Protocols That Do Not Fit One Layer: TLS, ARP and QUIC

Some protocols do not belong to a single OSI layer, because they were designed for the internet's four-layer TCP/IP stack rather than for the seven-layer model. TLS, ARP and QUIC are the three most often argued over. The layer a book gives them is a convention, and treating it as a fact leads to wrong conclusions about what they can see.

The symptom. Two sources place the same protocol at different layers. One tutorial puts TLS at layer 6, another at layer 4, a third calls it layer 5. A colleague insists ARP is layer 2, another says 3. Neither side is reading the protocol wrong; the model has no single right box for it.

Why it happens. The OSI model was drawn as a reference, and the protocols the internet uses were built to work, not to fit it. TLS sits on top of TCP but below HTTP, and does the encryption the model gives to layer 6. ARP is carried in frames like any layer 2 data, but exists only to serve layer 3. QUIC does the transport layer's job, reliable ordered delivery, but rides inside UDP, which is itself a transport protocol.

What it costs. The argument itself wastes time, but the real cost is a wrong inference. Someone who files QUIC under "UDP, layer 4" expects a layer 4 firewall to see its connections and streams the way it sees TCP's; it sees only encrypted UDP datagrams. Someone who files TLS under layer 6 may forget that a load balancer that ends TLS must read layer 7 to do anything useful with what it decrypts.

What to do instead. Describe a protocol by what it runs on and what it provides: "TLS runs over TCP and encrypts the application's bytes". Use the layer number as shorthand only when the listener already agrees on the convention.