🗺️ Layer 3: Network Layer

Routing & Logical Addressing

The Network Layer provides logical addressing and routing services to deliver packets from source to destination across multiple networks. It handles path determination and packet forwarding between different network segments.

Layer 3 (Network) Technologies

The Network Layer is responsible for end-to-end packet delivery across multiple networks. It provides logical addressing (IP), routing, path determination, and packet forwarding between different network segments.

Logical Addressing - IP addresses that work globally across different physical networks

Routing & Path Selection - Finding the best path through multiple routers to reach destination

Packet Forwarding - Moving packets hop-by-hop from source to destination network

Network Internetworking - Connecting different types of networks (Ethernet, Wi-Fi, etc.)

The Critical Role: While Layer 2 handles local delivery using MAC addresses, Layer 3 enables global internet communication using IP addresses and routing protocols.

Choose Network Protocol:

🖥️

Source Host

192.168.1.100

Ready

Route Lookup

Forward

Deliver

Routing Status:

Select a protocol and mode to begin

Step 0 of 0

Network Idle

🌐

Destination

8.8.8.8

Listening

Network Protocol Information

Select a protocol and click "Protocol Details" to learn more.

🎯 Primary Functions

Logical Addressing: IP addresses for global device identification
Routing: Finding best paths between networks
Packet Forwarding: Moving packets toward their destination
Path Determination: Calculating optimal routes
Fragmentation: Breaking packets into smaller pieces when needed

🔧 Key Characteristics

IP Addresses: 32-bit (IPv4) or 128-bit (IPv6) logical addresses
Routing Tables: Databases of network paths
Subnet Masks: Define network and host portions
TTL/Hop Limit: Prevent infinite packet loops
ICMP: Error reporting and network diagnostics

🌐 Network Layer Protocols

🌍 IPv4 (Internet Protocol v4)

Primary Internet Protocol

Internet Protocol Version 4 Version: 4, Header Length: 20 bytes Src: 192.168.1.100 (192.168.1.100) Dst: 8.8.8.8 (8.8.8.8) TTL: 64, Protocol: TCP (6)

What you see in Wireshark: Source/destination IP addresses, TTL, protocol type

Every packet on the internet uses IP addressing

🔮 IPv6 (Internet Protocol v6)

Next Generation Internet Protocol

Internet Protocol Version 6 Version: 6, Traffic Class: 0, Flow Label: 0 Src: 2001:db8::1 Dst: 2001:db8::100 Hop Limit: 64, Next Header: TCP (6)

What you see in Wireshark: 128-bit addresses, flow labels, hop limits

Solves IPv4 address exhaustion with massive address space

🔍 ICMP (Internet Control Message Protocol)

Network Diagnostics & Error Reporting

Internet Control Message Protocol Type: 8 (Echo Request) Code: 0, Checksum: 0x1234 Identifier: 0x0001, Sequence: 0x0001 Data: "Hello World"

What you see in Wireshark: Ping requests/replies, error messages, network unreachable

Powers ping, traceroute, and network error reporting

🗺️ OSPF (Open Shortest Path First)

Dynamic Routing Protocol

Open Shortest Path First Version: 2, Type: Hello Packet Router ID: 192.168.1.1 Area ID: 0.0.0.0 Neighbors: 192.168.1.2, 192.168.1.3

What you see in Wireshark: Hello packets, LSA updates, topology advertisements

Routers automatically learn network topology and calculate best paths

🌐 BGP (Border Gateway Protocol)

Internet Backbone Routing

Border Gateway Protocol Type: UPDATE, Length: 45 Path Attributes: AS_PATH, NEXT_HOP NLRI: 203.0.113.0/24 AS Path: 65001 65002 65003

What you see in Wireshark: Route advertisements, AS paths, network prefixes

How the global internet routes traffic between ISPs

🏠 ARP (Address Resolution Protocol)

IP to MAC Address Mapping

Address Resolution Protocol (request) Hardware type: Ethernet Protocol type: IPv4 Who has 192.168.1.1? Tell 192.168.1.100 Target hardware address: 00:00:00:00:00:00

What you see in Wireshark: ARP requests/replies finding MAC addresses

Bridges the gap between Layer 2 (MAC) and Layer 3 (IP)

📦 IPv4 Packet Header Structure

Understanding what's inside every IP packet:

Version
4 bits

IHL
4 bits

Type of Service
8 bits

Total Length
16 bits

Identification
16 bits

Flags
3 bits

Fragment Offset
13 bits

TTL
8 bits

Protocol
8 bits

Header Checksum
16 bits

Source IP Address
32 bits

Destination IP Address
32 bits

Real IPv4 Packet in Wireshark: Internet Protocol Version 4, Src: 192.168.1.100, Dst: 8.8.8.8 0100 .... = Version: 4 .... 0101 = Header Length: 20 bytes (5) Differentiated Services Field: 0x00 Total Length: 84 Identification: 0x1234 (4660) Flags: 0x4000, Don't fragment Time to live: 64 Protocol: ICMP (1) Header checksum: 0x5678 [validation disabled]

Key Header Fields Explained:

TTL (Time to Live): Prevents packets from circling forever - decremented at each router
Protocol: Tells what's inside (TCP=6, UDP=17, ICMP=1)
Source/Dest IP: Where packet came from and where it's going
Fragmentation: Allows large packets to be split across smaller networks
Checksum: Detects errors in the header (not the data)

🗺️ How Routing Works

Scenario: Packet traveling from your home (192.168.1.100) to Google (8.8.8.8)

Hop	Router	Network	Action	TTL
1	Home Router	192.168.1.0/24	Forward to ISP	64 → 63
2	ISP Gateway	10.0.0.0/8	Route to backbone	63 → 62
3	Backbone Router	Core Internet	BGP path selection	62 → 61
4	Google Router	8.8.8.0/24	Deliver to server	61 → 60

Traceroute showing the path: 1 192.168.1.1 1ms (home router) 2 10.0.0.1 15ms (ISP gateway) 3 203.0.113.1 25ms (backbone router) 4 8.8.8.8 30ms (Google DNS) Each hop shows a router making a forwarding decision!

🔢 Subnetting Mastery: Complete Guide

Understanding how networks are divided and organised

📐 IP Address Structure Breakdown

📝 Working Example: 192.168.1.100/24

🔍 Step 1: Identify the Components

�️ Host IP Address

192.168.1.100

Decimal Notation

🎯 Subnet Mask

255.255.255.0

/24 CIDR Notation

🔢 Step 2: Convert to Binary

IP Address Binary:

                                192.168.1.100 =

                                11000000.10101000.00000001.01100100

Subnet Mask Binary:

                                255.255.255.0 =

                                11111111.11111111.11111111.00000000

🎯 Step 3: Identify Network vs Host Portions

IP Address Binary:

                                11000000.10101000.00000001.01100100
                            
                                    └────────────── Network (24 bits) ──────────────┘
                                    └─ Host (8 bits) ─┘
                                
                                    Network identifies the subnet • Host identifies individual devices

📊 Step 4: Calculate Network Details

Network Address

192.168.1.0

(All host bits = 0)

Usable Range

192.168.1.1 - 192.168.1.254

(254 host addresses)

Broadcast Address

192.168.1.255

(All host bits = 1)

🎯 Common Subnet Masks Reference

CIDR	Subnet Mask	Total IPs	Usable Hosts	Binary Notation	Common Use Case
/8	255.0.0.0	16,777,216	16,777,214	11111111.00000000.00000000.00000000	Class A / ISP Networks
/16	255.255.0.0	65,536	65,534	11111111.11111111.00000000.00000000	Class B / Large Organisations
/24	255.255.255.0	256	254	11111111.11111111.11111111.00000000	Class C / Small Office/Home
/25	255.255.255.128	128	126	11111111.11111111.11111111.10000000	Subnet /24 into 2
/26	255.255.255.192	64	62	11111111.11111111.11111111.11000000	Subnet /24 into 4
/27	255.255.255.224	32	30	11111111.11111111.11111111.11100000	Small Department Networks
/28	255.255.255.240	16	14	11111111.11111111.11111111.11110000	Tiny Networks (10-15 devices)
/30	255.255.255.252	4	2	11111111.11111111.11111111.11111100	Point-to-Point Router Links
/31	255.255.255.254	2	2	11111111.11111111.11111111.11111110	RFC 3021 P2P Links (no broadcast)
/32	255.255.255.255	1	1	11111111.11111111.11111111.11111111	Single Host / Loopback

🧮 Practical Subnetting Example

📋 Scenario

Your company has been assigned 192.168.10.0/24 and needs to create 4 separate subnets for different departments.

📐 Step 1: Calculate Required Bits

🎯 The Question:

How many bits do we need to borrow to create 4 subnets?

🧮 Formula: 2ⁿ = Number of Subnets

2¹ = 2 subnets ❌
2² = 4 subnets ✅
2³ = 8 subnets (too many)

📊 Subnet Mask Changes:

Original: /24 (255.255.255.0)
Borrow: 2 bits from host portion
New mask: /26 (255.255.255.192)

🔢 Step 2: Calculate Block Size

🎯 The Question:

How many IP addresses will each subnet contain?

🧮 Formula: 256 - Subnet Octet

Subnet mask: 255.255.255.192
Calculation: 256 - 192 = 64
Block size = 64 addresses

📋 Each Subnet Provides:

📦 64 total IP addresses

💻 62 usable host addresses

(minus 1 network + 1 broadcast)

🎯 Step 3: Subnet Breakdown

🏢 Sales Department

Network: 192.168.10.0/26
Range: .1 → .62
Broadcast: 192.168.10.63

⚙️ Engineering Department

Network: 192.168.10.64/26
Range: .65 → .126
Broadcast: 192.168.10.127

📢 Marketing Department

Network: 192.168.10.128/26
Range: .129 → .190
Broadcast: 192.168.10.191

📊 Administration Department

Network: 192.168.10.192/26
Range: .193 → .254
Broadcast: 192.168.10.255

🧮 Visual Subnetting Calculator

Quick Reference: Common Subnet Divisions

Choose how many subnets you need from a /24 network

🔴

2 Subnets

                            /25 mask • 126 hosts each

                            Block size: 128

🟠

4 Subnets

                            /26 mask • 62 hosts each

                            Block size: 64

🟡

8 Subnets

                            /27 mask • 30 hosts each

                            Block size: 32

🟢

16 Subnets

                            /28 mask • 14 hosts each

                            Block size: 16

🎓 Essential Subnetting Formulas

Formula	Calculation	Purpose
Number of Subnets	2^n (where n = borrowed bits)	How many subnets you can create
Hosts per Subnet	2^h - 2 (where h = host bits)	Usable IP addresses per subnet
Block Size	256 - subnet octet	Increment between subnets
Network Address	All host bits = 0	First address (not usable)
Broadcast Address	All host bits = 1	Last address (not usable)

💡 Real-World Subnetting Scenarios

🏢 Office Building Network

Base Network: 192.168.0.0/23
512 total addresses available

🏢 Floor 1: Workstations 192.168.0.0/25

126 hosts • PCs, printers, phones

🏢 Floor 2: Workstations 192.168.0.128/25

126 hosts • PCs, printers, phones

🏢 Floor 3: Management 192.168.1.0/25

126 hosts • Executive offices

🖥️ Server Room: Infrastructure 192.168.1.128/27

30 hosts • File servers, databases

📶 Guest WiFi: Visitors 192.168.1.160/27

30 hosts • Isolated guest access

🏭 Manufacturing Plant Network

Base Network: 10.20.0.0/16
65,536 total addresses available

🏭 Production Floor: Machinery 10.20.0.0/20

4,094 hosts • PLCs, HMIs, controllers

📦 Warehouse: Logistics 10.20.16.0/21

2,046 hosts • Scanners, conveyors

👥 Office Staff: Administration 10.20.24.0/22

1,022 hosts • Computers, printers

🌐 IoT Sensors: Monitoring 10.20.28.0/22

1,022 hosts • Temperature, pressure

☎️ VoIP System: Communications 10.20.32.0/23

510 hosts • IP phones, gateways

🔍 Wireshark Filters for Subnet Analysis

📊 Essential Network Filters

Copy these filters directly into Wireshark to analyse subnet traffic

📡 All Subnet Traffic Most comprehensive

                            ip.addr == 192.168.1.0/24
                            # Shows all traffic in/out of subnet
                        

📤 Outgoing Traffic From subnet

                            ip.src == 192.168.1.0/24
                            # Traffic originating from subnet
                        

📥 Incoming Traffic To subnet

                            ip.dst == 192.168.1.0/24
                            # Traffic destined to subnet
                        

📢 Broadcast Traffic Network announcements

                            ip.addr == 192.168.1.255
                            # Broadcast messages
                        

🚫 External Traffic Outside subnet

                            !(ip.addr == 192.168.1.0/24)
                            # Traffic outside subnet
                        

🌐 Network Address Routing traffic

                            ip.addr == 192.168.1.0
                            # Network/routing traffic
                        

🔍 Real-World Example: Accessing a Website

Scenario: You type "www.google.com" in your browser

What happens at the Network Layer:

DNS Resolution: Browser gets IP address (216.58.194.174) for www.google.com
Route Lookup: Your router checks routing table for path to 216.58.194.174
Packet Creation: HTTP request wrapped in IP packet with source/dest addresses
Hop-by-Hop Forwarding: Each router decrements TTL and forwards toward destination
Path Determination: Routers use OSPF/BGP to find best path
Final Delivery: Packet reaches Google's network and is delivered
Return Journey: Response follows same process in reverse

🔍 Wireshark Network Layer Analysis

Step-by-step packet flow when accessing www.google.com

1 DNS Query Request

DNS Query: A record for www.google.com
Source: 192.168.1.100:53741
Destination: 8.8.8.8:53

2 DNS Response Received

DNS Response: 216.58.194.174
Type: A Record
TTL: 300 seconds

3 IP Packet Creation

IP Packet: 192.168.1.100 → 216.58.194.174
Protocol: TCP (Port 80/443)
TTL: 64 hops
Packet Size: 1500 bytes (MTU)

4 ARP Resolution

ARP: Resolve next hop MAC address
Who has 192.168.1.1? Tell 192.168.1.100
Reply: 192.168.1.1 is at aa:bb:cc:dd:ee:ff

5 HTTP Data Transmission

Multiple IP packets carrying HTTP data
Packet 1: [SYN] TCP handshake
Packet 2-5: HTTP GET request fragments
IPv4 fragments reassembled at destination

⚠ Error Handling (If Required)

ICMP if route fails: "Network unreachable"
Destination Host Unreachable
Router sends error back to source

🎯 Key Network Layer Functions Demonstrated:

✅ Logical Addressing (IP)

✅ Routing & Path Selection

✅ Packet Fragmentation

✅ Error Detection (ICMP)

The Network Layer makes global internet communication possible by providing logical addressing and routing.

🐛 Common Network Layer Problems

Routing Loops: Packets circling between routers infinitely
IP Address Conflicts: Multiple devices using same IP
Subnet Misconfigurations: Wrong subnet masks preventing communication
Routing Table Errors: Missing or incorrect routes
MTU Problems: Packets too large for network segments
TTL Expiration: Packets dying before reaching destination

🔧 Troubleshooting Tools

Ping: Test basic connectivity and packet loss
Traceroute: Show path packets take to destination
Routing Tables: View and modify router forwarding tables
IP Config: Display and configure IP settings
Wireshark: analyse IP packet headers and routing
Network Calculators: Subnet planning and IP management

🎓 Teaching Analogy: Postal System

Think of the Network Layer like the postal system:

Addresses (IP): Full mailing addresses that work globally
Postal Codes (Subnets): Group addresses by geographic regions
Sorting Facilities (Routers): Decide which direction mail should go
Postal Routes (Routing Tables): Maps showing best paths to destinations
Postal Trucks (Packets): Carry mail between sorting facilities
Return to Sender (ICMP): Error messages when delivery fails

Just like the postal system routes mail across the world, Layer 3 routes packets across the internet!

📚 Key Learning Points

Network Layer provides logical addressing that works across different networks
Routers operate at Layer 3, making forwarding decisions based on IP addresses
Routing protocols (OSPF, BGP) automatically learn and share network topology
Subnetting allows efficient use of IP address space
TTL/Hop Limit prevents packets from looping forever
Layer 3 makes internet-scale communication possible

← Return to OSI Overview