OSI Layers and Wireshark

There really is some core knowledge that we should have to fully understand the data that Wireshark is presenting to us and to be able to analyze that data, and that is, we have to have some knowledge around the OSI model and the different layers of the OSI model.

It's beyond the scope of this course to really have a deep dive into the OSI model and what it's all about, but this is going to give you some core information, some core base knowledge around the OSI model, to be able to start interpreting the Wireshark data. What I will add is that one of the best ways to learn about the OSI model and the different layers within the OSI model is to use Wireshark as a learning tool.

So we're going to talk more about data communication, and then we'll talk about the OSI model and the different layers of the OSI model, and then we'll get into Wireshark and how it applies to Wireshark.

Downloading a Game

We're going to use an example of downloading a game. If you went out to the internet and downloaded a game, you're going to be downloading those bits, those ones and zeros. We're going to represent this game as this block right here. It's a block of data, it's ones and zeros, ones and zeros, that we're going to download. Once it's on our computer we'll actually execute it, because it's a program, and it will install a game onto our computer. But essentially it's just data, it's ones and zeros.

Now, a lot of our communication lines only allow a single stream of data to be sent at any given time. This presents a problem when we have a block of data. If we were to download all of this data all at once with no breaks at all, then what that would mean is that no one else on that line can communicate at that same time. So if you're taking hours to download your game, no other communication can happen at that same time. In addition, if there was ever any kind of error or issue when this communication is happening, you'd have to start all over with this download.

Breaking Data Into Chunks

To solve this problem, we break up the data into smaller chunks. This allows us to intermix other communication along with our downloading this game, and that other devices now can still communicate while we're downloading the game. This also has an added advantage: that if something gets lost along the way — and this happens often — then we can just request that bit of data rather than downloading the whole game over again. When you get into Wireshark you'll actually be able to see all of those different communications that are happening. One of the views is going to allow us to see all of this back and forth communication and this downloading of information.

Sequencing

Now we've created a little bit of a problem. As this data gets sent back over to the other side, it could arrive in a different order and the sequence could be all off, and so somehow we need to label this different data so it can be reassembled in the correct order when it gets over to the other side. So we add information to this — we add information which includes a sequence number, so it can get reassembled on the other side.

Addressing

But we have another problem. I can't just drop a letter in the mail and expect it to get to wherever its destination is without some sort of addressing. Let's say this is the machine we're downloading the game onto, and this is the server that we're downloading it from. We need to somehow get our information, our request, to the server and then get the information back, so we need some sort of addressing.

So here's our data, and here's our sequencing number, and what we need to do is add an address to this information so that way it can get to its destination. We need to add it to every single data packet that we're going to be sending, because they're going to be sent individually, so we need to add the address to each one of these.

There is other information that gets added to this as well, such as an address that gets added to it. I'm not going to go into the differences between these two addresses that get added to it, but just realize that there's a secondary address that gets added to it for local communication.

Trailers and Signaling

Another thing that we add to this is what we call a trailer, and it's just a check to verify nothing has changed. Sometimes this information in here gets corrupted, and so this is just a validation to make sure that nothing has changed during transmission.

There is some signaling that happens when we actually send the bits as well. It's like a little wake-up signal for the other device saying, hey, wake up, you're going to be receiving some data. So we tack that in right at the beginning.

I will say that this is an oversimplification. I left a lot out when it comes to the information found in each one of these little sections here — that is, this is not just a sequence number, and in fact there's a lot of cool stuff that happens in this little section right here.

Names for the Sections

We have different names for the different sections of this, although many times you'll just hear this being referred to as a packet, even though technically speaking there's just a section of this that is the actual packet. Each one of these has their own name.

So for instance, if we talk about the data section of this, it's just called data. But we add the sequence number to it, and we now call it a segment. You add the first address to this and now it's a packet. You add the second address and the check at the end, and now we call that a frame. And finally, all of it together, we just call bits.

As we add more to this, we're adding layers, and we put numbers to those layers. So for instance, this first one, we start with the data — that's actually layer 5 through 7, and I'm not going to get into the reasons why it's multiple layers there, but we often find that there is multiple layers within the data section of this. And then we add a layer four to this, and then we add layer three to it, and then add a layer two, which is both at the beginning and the end here, and then a layer one.

You may hear the term header or trailer. A trailer is just the end here — if it comes at the end, that's a trailer — and the header comes at the beginning. So this would be the layer four header, this is the layer three header, the layer two header and the layer one header.

Each of these layers also have a name. Layer one is the physical layer, layer two is the data link layer, layer three is the network layer, layer four is transport, and layers 5 through 7 then is considered the application layer.

A Summary Table

Here's a table summarizing a lot of the concepts we just talked about. For instance, here are the layer numbers 1 through 7, and then we have the name of each one of those layers. I had mentioned that layers 5 through 7, a lot of times we just group that up and just call it the application layer, so you'll see that quite often.

Then with that we see the data types here, so we have a segment, packet, frame and bit. And then visually what those look like: we've got data, at some point in time we break it apart into segments, we add the header to the front of it, and then we add a layer three header to that, and then we add the layer two header and trailer to that, and then we just have the bits going across the line.

Another thing that we see here is some examples, and the examples are different protocols that we use. One of the advantages of the OSI layer is that we can start developing and improving things — for instance, moving from IP version 4 to IP version 6 without affecting all of these other technologies that are above and below it. So we're able to advance things at a faster rate because of this layered system.

Each one of these layers has specific functions that it carries out. Like this layer four, we mentioned, does the sequencing; it also has some sort of verification involved with it, an acknowledgement that allows it to retransmit data that's lost. The network side of this allows us to communicate on the global scale, versus the data link layer, which is more on a local scale and allows us to communicate locally.

Seeing the Layers in Wireshark

When you get into Wireshark you'll be able to select a packet and then be able to see the different layers within that packet. This is one of the views from Wireshark where we see all of the different layers within the packet.

Now, the name that you're going to see might vary a little bit — it might not be exactly the names that we just covered. For instance, for a physical layer you're going to see frame in there. From a data link you may see Ethernet 2. From a network layer you might see Internet Protocol version 4. From a transport layer you may see Transmission Control Protocol. That's because it's the specific protocols that are being used at each one of these layers. You're going to see things like HTTP and TCP, the IP version 4 and Ethernet.

Here's where we can use Wireshark to better understand the OSI model and these different protocols. What you can do is, you see these different layers here, we can open up layer three — and in this example right here it's Internet Protocol version 4 — and within here we can see all of the information that's being transmitted across here, to include the source address where it's coming from and the destination address where it's going to.

So really, by better understanding the OSI model layers, you're going to be able to better understand Wireshark and what's being presented to you. And what is being presented by Wireshark will allow you to better understand the OSI model layers. Both of which allow you to better understand data communication and how computers and devices on the internet communicate.