Packet”, in the rigorous language of the subject, is only the unit of the Network layer (3). Using it for a frame or a segment is imprecise, and it is one of the details that a well-marked paper penalises.
Addresses: MAC, IP, port
Each layer that needs to identify a counterpart uses a different type of address, and the difference is another central point of the test:
- MAC address (Media Access Control, layer 2): a 48-bit identifier, written in hexadecimal, assigned at the factory to the network card. It identifies a device on a local network and has no meaning outside it.
- IP address (layer 3): identifies a device uniquely across the whole network, including different networks connected together. It is the address that makes routing between networks possible. I go into this topic separately in IP addresses and subnetting in Year 4, when in Year 4 you get into the detail of subnet masks.
- Port (layer 4): a number from 0 to 65535 that identifies, within a single host, which application or service should receive the data (for example port 80 for HTTP, 443 for HTTPS).
A typical mistake is to confuse these three levels of addressing: the MAC answers the question “which network card”, the IP “which host on which network”, the port “which application on that host”.
Devices: which layer they work at
Each network device “sees” only up to a certain layer, and this determines what it can do:
- Hub (layer 1): repeats the electrical signal on all ports, without reading any address. It makes no choices: all the traffic goes everywhere.
- Switch (layer 2): reads the destination MAC address in the frame and forwards the traffic only to the right port, learning which devices are connected to which ports.
- Router (layer 3): reads the destination IP address in the packet and decides which network to route it to, connecting different networks to one another.
The difference between a switch and a router is probably the most recurrent question on this topic: a switch sorts traffic inside the same local network by looking at MAC addresses, a router connects different networks by looking at IP addresses.
Encapsulation: following a packet step by step
The most important concept in the whole block is encapsulation: going down, each layer adds its own header to the data received from the layer above, without changing its content. Let us follow what happens when you open a web page, from the Application layer down to the cable:
- Application: the browser generates an HTTP request (for example
GET /index.html). This is the “pure” data to be transmitted. - Transport: the TCP layer adds its own header in front of the HTTP data. The TCP header contains, among other things, the source port and the destination port (80, or 443 for HTTPS), as well as the sequence numbers that guarantee ordered delivery. The result is called a segment.
- Network: the IP layer adds its own header to the TCP segment, with the source IP address and the destination one. The result is called a packet.
- Data Link: the Ethernet layer adds a header with the source and destination MAC addresses (plus an error-checking trailer at the end). The result is called a frame.
- Physical: the frame is transmitted as a sequence of bits, electrical signals on the network cable.
The original data, then, reaches the cable “wrapped” in layers: a header from TCP, one from IP, and a header and trailer from Ethernet, a bit like a letter put in an envelope, then in a parcel, then in a container. On the receiving side the reverse process takes place, decapsulation: each layer removes its own header and passes the rest upwards, until only the original HTTP data is delivered to the application.
The detail not to miss: when a router receives a packet to route it towards another network, it removes and rebuilds the layer 2 header (the frame, with new MAC addresses valid for the next stretch of network), but leaves the IP addresses and everything above layer 3 unchanged (in the IP header it updates only the TTL, which goes down by 1 at every router, and the related checksum). MAC addresses change at every hop from one device to the next; IP addresses stay the same from the source to the final destination.
TCP and UDP: two very different transport protocols
Both work at the Transport layer, but with opposite philosophies:
- TCP (Transmission Control Protocol): connection-oriented, it guarantees that all the data arrives, in the right order, and retransmits what is lost. It has a cost in terms of a heavier header and preliminary exchanges (opening the connection), but it is reliable. It is used for the web, email and file transfer, where losing a piece of data is not acceptable.
- UDP (User Datagram Protocol): connectionless, it guarantees neither order nor delivery, but it is lighter and faster. It is used where speed matters more than total reliability: video streaming, video calls, online games, where an occasional lost packet is less serious than a delay.
A typical mistake is to think that UDP is “TCP done badly”: they are different design choices for different needs, not a worse version of the same thing.
Typical mistakes
| Mistake | How you notice it |
|---|---|
| Calling any data unit “packet”, at any layer | The packet is only the unit of the Network layer (3); below it is a frame, above it is a segment/datagram |
| Confusing switch and router | A switch works at layer 2 with MAC addresses inside the same network; a router works at layer 3 with IP addresses between different networks |
| Thinking that the router changes the IP addresses | The router rebuilds the layer 2 header at every hop; in the IP header the source and destination addresses stay the same (only the TTL changes) |
| Treating TCP/IP and OSI as two competing alternative stacks | TCP/IP is the model actually implemented; OSI is the seven-layer theoretical reference, used for studying and comparing |
| Thinking that UDP is just “TCP without something” | They are protocols with different goals: total reliability (TCP) versus speed and low overhead (UDP) |
Three worked exercises
1. Which layer does a device work at? A technician has to connect two different local networks to each other, so that the devices on one network can reach those on the other. Which device is needed, and which OSI layer does it work at?
A router is needed, which works at layer 3 (Network). A switch would not be enough: a switch sorts traffic inside a single local network by looking at MAC addresses, but it cannot route between different networks. That is exactly the function of the Network layer, which reasons in terms of IP addresses and distinct networks.
2. What happens to the headers when crossing a router? An IP packet travels from source A to destination B, passing through two intermediate routers. Does the IP header (with the IP addresses of A and B) stay the same for the whole journey? And the layer 2 header (Ethernet, with the MAC addresses)?
The addresses in the IP header stay unchanged along the whole path (the only field that changes is the TTL, decremented by each router): the header contains the source IP address (A) and the destination one (B), which do not change until the packet reaches its destination. The layer 2 header, on the other hand, is rebuilt at every hop: each router, when it receives the frame, decapsulates it up to layer 3, decides which interface to route the packet through, and re-encapsulates it in a new frame with the MAC addresses of the router itself and of the next device along that stretch of network. The MAC addresses therefore change at every hop, while the IP addresses stay those of the end hosts.
3. Classify the protocols by layer. Given the protocols HTTP, TCP, IP and Ethernet, say which OSI layer each belongs to and in which order their headers are added during the encapsulation of a web request.
- HTTP: layer 7 (Application): it generates the original data, with no headers of its own from lower layers.
- TCP: layer 4 (Transport): it adds its own header first, right below the HTTP data, including the source and destination ports.
- IP: layer 3 (Network): it adds its own header around the TCP segment, including the source and destination IP addresses.
- Ethernet: layer 2 (Data Link): it adds the header (and the trailer) last, including the MAC addresses, before the whole thing is transmitted as bits on the Physical layer.
The order of encapsulation is therefore HTTP → TCP → IP → Ethernet, from the top to the bottom of the stack: it is exactly the path a real packet follows when you open a web page.
There is not yet a dedicated practice test on this topic
Systems and Networks, unlike maths and physics, does not currently have a dedicated test simulator on the site. You can still find all the available practice tests, on other subjects, at /simulazioni/.
If this is the first heavy theory block of Systems and Networks, the next step, in Year 4, is to go into the detail of IP addresses and subnetting: I discuss it in IP addresses and subnetting in Year 4 of technical school. For the rest of the computer science programme, you will find everything at /materie/informatica/.
The physical layer and security, in Year 5, come up again in VLANs and security.
If you would like a hand to fix the layered model well before the test, the first introductory call is free and lasts half an hour.
