Layer 3: Network Layer
Routing & Logical Addressing
The Network Layer provides logical addressing and routing services to deliver packets from source to destination across multiple networks. It handles path determination and packet forwarding between different network segments.
Layer 3 (Network) Technologies
The Network Layer is responsible for end-to-end packet delivery across multiple networks. It provides logical addressing (IP), routing, path determination, and packet forwarding between different network segments.
Logical Addressing - IP addresses that work globally across different physical networks
Routing & Path Selection - Finding the best path through multiple routers to reach destination
Packet Forwarding - Moving packets hop-by-hop from source to destination network
Network Internetworking - Connecting different types of networks (Ethernet, Wi-Fi, etc.)
The Critical Role: While Layer 2 handles local delivery using MAC addresses, Layer 3 enables global internet communication using IP addresses and routing protocols.
Source Host
192.168.1.100
Ready
Route Lookup
Forward
Deliver
IP
IP
Routing Status:
Select a protocol and mode to begin
Step 0 of 0
Network Idle
Destination
8.8.8.8
Listening
Network Protocol Information
Select a protocol and click "Protocol Details" to learn more.
๐ฏ Primary Functions
- Logical Addressing: IP addresses for global device identification
- Routing: Finding best paths between networks
- Packet Forwarding: Moving packets toward their destination
- Path Determination: Calculating optimal routes
- Fragmentation: Breaking packets into smaller pieces when needed
๐ง Key Characteristics
- IP Addresses: 32-bit (IPv4) or 128-bit (IPv6) logical addresses
- Routing Tables: Databases of network paths
- Subnet Masks: Define network and host portions
- TTL/Hop Limit: Prevent infinite packet loops
- ICMP: Error reporting and network diagnostics
๐ Network Layer Protocols
๐ IPv4 (Internet Protocol v4)
Primary Internet Protocol
Internet Protocol Version 4
Version: 4, Header Length: 20 bytes
Src: 192.168.1.100 (192.168.1.100)
Dst: 8.8.8.8 (8.8.8.8)
TTL: 64, Protocol: TCP (6)
What you see in Wireshark: Source/destination IP addresses, TTL, protocol type
Every packet on the internet uses IP addressing๐ฎ IPv6 (Internet Protocol v6)
Next Generation Internet Protocol
Internet Protocol Version 6
Version: 6, Traffic Class: 0, Flow Label: 0
Src: 2001:db8::1
Dst: 2001:db8::100
Hop Limit: 64, Next Header: TCP (6)
What you see in Wireshark: 128-bit addresses, flow labels, hop limits
Solves IPv4 address exhaustion with massive address space๐ ICMP (Internet Control Message Protocol)
Network Diagnostics & Error Reporting
Internet Control Message Protocol
Type: 8 (Echo Request)
Code: 0, Checksum: 0x1234
Identifier: 0x0001, Sequence: 0x0001
Data: "Hello World"
What you see in Wireshark: Ping requests/replies, error messages, network unreachable
Powers ping, traceroute, and network error reporting๐บ๏ธ OSPF (Open Shortest Path First)
Dynamic Routing Protocol
Open Shortest Path First
Version: 2, Type: Hello Packet
Router ID: 192.168.1.1
Area ID: 0.0.0.0
Neighbors: 192.168.1.2, 192.168.1.3
What you see in Wireshark: Hello packets, LSA updates, topology advertisements
Routers automatically learn network topology and calculate best paths๐ BGP (Border Gateway Protocol)
Internet Backbone Routing
Border Gateway Protocol
Type: UPDATE, Length: 45
Path Attributes: AS_PATH, NEXT_HOP
NLRI: 203.0.113.0/24
AS Path: 65001 65002 65003
What you see in Wireshark: Route advertisements, AS paths, network prefixes
How the global internet routes traffic between ISPs๐ ARP (Address Resolution Protocol)
IP to MAC Address Mapping
Address Resolution Protocol (request)
Hardware type: Ethernet
Protocol type: IPv4
Who has 192.168.1.1? Tell 192.168.1.100
Target hardware address: 00:00:00:00:00:00
What you see in Wireshark: ARP requests/replies finding MAC addresses
Bridges the gap between Layer 2 (MAC) and Layer 3 (IP)๐ฆ IPv4 Packet Header Structure
Understanding what's inside every IP packet:
Version
4 bits
4 bits
IHL
4 bits
4 bits
Type of Service
8 bits
8 bits
Total Length
16 bits
16 bits
Identification
16 bits
16 bits
Flags
3 bits
3 bits
Fragment Offset
13 bits
13 bits
TTL
8 bits
8 bits
Protocol
8 bits
8 bits
Header Checksum
16 bits
16 bits
Source IP Address
32 bits
32 bits
Destination IP Address
32 bits
32 bits
Real IPv4 Packet in Wireshark:
Internet Protocol Version 4, Src: 192.168.1.100, Dst: 8.8.8.8
0100 .... = Version: 4
.... 0101 = Header Length: 20 bytes (5)
Differentiated Services Field: 0x00
Total Length: 84
Identification: 0x1234 (4660)
Flags: 0x4000, Don't fragment
Time to live: 64
Protocol: ICMP (1)
Header checksum: 0x5678 [validation disabled]
Key Header Fields Explained:
- TTL (Time to Live): Prevents packets from circling forever - decremented at each router
- Protocol: Tells what's inside (TCP=6, UDP=17, ICMP=1)
- Source/Dest IP: Where packet came from and where it's going
- Fragmentation: Allows large packets to be split across smaller networks
- Checksum: Detects errors in the header (not the data)
๐บ๏ธ How Routing Works
Scenario: Packet travelling from your home (192.168.1.100) to Google (8.8.8.8)
| Hop | Router | Network | Action | TTL |
|---|---|---|---|---|
| 1 | Home Router | 192.168.1.0/24 | Forward to ISP | 64 โ 63 |
| 2 | ISP Gateway | 10.0.0.0/8 | Route to backbone | 63 โ 62 |
| 3 | Backbone Router | Core Internet | BGP path selection | 62 โ 61 |
| 4 | Google Router | 8.8.8.0/24 | Deliver to server | 61 โ 60 |
Traceroute showing the path:
1 192.168.1.1 1ms (home router)
2 10.0.0.1 15ms (ISP gateway)
3 203.0.113.1 25ms (backbone router)
4 8.8.8.8 30ms (Google DNS)
Each hop shows a router making a forwarding decision!
๐ข Subnetting Mastery: Complete Guide โ Understanding how networks are divided and organised
๐ IP Address Structure Breakdown
๐ Working Example: 192.168.1.100/24
๐ Step 1: Identify the Components
๏ฟฝ๏ธ Host IP Address
192.168.1.100
Decimal Notation
๐ฏ Subnet Mask
255.255.255.0
/24 CIDR Notation
๐ข Step 2: Convert to Binary
IP Address Binary:
192.168.1.100 =
11000000.10101000.00000001.01100100
11000000.10101000.00000001.01100100
Subnet Mask Binary:
255.255.255.0 =
11111111.11111111.11111111.00000000
11111111.11111111.11111111.00000000
๐ฏ Step 3: Identify Network vs Host Portions
IP Address Binary:
11000000.10101000.00000001.01100100
โโโโโโโโโโโโโโโ Network (24 bits) โโโโโโโโโโโโโโโ
โโ Host (8 bits) โโ
Network identifies the subnet โข Host identifies individual devices
๐ Step 4: Calculate Network Details
Network Address
192.168.1.0
(All host bits = 0)
Usable Range
192.168.1.1 - 192.168.1.254
(254 host addresses)
Broadcast Address
192.168.1.255
(All host bits = 1)
๐ฏ Common Subnet Masks Reference
| CIDR | Subnet Mask | Total IPs | Usable Hosts | Binary Notation | Common Use Case |
|---|---|---|---|---|---|
| /8 | 255.0.0.0 | 16,777,216 | 16,777,214 | 11111111.00000000.00000000.00000000 | Class A / ISP Networks |
| /16 | 255.255.0.0 | 65,536 | 65,534 | 11111111.11111111.00000000.00000000 | Class B / Large Organisations |
| /24 | 255.255.255.0 | 256 | 254 | 11111111.11111111.11111111.00000000 | Class C / Small Office/Home |
| /25 | 255.255.255.128 | 128 | 126 | 11111111.11111111.11111111.10000000 | Subnet /24 into 2 |
| /26 | 255.255.255.192 | 64 | 62 | 11111111.11111111.11111111.11000000 | Subnet /24 into 4 |
| /27 | 255.255.255.224 | 32 | 30 | 11111111.11111111.11111111.11100000 | Small Department Networks |
| /28 | 255.255.255.240 | 16 | 14 | 11111111.11111111.11111111.11110000 | Tiny Networks (10-15 devices) |
| /30 | 255.255.255.252 | 4 | 2 | 11111111.11111111.11111111.11111100 | Point-to-Point Router Links |
| /31 | 255.255.255.254 | 2 | 2 | 11111111.11111111.11111111.11111110 | RFC 3021 P2P Links (no broadcast) |
| /32 | 255.255.255.255 | 1 | 1 | 11111111.11111111.11111111.11111111 | Single Host / Loopback |
๐งฎ Practical Subnetting Example
๐ Scenario
Your company has been assigned 192.168.10.0/24 and needs to create 4 separate subnets for different departments.
๐ Step 1: Calculate Required Bits
๐ฏ The Question:
How many bits do we need to borrow to create 4 subnets?
๐งฎ Formula: 2โฟ = Number of Subnets
2ยน = 2 subnets โ
2ยฒ = 4 subnets โ
2ยณ = 8 subnets (too many)
๐ Subnet Mask Changes:
Original: /24 (255.255.255.0)
Borrow: 2 bits from host portion
New mask: /26 (255.255.255.192)
๐ข Step 2: Calculate Block Size
๐ฏ The Question:
How many IP addresses will each subnet contain?
๐งฎ Formula: 256 - Subnet Octet
Subnet mask: 255.255.255.192
Calculation: 256 - 192 = 64
Block size = 64 addresses
๐ Each Subnet Provides:
๐ฆ 64 total IP addresses
๐ป 62 usable host addresses
(minus 1 network + 1 broadcast)
๐ฏ Step 3: Subnet Breakdown
๐ข Sales Department
Network: 192.168.10.0/26
Range: .1 โ .62
Broadcast: 192.168.10.63
โ๏ธ Engineering Department
Network: 192.168.10.64/26
Range: .65 โ .126
Broadcast: 192.168.10.127
๐ข Marketing Department
Network: 192.168.10.128/26
Range: .129 โ .190
Broadcast: 192.168.10.191
๐ Administration Department
Network: 192.168.10.192/26
Range: .193 โ .254
Broadcast: 192.168.10.255
๐งฎ Visual Subnetting Calculator
Quick Reference: Common Subnet Divisions
Choose how many subnets you need from a /24 network
๐ด
2 Subnets
/25 mask โข 126 hosts each
Block size: 128
Block size: 128
๐
4 Subnets
/26 mask โข 62 hosts each
Block size: 64
Block size: 64
๐ก
8 Subnets
/27 mask โข 30 hosts each
Block size: 32
Block size: 32
๐ข
16 Subnets
/28 mask โข 14 hosts each
Block size: 16
Block size: 16
๐ Essential Subnetting Formulas
| Formula | Calculation | Purpose |
|---|---|---|
| Number of Subnets | 2^n (where n = borrowed bits) | How many subnets you can create |
| Hosts per Subnet | 2^h - 2 (where h = host bits) | Usable IP addresses per subnet |
| Block Size | 256 - subnet octet | Increment between subnets |
| Network Address | All host bits = 0 | First address (not usable) |
| Broadcast Address | All host bits = 1 | Last address (not usable) |
๐ก Real-World Subnetting Scenarios
๐ข Office Building Network
Base Network: 192.168.0.0/23
512 total addresses available
512 total addresses available
๐ข Floor 1: Workstations
192.168.0.0/25
126 hosts โข PCs, printers, phones
๐ข Floor 2: Workstations
192.168.0.128/25
126 hosts โข PCs, printers, phones
๐ข Floor 3: Management
192.168.1.0/25
126 hosts โข Executive offices
๐ฅ๏ธ Server Room: Infrastructure
192.168.1.128/27
30 hosts โข File servers, databases
๐ถ Guest WiFi: Visitors
192.168.1.160/27
30 hosts โข Isolated guest access
๐ญ Manufacturing Plant Network
Base Network: 10.20.0.0/16
65,536 total addresses available
65,536 total addresses available
๐ญ Production Floor: Machinery
10.20.0.0/20
4,094 hosts โข PLCs, HMIs, controllers
๐ฆ Warehouse: Logistics
10.20.16.0/21
2,046 hosts โข Scanners, conveyors
๐ฅ Office Staff: Administration
10.20.24.0/22
1,022 hosts โข Computers, printers
๐ IoT Sensors: Monitoring
10.20.28.0/22
1,022 hosts โข Temperature, pressure
โ๏ธ VoIP System: Communications
10.20.32.0/23
510 hosts โข IP phones, gateways
๐ Wireshark Filters for Subnet Analysis
๐ Essential Network Filters
Copy these filters directly into Wireshark to analyse subnet traffic
๐ก All Subnet Traffic
Most comprehensive
ip.addr == 192.168.1.0/24
# Shows all traffic in/out of subnet
๐ค Outgoing Traffic
From subnet
ip.src == 192.168.1.0/24
# Traffic originating from subnet
๐ฅ Incoming Traffic
To subnet
ip.dst == 192.168.1.0/24
# Traffic destined to subnet
๐ข Broadcast Traffic
Network announcements
ip.addr == 192.168.1.255
# Broadcast messages
๐ซ External Traffic
Outside subnet
!(ip.addr == 192.168.1.0/24)
# Traffic outside subnet
๐ Network Address
Routing traffic
ip.addr == 192.168.1.0
# Network/routing traffic
๐ Real-World Example: Accessing a Website
Scenario: You type "www.google.com" in your browser
What happens at the Network Layer:
- DNS Resolution: Browser gets IP address (216.58.194.174) for www.google.com
- Route Lookup: Your router checks routing table for path to 216.58.194.174
- Packet Creation: HTTP request wrapped in IP packet with source/dest addresses
- Hop-by-Hop Forwarding: Each router decrements TTL and forwards toward destination
- Path Determination: Routers use OSPF/BGP to find best path
- Final Delivery: Packet reaches Google's network and is delivered
- Return Journey: Response follows same process in reverse
๐ Wireshark Network Layer Analysis
Step-by-step packet flow when accessing www.google.com
1
DNS Query Request
DNS Query: A record for www.google.com
Source: 192.168.1.100:53741
Destination: 8.8.8.8:53
2
DNS Response Received
DNS Response: 216.58.194.174
Type: A Record
TTL: 300 seconds
3
IP Packet Creation
IP Packet: 192.168.1.100 โ 216.58.194.174
Protocol: TCP (Port 80/443)
TTL: 64 hops
Packet Size: 1500 bytes (MTU)
4
ARP Resolution
ARP: Resolve next hop MAC address
Who has 192.168.1.1? Tell 192.168.1.100
Reply: 192.168.1.1 is at aa:bb:cc:dd:ee:ff
5
HTTP Data Transmission
Multiple IP packets carrying HTTP data
Packet 1: [SYN] TCP handshake
Packet 2-5: HTTP GET request fragments
IPv4 fragments reassembled at destination
โ
Error Handling (If Required)
ICMP if route fails: "Network unreachable"
Destination Host Unreachable
Router sends error back to source
๐ฏ Key Network Layer Functions Demonstrated:
โ
Logical Addressing (IP)
โ
Routing & Path Selection
โ
Packet Fragmentation
โ
Error Detection (ICMP)
The Network Layer makes global internet communication possible by providing logical addressing and routing.
๐ Common Network Layer Problems
- Routing Loops: Packets circling between routers infinitely
- IP Address Conflicts: Multiple devices using same IP
- Subnet Misconfigurations: Wrong subnet masks preventing communication
- Routing Table Errors: Missing or incorrect routes
- MTU Problems: Packets too large for network segments
- TTL Expiration: Packets dying before reaching destination
๐ง Troubleshooting Tools
- Ping: Test basic connectivity and packet loss
- Traceroute: Show path packets take to destination
- Routing Tables: View and modify router forwarding tables
- IP Config: Display and configure IP settings
- Wireshark: analyse IP packet headers and routing
- Network Calculators: Subnet planning and IP management
๐ Teaching Analogy: Postal System
Think of the Network Layer like the postal system:
- Addresses (IP): Full mailing addresses that work globally
- Postal Codes (Subnets): Group addresses by geographic regions
- Sorting Facilities (Routers): Decide which direction mail should go
- Postal Routes (Routing Tables): Maps showing best paths to destinations
- Postal Trucks (Packets): Carry mail between sorting facilities
- Return to Sender (ICMP): Error messages when delivery fails
Just like the postal system routes mail across the world, Layer 3 routes packets across the internet!
๐ Key Learning Points
- Network Layer provides logical addressing that works across different networks
- Routers operate at Layer 3, making forwarding decisions based on IP addresses
- Routing protocols (OSPF, BGP) automatically learn and share network topology
- Subnetting allows efficient use of IP address space
- TTL/Hop Limit prevents packets from looping forever
- Layer 3 makes internet-scale communication possible