OSI Model – Where OSI Model Layers Operate in the Operating System

arpipv4ositcp

The OSI model describes them as layers. But where do these layers actually operate in the operating system? For example, where and what actually does TCP? All these layers are described as using protocols or "rules", but how is the rule implemented? Does it all happen at the NIC? Is there a specific service running in the background that handles each protocol?

I can see that DHCP and DNS are run by services in the background of the windows operating system when I open up task manager. That's nice and easy to understand. Does TCP have its own background service or is it actually implemented in the code of an application using a network library? The same goes with ARP, IP and Ethernet. Does the NIC have a program running that handles ARP, IP, and Ethernet and where exactly?

Best Answer

First off the OSI model is a theoretical model, it doesn't nessacerally exactly match up with reality. Also generally layer models only show layers that actually add or remove something from the packet.

The following answer omits some minor details. Also some details may vary between operating systems, I have the most experiance with linux, some stuff may be different on other operating systems.

This answer also focuses on the basic set-up, many modern network controllers have "offload" features where features that were traditionally the responsibility of the OS kernel are taken over by the network controller.


The network controller is logically divided into two parts, the "MAC" and the "PHY". In some cases MAC and PHY may be integrated into the same chip.

The PHY does the following.

  • Converting between the wire-level encoding and a stream of binary data units.
  • Detecting when the line is busy (for half-duplex physical layers).
  • Detecting the start and of incoming frames.
  • Generating special wire-level encodings for the start and end of frames.

The MAC does the following.

  • Translating between data streams at wire-rate and frames in a buffer that the OS can read/write.
  • Generating/checking/stripping the preamble and FCS.
  • Notifying the OS through interrupts when incoming frames have been delivered to the buffer.
  • Implementing Medium access control if needed.
  • Fitering incoming frames by destination MAC address.

The Kernel implements the following.

  • Talking to the MAC (using a driver module).
  • Building and interpreting Ethernet frames (minus the preamble and FCS).
  • Implementing ARP (or ND for IPv6) to translate between IP and MAC addresses.
  • Implementing building and interpretation of IP packets.
  • Forwarding packets to the correct interface based on a routing table.
  • Packet filtering, NAT etc.
  • Major transport protocols like TCP and UDP.
  • Some parts of ICMP.

Daemons and tools running outside the kernel but considered to be part of the OS implement.

  • DHCP
  • DNS cache (if used).
  • Diagnostics like ping and traceroute.
  • Configuration of kernel features.

Libraries loaded by the application are generally used to implement stuff that runs on top of TCP/UDP including:

  • SSL/TLS
  • DNS
  • HTTP
Related Topic