OSI layers and cybersecurity attacks: what hits each layer and how to defend

Key takeaways

• Attacks and defences are easier to remember when mapped to the seven OSI layers.
• ARP spoofing sits at layer 2, IP spoofing at layer 3, SYN flood at layer 4, and web attacks at layer 7.
• Layered defence means a control at each layer, not one firewall.
• Wireshark display filters make several of these attacks visible in a capture.
• Practise only on your own lab network.

How does the OSI model help in security?

The OSI model splits network communication into seven layers. Security teams use it as a map: when an incident happens, you ask which layer is affected and which control belongs there. If you need a refresher, read what the OSI model is and how it differs from the TCP/IP model.

Which attacks and defences belong to each layer?

Our deeper article on cyberattacks at each OSI layer covers each one.

What does this look like in Wireshark?

Wireshark shows packets from the data link layer upward, so you can see signs of several attacks. Practise on your own lab VMs. The Wireshark documentation explains capture and display filters. These display filters are for spotting problems, not causing them.

• Layer 2, ARP anomalies: arp.duplicate-address-detected flags an IP claimed by two MAC addresses. Compare the MAC against your known device list.
• Layer 4, SYN flood signs: tcp.flags.syn == 1 && tcp.flags.ack == 0 shows connection attempts. A huge count from many addresses with no completed handshakes is the pattern.
• Layer 3, odd ICMP: icmp shows ping and unreachable messages. Bursts can indicate scanning or abuse.
• Layer 7, DNS: dns lists lookups. Unusual names or very long ones may point to tunnelling.
• Layer 6, TLS: tls.handshake shows the negotiated versions, so you can spot outdated protocol use.

How do you run a simple exercise?

1. Build two or three VMs on a host-only network.
2. Start a capture on one VM.
3. Generate normal traffic: ping, browse a local web page, resolve a name.
4. Apply each filter and note what normal looks like.
5. Write down what a deviation would look like. That baseline is what a defender uses.

Never capture or test on a network you do not own or have written permission to monitor.

What is layered defence?

No single control covers every layer. A firewall helps at layers 3 and 4 but does not stop an SQL injection at layer 7. Port security helps at layer 2 but not against stolen credentials. Combine controls and log at each layer.

Common mistakes

• Treating the OSI model as a strict reality. Real protocols blur layers, and TCP/IP is what is actually deployed.
• Putting all trust in one perimeter device.
• Forgetting layer 1 and 2 on internal networks.

Next steps

To practise packet analysis, see our Computer Network course and the CCNA course. For the attack side by layer, read cyberattacks at each OSI layer.