Trace an HTTPS request through the OSI model with curl
How I use curl verbose output to separate DNS, TCP, TLS and HTTP stages while troubleshooting an HTTPS connection.
Command and infographic terms
- DNS
- Resolve the target or proxy hostname to one or more IP addresses before connecting.
- TCP
- Establish a transport-layer connection to port 443.
- TLS
- Negotiate encryption and verify the server certificate; TLS does not map cleanly to one OSI layer.
- HTTP
- Send the application-layer request and inspect the response headers.
After more than 20 years in networking, I still use the seven-layer OSI model to structure a simple troubleshooting question: at which layer does the connection stop?
curl -v --http1.1 https://example.com/
Verbose output exposes several stages of an HTTPS request: hostname resolution, the TCP connection, TLS negotiation and certificate verification, followed by the HTTP request and response headers. Forcing HTTP/1.1 keeps the application exchange easy to recognise instead of negotiating HTTP/2.
This is a practical troubleshooting trace, not a validation of all seven OSI layers. It does not test the physical or data-link layers, reveal the complete network path, or prove which firewall policy matched. With an HTTP proxy, curl shows the proxy connection and CONNECT tunnel; target DNS may happen beyond the client. Verbose output can also contain sensitive headers or credentials, so I review it before sharing.