Previous Up Table of Contents Next

The ISO Layering Model

The International Organization for Standardization (ISO) has created a Reference Model of Open System Interconnection consisting of seven layers to describe networked systems. As a reference model, one should look at it as a means of comparing systems rather than a methodology for constructing systems. If one has N items to compare and one makes direct comparisons between each pair of items, one ends up with about N squared comparisons. On the other hand, if one has a standard of comparison (a ruler for measuring length, for example), one need only make N comparisons of items to the standard to get the same information.

Layer 7 Application Message Passing
Layer 6 Presentation Encoding
Layer 5 Session Authentication & Encryption
Layer 4 Transport Streams & Segments
Layer 3 Network Datagrams
Layer 2 Data Link Frames & Packets
Layer 1 Physical Hardware Signaling & Wiring

Figure 5: The 7 Layers of the ISO Reference Model

The ISO Reference Model was created for the OSI Network Protocol Suite. The OSI suite is actually typically implemented with 10 layers. We will not be studying the OSI Network Protocol Suite in detail, since it never gained great popularity in the United States. Essentially, it is a collection of standards created on paper by an international committee primarily of European telephone company representatives. It is not clear to me if they ever managed to create working systems for ordinary computers that conformed to the OSI standards and interconnected a variety of operating systems.

Physical Hardware Connection

Layer 1 deals primarily with the signaling and wiring standards. For signaling, a standard typically specifies things such as the voltages used to signal a binary digit or special information such as the beginning or end of a data frame. For wiring, a standard typically specifies things like the shape of the connectors at the end of the wires, the electrical properties of the wire. In the case of the standard for 10BASE-5 Ethernet, the wiring standard not only specifies a one half inch diameter for the coaxial cable, but suggests that the outer insulation be orange. Furthermore, it suggests that it be marked every few meters where taps may be placed.

Repeaters are the most interesting category of networking devices that operate exclusively at layer 1. They are capable of receiving a somewhat distorted analog signal for a bit and transmitting a cleaner analog signal for the bit. Repeaters permit the wiring to span greater lengths than would otherwise be possible, but also contribute a small, non-negligible delay to the signal that may contribute to other problems. For example, according to the standard a coaxial 10BASE-2 Ethernet cable may not extend for more than 200 meters. Inserting a repeater in the middle of a 300 meter cable brings a non-conforming and possible non-functional cable back into conformance with the standard. The standard also specifies that the signal must propagate from any device to any other device in less than 5 microseconds. A repeater adds a delay on the order of hundreds of nanoseconds and each 200 meter wire cable has a propagation time of about a microsecond or so. Hence, it is typically recommended that one never place more than 3 repeaters between any two devices in such an Ethernet.

Another category of networking devices that operate at layer 1 are media converters. Many actual networks are built using a variety of types of wiring and may include a mixture of optical signal carriers and electrical media (generically called "wiring" even when one may include glass fiber in the set of things one is talking about). In order to connect different types of media to each other, one uses a media converter which performs the same basic function as a repeater: it takes a signal from one medium and converts it, bit by bit, into a signal for another medium.

Data Link / Hardware Interface

Layer 2 deals primarily with frames and packets. Layer 1 exclusively deals with hardware, but layer 2 deals with a combination of hardware and software. Layer 1 is essentially for the media that connect networking devices whereas layer 2 deals with the circuitry inside the networking device as well as the software that may control it.

A frame is a group of bits traveling across the physical connection. A frame may be referred to as a cell in a system where the grouping of bits is of small, fixed size. A frame may contain information at its beginning, sometimes called a preamble, that is not relevant to the software controlling the interface. A frame may also contain information at its end, sometimes called a trailer, that is likewise not important to the software part of the interface. For example, an Ethernet frame trailer contains a checksum of the contents of the frame to verify that it was not garbled in transmission.

A packet is a frame with the preamble and trailer (if either or both exist in the particular system) removed. A packet is the part of the frame that is passed to the software part of an interface. Since a packet and a frame contain essentially the same information, the terms are often used interchangeably.

Layer 2 devices deal with packets as a whole and include things like bridges and switches which can filter and forward packets from one group of wires to another. This process is fairly simple and can be accomplished without using a sophisticated general-purpose CPU. Typically, such devices are controlled with special purpose CPUs and firmware or they may be constructed out of very large scale integrated (VLSI) application specific integrated circuits (ASICs). The VLSI/ASIC approach generally yields a device with fewer "bells and whistles" but which is much cheaper when mass produced. For example, the Ball State Computer Science Department just purchased an Ethernet switch for under $2,000 with a VLSI/ASIC design instead of a functionally similar software controlled switch that would have cost about $15,000. For very high speed devices such as an ATM switch, the VLSI/ASIC approach is the only one currently practical.


Layer 3 deals with the delivery of datagrams in a media-independent manner. Datagrams are a group of data that travels as a single package from a sending computer's operating system to a receiving computer's operating system. Standards must specify datagrams are to be inserted into frames for transport across a communication link.

Datagrams also contain addressing information. A layer 3 protocol will assign an address to each layer 3 device. The receiver's address needs to be attached to the datagram and the sender's address is also typically required to be present. The layer 3 addresses may or may not be related to any layer 2 address in any direct way. The addressing information is typically contained in a datagram header separate from the message data being delivered from one computer to another.

Sending and receiving computers might not be directly connected by a communication link. In that case, they would depend on the services of layer 3 device called a router. A router is a device which connects to more than one network and offers its services to computers on those networks as a mechanism to forward datagrams from one network to another network. The joining of two or more networks in this way is called internetworking and the networks formed in this way are called internets.


Layer 4 deals with communication between programs on computers, as opposed to layer 3 which deals with communication between operating systems. Some layer 4 protocols merely add program identification information to the information sent by the layer 3 protocol so the message data can be delivered to the destination program by the operating system on the receiving computer. Other layer 4 protocols are much more elaborate and deal with pathological conditions such as layer 3 datagrams being lost or delivered out of order.

>Typically the transport layer is the boundary between system services and the application programs that use them. Higher layers are not typically built in to the computer's operating system and depend on separate software libraries.


Layer 5 deals with establishing and maintaining a context for a sequence of messages delivered by layer 4. A network session is directly analogous to a terminal session where a user logs in, sends keystrokes and receives text characters, and then logs out. The session layer is responsible for maintaining the context in which layer 4 data is interpreted, just as a login session maintains a context for the incoming keystrokes. In establishing this context, the session layer may need to verify the identity of the party at the other end of the communication path. The process of establishing this identity is called authentication, since it is intended to demonstrate that the data is authentic. Authentication is separate from, but often related to authorization, which is the process of determining if some action is allowed.

Since the session layer typically not part of the package delivered with an operating system, it is somewhat less standardized and well developed. In many cases, it is a null layer. That is, no attempt is made to provide the services this layer should provide. Only in the last few years have serious standards been proposed and adopted in a widespread manner.


Layer 6 is the one charged with interpreting the meaning of the bits sent from one program to another via encoding standards. Different machines may represent numbers and characters with different bit patterns. IBM mainframes often use the EBCDIC encoding of characters, whereas most other modern systems use the ASCII encoding. Many machines use the 2's compliment representation of signed integers, but may differ in the number of bits used to represent them. Even machines that use a 32-bit IEEE representation of numbers may differ in the order in which the 8-bit bytes are stored internally.

More significant problems result when one considers how to transmit data types that are not built in to typical hardware such as something as simple as a date or time. At one extreme, all data can be converted into a text string by the sender and parsed or interpreted by the receiver. This wastes bandwidth and CPU cycles. At the other extreme, all data can be transmitted in some standardized binary format that may or may not be equivalent to the internal format used by the parties to the communication. Either case leads to format conversions that may not be precise and may consume a fair number of CPU cycles.

During the early development of networking standards, processing the presentation protocol was often slower than the transmission of data across a local area network. Hence, they were often ignored since they were only required if the systems communicating where actually different. Since then, however, CPU speed has increased faster than network speed, so it is now quite practical to incorporate non-trivial presentation protocols.


The top layer, layer 7, builds on the lower layers to actually get something useful to end user's accomplished. One must be careful, however, to distinguish between application protocols and applications. Often, the application that uses a given protocol has the same name as the protocol. For example, the "File Transfer Protocol," FTP, is often employed by a program named "ftp." The confusion between application layer protocols and application has lessened with the advent of the World Wide Web. A typical Web browser will employ several application layer protocols such as HTTP, FTP, POP, and SMTP.

Previous Up Table of Contents Next

© Paul Buis, Associate Professor
Computer Science Department
Ball State University
September, 1996