Layer 6: Presentation Layer

Data Translation, Encryption & Compression

The Presentation Layer handles data format translation, encryption/decryption, and compression/decompression. It ensures that data from the application layer is properly formatted for transmission and reception across different systems.

Layer 6 (Presentation) Technologies

The Presentation Layer is responsible for data format translation, encryption/decryption, and compression/decompression. It ensures data is in the correct format for the receiving application and provides syntax and semantics transformation, data security, and bandwidth optimisation.

Data Translation - Converting between different character encodings, data formats, and representations

Encryption/Decryption - Protecting data confidentiality during transmission with cryptographic algorithms

Compression/Decompression - Reducing data size for efficient transmission and storage

Syntax Transformation - Converting data structures and formats between applications

The Critical Role: While lower layers handle reliable delivery, Layer 6 ensures data format compatibility and security between different applications and systems.

Choose Presentation Technology:

🖥️

Sender

Plain Data

Ready

Transform

Process

Deliver

DATA

Presentation Status:

Select a technology and mode to begin

Step 0 of 0

Processing Idle

📺

Receiver

Expected Format

Waiting

🎯 Primary Functions

Data Translation: Converting between different data formats
Encryption/Decryption: Securing data for transmission
Compression: Reducing data size for efficient transmission
Character Encoding: Converting text between character sets
Format Conversion: Translating between different file formats

🔧 Key Characteristics

Syntax Translation: Converting data structures and formats
Cryptography: Encryption algorithms and key management
Data Compression: Algorithms to reduce data size
Character Sets: ASCII, Unicode, EBCDIC conversion
Media Formats: Image, audio, video encoding/decoding

🌐 Presentation Layer Technologies

🔒 TLS/SSL (Transport Layer Security)

Encryption & Authentication

Transport Layer Security TLS Record Layer: Handshake Protocol Content Type: Handshake (22) Version: TLS 1.3 (0x0304) Cipher Suite: TLS_AES_256_GCM_SHA384

What you see in Wireshark: TLS handshake, certificate exchange, encrypted application data

Secures HTTPS, email, and many other protocols

📸 JPEG (Image Compression)

Lossy Image Compression

JPEG File Interchange Format SOI Marker: 0xFFD8 APP0 Segment: JFIF identifier Quantization Tables: Quality factor 85% Huffman Tables: Compression data

What you see in Wireshark: JPEG headers when images are transferred over HTTP

Compresses images for web and email transmission

🎵 MP3 (Audio Compression)

Lossy Audio Compression

MPEG Audio Layer 3 Sync Word: 0xFFF Version: MPEG-1, Layer III Bitrate: 128 kbps, Sample Rate: 44.1 kHz Channel Mode: Stereo

What you see in Wireshark: MP3 headers in streaming audio protocols

Reduces audio file sizes for streaming and storage

🗜️ GZIP Compression

Lossless Data Compression

HTTP Content-Encoding: gzip GZIP Header: Magic Number 0x1F8B Compression Method: DEFLATE Original Size: 15,420 bytes Compressed Size: 3,847 bytes

What you see in Wireshark: Compressed HTTP responses, reduced bandwidth usage

Compresses web content for faster loading

🔤 UTF-8 Encoding

Unicode Character Encoding

HTTP Content-Type: text/html; charset=UTF-8 Character: "Hello 世界" (Hello World in Chinese) UTF-8 Bytes: 48 65 6C 6C 6F 20 E4 B8 96 E7 95 8C ASCII: H e l l o [space] [Chinese characters]

What you see in Wireshark: Text data in various languages encoded as UTF-8

Enables global communication with multiple languages

📄 ASN.1 (Abstract Syntax Notation)

Data Structure Definition

Abstract Syntax Notation One Certificate (SEQUENCE) Version: v3 (INTEGER: 2) Serial Number: 0x1234567890ABCDEF Signature Algorithm: sha256WithRSAEncryption

What you see in Wireshark: ASN.1 structures in SSL certificates, SNMP, LDAP

Defines data structures independent of machine representation

🔄 Data Format Transformation Demo

See how the Presentation Layer transforms data between different formats:

Original Text

"Hello World!"

ASCII Encoding

72 101 108 108 111 32 87 111 114 108 100 33

Base64 Encoding

SGVsbG8gV29ybGQh

URL Encoding

Hello%20World%21

Wireshark showing format transformations: HTTP: Content-Type: text/plain; charset=UTF-8 HTTP: Content-Encoding: gzip MIME: Content-Transfer-Encoding: base64 (email, not HTTP) The same "Hello World!" appears as different byte sequences depending on the encoding used at the Presentation Layer!

🔐 Encryption in Action

How TLS/SSL encrypts your data:

Before Encryption (Plaintext):

GET /login HTTP/1.1 Host: banking.com Username: john_doe Password: secret123

After TLS Encryption (Ciphertext):

16 03 03 00 4A B2 C7 E3 F1 9A 4D 8E 2B 55 C9 1F 7E A3 B8 4C D2 6F 91 3A E7 5C 28 B9 F0 45 62 D1 3F 8A C4 E6 71 2E B3 58 97 1D 6B A2 CF 84 39 E5

Wireshark TLS Analysis: Transport Layer Security TLS Record Layer: Application Data Content Type: Application Data (23) Version: TLS 1.2 (0x0303) Length: 74 Encrypted Application Data: [encrypted login credentials] Note: The actual login data is completely hidden from network sniffers!

🗜️ Compression Efficiency

How compression reduces data size:

Content Type	Original Size	Compressed Size	Compression Ratio	Algorithm
HTML Page	45 KB	12 KB	73% reduction	GZIP
High-res Photo	15 MB	2.1 MB	86% reduction	JPEG
Audio File	50 MB	4.5 MB	91% reduction	MP3
Video Clip	1 GB	85 MB	92% reduction	H.264

Wireshark HTTP Compression Example: HTTP Response: Content-Type: text/html Content-Encoding: gzip Content-Length: 12,450 (compressed) X-Original-Size: 45,230 (original) Compression-Ratio: 72.5% Without compression: 45,230 bytes transferred With compression: 12,450 bytes transferred Bandwidth saved: 32,780 bytes (72.5%)

🌍 Character Encoding Examples

How different character sets represent the same text:

Text	Language	UTF-8 Bytes	Character Count
Hello	English	48 65 6C 6C 6F	5 bytes
こんにちは	Japanese	E3 81 93 E3 82 93 E3 81 AB E3 81 A1 E3 81 AF	15 bytes
مرحبا	Arabic	D9 85 D8 B1 D8 AD D8 A8 D8 A7	10 bytes
Привет	Russian	D0 9F D1 80 D0 B8 D0 B2 D0 B5 D1 82	12 bytes

Wireshark Character Encoding Analysis: HTTP: Content-Type: text/html; charset=UTF-8 Data shows mixed languages in single webpage: English: "Welcome" (7 bytes) Chinese: "欢迎" (6 bytes for 2 characters) Russian: "Добро пожаловать" (31 bytes for 16 characters) All properly decoded by browser's Presentation Layer!

🔍 Real-World Example: Secure Online Banking

Scenario: You log into your online banking account

What happens at the Presentation Layer:

TLS Handshake: Browser and bank negotiate encryption algorithms
Certificate Verification: Bank's identity verified using ASN.1 certificates
Data Encryption: Login credentials encrypted with AES-256
Character Encoding: Form data encoded as UTF-8
Compression: Web page content compressed with GZIP
Format Translation: JSON data converted to HTML display
Media Processing: Bank logo JPEG decompressed for display

🔒 1) TLS handshake

Client Hello: TLS 1.3; cipher suites: TLS_AES_256_GCM_SHA384; random [32B]
Server Hello: selected TLS_AES_256_GCM_SHA384; cert chain RSA 2048‑bit; random [32B]
Key exchange: session keys generated; secure channel established ✓

📜 2) Application data

Content type: Application Data (23)
Encryption: AES‑256‑GCM (symmetric)
Form data: [ENCRYPTED] — username/password hidden
Result: no plaintext credentials in capture

🗜️ 3) HTTP content‑encoding

Header: Content‑Encoding: gzip
Original: 45,230 bytes → Compressed: 12,450 bytes
Saving: 72.5% (−32,780 bytes) 🚀

🌍 4) Character encoding

Content‑Type: application/json; charset=UTF‑8
English: “Hello” (5B); Chinese: “你好” (6B/2 chars); Arabic: “مرحبا” (10B/5 chars)
All languages correctly decoded ✓

🖼️ 5) Image data (JPEG)

Format: image/jpeg; quality ~85%
RAW: 24.0 MB → JPEG: 2.1 MB
Reduction: ≈91.25% smaller 📊

🔐 6) Security analysis

TLS application data: [ENCRYPTED BLOB]
Credentials: [NOT VISIBLE]; cookies: [PROTECTED]; personal data: [SECURED]
Verdict: all sensitive data protected 🛑

Key insight: The Presentation Layer transforms how data appears on the wire — encrypting, compressing and encoding it for secure, efficient transfer.

The Presentation Layer ensures your sensitive data is encrypted, compressed efficiently, and displayed correctly.

🐛 Common Presentation Layer Problems

Character Encoding Issues: Text appearing as garbage due to wrong encoding
Certificate Problems: SSL/TLS errors due to invalid certificates
Compression Errors: Corrupted data from failed compression/decompression
Format Incompatibility: Applications unable to read certain file formats
Encryption Failures: Weak ciphers or key exchange problems
Media Codec Issues: Unable to play audio/video due to missing codecs

🔧 Troubleshooting Tools

OpenSSL: Test and analyse SSL/TLS connections
Character Encoding Detectors: Identify text encoding issues
Compression Tools: Test compression/decompression manually
Certificate Analysers: Validate SSL certificate chains
Format Converters: Transform between different data formats
Wireshark: Analyse encrypted vs plaintext data flows

🎓 Teaching Analogy: Translation and Packaging Service

Think of the Presentation Layer like a professional translation and packaging service:

Translator (Character Encoding): Converts documents between languages and writing systems
Encryption Service (TLS/SSL): Puts sensitive documents in locked, tamper-proof containers
Compression Service (GZIP/JPEG): Packages items efficiently to save shipping space
Format Converter (Media Codecs): Converts documents between different formats (Word to PDF)
Quality Control (ASN.1/Standards): Ensures everything follows proper formatting rules
Package Labeling (Content-Type headers): Labels what's inside each container

Just like a translation service makes information accessible across different languages and formats, the Presentation Layer makes data understandable across different systems!

📚 Key Learning Points

Presentation Layer acts as data translator between application and network formats
Encryption/Decryption protects sensitive data during transmission
Compression reduces bandwidth usage and improves performance
Character encoding enables global communication across different languages
Format conversion ensures compatibility between different systems
Layer 6 is often invisible to users but critical for proper data handling

Check your understanding — Layer 6

Five questions on Layer 6 — encoding, encryption and compression.

Which of these is a Presentation Layer job?
Layer 6 is about the *form* the data takes on the wire: what character set it uses, whether it is compressed, and whether it is encrypted. Routing is Layer 3, retransmission Layer 4 and MAC learning Layer 2.
How many bytes does the letter “A” take in UTF-8?
UTF-8 is designed so that the entire ASCII range encodes to a single byte, which is why ASCII text is also valid UTF-8. Characters outside ASCII take two to four bytes each.
GZIP is which kind of compression?
GZIP (using DEFLATE) is lossless, which is essential for text, code and archives. JPEG and MP3 are lossy: they throw away detail the eye or ear is unlikely to notice, and you can never get it back.
At which OSI layer is TLS conventionally taught?
TLS is normally placed at Layer 6 because its job — encrypting and formatting data — is Presentation work. In practice TLS sits awkwardly across Layers 5, 6 and 7: it runs over TCP, it manages sessions, and it is implemented in application libraries.
An HTTP response carries “Content-Encoding: gzip”. What does that tell you?
Content-Encoding describes a transformation applied to the body that the recipient must reverse. Character set is carried separately in Content-Type; encryption is TLS's job, not an encoding.

Layer 6 (Presentation) — frequently asked questions

What is the Presentation Layer?

The Presentation Layer is Layer 6. It makes sure that data sent by one system is intelligible to another by handling translation between data formats and character sets, encryption and decryption, and compression and decompression. It is concerned with the syntax of the data, not its delivery.

Is TLS at Layer 6 or Layer 4?

Courses and exams almost always place TLS at Layer 6, because encrypting and re-formatting data is Presentation work. Strictly, TLS does not fit the model cleanly: it runs on top of TCP at Layer 4, performs session establishment and resumption like Layer 5, and is called from application code like Layer 7. “Layer 6” is the useful teaching answer, not a precise one.

What is the difference between encoding, encryption and compression?

Encoding changes the representation of data so a system can handle it, with no secrecy involved and no size goal — UTF-8 and Base64 are encodings, and anyone can reverse them. Compression reduces size, either losslessly (GZIP) or lossily (JPEG). Encryption makes data unreadable without a key. All three are Layer 6 concerns, and confusing them — “Base64 is not encryption” — is a classic security mistake.

Does the Presentation Layer exist in TCP/IP?

Not as its own layer. TCP/IP folds OSI Layers 5, 6 and 7 into one Application layer, so encoding, compression and encryption are handled by application protocols and libraries — Content-Type and Content-Encoding headers in HTTP, TLS beneath it, and image or audio codecs inside the application itself.

← Return to OSI Overview

🎭 Layer 6: Presentation Layer