Third session: the OSI model from module 3. These exercises train something different from the previous ones — not one specific protocol, but the mental map that orders them all and the language professionals use to narrow problems down ("that's layer 2", "smells like layer 6"). You will practice the classic assignments (protocols, devices, PDUs), diagnosis from symptoms, the borderline cases that don't quite fit, and the table exam that sooner or later will be put in front of you in an interview or certification. Scenarios: Meridiano, with its VLAN switch, plus a visit or two to Clínica Azahar.

• Answer before looking at the solution, which sits right below. In the classification ones, also write the why of each assignment: a layer without an argument is forgotten; with an argument, it sticks.
• In the diagnosis ones, state the layer and the evidence that leads you there, as you would in front of a colleague.
• 📌 marks which lesson to review if you get one wrong. The eight lessons of module 3 (03-01 to 03-08) are this session's exact syllabus: there is nothing here that isn't there.

Place each protocol in its OSI layer (if any of them resists a single layer, say so and explain why — that's not cheating, that's reality):

HTTP · TCP · IP · Ethernet · DNS · UDP · ICMP · SMTP · TLS · ARP

📌 Review if you struggled: lessons 03-01 to 03-08.

Frequent mistakes: placing DNS at layer 3 "because it deals with IP addresses". DNS returns IPs, but it is an application like any other: client, server, a port (53), requests and responses. The layer is decided by how it works, not by what it talks about.

Which OSI layer does each device's main function belong to, and what decision does it make (or not make) with what arrives?

1. The repeater that regenerates the signal on a long run at the clinic.
2. An old hub found in a drawer at Meridiano.
3. The switch in the Valencia office.
4. The router 192.168.10.1.
5. The Wi-Fi access point.

📌 Review if you struggled: lessons 03-02, 03-03 and 03-04.

1. Layer 1. It understands nothing of what passes through it: it regenerates signals, bit by bit. Zero decisions.
2. Layer 1. However many ports it has, it is a multiport repeater: it repeats everything out every port. That is why one hub = one single collision domain.
3. Layer 2. It reads the frames' MACs and decides which port to forward out of using its MAC table. It separates collision domains, but not broadcast domains (broadcasts still reach everyone... within the same VLAN).
4. Layer 3. It reads the packets' IPs and decides the next hop with its routing table. It separates broadcast domains.
5. Layer 2. It bridges the wireless and wired media, working with frames and MACs; it does not route between networks.

Fill in the blanks: as Marta's request to the intranet goes down the stack, what is the data unit called at each point?

1. What HTTP hands downward.
2. What the transport layer builds.
3. What the network layer builds.
4. What the data link layer builds.
5. What physically travels along the cable.

And one more: is "TCP packet" a correct expression?

📌 Review if you struggled: lesson 03-01.

1. Data (layers 5-7 don't rename it).
2. Segment (with TCP; datagram if it's UDP).
3. Packet.
4. Frame.
5. Bits (signals).

"TCP packet" is, strictly speaking, incorrect: TCP produces segments; the packet is IP's PDU. You hear it constantly and everyone understands it, but in an exam — and when communicating precisely — the protocol-PDU pairing matters: TCP segment, IP packet, Ethernet frame.

For each incident, state the most likely OSI layer of the problem and what points you to it:

1. Ana's PC shows "network cable unplugged"; the port LED is off. Her desk was moved yesterday.
2. In a report downloaded from the intranet, all the accented characters show up as ó and á.
3. Marta can ping the server by IP, but when she opens the application it instantly answers "connection refused" on port 8443.
4. The intranet asks Jon to sign in again every two minutes, even though the network is running perfectly.
5. Nobody in the office can open any website by name, but ping 8.8.8.8 works on every machine.
6. Between two machines plugged into the same switch and in the same VLAN, one with IP 192.168.10.30 and the other with 192.168.11.40, there is no communication — even though both have link and their LEDs are blinking.

📌 Review if you struggled: lessons 03-02 to 03-08.

1. Layer 1. LED off = no signal on the medium. With a recent desk move, the suspect is the cable (loose, damaged, or plugged into another wall jack). There is no point looking any higher until this is resolved.
2. Layer 6 — presentation. The classic encoding problem: the text was generated in UTF-8 and is being interpreted with a different character table. The network transported the bytes perfectly; what's broken is their interpretation.
3. Layer 4. The ping (layer 3) works: network and everything below it, ruled out. An immediate "connection refused" = the host is alive and answers that nobody is listening on that port (or a firewall rejects it). The service is down or misconfigured — and remember the difference: a closed port answers instantly; a dead host, silence and timeout.
4. Layer 5 — session. Communication works; what's being lost is the state of the dialogue (the signed-in session, the cookie that remembers it). A typical session-expiry or session-management problem in the application.
5. Layer 7 — the DNS service. IP connectivity is intact (the ping to 8.8.8.8 proves it); what fails is name resolution, which is an application service. It affects everyone → look at the DNS server everyone uses.
6. Layer 3. Link and physical work (same VLAN, LEDs blinking), but 192.168.10.30 and 192.168.11.40 are on different IP networks (with a /24 mask): each considers the other "remote" and sends its traffic to the gateway instead of talking directly. An addressing error: same cable does not mean same network.

Frequent mistakes: in case 5, rushing to "the Internet is down" and rebooting the router. The working ping is gold: it proves layers 1-3 are healthy and corners the problem up high. Let each piece of evidence rule out layers before touching anything.

State which layer (or layers) of the OSI model you are mainly checking when you:

1. Look at whether the switch port LED is blinking.
2. Run arp -a and check whether the gateway's MAC shows up.
3. Run ping 192.168.10.10.
4. Run ss -t and look for a connection in the ESTABLISHED state to port 443.
5. Run nslookup intranet.grupomeridiano.example.

📌 Review if you struggled: lessons 03-01 to 03-08 (and module 6 for the tools).

1. Layer 1: there is or there isn't a physical signal.
2. Layers 2-3: ARP lives right at that seam; if the gateway's MAC shows up, IP→MAC resolution on your local network works.
3. Layer 3 — and as a bonus it validates 1 and 2 up to that destination: a ping with a reply certifies the whole round trip at the network level.
4. Layer 4: you are looking at the state of the TCP connection, no higher (you don't know whether HTTP works) and no lower (the connection could be established over a link that just went down).
5. Layer 7: the DNS service. Resolving doesn't guarantee you can connect; not resolving doesn't mean there is no network.

The point of this exercise is the point of all of module 6: each tool lights up one floor of the building, and choosing the tool is choosing which floor you inspect.

Meridiano Valencia's switch has VLAN 10 (corporate) and VLAN 20 (guests). A visitor plugs their laptop into a VLAN 20 port.

1. How many broadcast domains are there on that switch? And collision domains, if it has 24 active ports?
2. The visitor's laptop sends out its DHCP Discover as a broadcast. Does it reach Marta's PC (VLAN 10)? Why?
3. An absent-minded technician moves the printer's port to VLAN 20. What happens to the office, and at which layer would you classify the problem?
4. What device would be needed for a VLAN 20 machine to reach, in a controlled way, a resource on VLAN 10?

📌 Review if you struggled: lesson 03-03.

1. Two broadcast domains — each VLAN is one, as if they were two separate switches inside the same box. Twenty-four collision domains: on a switch, every port is its own.
2. No. Broadcasts stop at the VLAN boundary: the visitor's Discover is only seen by VLAN 20 ports. That is exactly the design's purpose — guests can't even "see" the corporate network.
3. The printer stops being reachable from the corporate machines: it is still powered on, with link and with its IP, but it lives in another broadcast domain (neither its traffic nor ARP toward it crosses the boundary). It is a layer 2 problem — VLAN configuration — wearing the misleading disguise of "the printer is broken". This pattern (everything looks fine on the device, but it's in the wrong VLAN) is one of the biggest time thieves for whoever doesn't know it.
4. A layer 3 device — a router (or the switch itself if it can route) connecting both networks, where you can control which traffic crosses. VLANs separate at layer 2; joining them selectively is layer 3's job.

Argue briefly, as you would in a technical conversation, where you would place each one and why it's fine that the answer isn't a round number:

1. ARP.
2. TLS.
3. Marta's browser as a "network application".

📌 Review if you struggled: lessons 03-01, 03-06, 03-07 and 03-08.

1. ARP: between 2 and 3. Its function is layer 2 (obtaining the MAC to build the frame, never crossing routers), but it talks about layer 3 addresses (it asks about an IP). Saying "2/3 boundary" is not indecision: it is describing it accurately.
2. TLS: between 5 and 6. It establishes and manages a secure dialogue with its own handshake (session) and encrypts and transforms the data flowing through it (presentation). In the real world hardly anyone assigns it a number: people say "TLS sits between TCP and the application", and everyone understands the exact spot.
3. The browser merges layers 5, 6 and 7. It manages sessions and cookies (5), interprets encodings, decompresses and renders (6), and speaks HTTP (7) — all in one program. OSI's upper layers describe functions, not separate programs; that one piece of software implements them together doesn't invalidate the model, which remains useful for pointing at which function is failing.

The moral: OSI is a map, not the territory. The borderline cases are not failures of the student or of the model; they are proof that you know how to use the map with judgment instead of reciting it.

Fill in the empty cells. It is the classic exam and interview format — do it without looking anything up:

📌 Review if you struggled: lesson 03-01 (and the lesson of whichever layer you miss).

Layers 5-7 have no typical device: they live in the software at the endpoints. If you filled in the whole table without hesitating, you have the OSI model where it belongs: in working memory, ready to use.

Frequent mistakes: crossing PDUs (frame at layer 3, packet at layer 2). Retention trick: from the bottom up, bits, frames, packets, segments — "Big Frogs Prefer Swamps".

OSI session complete: you have placed protocols and devices on their floor, named every PDU, translated six real symptoms into their guilty layer, understood which floor each tool lights up, played with VLANs and broadcast domains, defended the borderline cases like a professional and filled in the exam table from memory. The model has stopped being a drawing of seven boxes and become what it always wanted to be: your coordinate system for thinking and communicating. The next session holds it up to the mirror: exercises on the TCP/IP model, the one that actually runs on the machines — with routing tables, connection states and the complete flow of an HTTPS request from start to finish.