Which Layer Is Your Problem At? (OSI Model)

easy

Learn with your AI

Pick a depth. Each prompt opens in your AI pre-loaded with the lesson. Click a row to preview the prompt.

Or teach me the whole lesson:

Why this matters

Cloud load balancers, firewalls, and proxies are sold by layer — an L4 NLB behaves nothing like an L7 ALB, and pricing reflects it. If you can't articulate which layer a problem lives at, you'll reach for the wrong service and pay for headers you never inspect.

Demo

Inspect how AWS exposes layer-3 routing, layer-4 NLB, and layer-7 ALB as distinct primitives.

Try it yourself

Run the L3 route-table command and identify which destination CIDR routes to your internet gateway vs a NAT.
List both NLBs and ALBs in your account and note which ones have listeners on port 443 with TLS termination (L7 only).
Pick one ALB rule and trace which OSI layer the rule's match condition operates at (host header = L7, source IP = L3/L4).

References

# Layer 3: route table (IP-level forwarding)
aws ec2 describe-route-tables \
  --query 'RouteTables[0].Routes[*].[DestinationCidrBlock,GatewayId]' \
  --output table

# Layer 4: Network Load Balancer (TCP/UDP, no header inspection)
aws elbv2 describe-load-balancers \
  --query 'LoadBalancers[?Type==`network`].[LoadBalancerName,Scheme]'

# Layer 7: Application Load Balancer (HTTP host/path routing)
aws elbv2 describe-listeners \
  --load-balancer-arn <alb-arn> \
  --query 'Listeners[*].[Protocol,Port,DefaultActions[0].Type]'