Layer 3: Network Layer
Routing & Logical Addressing
The Network Layer provides logical addressing and routing services to deliver packets from source to destination across multiple networks. It handles path determination and packet forwarding between different network segments.
Layer 3 (Network) Technologies
The Network Layer is responsible for end-to-end packet delivery across multiple networks. It provides logical addressing (IP), routing, path determination, and packet forwarding between different network segments.
The Critical Role: While Layer 2 handles local delivery using MAC addresses, Layer 3 enables global internet communication using IP addresses and routing protocols.
Source Host
Destination
Network Protocol Information
🎯 Primary Functions
- Logical Addressing: IP addresses for global device identification
- Routing: Finding best paths between networks
- Packet Forwarding: Moving packets toward their destination
- Path Determination: Calculating optimal routes
- Fragmentation: Breaking packets into smaller pieces when needed
🔧 Key Characteristics
- IP Addresses: 32-bit (IPv4) or 128-bit (IPv6) logical addresses
- Routing Tables: Databases of network paths
- Subnet Masks: Define network and host portions
- TTL/Hop Limit: Prevent infinite packet loops
- ICMP: Error reporting and network diagnostics
🌐 Network Layer Protocols
🌍 IPv4 (Internet Protocol v4)
Primary Internet Protocol
What you see in Wireshark: Source/destination IP addresses, TTL, protocol type
Every packet on the internet uses IP addressing🔮 IPv6 (Internet Protocol v6)
Next Generation Internet Protocol
What you see in Wireshark: 128-bit addresses, flow labels, hop limits
Solves IPv4 address exhaustion with massive address space🔍 ICMP (Internet Control Message Protocol)
Network Diagnostics & Error Reporting
What you see in Wireshark: Ping requests/replies, error messages, network unreachable
Powers ping, traceroute, and network error reporting🗺️ OSPF (Open Shortest Path First)
Dynamic Routing Protocol
What you see in Wireshark: Hello packets, LSA updates, topology advertisements
Routers automatically learn network topology and calculate best paths🌐 BGP (Border Gateway Protocol)
Internet Backbone Routing
What you see in Wireshark: Route advertisements, AS paths, network prefixes
How the global internet routes traffic between ISPs🏠 ARP (Address Resolution Protocol)
IP to MAC Address Mapping
What you see in Wireshark: ARP requests/replies finding MAC addresses
Bridges the gap between Layer 2 (MAC) and Layer 3 (IP)📦 IPv4 Packet Header Structure
Understanding what's inside every IP packet:
4 bits
4 bits
8 bits
16 bits
16 bits
3 bits
13 bits
8 bits
8 bits
16 bits
32 bits
32 bits
Key Header Fields Explained:
- TTL (Time to Live): Prevents packets from circling forever - decremented at each router
- Protocol: Tells what's inside (TCP=6, UDP=17, ICMP=1)
- Source/Dest IP: Where packet came from and where it's going
- Fragmentation: Allows large packets to be split across smaller networks
- Checksum: Detects errors in the header (not the data)
🗺️ How Routing Works
Scenario: Packet travelling from your home (192.168.1.100) to Google (8.8.8.8)
| Hop | Router | Network | Action | TTL |
|---|---|---|---|---|
| 1 | Home Router | 192.168.1.0/24 | Forward to ISP | 64 → 63 |
| 2 | ISP Gateway | 10.0.0.0/8 | Route to backbone | 63 → 62 |
| 3 | Backbone Router | Core Internet | BGP path selection | 62 → 61 |
| 4 | Google Router | 8.8.8.0/24 | Deliver to server | 61 → 60 |
🔢 Subnetting Mastery: Complete Guide — Understanding how networks are divided and organised
📐 IP Address Structure Breakdown
📝 Working Example: 192.168.1.100/24
🔍 Step 1: Identify the Components
🖥️ Host IP Address
🎯 Subnet Mask
🔢 Step 2: Convert to Binary
11000000.10101000.00000001.01100100
11111111.11111111.11111111.00000000
🎯 Step 3: Identify Network vs Host Portions
📊 Step 4: Calculate Network Details
🎯 Common Subnet Masks Reference
| CIDR | Subnet Mask | Total IPs | Usable Hosts | Binary Notation | Common Use Case |
|---|---|---|---|---|---|
| /8 | 255.0.0.0 | 16,777,216 | 16,777,214 | 11111111.00000000.00000000.00000000 | Class A / ISP Networks |
| /16 | 255.255.0.0 | 65,536 | 65,534 | 11111111.11111111.00000000.00000000 | Class B / Large Organisations |
| /24 | 255.255.255.0 | 256 | 254 | 11111111.11111111.11111111.00000000 | Class C / Small Office/Home |
| /25 | 255.255.255.128 | 128 | 126 | 11111111.11111111.11111111.10000000 | Subnet /24 into 2 |
| /26 | 255.255.255.192 | 64 | 62 | 11111111.11111111.11111111.11000000 | Subnet /24 into 4 |
| /27 | 255.255.255.224 | 32 | 30 | 11111111.11111111.11111111.11100000 | Small Department Networks |
| /28 | 255.255.255.240 | 16 | 14 | 11111111.11111111.11111111.11110000 | Tiny Networks (10-15 devices) |
| /30 | 255.255.255.252 | 4 | 2 | 11111111.11111111.11111111.11111100 | Point-to-Point Router Links |
| /31 | 255.255.255.254 | 2 | 2 | 11111111.11111111.11111111.11111110 | RFC 3021 P2P Links (no broadcast) |
| /32 | 255.255.255.255 | 1 | 1 | 11111111.11111111.11111111.11111111 | Single Host / Loopback |
🧮 Practical Subnetting Example
📋 Scenario
Your company has been assigned 192.168.10.0/24 and needs to create 4 separate subnets for different departments.
📐 Step 1: Calculate Required Bits
🎯 The Question:
How many bits do we need to borrow to create 4 subnets?
🧮 Formula: 2ⁿ = Number of Subnets
📊 Subnet Mask Changes:
🔢 Step 2: Calculate Block Size
🎯 The Question:
How many IP addresses will each subnet contain?
🧮 Formula: 256 - Subnet Octet
📋 Each Subnet Provides:
🎯 Step 3: Subnet Breakdown
🏢 Sales Department
⚙️ Engineering Department
📢 Marketing Department
📊 Administration Department
🧮 Visual Subnetting Calculator
Quick Reference: Common Subnet Divisions
Choose how many subnets you need from a /24 network
Block size: 128
Block size: 64
Block size: 32
Block size: 16
🎓 Essential Subnetting Formulas
| Formula | Calculation | Purpose |
|---|---|---|
| Number of Subnets | 2^n (where n = borrowed bits) | How many subnets you can create |
| Hosts per Subnet | 2^h - 2 (where h = host bits) | Usable IP addresses per subnet |
| Block Size | 256 - subnet octet | Increment between subnets |
| Network Address | All host bits = 0 | First address (not usable) |
| Broadcast Address | All host bits = 1 | Last address (not usable) |
💡 Real-World Subnetting Scenarios
🏢 Office Building Network
512 total addresses available
🏭 Manufacturing Plant Network
65,536 total addresses available
🔍 Wireshark Filters for Subnet Analysis
📊 Essential Network Filters
Copy these filters directly into Wireshark to analyse subnet traffic
🔍 Real-World Example: Accessing a Website
Scenario: You type "www.google.com" in your browser
What happens at the Network Layer:
- DNS Resolution: Browser gets IP address (216.58.194.174) for www.google.com
- Route Lookup: Your router checks routing table for path to 216.58.194.174
- Packet Creation: HTTP request wrapped in IP packet with source/dest addresses
- Hop-by-Hop Forwarding: Each router decrements TTL and forwards toward destination
- Path Determination: Routers use OSPF/BGP to find best path
- Final Delivery: Packet reaches Google's network and is delivered
- Return Journey: Response follows same process in reverse
🔍 Wireshark Network Layer Analysis
Step-by-step packet flow when accessing www.google.com
The Network Layer makes global internet communication possible by providing logical addressing and routing.
🐛 Common Network Layer Problems
- Routing Loops: Packets circling between routers infinitely
- IP Address Conflicts: Multiple devices using same IP
- Subnet Misconfigurations: Wrong subnet masks preventing communication
- Routing Table Errors: Missing or incorrect routes
- MTU Problems: Packets too large for network segments
- TTL Expiration: Packets dying before reaching destination
🔧 Troubleshooting Tools
- Ping: Test basic connectivity and packet loss
- Traceroute: Show path packets take to destination
- Routing Tables: View and modify router forwarding tables
- IP Config: Display and configure IP settings
- Wireshark: analyse IP packet headers and routing
- Network Calculators: Subnet planning and IP management
🎓 Teaching Analogy: Postal System
Think of the Network Layer like the postal system:
- Addresses (IP): Full mailing addresses that work globally
- Postal Codes (Subnets): Group addresses by geographic regions
- Sorting Facilities (Routers): Decide which direction mail should go
- Postal Routes (Routing Tables): Maps showing best paths to destinations
- Postal Trucks (Packets): Carry mail between sorting facilities
- Return to Sender (ICMP): Error messages when delivery fails
Just like the postal system routes mail across the world, Layer 3 routes packets across the internet!
📚 Key Learning Points
- Network Layer provides logical addressing that works across different networks
- Routers operate at Layer 3, making forwarding decisions based on IP addresses
- Routing protocols (OSPF, BGP) automatically learn and share network topology
- Subnetting allows efficient use of IP address space
- TTL/Hop Limit prevents packets from looping forever
- Layer 3 makes internet-scale communication possible
Check your understanding — Layer 3
Five questions on Layer 3 — IP addressing, routing and subnetting.
-
What is the PDU at the Network Layer?
Layer 3 produces packets: a payload from Layer 4 wrapped in an IP header carrying source and destination IP addresses, TTL and protocol number.
-
What does a router do to the TTL field of every packet it forwards?
Each router decrements TTL by one. At zero the packet is discarded and an ICMP “Time Exceeded” message goes back to the sender — which is exactly the mechanism traceroute exploits.
-
How many usable host addresses does a /26 subnet provide?
A /26 leaves 6 host bits, so 2⁶ = 64 total addresses. Subtract the network address and the broadcast address and you are left with 62 usable hosts.
-
Which protocol does ping use?
Ping sends ICMP Echo Requests (type 8) and waits for Echo Replies (type 0). ICMP rides directly inside IP with protocol number 1 — there is no TCP or UDP port involved.
-
What is the broadcast address of 192.168.1.100/24?
With a /24 the last octet is entirely host bits. All host bits set to 1 gives 192.168.1.255. All host bits set to 0 gives the network address, 192.168.1.0.
Layer 3 (Network) — frequently asked questions
What is the Network Layer in the OSI model?
The Network Layer is Layer 3. It provides logical addressing (IP), works out the best path to a destination, and forwards packets hop by hop across networks that may use completely different Layer 1 and Layer 2 technologies. Routers are the classic Layer 3 device.
What is the difference between an IP address and a MAC address?
A MAC address is a fixed hardware identifier that only has meaning on the local link — it is never rewritten as a frame crosses a router. An IP address is a logical, configurable address that identifies a host anywhere on the internet and stays the same end to end. ARP is what maps one to the other on a local segment.
Why does traceroute work?
Traceroute sends packets with TTL set to 1, then 2, then 3, and so on. Each router that decrements TTL to zero discards the packet and returns an ICMP “Time Exceeded” message revealing its own address. Reading those replies in order maps out the path.
What is subnetting and why does it matter?
Subnetting borrows bits from the host portion of an address to create several smaller networks from one larger allocation. It limits the size of broadcast domains, lets you apply different security policies per department, and stops you wasting thousands of addresses on a link that only needs two.