The OSI model

The OSI model typifies the stream of data in a network, from the physical connections at the lowest layer up to the layer that has the user’s applications. Data passing through the network is passed from layer to layer, and each layer has the ability to communicate with the layer directly above it and the layer directly below it. Each layer written is a capable streamlined software component and when a layer receives a packet of information, it checks the target address and if its corresponding address is not there it passes the packet to the following layer. Merkow, M. & Breithaupt, J. (2006)

The seven layers of the OSI model

Physical layer

The physical layer, the lowest layer of the OSI model, is concerned with the transmission and reception of the unstructured raw bit stream over a physical medium. It describes the electrical/optical, mechanical, and functional interfaces to the physical medium, and carries the signals for all of the higher layers.

Data link layer

The data link layer provides error-free transfer of data frames from one node to another over the physical layer, allowing layers above it to assume virtually error-free transmission over the link.

Network layer

The network layer controls the operation of the subnet, deciding which physical path the data should take based on network conditions, priority of service, and other factors.

Transport layer

The transport layer ensures that messages are delivered error-free, in sequence, and with no losses or duplications. It relieves the higher layer protocols from any concern with the transfer of data between them and their peers.

Session layer

The session layer allows session establishment between processes running on different stations. It provides session establishment, maintenance and termination which allow two application processes on different machines to establish, use and terminate a connection, called a session, and session support which performs the functions that allow these processes to communicate over the network, performing security, name recognition, logging, and so on.

Presentation layer

The presentation layer formats the data to be presented to the application layer. It can be viewed as the translator for the network. This layer may translate data from a format used by the application layer into a common format at the sending station, and then translate the common format to a format known to the application layer at the receiving station.

Application layer

The application layer serves as the window for users and application processes to access network services. This layer contains a variety of commonly needed functions like resource sharing and device redirection, remote file access, remote printer access, inter-process communication, network management, directory services, electronic messaging (such as mail), and Network virtual terminals. Kretchmar (2003)

At which layers of the OSI model do packet-filtering routers and firewalls reside and how do packet-filtering routers and firewalls protect a network?

Packet filtering firewalls and routers examine both the source and destination address of the incoming data packet and operates at different layers which use different criteria’s to restrict traffic. The lowest layers at which a firewalls and routers can work is layer three and four, the network and transport layers. The network layer is concerned with routing packets to their destination. At this layer a firewall can determine whether a packet is from a trusted source, but cannot be concerned with what it contains or what other packets it is associated with. Firewalls that operate at the transport layer know a little more about a packet, and are able to grant or deny access depending on more sophisticated criteria. At the application level, firewalls know a great deal about what is going on and can be very selective in granting access. Kretchmar (2003)

Packet filtering is the simplest packet screening method. A packet filtering firewall does exactly what its name implies, it filters packets. The most common implementation is on a router. The packet filtering process is accomplished in the following manner. As each packet passes through the firewall, it is examined and information contained in the header is compared to a pre-configured set of rules or filters, allowing or denying decisions are made based on the results of the comparison. Each packet is examined individually without regard to other packets that are part of the same connection. A Packet filtering firewall uses firewall rules set to allow or deny packets. Packet filtering routers and firewalls are often called network layer firewalls because the filtering is primarily done at the network layer (layer three) or the transport layer (layer four) of the OSI reference model. Lipták (2002)

Conclusion

A network security domain is a contiguous region of a network that operates under a single, uniform security policy. Whenever domains intersect, there is a potential need for security to control traffic allowed into the network. Firewall technology in the OSI model can be used to filter this traffic. The most common boundary where firewalls are applied is between an organization’s internal network and the internet.

References

Instrument engineers' handbook, Béla G. Lipták, ISA--The Instrumentation, Systems, and Automation Society 2002 Retrieved July 3, 2009

Chapter 12, Telecommunications, Network, and Internet Security Information Security: Principles and Practices, by Mark S. Merkow and Jim Breithaupt. Copyright © 2006 by Pearson Education, Inc. Retrieved July 3, 2009

Open Source Network Administration, Prentice Hall Series in Computer Networking and Distributed Systems, James M. Kretchmar 2003, Retrieved July 4, 2009