A Practical OSI Model for Diagnosis

Network Troubleshooting

Chapter 2 · A Practical OSI Model for Diagnosis

Chapter 1's four scoping questions narrow a vague complaint down to a rough shape — one user or many, one destination or everywhere. They don't yet tell you which layer of the network is actually broken. That's this chapter's job: a version of the OSI model built specifically for triage, not for an exam — fewer layers, a deliberately practical starting point, and one honest deviation from the textbook order that matters more than it might seem.

Why Not Just Use the Textbook Seven Layers?

The full OSI model — Physical, Data Link, Network, Transport, Session, Presentation, Application — is precise and genuinely useful for understanding how networking software is built, which is exactly why Networking Fundamentals (net1) teaches it in full. But precision isn't what triage needs. In practice, Session and Presentation rarely come up as a distinct troubleshooting step, and Physical is often something you can't even check directly on a remote user's machine. Support diagnosis collapses the seven layers down to five practical categories, each tied to one concrete question and one or two tools you'll cover in depth over the next several chapters.

Practical layerThe one question it answersCovered in
Local connectivityDoes this machine have a working network connection at all — interface up, IP assigned, gateway reachable?Chapter 3
DNS resolutionDoes the name resolve to the IP address it's actually supposed to?Chapter 4
Network reachabilityCan a packet get from here to that IP address at all?Chapter 5
Port / service reachabilityIs something actually listening and accepting connections on the specific port?Chapter 6
Application responseDoes the service reply with the right thing once a connection is made?Chapters 7–9

The One Honest Deviation: Why DNS Comes Before "Network"

Strictly by OSI layer number, DNS is an application-layer protocol (it runs over the network, same as any other service) — so a purist ordering would test raw network reachability before ever touching DNS. This course's practical ladder puts DNS second anyway, right after local connectivity, and it's worth being upfront about why: almost every later test in this ladder needs a correct IP address to test against. If DNS resolves a name to the wrong IP, every network-reachability, port, and application test that follows will faithfully test the wrong destination and produce confusing, misleading results — not because those layers are broken, but because the address itself was wrong from the start. Checking DNS early isn't about OSI purity; it's about not wasting the rest of the ladder on a bad starting address.

Two things deliberately don't fit in the ladder at all
Firewalls (Chapter 7) and proxies/VPNs/NAT (Chapter 8) aren't a single layer — a firewall can filter at the network layer, the transport layer, or inspect all the way up at the application layer, and a proxy or VPN can quietly change which path your traffic even takes before it reaches any of the layers above. Both get their own dedicated chapter specifically because they sit beside this ladder, capable of interfering with more than one rung of it at once, rather than living cleanly on one.

Working the Ladder: Where to Actually Start

A textbook bottom-up review starts at the physical layer — but as a support engineer, you usually can't see a user's cable or link light from where you're sitting, so that step is often not available to you at all. The practical starting point is one rung up: confirm local connectivity is basically sane (Chapter 3 covers exactly how, remotely), then work upward one rung at a time, stopping the moment you find the first rung that fails. The first failure you find is very often the actual problem — not always, but often enough that it's the right place to start looking closely before moving further up.

Don't test the top of the ladder before the bottom
It's tempting to jump straight to the application — open a browser, try the exact thing the user tried, see it fail, and start reading application logs or debugging application code. If DNS or network reachability was the actual problem, none of that time was wasted on the real cause, because the application was never going to work regardless of what's inside it. Confirm each rung below "application" is fine first; it usually takes less time than one detour into the wrong codebase.

Working Example: Walking the Ladder on Chapter 1's Complaint

Chapter 1 left a ticket open: "I can't reach the app," with a ping that timed out. Suppose this time the ping actually succeeds — walking the ladder from the bottom:

$ ping app.example.com PING app.example.com (203.0.113.42): 56 data bytes 64 bytes from 203.0.113.42: icmp_seq=0 ttl=54 time=11.204 ms 64 bytes from 203.0.113.42: icmp_seq=1 ttl=54 time=10.887 ms $ telnet app.example.com 443 Trying 203.0.113.42... telnet: Unable to connect to remote host: Connection refused

Local connectivity: fine, since the ping left this machine and came back. DNS: fine, since the name resolved to the expected IP. Network reachability: fine, since the ping actually got a reply this time, unlike Chapter 1's example. The first rung that fails is port/service reachability — something on the far end is actively refusing the connection on port 443, rather than the packet simply going nowhere. That's a genuinely different, much narrower problem than the one in Chapter 1, and Chapter 6 covers exactly what "connection refused" does and doesn't tell you about what's happening on the other end.

"Refused" and "timed out" are not the same failure
A quick preview worth holding onto until Chapter 6: a refused connection means something on the far end actively responded to say no — usually nothing is listening on that port. A timeout means no response came back at all, which is more consistent with a firewall silently dropping the traffic or the packet never arriving. The two look similar at a glance but point in different directions.

What This Buys You

The practical ladder doesn't replace the four scoping questions from Chapter 1 — it comes after them. Scoping tells you roughly what kind of problem you're looking at (one user vs. many, new vs. persistent); the ladder tells you specifically which layer is responsible, by testing from the bottom and stopping at the first failure. Together they turn "I can't reach the app" into a precise, evidence-backed statement like "DNS and network reachability are both fine, but port 443 is refusing connections" — which is a genuinely different, far more actionable ticket than the one that came in.

Hands-On Exercises

Exercise 1

Explain why this chapter's practical ladder checks DNS resolution before raw network reachability, even though DNS is formally an application-layer protocol sitting above the network layer in the textbook OSI model.

📄 View solution
Exercise 2

A colleague's first troubleshooting step for "I can't reach the app" is opening the app directly and reading its logs. Explain why this chapter would consider that risky as a first step, and what to check before it.

📄 View solution
Exercise 3

In this chapter's worked example, DNS resolves correctly and the ping succeeds, but a connection to port 443 comes back "connection refused." Explain which rung of the ladder this points to, and why it's a narrower, different problem than Chapter 1's timed-out ping.

📄 View solution

Chapter 2 Quick Reference

  • The practical ladder: local connectivity → DNS resolution → network reachability → port/service reachability → application response
  • Session and Presentation are collapsed away; Physical is skipped as a starting point because it's rarely checkable remotely
  • DNS deliberately comes before raw network reachability — every later test needs a correct IP to test against
  • Firewalls and proxies/VPNs/NAT don't fit cleanly into one rung — they can interfere with several at once, hence their own dedicated chapters (7 and 8)
  • Work the ladder bottom-up and stop at the first failing rung — don't debug the application before confirming everything below it is fine
  • "Refused" ≠ "timed out" — refused means an active no; timed out means no response at all (Chapter 6 covers the difference in full)
  • Next chapter: Local Connectivity: Interfaces, IP Configuration & the Default Gateway