Layer 5 — Session

What This Layer Does

Some exchanges are single events. Ask a question, get an answer, done. Many are not. Signing into a bank, holding a video call, or copying a large folder to a server all involve a stretch of related back-and-forth that has a beginning, a middle, and an end.

The Session layer handles that stretch. A session is an ongoing communication between two systems that both sides agree exists. This layer's responsibilities are to start a session, keep it alive while it is needed, and close it cleanly when it is finished.

Starting a session usually means establishing who is talking and agreeing on the terms of the conversation. Keeping it alive can mean sending small periodic messages so that neither side assumes the other has vanished, and it can mean tracking where the conversation had got to, so that a long transfer interrupted partway through can resume rather than start over. Ending a session means closing it deliberately and releasing whatever was being held open for it. When a session ends because nothing has happened for a while rather than because anyone closed it, that is a timeout — the reason a banking site logs you out after a few quiet minutes.

Now the honest part, which many books skip.

In the OSI model the Session layer is a distinct layer with distinct duties. In the networking that actually runs the internet, it is not implemented as a separate layer at all. The internet's own model, defined by the IETF, has four layers and folds OSI's Session, Presentation, and Application layers into a single application layer. Session behavior is real and necessary, but it lives inside applications and protocols rather than in a component you can point at.

That is not a flaw in the model. It is a reminder of what the model is: a way of naming jobs, not a map of parts. When someone says "that's a Layer 5 problem," they mean the conversation itself broke down — not that a particular piece of software failed.

Common Examples

• Signing in to a website and staying signed in while you move between pages
• A video call that lasts from "hello" to "goodbye"
• A remote desktop connection held open while you work
• Session cookies, which let a web server recognize your later requests as part of the same visit
• Automatic sign-out after a period of inactivity

Simple Real-World Example

You sign in to an online store. You browse three categories, open two product pages, and add an item to your cart. The web server treats all of that as one visit and remembers who you are the whole way through.

Underneath, your browser opened and closed several separate connections. The session is the thread that ties them together. Leave the tab alone for long enough and the session times out; return, and you are asked to sign in again.

   START            KEEP GOING                     END
   ─────            ──────────                     ───
   Sign in   →   browse   →   browse   →   buy   →   sign out
                     (session is maintained)          or time out

What Can Go Wrong?

• The session times out too soon. You are signed out in the middle of something and lose your place.
• The session is never closed. Abandoned sessions pile up on a server and consume resources that nothing is using.
• The connection drops mid-session. A transfer that cannot resume has to start again from the beginning.
• Both sides disagree about the session's state. One believes the conversation is still open, the other has moved on, and requests fail in confusing ways.

Remember This

Layer 5 helps manage the beginning, continuation, and ending of a communication session.