Layer 6 – Presentation ■ Focus

Encryption, Compression, Translation

OSI Model • Layers 5 – 7
Layer 5 – Session Session Management, Sync, Dialog

Layer 4 – Transport TCP, UDP

OSI Model
Layer Overview
3 – Network IP, ICMP, OSPF
The OSI (Open Systems Interconnection) model divides network communication into 7 layers. This note
LayerLayers
covers 2 – Data Link
5, 6, Ethernet,
and 7 — the upper layers responsible for session management, PPP, Frameand
data formatting,
user-facing applications.
Layer 1 – Physical Cables, Hubs, Signals

Fig 1: OSI Model — Highlighted layers (5-7) are covered in this note.

SECTION 1 — Session Layer (Layer 5)

1.1 Description
The Session Layer is responsible for establishing, managing, and terminating communication sessions
between applications on different hosts. It provides the mechanism for opening, closing, and managing a
session — a semi-permanent dialogue — between end-user application processes.
Session Layer – Three Phases of Communication
1.2 Functions of the Session Layer
• Session Establishment, Maintenance & Termination — sets up, controls, and ends sessions.
Establishment
• Synchronization — inserts checkpoints (syncData Transfer
points) Termination
into data streams to allow recovery.
Synchronization Checkpoints
• Dialog Control — manages half-duplex or full-duplex communication between processes.
Three-way Token Graceful
• Token Management — prevents two parties from attempting the same critical operation
Handshake Management Close
simultaneously.
• Activity Management — groups messages into logical activities/units of work.
• Exception Reporting — notifies the presentation layer of exceptions.

Fig 2: Session Layer — Establishment → Data Transfer (with sync points) → Termination.

1.3 Session Layer Protocols

Protocol Full Name Use Case

NetBIOS Network Basic Input/Output System Windows LAN session management

RPC Remote Procedure Call Executing procedures on remote servers

PPTP Point-to-Point Tunneling Protocol VPN tunneling sessions

L2TP Layer 2 Tunneling Protocol VPN with IPSec security

SIP Session Initiation Protocol VoIP call setup & tear-down

H.323 ITU H.323 Multimedia conferencing sessions

SOCKS SOCKet Secure Proxy-based session routing

1.4 Working of Session Layer

When two applications want to communicate, the session layer follows these steps:
• 1. Connection Request — Application A requests a session with Application B via the session layer.
• 2. Negotiation — Both sides negotiate parameters (duplex mode, sync points, token usage).
• 3. Session Opened — A unique Session ID is assigned; data transfer may begin.
• 4. Sync Point Insertion — Periodically, sync points are placed so transfer can resume from a
checkpoint on failure.
 • 5. Token Passing — For half-duplex, a "token" controls who transmits at any time.
• 6. Session Termination — Either side initiates graceful close; all resources are freed.
■ Key distinction: The Transport Layer manages end-to-end connections; the Session Layer manages
application-level dialogues which may span multiple transport connections.
 Presentation Layer – Data Transformation Pipeline

SECTION 2 — Presentation Layer (Layer 6)

Sender Receiver
Encode Network (Standardized Format) Decrypt
Compress Decompress
2.1 Description
Encrypt Decode
The Presentation Layer, often called theSSL/TLS
"syntax· ASN.1
layer,"· MIME · XDR
is responsible for translating data between the
format used by the application and the format used by the network. It acts as a data translator, ensuring
that data sent from one system can be understood by another regardless of differences in internal data
representation.

Fig 3: Presentation Layer transforms data for network transmission and back.

2.2 Functions of the Presentation Layer

• Data Translation / Encoding — converts data from one encoding format to another (e.g., EBCDIC to
ASCII, Unicode to UTF-8).
• Data Compression — reduces the size of data to speed up transmission (lossless: ZIP, RLE; lossy:
JPEG, MP3).
• Data Encryption & Decryption — encrypts data for confidentiality before transmission and decrypts on
receipt (SSL/TLS operates here).
• Data Formatting — ensures data is in a readable format for the application layer (e.g., HTML, JSON,
XML, JPEG, MPEG).
• Serialization — converts objects/data structures to byte streams for transmission.
• Abstract Syntax Notation — defines abstract syntax of data independent of machines.

2.3 Presentation Layer Protocols & Standards

Standard/Protocol Purpose

SSL / TLS Secure Sockets Layer / Transport Layer Security — encryption

MIME Multipurpose Internet Mail Extensions — email data formatting

ASN.1 Abstract Syntax Notation One — data structure description

XDR External Data Representation — Sun Microsystems standard

AFP Apple Filing Protocol — file sharing encoding

NDR Network Data Representation — DCE/RPC data format

JPEG/MPEG/GIF Multimedia compression & encoding formats

2.4 Working of Presentation Layer

• 1. Data Received from Application — raw data arrives (e.g., a string, image, or object).
• 2. Format Conversion — data is converted to a common/network format (e.g., text to ASCII bytes).
• 3. Compression — large data is compressed to reduce bandwidth usage.
• 4. Encryption — data is encrypted using session keys (SSL/TLS handshake provides keys).
• 5. Handoff to Session Layer — formatted, compressed, and encrypted data is passed downward.
• 6. Reverse on Receipt — receiver decrypts → decompresses → converts back to application format.
■ SSL/TLS is technically implemented at the Presentation Layer, though many modern texts associate it with
Layer 4 or Layer 7 for practical reasons.
 Client DNS Resolution
Local DNS Process – Step byDNS
Root Step TLD DNS
SECTIONBrowser
3 — Application Layer (Layer Server
Resolver 7) (.com)

The Application Layer is the topmost

1. Query
layer of the OSI model
2. Query
and the one closest3. Query to the end user. It
provides network services directly to user applications and defines the protocols and rules for how
programs communicate over a network. It does NOT include the application
5. Referral
programs
6. Auth Query / 7. IP
themselves, but the
4. Returned
Referral
Authoritative
protocols they use.
DNS Server

3.1 DNS — Domain Name System

DNS is the "phonebook of the Internet." It translates human-readable domain names (e.g.,
[Link]) into IP addresses (e.g., [Link]) that computers use to identify each other. DNS
operates on port 53 using UDP (for queries) and TCP (for zone transfers).

Fig 4: Iterative DNS Resolution — 7 steps from query to IP address.

DNS Key Concepts

• Record Types: A (IPv4), AAAA (IPv6), CNAME (alias), MX (mail), NS (name server), TXT, PTR
• DNS Cache: Resolvers cache responses for TTL duration to speed up future queries
• DNS Hierarchy: Root (.) → TLD (.com, .org) → Second Level (google, amazon) → Subdomain
• Recursive vs Iterative: Recursive — resolver does all the work; Iterative — client does the work
• DNSSEC: DNS Security Extensions — adds digital signatures to prevent cache poisoning
• Port: UDP 53 (queries), TCP 53 (zone transfer > 512 bytes)

3.2 SMTP — Simple Mail Transfer Protocol

SMTP (port 25/587/465) is the protocol used to send email messages between mail servers and from
clients to servers. It is a push protocol — it only sends mail. To retrieve email, POP3 (port 110) or IMAP
(port 143) is used.

Command Purpose Example

HELO/EHLO Initiate connection EHLO [Link]

MAIL FROM Specify sender MAIL FROM:<sender@[Link]>

RCPT TO Specify recipient RCPT TO:<recv@[Link]>

DATA Begin message body DATA (followed by message + [Link])

QUIT End session QUIT

AUTH Authenticate client AUTH LOGIN

STARTTLS Upgrade to TLS STARTTLS

■ SMTP Flow: Client → SMTP Server (sender) → DNS MX lookup → SMTP Server (receiver) → Mailbox

3.3 SNMP — Simple Network Management Protocol

SNMP (port 161 UDP for queries, 162 for traps) is used to monitor and manage network devices like
routers, switches, servers, and printers. It uses a Manager-Agent architecture.
 SNMP Components & Concepts
• Manager — the central system that queries agents and receives traps (e.g., network monitoring software)
• Agent — software on each managed device that collects & reports data to the manager
• MIB (Management Information Base) — a hierarchical database of variables the agent maintains
• OID (Object Identifier) — unique ID for each variable in the MIB tree
• Operations: GET, GET-NEXT, GET-BULK, SET, RESPONSE, TRAP, INFORM
• Versions: SNMPv1 (no security), SNMPv2c (community strings), SNMPv3 (authentication + encryption)
• Community String — acts as a simple password in v1/v2c (default "public" read-only)

3.4 FTP — File Transfer Protocol

FTP (ports 20 & 21) enables transfer of files between client and server. It uses two separate TCP
connections: a control connection (port 21) for commands and a data connection (port 20) for actual file
transfer.

Mode Description Port

Active Mode Client opens random port; server connects back Server: 20

Passive Mode Server opens random port; client connects to it Client-initiated

SFTP SSH File Transfer Protocol — encrypted 22

FTPS FTP over SSL/TLS 990 (implicit)

■ Common FTP Commands: USER, PASS — login; LIST — list directory; GET/RETR — download;
PUT/STOR — upload; MKD — make directory; RMD — remove directory; QUIT — close session
 HTTP Request: GET /[Link] HTTP/1.1
■ Client ■ Server
3.5 HTTP
Browser & WWW — HyperText Transfer Protocol & World Wide Web
/ App Apache / Nginx

HTTP (port 80) and HTTPS (port 443) are the foundation of data communication on the World Wide Web.
HTTP Response: 200 OK + HTML Body
HTTP is a stateless, request-response application-layer protocol. The WWW is a system of interlinked
hypertext documents accessed via the Internet.

Fig 5: HTTP Client-Server Request-Response Model.

HTTP Method Operation Description

GET Read Retrieve a resource from the server

POST Create Submit data to the server (form, file)

PUT Update Replace a resource entirely

PATCH Modify Partially update a resource

DELETE Remove Delete a specified resource

HEAD Headers only Same as GET but no response body

OPTIONS Capabilities Returns supported HTTP methods

HTTP Status Codes

• 1xx Informational — 100 Continue, 101 Switching Protocols
• 2xx Success — 200 OK, 201 Created, 204 No Content
• 3xx Redirection — 301 Moved Permanently, 302 Found, 304 Not Modified
• 4xx Client Error — 400 Bad Request, 401 Unauthorized, 403 Forbidden, 404 Not Found
• 5xx Server Error — 500 Internal Server Error, 502 Bad Gateway, 503 Service Unavailable

HTTP Versions
• HTTP/1.0 — one TCP connection per request; no persistent connections.
• HTTP/1.1 — persistent connections (keep-alive), pipelining, chunked transfer, Host header.
• HTTP/2 — binary framing, multiplexing (multiple streams on one connection), server push, header
compression (HPACK).
• HTTP/3 — uses QUIC (UDP-based) instead of TCP; faster connection setup, improved loss recovery.
• HTTPS — HTTP over TLS/SSL; encrypts all data in transit; uses digital certificates.

WWW — World Wide Web Components

• URL (Uniform Resource Locator) — e.g., [Link]
• HTML (HyperText Markup Language) — structure of web pages
• CSS (Cascading Style Sheets) — styling and layout
• JavaScript — client-side scripting and interactivity
• Web Browser — renders HTML/CSS/JS (Chrome, Firefox, Safari)
• Web Server — serves content (Apache, Nginx, IIS)
• CGI/REST API — server-side processing of dynamic requests
SECTION 4 — Network Security
Encryption Comparison
4.1 Cryptography
Symmetric (Private
Cryptography Key) Encryption
is the science of securing communication by transforming readable data (plaintext) into an
unreadable format (ciphertext) using mathematical algorithms and keys. Only authorized parties with the
correct key can decrypt and read the data.
Plaintext ■ Key Ciphertext ■ Key Plaintext
Encrypt Decrypt
Key Terminology
• Plaintext — original readable data.
Asymmetric
• Ciphertext(Public Key) Encryption
— encrypted, unreadable data.
• Encryption — process of converting plaintext to ciphertext.
• Decryption — process of converting ciphertext back to plaintext.
— a secret value used in■the
• KeyPlaintext Public
encryption/decryption
Ciphertext algorithm.
■ Private
Plaintext
Encrypt Decrypt
• Algorithm (Cipher) — the mathematical method used (AES, RSA, SHA, etc.).

Fig 6: Symmetric vs Asymmetric Encryption — key usage comparison.

4.1.1 Private Key (Symmetric) Cryptography

In symmetric encryption, the SAME key is used for both encryption and decryption. Both sender and
receiver must securely share this secret key beforehand.

Algorithm Key Size Notes

DES 56-bit Old, now considered insecure (brute-forceable)

3DES 112/168-bit Triple DES — applies DES 3 times; slow but more secure

AES 128/192/256-bit Current standard — fast and very secure; used in WPA2

RC4 Variable Stream cipher; used in older SSL/WEP (deprecated)

Blowfish 32–448-bit Fast block cipher; used in some VPNs and bcrypt

Symmetric Encryption — Pros & Cons

• PRO: Very fast — suitable for encrypting large volumes of data (bulk encryption)
• PRO: Simple implementation — only one key to manage per session
• CON: Key Distribution Problem — securely sharing the key with the receiver is difficult
• CON: Scalability — N users need N*(N-1)/2 unique keys for pair-wise communication
• USE: File encryption, database encryption, VPN data channel (IPSec), AES in WPA2/WPA3

4.1.2 Public Key (Asymmetric) Cryptography

Asymmetric encryption uses a mathematically related key PAIR: a public key (shared openly) and a private
key (kept secret by the owner). Data encrypted with one key can only be decrypted with the other. This
solves the key distribution problem of symmetric cryptography.

Algorithm Key Size Use Case

RSA 1024–4096-bit Key exchange, digital signatures, HTTPS certificates

ECC 160–521-bit Elliptic Curve — stronger security with smaller keys

DSA 1024–3072-bit Digital Signature Algorithm — signing only

Diffie-Hellman Variable Key exchange protocol — not for encryption directly

ElGamal Variable Based on DH; used in PGP email encryption

Asymmetric Encryption — Pros & Cons
• PRO: No shared secret needed — public key can be freely distributed
• PRO: Scalable — N users only need N key pairs total
• PRO: Enables digital signatures and non-repudiation
• CON: Much slower than symmetric encryption — not suitable for bulk data
• CON: Larger key sizes needed for equivalent security vs symmetric
• USE: SSL/TLS handshake (key exchange), email (PGP/S/MIME), SSH, digital certificates

■ Hybrid Approach: Real-world systems (HTTPS/TLS) use asymmetric encryption to securely exchange a
symmetric session key, then use that symmetric key for fast bulk data encryption.
 Hash (SHA) Hash (SHA)
Message +
Sign w/ Pvt Key Signature Compare Hashes ✓

4.2 Digital Signature

A digital signature is a cryptographic mechanism that provides authentication, integrity, and
non-repudiation for digital messages or documents. It is the digital equivalent of a handwritten signature
but far more secure — it cannot be forged without the signer's private key.

Fig 7: Digital Signature — Signing with Private Key, Verifying with Public Key.

Properties Provided by Digital Signatures

• Authentication — confirms the identity of the sender (only the private key holder can sign)
• Integrity — any modification to the message after signing invalidates the signature
• Non-repudiation — the signer cannot later deny having signed the document
• NOTE: Digital signatures do NOT provide confidentiality (use encryption for that)

How Digital Signatures Work — Step by Step

• 1. Hash Generation (Sender) — a cryptographic hash function (SHA-256) generates a fixed-size
digest of the message.
• 2. Signature Creation (Sender) — the sender encrypts the hash with their PRIVATE key → this is the
digital signature.
• 3. Transmission — the original message + the digital signature are sent together.
• 4. Hash Decryption (Receiver) — the receiver decrypts the signature using the sender's PUBLIC key
to get the original hash.
• 5. Hash Recomputation (Receiver) — the receiver independently computes the hash of the received
message.
• 6. Comparison (Receiver) — if both hashes match → signature is valid; message is authentic and
unaltered.

Hash Functions Used

Hash Function Output Size Status Common Use

MD5 128-bit Deprecated Checksums (not security)

SHA-1 160-bit Deprecated Old SSL/TLS (before 2017)

SHA-256 256-bit Current HTTPS, Bitcoin, code signing

SHA-384 384-bit Current TLS 1.3, federal standards

SHA-512 512-bit Firewall ArchitectureHigh-security

Current with DMZ applications
SHA-3 Variable Current NIST standard, alternative to SHA-2
■ Firewall
■ PKI (Public Key Infrastructure) — a framework of ✓digital DMZ
Allow certificates, Certificate Authorities (CAs), and
protocols that manage public key Packet
distribution and validation. Used Web
in Server (SSL/TLS certificates).
HTTPS
■ Packet ■
Filter Mail Server
Internet Rules
Internal
Untrusted Trusted
4.3 Firewalls NAT ✗ Block

A firewall is a network security device (hardware or software) that monitors and controls incoming and
outgoing network traffic based on predetermined security rules. It acts as a barrier between trusted internal
networks and untrusted external networks (like the Internet).

Fig 8: Firewall Architecture — separating Internet, DMZ, and Internal Network.

Types of Firewalls
Type How It Works Pros / Cons
 Packet Filter Inspects each packet independently; Fast, simple;
(Stateless) checks IP, port, protocol No context awareness

Tracks TCP connection state; Better security than packet filter;

Stateful Inspection
verifies packets belong to valid sessions More resource-intensive

Application Layer Inspects payload at Layer 7; Deep inspection;

(Proxy) understands protocols (HTTP, FTP) Slower, complex

Combines stateful + DPI + IPS/IDS Most comprehensive;

Next-Gen (NGFW)
+ SSL inspection + App-awareness Expensive

Circuit-Level Monitors TCP handshakes; Simple & fast;

Gateway Validates sessions without inspecting content No content filtering

Firewall Rules & Concepts

• Access Control List (ACL) — ordered set of rules; firewall checks each packet against rules top-down.
• Default Policy — "Default Deny" (whitelist) is more secure than "Default Allow" (blacklist).
• DMZ (Demilitarized Zone) — semi-trusted network segment for public-facing servers (web, mail,
DNS).
• NAT (Network Address Translation) — hides internal IP addresses, providing an extra layer of
obscurity.
• Ingress Filtering — controls inbound traffic entering the network.
• Egress Filtering — controls outbound traffic leaving the network (prevents data exfiltration).
• IDS (Intrusion Detection System) — detects and alerts on suspicious activity (passive).
• IPS (Intrusion Prevention System) — detects AND blocks suspicious activity (active).
QUICK REFERENCE — Protocol Summary Table
Protocol Layer Port Transport Purpose

DNS 7 53 UDP/TCP Domain name resolution

HTTP 7 80 TCP Web page transfer

HTTPS 7 443 TCP Secure web (HTTP+TLS)

SMTP 7 25/587 TCP Send email

POP3 7 110 TCP Retrieve email (download)

IMAP 7 143 TCP Retrieve email (sync)

FTP 7 20/21 TCP File transfer

SFTP 7 22 TCP Secure file transfer (SSH)

SNMP 7 161/162 UDP Network management

SSH 7 22 TCP Secure remote shell

Telnet 7 23 TCP Remote shell (insecure)

SIP 5 5060/5061 UDP/TCP VoIP session setup

RPC 5 Dynamic TCP/UDP Remote procedure calls

SSL/TLS 6 N/A TCP Encryption layer

MIME 6 N/A N/A Email data encoding

Symmetric vs Asymmetric — Comparison

Feature Symmetric (Private Key) Asymmetric (Public Key)

Keys Used Same key for encrypt/decrypt Key pair: public + private

Speed Very fast Slow (10–1000x slower)

Key Distribution Problem — must share secretly No problem — public key is open

Scalability N*(N-1)/2 keys needed Only N key pairs needed

Security Vulnerable to key theft Private key never shared

Examples AES, DES, 3DES, RC4 RSA, ECC, DSA, Diffie-Hellman

Use Case Bulk data encryption Key exchange, signatures, certificates

Key Size Smaller (128–256 bit AES) Larger (2048+ bit RSA)

These notes cover OSI Layers 5 (Session), 6 (Presentation), and 7 (Application) with emphasis on DNS,
SMTP, SNMP, FTP, HTTP/WWW, Cryptography (Private & Public Key), Digital Signatures, and Firewalls. All
diagrams are original illustrations.