// foundations · osi model, corrected for wireless
The OSI Model, Corrected for Wireless
Almost every popular OSI writeup repeats the same handful of errors. The model is a fine map, not the territory. This page presents it honestly, threads the one distinction most explainers omit — per-hop versus end-to-end addressing — and lands where a wireless engineer lives: Wi-Fi is not a Physical-layer technology, but a Physical plus Data Link technology whose Data Link half is the interesting half.
— Shankar K. · Verified against ISO/IEC 7498-1, IETF RFCs, IEEE 802.11-2020 ·
Read this once before the layer list: OSI (ISO/IEC 7498-1) is a reference model, a set of conceptual buckets. The internet runs on the TCP/IP model (IETF RFC 1122), which has four layers, not seven. In TCP/IP, OSI Layers 5, 6, and 7 collapse into a single Application layer; there is no separate Session or Presentation layer on the wire. The model also earns its keep as a fault-localization tool: the layer that is failing tells you which instrument to reach for — a link-layer problem wants a sniffer, a routing problem wants traceroute, an application problem wants the app's own logs.
// diagram · seven-layer stack
Colour grouping carries meaning: Layers 5–7 collapse into the TCP/IP application; Wi-Fi (802.11) spans Layers 1 and 2.
The seven layers, told accurately
7 · Application
The interface between user software and the network: HTTP, SMTP, IMAP/POP3, DNS, FTP. In TCP/IP this single layer absorbs OSI 5, 6, and 7.
6 · Presentation
No standalone Presentation layer exists on the wire. TLS (IETF RFC 8446) runs inside the application's socket, above TCP and below the app protocol. ASCII-to-EBCDIC translation is a museum artifact.
5 · Session
No distinct Session layer in TCP/IP. The “session” plumbing is the TCP connection itself; the classic examples, RPC and NetBIOS, are application-layer constructs.
4 · Transport
TCP (IETF RFC 9293) segments the byte stream, guarantees ordered reliable delivery, and does flow and congestion control. UDP (RFC 768) is connectionless datagrams. QUIC (RFC 9000) rides UDP with TLS 1.3 built in, in user space, so it spans transport and security rather than sitting cleanly at L4. Correction: TCP does detection plus retransmission, not error correction — there is no FEC at Transport. PDU: segment / datagram. This layer reassembles the stream, not Layer 2.
3 · Network (Internet)
IP (RFC 791 / RFC 8200) stamps each segment with source and destination IP and routes it hop by hop. Routing selects a logical path by destination IP; no single router knows the end-to-end route. IP addresses are end-to-end, fixed origin to destination (NAT rewrites at boundaries is the exception). PDU: packet.
2 · Data Link
Node-to-node delivery across one link, split into LLC (IEEE 802.2) and MAC sublayers. Ethernet (802.3), Wi-Fi (802.11), PPP, and VLAN tagging (802.1Q) live here; ARP is conventionally placed here too (some texts say L2/L3) since it resolves an IP address to a MAC. Layer 2 detects errors and discards — Ethernet's FCS (CRC-32) drops a bad frame without repair; only the 802.11 MAC additionally retransmits. MAC addresses are per-hop, rewritten at every router (via ARP / NDP). PDU: frame.
1 · Physical
Bits into signals over copper, fiber, or radio. A switch is a Layer 2 device, not L1. And Wi-Fi is not L1-only: 802.11 defines both a PHY (the radio) and a substantial MAC at Layer 2. Fiber is genuinely L1; Wi-Fi spans L1 and L2.
Thread A — per-hop versus end-to-end addressing
IP (L3) is end-to-end and fixed; MAC (L2) is per-hop and rewritten at every router. On Ethernet this stays invisible, because a frame carries only two MAC addresses and both are per-hop. Wi-Fi makes it visible: an 802.11 data frame may cross the AP as an intermediary and therefore carries up to four MAC addresses, explicitly separating the per-hop link pair from the end-to-end endpoints. The To DS and From DS bits select the mapping (IEEE 802.11-2020).
// decoder · 802.11 four addresses
Address 1 (RA) and Address 2 (TA) are always the per-hop pair; SA/DA are the endpoints, preserved across the hop.
One capture-reading caveat, verified against the standard: in an aggregated A-MSDU frame, Address 3 always carries the BSSID regardless of the To DS and From DS bits, so check the aggregation bit before trusting Address 3.
Thread B — who detects, who corrects, who retransmits
Three different mechanisms, commonly conflated. Forward error correction lives at the PHY (L1): the 802.11 radio applies channel coding — BCC (mandatory) or LDPC (optional) — to repair bit errors without a retransmission, the only true “correction” in the stack. Detection, and on Wi-Fi retransmission, live at the MAC (L2): the FCS detects a corrupt frame, Ethernet discards it, the 802.11 MAC additionally retries it. End-to-end reliability lives at Transport (L4), where TCP recovers anything the lower layers dropped. No layer above L1 does true correction.
What the 802.11 MAC adds over Ethernet
Since Wi-Fi's Layer 2 is the half that matters, here is what the 802.11 MAC does that the Ethernet MAC does not. This is the “L1 plus a large L2” story in one panel.
// comparison · 802.11 MAC vs 802.3 MAC
Everything in the Wi-Fi column is Layer 2 work Ethernet never does — and it is what fills a Wi-Fi capture.
The corrections, at a glance
OSI is a reference model; the internet runs TCP/IP, where Layers 5–7 collapse into the application.
Presentation and Session are conceptual buckets, not wire layers; TLS runs in the socket, not as a standalone L6.
Transport does detection plus retransmission, not error correction (no FEC in TCP).
IP is end-to-end and fixed; MAC is per-hop and rewritten at every router.
The PDUs are distinct: segment or datagram (L4), packet (L3), frame (L2).
Layer 2 detects errors and discards; only Wi-Fi's MAC additionally retransmits. True correction (FEC) is at the PHY.
Switches are Layer 2, routers are Layer 3.
Wi-Fi is not Layer 1; it is Layer 1 plus a large Layer 2, and the Layer 2 half is where the engineering is.
Governing bodies kept distinct on purpose: OSI is ISO/IEC (7498-1); the protocols (IP, TCP, UDP, TLS, ARP, and the routing protocols) are IETF RFCs; the link technologies (Ethernet, LLC, Wi-Fi) are IEEE (802.3, 802.2, 802.11). Verified against primary sources: TCP RFC 9293, UDP RFC 768, QUIC RFC 9000 / TLS 1.3 RFC 9001, IP RFC 791 & RFC 8200, TLS RFC 8446, ARP RFC 826, NDP RFC 4861; the four-address To‑DS/From‑DS mapping, CCMP (WPA2) and GCMP (WPA3), and PHY FEC via BCC/LDPC per IEEE 802.11-2020.