OSI model
Seven layers, Physical to Application. A naming map. The internet you operate is TCP/IP.
The Open Systems Interconnection model (ISO/IEC 7498-1) names seven layers: Physical, Data Link, Network, Transport, Session, Presentation, Application. Each layer uses the one below and offers services to the one above. It is a reference model, not a packet path you can traceroute.
The stack you actually run is TCP/IP (RFC 1122): link, internet, transport, application. Session and Presentation almost always collapse into Application. Desk shorthand: L1 media and PHY; L2 Ethernet, MAC, switching, ARP; L3 IP, ICMP, routing; L4 TCP, UDP, ports; L7 HTTP, DNS, SMTP, and TLS as the application uses it. "Layer 7 WAF" and "layer 3/4 DDoS" are that dialect.
Use it to blame the right layer. ARP spoofing is L2. A routing black hole is L3. A SYN flood is L4. SQL injection is L7. A certificate failure is not a routing failure. A layer-3 ACL does not inspect the HTTP body. Segmentation lives mostly at L2/L3; identity and application bugs live above that.
See also:
Fact source: ISO/IEC 7498-1:1994, IETF RFC 1122.