The Network Layer

The network layer makes one promise and deliberately makes no others.

The organising fact is that IP offers best-effort delivery of a datagram to an address anywhere, and every other mechanism in this chapter either creates addresses, translates between them, or repairs a gap that the promise leaves.

Best-effort means no guarantee of delivery, ordering, or timing, and no notification when a datagram is dropped. ICMP exists precisely because that silence is sometimes unacceptable.

ARP translates an IP address into a link-layer address. DHCP hands out addresses. NAT rewrites them. Fragmentation repairs the mismatch between what IP allows and what a link can carry.

The second organising fact is that an IP address names an interface, not a machine, and its structure is a prefix identifying a network plus a suffix identifying a host within it.

The third is that forwarding uses longest prefix match, which is what allows a general route and a specific exception to coexist in one table.

1. The IPv4 Datagram

The header is 20 bytes without options and at most 60 with them.

Two design decisions are worth pausing on. The checksum covers only the header, because the payload is the transport layer's responsibility and recomputing a full checksum at every hop would be prohibitive.

The time to live field is decremented by each router, and a datagram reaching zero is discarded with an ICMP notification, which is what prevents routing loops from consuming the network forever.

2. Addressing and CIDR

Classful addressing divided the space into fixed blocks: class A with an 8-bit prefix, class B with 16, and class C with 24. The rigidity wasted enormous numbers of addresses, since an organisation needing 300 hosts had to take a class B block of 65,534.

Classless inter-domain routing replaced it with an explicit prefix length. An address is written as a.b.c.d/n, where the first $n$ bits are the network prefix.

The block contains $2^{32-n}$ addresses, of which two are unusable: the all-zeros host part is the network address and the all-ones host part is the directed broadcast.

So a prefix of length $n$ supports $2^{32-n}-2$ hosts.

The subnet mask is $n$ ones followed by $32-n$ zeros, and a host computes its network address by taking the bitwise AND of its address with the mask.

Subnetting borrows bits from the host part to create several smaller networks inside one block. Supernetting or aggregation merges adjacent blocks into a shorter prefix, which is what keeps global routing tables from exploding.

Longest prefix match is the forwarding rule. When several entries match a destination, the one with the longest prefix wins, which lets a specific route override a general one without any explicit priority field.

3. Fragmentation

Every link has a maximum transmission unit, and a datagram larger than the next link's MTU must be fragmented or discarded.

Three header fields control it. Identification is copied to every fragment so the destination can group them. The more-fragments flag is set on all but the last. The offset gives the fragment's position in the original payload.

The offset is measured in units of 8 bytes, because 13 bits must address a payload of up to 65,515 bytes, and $2^{13}\times 8=65,536$.

Consequently every fragment except the last must carry a payload that is a multiple of 8 bytes.

Reassembly happens only at the destination, never at intermediate routers, because different fragments may take different paths.

A lost fragment costs the whole datagram, since reassembly cannot complete, which is one reason fragmentation is avoided in practice through path MTU discovery.

Setting the don't-fragment flag makes a router discard an oversized datagram and return an ICMP message naming the MTU, which is how path MTU discovery learns the limit.

4. ARP, DHCP, ICMP and NAT

ARP resolves an IP address to a link-layer address on the same subnet. The requester broadcasts a query and the owner replies by unicast, and both cache the result.

ARP only ever resolves addresses on the local subnet. To reach a remote destination, a host resolves the address of its default gateway, so the frame's destination MAC is the router's while the datagram's destination IP remains the final target.

That distinction is examined constantly: the IP addresses stay fixed end to end while the MAC addresses change at every hop.

DHCP assigns addresses dynamically through a four-message exchange: discover, offer, request and acknowledge. It runs over UDP on ports 67 and 68, and the first messages are broadcast because the client has no address yet.

ICMP reports errors and provides diagnostics, carried inside IP as protocol 1. Destination unreachable, time exceeded, echo request and echo reply are the messages to know.

Ping uses echo request and reply. Traceroute uses time exceeded, sending datagrams with time to live 1, then 2, and so on, so each router in turn reports itself.

ICMP never makes IP reliable. It reports failures; it does not retransmit.

An ICMP error carries the failed datagram's header and first eight payload bytes, which is exactly enough for the source to identify the transport connection responsible, since the first eight bytes of a TCP or UDP header contain both port numbers.

NAT rewrites addresses and ports at a boundary, letting many private hosts share one public address. The translation table maps an internal address and port to an external port.

NAT breaks the end-to-end principle, since an outside host cannot initiate a connection inward without explicit configuration, and protocols embedding addresses in their payload need special handling.

Special and Private Addresses

Three ranges are reserved for private use and are never routed on the public internet: 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16.

The loopback block is 127.0.0.0/8, of which 127.0.0.1 is the familiar address, and traffic to it never leaves the host.

169.254.0.0/16 is link-local, self-assigned when DHCP fails, which is why a machine with no network shows an address in that range.

255.255.255.255 is the limited broadcast, never forwarded by a router.

IPv6

IPv6 uses 128-bit addresses, ending exhaustion as a design concern, and simplifies the header rather than merely enlarging it.

The header is a fixed 40 bytes with no checksum and no fragmentation fields. Removing the checksum avoids recomputation at every hop, and fragmentation is pushed to the source through mandatory path MTU discovery.

Options move into extension headers chained after the fixed header, so a router that does not need them skips them entirely.

ARP is replaced by neighbour discovery, which runs over ICMPv6 rather than as a separate link-layer protocol, and broadcast is replaced by multicast throughout.

5. Worked Examples

Example 1. An organisation is given 200.10.16.0/20 and needs 8 equal subnets. Compute the new prefix length, the addresses per subnet, and the range of the third subnet.

Eight subnets need 3 additional bits, since $2^3=8$.

The new prefix length is $20+3=23$.

Each subnet holds $2^{32-23}=2^9=512$ addresses, of which $512-2=510$ are usable by hosts.

The block starts at 200.10.16.0, and each subnet spans 512 addresses, which is two full values of the third octet.

Subnet 0 covers 200.10.16.0 to 200.10.17.255.

Subnet 1 covers 200.10.18.0 to 200.10.19.255.

Subnet 2, the third one, covers 200.10.20.0 to 200.10.21.255.

Its network address is 200.10.20.0 and its broadcast is 200.10.21.255, so the usable host range is 200.10.20.1 to 200.10.21.254.

The mask for a /23 is 255.255.254.0, since 23 ones is eight, eight, then seven ones and one zero, and 11111110 is 254.

Example 2. A router has these entries. To which interface does a datagram for 192.168.5.130 go?

Test each entry by masking the destination.

Against /16, the first 16 bits of the destination are 192.168, which matches. Entry A matches.

Against /22, the mask covers the first 22 bits, so the third octet is masked with 11111100, which is 252. The destination's third octet is 5, and $5\text{ AND }252=4$, matching the prefix's 4. Entry B matches.

Against /25, the mask covers the first 25 bits, so the fourth octet is masked with 128. The destination's fourth octet is 130, and $130\text{ AND }128=128$, matching. Entry C matches.

Entry D, the default route, matches everything.

Four entries match, and longest prefix match selects the longest, which is the /25.

The datagram goes to interface C.

This is exactly the mechanism that lets a specific exception override a general rule without any priority or ordering field in the table. Adding a more specific route is how traffic is redirected, and removing it restores the previous behaviour automatically.

Example 3. A 4000-byte datagram, including a 20-byte header, must cross a link with an MTU of 1500 bytes. Compute the fragments.

The payload is $4000-20=3980$ bytes.

Each fragment carries a 20-byte header, so at most $1500-20=1480$ bytes of payload.

The payload per fragment must be a multiple of 8, and 1480 is $8\times 185$, so 1480 is usable directly.

Fragment 1 carries bytes 0 to 1479, offset 0, more-fragments set.

Fragment 2 carries bytes 1480 to 2959. Its offset is $1480/8=185$, more-fragments set.

Fragment 3 carries the remaining $3980-2960=1020$ bytes, that is bytes 2960 to 3979. Its offset is $2960/8=370$, more-fragments clear.

Total bytes on the wire are $1500+1500+1040=4040$, against 4000 originally, so fragmentation added 40 bytes of header overhead.

All three fragments carry the same identification value, which is how the destination groups them.

If fragment 2 is lost, fragments 1 and 3 are useless. The destination holds them until a reassembly timer expires and then discards everything, and IP sends no notification to the source about the individual fragment.

That is why path MTU discovery is preferred: setting don't-fragment and learning the limit avoids the fragility entirely.

Example 4. Host A at 10.0.1.5 sends to host B at 10.0.2.9 through router R, which has interfaces 10.0.1.1 and 10.0.2.1. State the source and destination IP and MAC addresses in each frame.

Host A first determines that B is not on its subnet, by masking both addresses and finding different network numbers.

So A must send the datagram to its default gateway, which is R at 10.0.1.1.

A uses ARP to learn R's MAC address on the 10.0.1.0 subnet, broadcasting a request for 10.0.1.1 and receiving R's reply.

In the first frame, from A to R: source IP is 10.0.1.5, destination IP is 10.0.2.9, source MAC is A's, destination MAC is R's 10.0.1.1 interface.

Note carefully that the destination IP is B's, not R's. The datagram is addressed to its final destination throughout; only the frame is addressed to the next hop.

R receives the frame, strips it, decrements the time to live, and consults its routing table.

R then uses ARP on the 10.0.2.0 subnet to learn B's MAC address.

In the second frame, from R to B: source IP is still 10.0.1.5, destination IP is still 10.0.2.9, source MAC is R's 10.0.2.1 interface, destination MAC is B's.

The rule to carry away: IP addresses are end to end and never change; MAC addresses are hop by hop and change at every router.

The only exception is NAT, which deliberately rewrites the IP addresses and is therefore not a router in the pure sense.

Example 5. Four blocks are allocated to one organisation: 200.10.8.0/24, 200.10.9.0/24, 200.10.10.0/24 and 200.10.11.0/24. Can they be aggregated, and what is the resulting prefix?

Write the third octets in binary. 8 is 00001000, 9 is 00001001, 10 is 00001010, 11 is 00001011.

The four values share their first six bits, 000010, and differ only in the last two.

Since the first two octets are identical, the common prefix is $16+6=22$ bits.

The aggregate is 200.10.8.0/22, covering 200.10.8.0 to 200.10.11.255, which is exactly the four blocks and nothing more.

Two conditions had to hold, and both are essential.

The blocks must be contiguous, which 8 through 11 are.

The count must be a power of two and the first block must be aligned to that boundary, which 8 is, since $8=4\times 2$ and the block count is 4.

Had the blocks been 9 through 12, aggregation would fail. Their common prefix would be only /20, covering 200.10.0.0 to 200.10.15.255, which includes eleven blocks the organisation does not own, and advertising it would attract traffic for addresses belonging to others.

This alignment requirement is why address allocation is done in aligned power-of-two blocks, and it is the entire reason the global routing table is merely large rather than unmanageable.

Example 6. A NAT router has one public address 203.0.113.7. Two internal hosts, 192.168.1.10 and 192.168.1.11, each open a connection to 93.184.216.34 port 80 from their own source port 5000. Describe the translation and one thing it breaks.

Both internal connections have the same source port, 5000, which would collide if the router simply substituted its own address.

So NAT rewrites the port as well, allocating a distinct external port for each connection.

The table holds two entries: internal 192.168.1.10 port 5000 mapped to external 203.0.113.7 port 40001, and internal 192.168.1.11 port 5000 mapped to external port 40002.

Outgoing datagrams have their source address and port rewritten, and the checksums must be recomputed, since both the IP header and the transport header change.

Incoming datagrams are matched by destination port against the table and rewritten back.

What this breaks is inbound connection establishment. An outside host cannot initiate a connection to 192.168.1.10, because no table entry exists until the internal host sends something first, and the router has nothing to match on.

A second breakage is protocol-specific. Any protocol that carries an IP address inside its payload, as classic FTP does in its port command, sends a private address the outside world cannot route, so NAT must inspect and rewrite the payload too.

The general principle is that NAT violates the end-to-end argument by putting connection state in the middle of the network, which is exactly what IP was designed to avoid, and it is tolerated because it postponed IPv4 exhaustion by decades.

Summary

IP promises best-effort delivery to an address anywhere, and everything else here creates addresses, translates them, or repairs a gap the promise leaves.

The header is 20 to 60 bytes. The checksum covers the header only, because the payload belongs to the transport layer. Time to live prevents loops from consuming the network.

CIDR writes an address as a prefix length. A /n block holds $2^{32-n}$ addresses and $2^{32-n}-2$ usable hosts, since the all-zeros and all-ones host parts are reserved. Subnetting borrows host bits; aggregation merges aligned, contiguous, power-of-two blocks into a shorter prefix.

Longest prefix match lets a specific route override a general one with no priority field.

Fragment offset is in 8-byte units, so every fragment but the last carries a multiple of 8 bytes. Reassembly happens only at the destination, and one lost fragment destroys the whole datagram. Don't-fragment plus ICMP gives path MTU discovery.

ARP resolves only local addresses, so a host off-subnet resolves its gateway instead. IP addresses are end to end and unchanged; MAC addresses change at every hop.

DHCP uses discover, offer, request and acknowledge over UDP ports 67 and 68. ICMP reports errors without repairing them, and traceroute exploits time exceeded.

NAT rewrites addresses and ports, requires checksum recomputation, prevents unsolicited inbound connections, and breaks protocols that embed addresses in payloads.

The private ranges are 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16; 127.0.0.0/8 is loopback and 169.254.0.0/16 is the self-assigned link-local block that appears when DHCP fails.

IPv6 has 128-bit addresses and a fixed 40-byte header with no checksum and no fragmentation fields, moving options into chained extension headers and replacing ARP with neighbour discovery over ICMPv6.