Browser communication to a webserver and the OSI model

Question

If I use google chrome (on a windows 7 machine) to access https://www.google.com, can someone tell me where the involved pieces fit into the OSI model?

I would also like to know

• If I use wireshark/fiddler to monitor the traffic, between which layers do they start sniffing?
• Isn't encryption done by the browser itself?

This is my take on this

Chrome : Application layer (layer 7) and Presentation layer (layer 6) because chrome does the encryption .

TCPIP Software: that is a part of the OS, is the Session layer (layer 5) and Transport layer (layer 4)

My Router: is the Network layer (layer 3)

My Modem: is the Data Link Layer (Layer2)

The cable: that connects my modem to the wall and beyond in the Physical Layer (Layer 1)

Fiddler sniffs the traffic between layers 5 and 6, where as wireshark sniffs the traffic between layers 3 and 4.

Answer 1

First thing, it is important for you to understand that the Internet does not strictly conform to the OSI networking model. The Internet mostly operates on a simplified model. The Internet model simply classifies everything above the transport level as application. Also, the OSI model is a bit on the rigid side. IP, and related do not exactly fit on the OSI model. For example IP itself has some functionality that happens at layer 2 (ARP, DHCP), but it mostly operates on the network layer (layer 3).

It is also important to understand that most of the things you mentioned operate at several levels of the the OSI model. You can't simply point at a device and assign it to a particular layer. A router is typically called a layer 3 device, but that doesn't mean that it doesn't also have to have layer 1 and 2 functionality. After a router has to be connected to something, and has to have a data-link connection.

• The cable

  • Yes, that is layer 1 only

• My Modem

  • Typical broadband modems are running Ethernet or some other link protocol, but some modems also perform routing functions. Functionality provided by devices these days is very blurry. So if the modem is not doing any form of routing is it doing Layer 1-2, if it also includes any routing features then it is operating at layers 1-3.

• My Router

  • A router operates at layer 3 (IP), but it also has physical connections, and must have a data link protocol (Ethernet).

• Your Computer

  • Your computer has an network interface that almost certainly supports Ethernet, and is connected to something. (Layer 1-2)
  • The OS on your computer is communicating with your Network interface and typically handles the layers 2-4 (2:Ethernet, 3:IP, 4:TCP/UDP/GRE/etc).
  • Everything above that is handled within the application. Most application software will use the OS APIs to open an Internet Scoket which is most often a TCP, or UDP.

Wirehsark can capture Ethernet, and 802.11. But it also has the ability to disect protocols so it operates at layers 2 and above.

Fiddler is an HTTP proxy. So connections to fiddler are coming in via a Socket. Putting it clearly in the Layer 3 and above. Since it has to handle the network stuff, and also offers functionality to dig deeper.

Isn't encryption done by the browser itself?

The browser handles encryption, or it links into OS features that handle encryption. But that doesn't mean you can't capture the encrypted traffic using wireshark or fiddler.

Since Fiddler is acting as a proxy, it simply acts as if was the web server. This results in a certificate error in the browser, because it is basically performing a MITM attack.

Wireshark can decode HTTPS traffic if you have private key associated with the servers SSL certificate.