1. Network Layer Overview

The network layer (Layer 3 in the OSI model) is responsible for logical addressing and routing — getting packets from a source host to a destination host across multiple networks, potentially traversing many routers along the way.

While the Data Link layer handles communication between two directly connected devices on the same network, the Network layer handles end-to-end delivery across different networks. Every time a packet crosses from one network to another, it passes through a router — a device that operates at Layer 3.

Key Network Layer Functions

• Logical Addressing: Assigns IP addresses to identify source and destination hosts globally
• Routing: Determines the best path for packets through the network of routers
• Packet Forwarding: Moves packets from input to output interface based on routing table
• Fragmentation: Breaks large packets into smaller pieces if the next link’s MTU (Maximum Transmission Unit) is smaller
• Logical Network Separation: Separates networks into distinct logical entities (subnets)

2. IPv4 Address Structure

An IPv4 address is a 32-bit number, written as four groups of decimal numbers (0–255) separated by dots — called dotted-decimal notation.

An IPv4 address has two parts:

• Network portion: Identifies which network the device is on — shared by all devices on the same subnet
• Host portion: Identifies the specific device within that network — unique per device

The subnet mask determines which bits belong to the network portion (mask bits = 1) and which to the host portion (mask bits = 0).

Special IPv4 Addresses

Private IP Address Ranges (RFC 1918)

Private addresses are not routable on the public internet — routers will not forward packets from/to these ranges. NAT (Network Address Translation) is used to connect private networks to the internet.

3. IP Address Classes

The original IPv4 design divided the address space into classes based on the first few bits. This classful system is largely superseded by CIDR, but understanding classes is foundational.

4. Subnetting

Subnetting divides a large network into smaller sub-networks (subnets) by borrowing bits from the host portion of the address. This improves security, reduces broadcast traffic, and enables more efficient IP allocation.

How to Subnet — Step by Step

Subnetting Quick Reference

5. CIDR and Supernetting

CIDR (Classless Inter-Domain Routing) was introduced in 1993 to replace the rigid class-based system. It allows any prefix length from /0 to /32, enabling flexible allocation of IP address blocks.

Supernetting (route aggregation) is the opposite of subnetting — it combines multiple contiguous networks into a single routing entry, reducing the size of routing tables.

6. ARP and RARP

ARP (Address Resolution Protocol) bridges the gap between Layer 3 (IP addresses) and Layer 2 (MAC addresses). When a device knows a destination IP address on its local network, it needs the MAC address to construct the Ethernet frame.

ARP Process

1. Device A wants to send to 192.168.1.10 (on the same subnet)
2. A checks its ARP cache — if 192.168.1.10’s MAC is cached, use it directly
3. If not cached: A broadcasts an ARP Request: “Who has 192.168.1.10? Tell 192.168.1.5”
4. All devices on the subnet receive the broadcast; only 192.168.1.10 responds
5. 192.168.1.10 sends an ARP Reply (unicast): “192.168.1.10 is at MAC AA:BB:CC:DD:EE:FF”
6. A stores this in its ARP cache (with a timeout, typically 20 minutes) and sends the packet

RARP (Reverse ARP) was the predecessor to DHCP — a diskless workstation could broadcast its MAC address and receive back its IP. Largely obsolete, replaced by DHCP/BOOTP.

IPv6 replacement for ARP: NDP (Neighbour Discovery Protocol) using ICMPv6 Neighbour Solicitation and Neighbour Advertisement messages.

7. DHCP

DHCP (Dynamic Host Configuration Protocol) automatically assigns IP addresses and network configuration to devices when they join a network, eliminating the need for manual configuration.

DHCP DORA Process

DHCP provides: IP address, subnet mask, default gateway, DNS server addresses, lease duration.

A DHCP lease can be renewed before it expires. If the lease expires, the client must go through DORA again. This allows IP addresses to be reused when devices leave the network.

8. ICMP

ICMP (Internet Control Message Protocol) is a companion protocol to IP, used for error reporting and network diagnostics. It is NOT a transport protocol — it doesn’t carry user data. Instead, it carries messages about the IP network itself.

Common ICMP Message Types

How Ping and Traceroute Work

ping: Sends ICMP Echo Request to the target; target replies with Echo Reply. Measures round-trip time and packet loss.

traceroute: Sends packets with increasing TTL values (1, 2, 3…). Each router that decrements TTL to 0 sends back an ICMP Time Exceeded message — revealing its identity (IP address) and distance (RTT). This traces the complete path from source to destination.

9. NAT – Network Address Translation

NAT allows an entire private network to access the internet using a single public IP address. Your home router performs NAT — all your devices (laptop, phone, TV) share one public IP when browsing the internet.

How NAT Works (PAT — Port Address Translation)

1. Device 192.168.1.10 opens a connection to google.com:443, using source port 54321
2. Router records: {192.168.1.10:54321 ↔ public_IP:60001}
3. Router rewrites packet: source = public_IP:60001, sends to Google
4. Google responds to public_IP:60001
5. Router looks up port 60001 in its NAT table → forwards to 192.168.1.10:54321

10. IPv6

IPv6 was developed to solve IPv4’s fundamental problem: address exhaustion. With 128-bit addresses, IPv6 provides 3.4 × 10³⁸ addresses — effectively unlimited.

IPv6 Address Format

Written as eight groups of four hexadecimal digits, separated by colons: 2001:0db8:85a3:0000:0000:8a2e:0370:7334

Shorthand rules:

• Leading zeros in each group can be omitted: 0db8 → db8
• One or more consecutive all-zero groups can be replaced with :: (only once per address): 2001:db8::8a2e:370:7334

IPv6 Address Types

Key IPv6 Improvements over IPv4

• No broadcast: IPv6 uses multicast and anycast instead of broadcast, reducing network traffic
• Simplified header: Fixed 40-byte header (fewer fields than variable-length IPv4 header) for faster router processing
• SLAAC: Stateless Address Autoconfiguration — devices can generate their own IPv6 address without a DHCP server
• Built-in IPSec: Security (authentication and encryption) is a mandatory part of the IPv6 specification
• No fragmentation at routers: Routers don’t fragment IPv6 packets; end hosts do (using Path MTU Discovery)
• NDP replaces ARP: Neighbour Discovery Protocol uses ICMPv6 instead of the broadcast-heavy ARP

11. Common Misconceptions