The Network Layer

The Internet layer is the "thin waist" of the internet's hourglass architecture: every application runs above it, every physical technology runs below it, and IP is the universal glue in the middle. It provides two services: logical addressing (globally unique identifiers for interfaces) and routing (getting packets from any source to any destination across an arbitrary number of hops).

IPv4 — Internet Protocol version 4 (RFC 791, 1981)

IPv4 is a connectionless, best-effort packet delivery protocol. "Best-effort" means IP does not guarantee delivery, order, or absence of duplicates — those guarantees are left to TCP if needed.

IPv4 header (20 bytes minimum)

Worked example: IPv4 packet fragmentation

Every physical link layer enforces a Maximum Transmission Unit (MTU) — the largest IP packet size that the link can carry without splitting (e.g. 1,500 bytes for standard Ethernet). When an IPv4 router receives a datagram larger than the next-hop link's MTU, and the DF (Don't Fragment) bit is 0, it fragments the packet into multiple smaller IPv4 datagrams.

Key rules of IPv4 fragmentation:

• Every fragment receives its own independent 20-byte IPv4 header copy, retaining the original datagram's 16-bit Identification number.
• The More Fragments (MF) flag is set to 1 on all fragments except the final fragment (which has MF = 0).
• Because the 13-bit Fragment Offset field is measured in units of 8-byte blocks (64 bits), the data payload size of every fragment (except the last one) must be an exact multiple of 8 bytes.
• Fragments are reassembled only at the final destination host, never at intermediate routers (different fragments might take different paths). If even a single fragment is lost in transit, the destination host's reassembly timer expires, the entire original datagram is discarded, and upper-layer protocols (like TCP) must retransmit.

Worked fragmentation calculation:
Original datagram : Total Length = 4,000 bytes (20 B IPv4 header + 3,980 B payload), ID = 777, DF = 0
Outgoing link MTU : 1,500 bytes

Step 1: Compute maximum payload per fragment:
  Max fragment payload = MTU − Header Length = 1,500 − 20 = 1,480 bytes
  Verify 8-byte alignment: 1,480 ÷ 8 = 185 (exact multiple of 8, valid!)

Step 2: Partition payload across fragments:
  • Fragment 1: Carries payload bytes 0–1,479 (1,480 bytes)
    - Total Length    = 1,500 bytes (20 B header + 1,480 B data)
    - Identification  = 777
    - Flags           = MF = 1 (more fragments follow), DF = 0
    - Fragment Offset = 0 ÷ 8 = 0

  • Fragment 2: Carries payload bytes 1,480–2,959 (1,480 bytes)
    - Total Length    = 1,500 bytes (20 B header + 1,480 B data)
    - Identification  = 777
    - Flags           = MF = 1 (more fragments follow), DF = 0
    - Fragment Offset = 1,480 ÷ 8 = 185

  • Fragment 3: Carries remaining payload bytes 2,960–3,979 (1,020 bytes)
    - Total Length    = 1,040 bytes (20 B header + 1,020 B data)
    - Identification  = 777
    - Flags           = MF = 0 (last fragment!), DF = 0
    - Fragment Offset = 2,960 ÷ 8 = 370

IPv4 address space

IPv4 uses 32-bit addresses written as four dot-separated decimal octets: 192.168.10.50. The total space is 2³² = 4,294,967,296 addresses. Excluding reserved ranges, roughly 3.7 billion are theoretically usable as public addresses — far fewer than the world's devices, which is why NAT and IPv6 exist.

Special address ranges

CIDR and subnetting — worked examples

CIDR (Classless Inter-Domain Routing, RFC 4632) replaced classful addressing in 1993. An address + prefix length fully defines a subnet. The prefix length is the number of network bits; the remaining bits are host bits.

Binary breakdown example: 192.168.10.100/26

IP address : 192.168.10.100
Binary     : 11000000.10101000.00001010.01100100
Prefix /26 : 11111111.11111111.11111111.11000000  ← subnet mask
             ←────────── 26 network bits ──────→ ←─6 host bits─→

The last octet of the address: 01100100
                                ↑↑
                                These first 2 bits belong to the NETWORK portion.
                                The remaining 6 bits (100100) are HOST bits.

Network bits: 26  →  host bits: 6  →  2^6 = 64 total addresses
Network addr: 11000000.10101000.00001010.01000000 = 192.168.10.64
              (host bits all zeroed)
Broadcast   : 11000000.10101000.00001010.01111111 = 192.168.10.127
              (host bits all ones)
Subnet mask : 255.255.255.192
Wildcard    : 0.0.0.63
First host  : 192.168.10.65
Last host   : 192.168.10.126
Usable hosts: 62  (64 total − 1 network addr − 1 broadcast)

Splitting a /24 into four equal subnets

Start: 10.1.1.0/24  (256 addresses, 254 usable)
Add 2 bits → /26 (4 subnets of 64 addresses each, 62 usable)

Subnet 1:  10.1.1.0/26    hosts: 10.1.1.1  – 10.1.1.62   bcast: 10.1.1.63
Subnet 2:  10.1.1.64/26   hosts: 10.1.1.65 – 10.1.1.126  bcast: 10.1.1.127
Subnet 3:  10.1.1.128/26  hosts: 10.1.1.129– 10.1.1.190  bcast: 10.1.1.191
Subnet 4:  10.1.1.192/26  hosts: 10.1.1.193– 10.1.1.254  bcast: 10.1.1.255

Interactive subnet calculator

VLSM — Variable Length Subnet Masking

Traditional fixed-length subnetting (FLSM) divides a network into subnets of identical size. If a company has four departments requiring 120, 50, 25, and 2 hosts respectively, FLSM forces the administrator to assign a /25 (128 addresses) to every segment — squandering 126 addresses on point-to-point links. VLSM allows an administrator to subnet already-subnetted blocks, applying different mask lengths to fit the exact host requirements of each network segment.

Worked VLSM design example: Starting with base network 192.168.100.0/24 (256 addresses total), allocate subnets for five distinct requirements:

Notice that addresses 192.168.100.120 through 192.168.100.255 (136 addresses, including a contiguous /25 block at 192.168.100.128/25) remain completely free for future expansion.

Route aggregation (supernetting)

Route aggregation (also called supernetting or prefix summarization) is the ability of CIDR to consolidate multiple contiguous, smaller address blocks into a single summary prefix. In core internet routers, routing tables would otherwise grow uncontrollably with hundreds of thousands of individual customer routes. By advertising a single aggregated prefix via BGP, ISPs dramatically reduce router memory consumption and routing protocol churn.

Worked aggregation example: Suppose an ISP allocates four contiguous /24 customer subnets:

• Customer 1: 203.0.112.0/24 → 3rd octet in binary: 01110000
• Customer 2: 203.0.113.0/24 → 3rd octet in binary: 01110001
• Customer 3: 203.0.114.0/24 → 3rd octet in binary: 01110010
• Customer 4: 203.0.115.0/24 → 3rd octet in binary: 01110011

Comparing the bits of the 3rd octet, all four networks share the exact same first 6 bits: 011100. Combining the two initial octets (16 bits) with these 6 matching bits yields 22 network bits:

Aggregated Supernet Route = 203.0.112.0/22  (mask 255.255.252.0)

Instead of advertising four separate routes to external BGP peers, the ISP advertises a single route for 203.0.112.0/22 covering all 1,024 IP addresses (from 203.0.112.0 to 203.0.115.255).

Longest prefix match with exceptions: What happens if Customer 3 (203.0.114.0/24) changes internet providers and moves to a competing ISP B? ISP B begins advertising the more specific route 203.0.114.0/24 to the global internet, while ISP A continues advertising its broad aggregate 203.0.112.0/22. Global routers applying the Longest Prefix Match (LPM) rule compare the prefix lengths: because /24 is longer and more specific than /22, packets destined for 203.0.114.x are automatically routed to ISP B, while all packets for .112.x, .113.x, and .115.x continue flowing to ISP A without issue.

IPv6 — Internet Protocol version 6 (RFC 8200)

IPv4 address exhaustion was anticipated in the early 1990s. IPv6, finalised in 1998, uses 128-bit addresses — providing 2¹²⁸ ≈ 3.4 × 10³⁸ addresses, enough for every atom on Earth's surface to have its own address, with many orders of magnitude to spare.

IPv6 address notation

Written as eight groups of four hex digits, colon-separated: 2001:0db8:85a3:0000:0000:8a2e:0370:7334. Simplification rules:

• Leading zeros in each group can be omitted: 2001:db8:85a3:0:0:8a2e:370:7334
• One consecutive run of all-zero groups can be replaced with ::: 2001:db8:85a3::8a2e:370:7334
• Loopback: ::1 (equivalent to 127.0.0.1)
• Unspecified: :: (equivalent to 0.0.0.0)

IPv6 address types

Key IPv6 improvements over IPv4

• No header checksum: recalculating per-hop was expensive; offloaded to transport and link layers.
• No router fragmentation: routers never fragment packets. Sources must use PMTUD (minimum guaranteed MTU on any IPv6 link is 1280 bytes). This simplifies and speeds up forwarding.
• SLAAC (Stateless Address Autoconfiguration, RFC 4862): a host derives its own global address from the router's advertised prefix + its interface identifier (derived from MAC or randomly generated via RFC 7217 privacy extensions). No DHCP required, though DHCPv6 also exists.
• Neighbour Discovery Protocol (NDP, RFC 4861): replaces ARP using ICMPv6. More secure, extensible, and multicast-based (no broadcasts).
• IPsec support: originally mandated (now "should" implement per RFC 6434), but authentication headers work the same way.

Routing — how packets find their way

Every IP-speaking device (hosts, routers) has a routing table mapping destination prefixes to next-hop addresses or outgoing interfaces. When a packet arrives, the device applies the longest prefix match rule — the entry with the most specific (longest) matching prefix wins.

# Linux routing table
$ ip route show
default via 10.0.0.1 dev eth0                   ← 0.0.0.0/0 (prefix length 0)
10.0.0.0/8 dev eth0 proto kernel scope link     ← directly connected
10.0.0.128/25 via 10.0.0.250 dev eth0           ← more specific, wins for /25
192.168.100.0/24 via 10.0.0.1 dev eth0

# Example decision for packet to 10.0.0.150:
# Matches: 10.0.0.0/8 (prefix 8) AND 10.0.0.128/25 (prefix 25)
# Longest match wins → forward via 10.0.0.128/25 route (next hop: 10.0.0.250)

Static vs. dynamic routing

Static routes are manually configured by an administrator. Advantages: predictable, no routing overhead, no chance of a protocol bug sending traffic the wrong way. Disadvantages: doesn't adapt to failures; doesn't scale to the internet's size.

Dynamic routing protocols Nice-to-know — Details in Computer Networking II let routers automatically discover topology and compute paths:

Autonomous System (AS): a network under one administrative control, identified by a 16- or 32-bit ASN (Autonomous System Number). Example: AS13335 = Cloudflare, AS15169 = Google. BGP exchanges reachability information between ASes.

Static routing worked example: Three routers end-to-end

To understand how routers forward packets hop-by-hop without dynamic protocols, consider a network connecting two offices across three intermediate routers:

For communication to succeed between Host A and Host B, the administrator must configure explicit static routes in all three routing tables:

Hop-by-hop packet forwarding walkthrough (Host A → Host B):

1. Host A (192.168.10.5) checks destination 192.168.20.50. Mask comparison shows it is outside LAN A. Host A looks up its default gateway (192.168.10.1), sends an ARP request for R1's MAC, and transmits an Ethernet frame with dst MAC = R1.
2. Router R1 receives the frame on eth0, strips the Ethernet header, decrements IPv4 TTL by 1. R1 looks up 192.168.20.50 in its FIB → matches 192.168.20.0/24 with next-hop 10.1.2.2. R1 encapsulates the packet in a new Ethernet frame (src MAC = R1 eth1, dst MAC = R2 eth0) and transmits across WAN1.
3. Router R2 receives on eth0, decrements TTL. R2 consults its FIB → matches 192.168.20.0/24 with next-hop 10.2.3.2 on eth1. R2 rewrites link-layer MACs and forwards across WAN2.
4. Router R3 receives on eth0, decrements TTL. R3 matches destination 192.168.20.50 to directly connected network on eth1. R3 ARPs for Host B, encapsulates into a frame, and delivers directly to Host B.

Crucial lesson on asymmetric routing: Network routing is one-way! If the administrator configures routes from R1 → R2 → R3, Host A's packets reach Host B. But if R2 lacks a return route for 192.168.10.0/24, Host B's replies will be silently dropped at R2, resulting in 100% packet loss on ping. Every intermediate hop must have both forward and reverse paths defined.

ICMP — Internet Control Message Protocol (RFC 792)

ICMP carries error messages and diagnostic information within the IP layer. It is encapsulated in IP packets (Protocol = 1). ICMP is not a transport protocol — it carries no user data. Key message types:

How traceroute works

traceroute sends a series of packets with TTL = 1, 2, 3, … Each router decrements TTL; when it reaches 0, the router drops the packet and sends back ICMP Type 11 (Time Exceeded) to the source, revealing its IP and RTT. On Linux/macOS, traceroute uses UDP by default (ports 33434+); on Windows, tracert uses ICMP Echo Requests. Many networks block ICMP, explaining * * * output for some hops.

NAT / PAT — in detail

NAT (Network Address Translation, RFC 3022) modifies IP addresses in packet headers as they pass through a router. The most common form today is NAPT / PAT (Port Address Translation), often loosely called "NAT overload."

The NAT router maintains a translation table:

# NAT translation table (conceptual)
Internal src          External src (after NAT)   Destination           Proto
192.168.1.10:54321    203.0.113.1:40001           93.184.216.34:443     TCP
192.168.1.20:54890    203.0.113.1:40002           93.184.216.34:443     TCP
192.168.1.10:54322    203.0.113.1:40003           8.8.8.8:53            UDP

# Outbound: src IP/port rewritten to public IP + new port
# Inbound: dst IP/port rewritten back to original private IP/port

NAT implications and problems:

• Breaks end-to-end connectivity: external hosts cannot initiate connections to internal hosts — they don't know the private IP or port. Peer-to-peer applications (BitTorrent, WebRTC, gaming) need NAT traversal techniques (STUN, TURN, ICE, UPnP, NAT-PMP).
• Complicates protocols: protocols that embed IP addresses in payload (FTP, SIP, H.323) need application-layer gateways (ALGs) to rewrite those embedded addresses.
• Carrier-Grade NAT (CGN/CGNAT): ISPs deploy NAT at their own network, putting entire customer networks behind a shared public IP. RFC 6598 reserves 100.64.0.0/10 for this.
• IPv6 solution: every device gets a globally routable IPv6 address; NAT is not needed and is generally avoided.

Port forwarding (DNAT — Destination NAT)

Standard NAT/PAT handles outbound traffic (Source NAT / SNAT), mapping multiple private LAN addresses to a single public IP. However, because external internet hosts have no route to private RFC 1918 addresses, they cannot initiate inbound connections to internal devices. Port forwarding (DNAT — Destination Network Address Translation) solves this by rewriting destination IP addresses and ports on inbound packets.

When an incoming packet arrives at the router's external WAN interface, the router consults its static DNAT rules:

# Linux DNAT rule using iptables (PREROUTING chain):
$ sudo iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 8080 -j DNAT --to-destination 192.168.1.50:80

# Equivalent rule in modern nftables:
$ sudo nft add rule ip nat PREROUTING iif "eth0" tcp dport 8080 dnat to 192.168.1.50:80

Hairpin NAT (NAT loopback): A common problem arises when a device inside the LAN attempts to access the forwarded server using its public domain name or WAN IP. Without hairpinning, the router sends the packet to the server, but the server replies directly to the client's private IP, bypassing the router; the client drops the reply because it expected a response from the public IP. Hairpin NAT applies both DNAT and SNAT to internal requests directed at the public interface, keeping the connection symmetric.

Network tunneling and encapsulation

Tunneling encapsulates packets of one network protocol inside the payload of another (or the same) protocol. This creates an overlay network, allowing private or foreign packets to traverse an intermediate transit network without intermediate routers needing to understand or route the inner addresses.

Common tunneling protocols

• IP-in-IP (RFC 2003): Protocol number 4. Simplest encapsulation: prepends an outer 20-byte IPv4 header to an inner IPv4 packet. No encryption; often used in mobile IP and internal cluster routing.
• GRE (Generic Routing Encapsulation, RFC 2784): Protocol number 47. Cisco-developed, standardised protocol capable of encapsulating arbitrary layer-3 payloads (including multicast and IPv6) over IPv4 backbones. Adds 4 to 16 bytes of header overhead.
• WireGuard & IPsec: Encrypted tunnels. IPsec uses ESP (Encapsulating Security Payload, protocol 50); WireGuard encapsulates ChaCha20-Poly1305 encrypted packets within standard UDP datagrams (port 51820).
• VXLAN (RFC 7348) Overlay — Not on exam: Encapsulates entire Layer-2 Ethernet frames inside Layer-4 UDP packets (port 4789). Extends VLAN boundaries from 4,096 to over 16 million Virtual Network Identifiers (VNIs) across cloud data-centre spine-leaf fabrics.

[IPv6 Node] → (IPv6) → [Router B] === (IPv4 transit: Router C → Router D) ===> [Router E] → (IPv6) → [IPv6 Node]
                      (Ingress)                                               (Egress)

Router internals: Architecture and packet scheduling

A router operates at two radically different time scales, strictly separating its architecture into the Control Plane and the Data Plane (Forwarding Plane):

Internal router components

1. Input ports: Terminate physical links, decapsulate link-layer frames, and perform line-rate destination IP lookups in the FIB using TCAM (Ternary Content Addressable Memory). TCAM evaluates all prefix rules in parallel in a single clock cycle, enabling constant-time O(1) longest prefix matching.
   Input-Queue Head-of-Line (HOL) Blocking: Even if a router employs an ideal non-blocking crossbar fabric, contention can still occur if two packets at the front of two distinct input queues are destined for the same output port simultaneously. One packet must wait. That waiting packet stalls all packets queued behind it in the same input FIFO buffer — even if those queued packets are destined for completely idle, conflict-free output ports! Under uniform random traffic, FIFO input queuing mathematically caps total switch throughput to at most 2 − √2 ≈ 58.6%. Modern routers eliminate this bottleneck using Virtual Output Queuing (VOQ), maintaining a separate queue at each input port for every destination output port.
2. Switching fabric: The high-speed interconnect linking input ports to output ports:
   • Memory: CPU copies packets between ports via system RAM (early routers; throughput capped by bus memory bandwidth).
   • Shared bus: Ports communicate over a shared internal bus; only one packet can transfer at a time.
   • Crossbar switch: A 2D grid of interconnected fabric points allowing multiple non-conflicting packet transfers simultaneously in parallel. Modern high-capacity switches and core routers use multi-stage crossbar fabrics.
3. Output ports: Buffer packets when the switching fabric delivers data faster than the outgoing line can transmit, and schedule packets onto the physical wire.

Packet scheduling algorithms

When an output buffer experiences congestion, the packet scheduler determines the transmission order of queued packets:

• FIFO (First-In, First-Out): Delivers packets strictly in arrival order. Zero QoS differentiation; interactive VoIP packets wait behind bulk file downloads.
• Priority Queuing (PQ): Partitions traffic into priority queues (e.g. High, Medium, Low). Highest priority queue is always emptied first. Limitation: Lower priority flows can suffer complete starvation.
• Round Robin (RR): Scans active classes cyclically, dispatching one packet from each. Prevents starvation, but unfair if one class sends 1,500-byte packets and another sends 64-byte packets.
• Weighted Fair Queuing (WFQ): Generalised Processor Sharing. Each traffic flow receives a configurable percentage of link bandwidth. The scheduler computes a virtual completion time for each packet based on its byte length, interleaving transmissions to guarantee bit-level fairness regardless of individual packet sizes.

Buffer management: Drop Tail vs. AQM: When a FIFO queue fills completely, default Drop Tail discards all incoming packets. This leads to TCP global synchronisation: hundreds of flows simultaneously experience packet loss, drop their congestion windows at the exact same instant, and recover in unison, causing severe bandwidth oscillations. Modern routers use Active Queue Management (AQM) like RED (Random Early Detection) and CoDel (Controlled Delay) to drop or ECN-mark packets probabilistically before the buffer is exhausted, smoothing throughput and combating bufferbloat.

Extra Knowledge: SDN, Generalized Forwarding, and Middleboxes Beyond

Modern network architectures increasingly move beyond traditional per-router routing algorithms and simple destination-based forwarding toward programmable flow tables and specialised intermediate processing appliances.

Generalized Forwarding (Match-Plus-Action)

Traditional routers perform destination-based forwarding: when a packet arrives, the router inspects only the destination IP address, searches its Forwarding Information Base (FIB) using Longest Prefix Match, and transmits the datagram out of a specific interface.

By contrast, generalized forwarding (popularised by OpenFlow and P4) models network elements as flexible match-plus-action engines. Instead of looking only at the destination IP, an OpenFlow switch evaluates an arbitrary set of header fields across multiple protocol layers simultaneously:

• Layer 2: Source and Destination MAC addresses, Ethernet type, VLAN ID / priority.
• Layer 3: Source and Destination IPv4/IPv6 addresses, protocol field, ToS / DSCP bits.
• Layer 4: Source and Destination TCP/UDP port numbers, TCP flags.

When an incoming datagram matches a flow table rule, the switch executes one or more specified actions:

• Forward: Direct the datagram to one or more egress ports (supporting point-to-point forwarding or multicast fan-out).
• Drop: Silently discard the packet, implementing line-rate firewall and ACL filtering.
• Modify: Rewrite header values (e.g. rewriting IP addresses and port numbers for NAT, decrementing TTL, or pushing/popping VLAN tags).
• Send to Controller: Encapsulate and forward the unrecognised packet to the centralised SDN controller for policy decisions.

Software-Defined Networking (SDN)

Traditional computer networking relies on a distributed control plane: each router independently runs routing daemons (such as OSPF, IS-IS, or BGP) in its own operating system, exchanges routing state with neighbours, computes shortest paths, and populates its local forwarding table.

Software-Defined Networking (SDN) decouples the network into two distinct, specialised tiers:

• Logically Centralised Control Plane: The routing and control logic is removed from individual routers and consolidated into an SDN Controller (or a resilient distributed controller cluster like ONOS or OpenDaylight). The controller maintains a complete, centralised view of network topology, link loads, and access policies, calculating flow paths as software applications.
• Data Plane (Forwarding Plane): Simple, high-speed hardware switches ("white-box" switches) equipped with TCAM flow tables that execute fast match-action packet processing without running distributed routing algorithms.
• Southbound API: A standardised protocol interface (such as OpenFlow or P4Runtime) through which the SDN controller communicates with data-plane switches to install, update, and monitor flow table rules.

Middleboxes and the End-to-End Principle

RFC 3234 defines a middlebox as "any intermediate device on the datagram path between a source host and destination host that performs functions other than the normal, standard functions of an IP router on the datagram path". While traditional routers merely examine IP headers to forward datagrams hop-by-hop, middleboxes inspect, modify, filter, or terminate traffic:

• NATboxes (Network Address Translation): Rewrite private RFC 1918 addresses and ephemeral port numbers to public routable IPs and ports, overcoming IPv4 exhaustion.
• Firewalls & IDS/IPS: Enforce security policies via stateless packet filtering (IP/port matching), stateful inspection (tracking TCP handshake state and sequence numbers), or Deep Packet Inspection (DPI, scanning application payloads for exploits).
• Load Balancers: Distribute client workloads across back-end server pools using Layer 4 transport load balancing (DNAT/IP tunneling) or Layer 7 reverse proxying (HTTP URL path routing, TLS termination).
• Web Caches, Proxies & WAN Optimisers: Store cached HTTP objects, terminate and split TCP connections across high-latency WAN links, and enforce MSS clamping to prevent tunnel fragmentation.

Trade-offs and Protocol Ossification: Although middleboxes deliver critical performance and security capabilities, they violate the fundamental end-to-end principle of the Internet architecture (which states that network reliability and intelligence should reside exclusively at communicating end hosts, with the network core remaining a simple, stateless packet carrier). Furthermore, middleboxes frequently drop packets bearing unfamiliar TCP options or experimental protocol numbers, creating severe protocol ossification. This rigid ossification was the primary catalyst for modern protocols like QUIC (RFC 9000), which encrypts transport-layer headers inside standard UDP datagrams to prevent on-path middleboxes from meddling with transport state.