TechKnowSurge
CompTIA Network+ 1.1 Cisco CCST Networking 5.2 Cisco CyberOps Associate 4.8 Cisco CCST Networking 1.1 Cisco CyberOps Associate 4.6
TechKnowSurge Catalog Videos DEMO: OSI Layers on Wireshark
VideoNetworkFree

DEMO: OSI Layers on Wireshark

Wireshark reveals OSI model layers within a captured network packet, showing how HTTP, TCP, IP, and Ethernet headers each contribute distinct information at their respective layers. Layer 1 data is absent from captures because NICs discard the preamble before processing begins.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Wireshark provides a practical view of OSI model layering by allowing inspection of each protocol header embedded within a captured packet. Using an HTTP GET request sent from a laptop to an Apache web server running on a Raspberry Pi, the packet details pane breaks down exactly which information each layer contributes and where it sits within the overall frame structure. This kind of hands-on packet analysis reinforces the theoretical model by connecting abstract layer definitions to real, observable data. At the application layer, the HTTP GET request identifies the destination resource and target IP address. Moving down to the transport layer, TCP adds source and destination port numbers — port 80 in this case, indicating standard web traffic — along with sequence and acknowledgment numbers that manage reliable delivery. The network layer contributes the IPv4 source and destination addresses, while the data link layer provides the Ethernet source and destination MAC addresses used for local network communication. Layer 1 physical signaling, specifically the Ethernet preamble used to synchronize communication between network interface cards, does not appear in Wireshark captures. NICs process and discard that preamble immediately upon receipt, before the frame is passed up for software-level inspection. The top entry in Wireshark's packet details pane may appear to represent Layer 1, but it is actually a summary of the entire captured frame rather than physical layer data. For practical analysis purposes, the meaningful layers to examine are 2 through 4 and 5 through 7.

What you'll learn

What's covered

Wireshark OSI Layers

Aligned to

CompTIA Network+
1.1 Explain concepts related to the Open Systems Interconnection (OSI) reference model.
Cisco CCST Networking
5.2 Perform a packet capture with Wireshark and save it to a file
1.1 Identify the fundamental conceptual building blocks of networks
Cisco CyberOps Associate
4.8 Interpret the fields in protocol headers as related to intrusion analysis
4.6 Extract files from a TCP stream when given a PCAP file and Wireshark

Key terms

Open Systems Interconnection Model
OSI
A conceptual framework that standardizes network communication into seven distinct layers.
Encapsulation
The process of wrapping data with protocol headers as it passes down the layers of the OSI model.
Data Link Layer
Layer 2 of the OSI model responsible for node-to-node data transfer and error detection on a single network segment.
Network Layer
Layer 3 of the OSI model, responsible for logical addressing and routing data packets between networks.
Transport Layer
Layer 4 of the OSI model, responsible for end-to-end communication, flow control, and error recovery.
Application Layer
The topmost layer of the OSI model (Layer 7) that provides network services directly to end-user applications.
Transmission Control Protocol
TCP
A connection-oriented transport protocol that ensures reliable, ordered, and error-checked delivery of data.
Media Access Control
MAC
A sublayer of the Data Link layer that controls how devices on a network gain access to a medium and transmit data.
Port
A logical endpoint for communication in a network, identified by a number that specifies a particular service or application.
Packet
A unit of data formatted for transmission over a network, containing a header, payload, and sometimes a trailer.
Wireshark
Wireshark is an open-source network protocol analyzer that captures and interactively displays packet-level traffic, used by security professionals for network forensics, vulnerability research, and incident investigation.
Hypertext Transfer Protocol
HTTP
An application-layer protocol that defines how web browsers and servers communicate to request and deliver web pages and other content, operating over TCP on port 80. HTTP transmits data in plaintext, which is why it has been largely replaced by HTTPS for sensitive content.

Transcript

Let's take another look at Wireshark and see those different layers, the different OSI model layers within Wireshark.

The captured traffic

I have Wireshark open and I already captured some data going between this demo laptop and my Pi. I've got Apache running on the Pi and it's serving out websites, and so it made this request. Just notice here at the top, this is the handshake that happens, that TCP makes before we make the request. And then we see this first HTTP traffic going across back and forth. It's a get command, so it's asking for this website. So this is the one I'm going to use as the example. This is the packet, and down here below, these are the different layers.

Layer 7 - HTTP

So let's first of all take a look at the hypertext transfer protocol. This is layer 7 on here, or layer 5 through 7. I can open this up and take a look at some of the details of this. It's going to ask for things like, this is the actual request it's asking for, is for 10.1.0.3. So there it is, that's the layer 7 at work there.

Layer 4 - TCP

Then we go down to layer 4, that's added to there, and I said it adds a port to it, so we see the port number here. In fact, actually the destination port is the one we're looking at. So this is web traffic, so it's port 80.

Also I mentioned the sequence number, so we see the sequence number right here. I also mentioned that the sequence number can look a lot different; we'll explain that in another lesson. But we're just taking a look at this sequence number, that's a relative sequence number. It's kind of interesting how Wireshark displays it, it's a cool feature of Wireshark.

So then we also have an acknowledgement number that's happened, and I've also mentioned that in one of my prior lessons. So there's some of the data that we find on the TCP, the layer 4. As I mentioned before, I think the TCP layer is really cool. There's a lot of cool stuff that happens in it. The other layers are pretty cool too, but some of them are kind of boring. The TCP has a lot of cool stuff in it.

Layer 3 - IP

So now we get to the internet protocol. This is IP version 4, this is our layer three. We see that the big key here is just the source and destination address. No surprises there. So that's what we see there. I'm going to close that.

Layer 2 - Ethernet

Then we've got our Ethernet, so I'm going to open up the Ethernet, and that's the MAC address. It's communicating Ethernet here, so we see the source and destination MAC addresses there. So that makes sense right there. And then I can close that out.

Layer 1

Now the one thing that we are missing here is that layer one. The layer one for Ethernet is that preamble, the little ones and zeros that get sent over, so that way one NIC can wake up the other side and say, hey, I'm starting to talk, please listen to me. So that doesn't get captured in here, probably because the NICs just take that in, it wakes up and then it discards it right away and then starts processing the rest of the frame.

So at the top here, it looks like it could be a layer one, but technically this isn't really the layer one. We could represent it as being the layer one, but when we look through it, it's actually just some detail, some summary information about this whole Ethernet frame. Just to prove the point here, I can click on the top here and it highlights all of the frame details. So it's just a highlight of all of the frame details, so you can ignore that for the most part right there. We are more concerned with these other layers, layers two, three, four and seven, or five through seven.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →