CN Module 3 — Network Layer

Layer 3

Network Layer & Packet Switching

Network Layer (OSI Layer 3) — end-to-end delivery of packets across multiple networks. Unlike Data Link (same network), Network Layer handles cross-network routing via IP addresses.

5 Key Functions

Function	What it does
Logical Addressing	Assigns unique IP addresses; identifies host + network
Routing	Finds optimal path using algorithms (Dijkstra, Bellman-Ford)
Packet Forwarding	Moves packet from input interface → correct output interface
Fragmentation & Reassembly	Splits packets to fit MTU; reassembles at destination
Error/Congestion Control	Detects errors, notifies upper layers, prevents congestion

Packet Switching

Data is broken into packets that travel independently through the network — no dedicated path (unlike circuit switching used in old PSTN).

✔ Advantages

Efficient resource utilization (shared links)
Resilient — reroutes around failures
Scalable — handles bursty traffic
Cost-effective — no dedicated circuit

✘ Disadvantages

Variable delay (jitter)
Possible packet loss → retransmission
Out-of-order delivery

Packet Structure

Part	Contains
Header	Source IP, Dest IP, Sequence #, Protocol type (TCP/UDP), TTL
Payload	Actual data being transmitted

MTU (Maximum Transmission Unit) — max packet size a network can carry. Ethernet MTU = 1500 bytes. Packets larger than MTU are fragmented.

Devices

Networking & Internetworking Devices

Quick Comparison — All Devices

Device	OSI Layer	Addresses Used	Broadcast?	Key Role
Repeater	Layer 1 (Physical)	None	Yes	Signal amplification/regeneration
Hub	Layer 1 (Physical)	None	Yes (all ports)	Multi-port repeater
Bridge	Layer 2 (Data Link)	MAC address	Selective	Connects two LAN segments
Switch	Layer 2 (Data Link)	MAC address	No (unicast)	Intelligent multi-port bridge
Router	Layer 3 (Network)	IP address	No	Connects different networks
Gateway	Layer 4–7 (up to App)	IP + Protocol	No	Protocol conversion between hetero networks
Firewall	Layer 3 + 7	IP, Port, Protocol	No	Traffic filtering & security

L1Repeater

Operates at Physical Layer. Amplifies/regenerates electrical signals to extend network distance.

Simple, inexpensive, extends cable distance

No filtering — forwards noise too. No MAC/IP awareness.

L1Hub

Multi-port repeater. Broadcasts every incoming signal to ALL ports. All devices share one collision domain.

Device A sends frame → hub receives on port 1
Hub regenerates signal → broadcasts to ALL other ports
Only device with matching MAC accepts it; others discard

✔ Pros	✘ Cons
Simple, cheap, plug-and-play	Broadcasts to all → collisions
Signal regeneration	Shared bandwidth degraded with more devices
Star topology support	No traffic filtering, no security

Largely replaced by Switches which handle data intelligently at Layer 2.

L2Bridge

Operates at Data Link Layer. Connects two LAN segments. Learns MAC addresses and forwards frames only to the segment where the destination lives.

Maintains a MAC address table (learned by observing source addresses)
Reduces collision domain (each segment is separate)
Filters traffic between segments — less congestion

L2Switch

A multi-port bridge. Each port = its own collision domain. Uses MAC address table (CAM table) to forward frames only to the correct port.

Frame arrives → switch reads source MAC → updates CAM table
Looks up destination MAC in table
Forwards frame only to destination port (unicast)
If unknown destination → floods all ports (like hub)

Full bandwidth per port, no collisions, intelligent forwarding

L3Router

Operates at Network Layer. Connects different networks. Uses IP addresses and routing tables to determine optimal path.

How a Router Forwards a Packet

Packet arrives at input interface
Router reads destination IP from header
Searches routing table for longest prefix match
Selects best path (using routing algorithm)
Forwards out appropriate interface → next hop
Repeat at each router until destination reached

Routing Table Entry contains:

Dest Network | Subnet Mask | Next-Hop IP | Interface | Metric

Subnet Example:

IP: 192.168.1.10 | Mask: 255.255.255.0 → Network: 192.168.1.0 | Host: 10

✔ Pros	✘ Cons
Inter-network communication	Complex config
Optimal path selection	Higher cost than hub/switch
Traffic management & filtering	Processing latency
Protocol independence	Routing table maintenance overhead

L7Gateway

Protocol converter between heterogeneous networks (different architectures/protocols). Operates up to Application Layer.

Use case: Connecting a TCP/IP network to a legacy IBM SNA mainframe — Gateway translates HTTP ↔ SNA.

Address conversion (IP ↔ SNA address)
Protocol conversion (TCP/IP ↔ SNA)
Data format/encoding conversion
Acts as security checkpoint (proxy)

Con: Single point of failure — if gateway goes down, inter-network comm stops.

L3+7Firewall

Monitors, filters, and controls traffic based on predefined security rules. Barrier between trusted internal ↔ untrusted external networks.

Types of Firewalls

Type	How it works	State-aware?
Packet Filtering (Stateless)	Checks each packet header (src IP, dest IP, port, protocol) against rules independently	No
Stateful Inspection	Tracks active connection state — only allows packets matching established sessions	Yes
Proxy-based	Intermediary — client ↔ firewall ↔ server; full application-level inspection	Yes

Flexible rules (IP, port, protocol, application), VPN support, data leakage prevention

Cannot protect against internal threats or sophisticated app-layer attacks alone.

Addressing

IPv4 — Logical Addressing

IPv4 — 32-bit address, written as 4 octets in dotted-decimal notation. 192.168.1.10. Total ~4.3 billion addresses (2³²).

IPv4 Header (20 bytes minimum)

IPv4 Address Classes

Class	First Octet Range	Default Subnet Mask	Networks	Hosts/Network	Use
A	1–126	255.0.0.0 (/8)	126	16,777,214	Large orgs, ISPs
B	128–191	255.255.0.0 (/16)	16,384	65,534	Universities, mid-size
C	192–223	255.255.255.0 (/24)	2M+	254	Small networks, homes
D	224–239	N/A	—	—	Multicast
E	240–255	N/A	—	—	Research/Reserved

127.x.x.x = Loopback (localhost). 169.254.x.x = APIPA (no DHCP). 10.x, 172.16–31.x, 192.168.x = Private ranges (RFC 1918).

Subnetting & CIDR

CIDR (Classless Inter-Domain Routing) — uses prefix notation /n to define variable-length subnet masks. Replaces classful addressing.

CIDR	Subnet Mask	Hosts	Example Use
`/8`	255.0.0.0	16,777,214	Class A equiv
`/16`	255.255.0.0	65,534	Class B equiv
`/24`	255.255.255.0	254	Class C equiv
`/30`	255.255.255.252	2	Point-to-point links

Hosts = 2^(32-prefix) − 2 (subtract network & broadcast address)

IPv4 Datagram Delivery

Type	Description	Example
Direct Delivery	Source & destination on same network — no routing needed	192.168.1.5 → 192.168.1.20
Indirect Delivery	Passes through one or more routers	192.168.1.5 → 8.8.8.8 via ISP router
Unicast	One source → one destination	HTTP request to server
Broadcast	One source → all hosts in network	ARP request: 255.255.255.255
Multicast	One source → group of interested receivers (Class D)	OSPF routers (224.0.0.5)

IPv6

IPv6 — Next Generation IP

IPv6 — 128-bit address. Written as 8 groups of 4 hex digits separated by colons.
2001:0db8:85a3:0000:0000:8a2e:0370:7334
Total = 2¹²⁸ ≈ 3.4 × 10³⁸ addresses — effectively unlimited.

Why IPv6? — IPv4 Problems Solved

IPv4 Problem	IPv6 Solution
Address exhaustion (only ~4.3B)	128-bit = 340 undecillion addresses
Complex header with options overhead	Fixed 40-byte header, extension headers for options
Fragmentation by routers	Only source fragments; routers drop oversized + send ICMPv6
No built-in security	IPSec mandatory in IPv6 spec
Manual / DHCP address config	SLAAC — Stateless Address Autoconfiguration
Checksum in header (redundant)	No header checksum — upper layers handle it
Broadcast (wastes bandwidth)	No broadcast — uses multicast & anycast instead

IPv6 Header (Fixed 40 bytes)

IPv6 Address Types

Type	Prefix	Description
Unicast — Global	`2000::/3`	Routable on internet (like public IPv4)
Unicast — Link-Local	`FE80::/10`	Auto-configured, same link only (like 169.254.x.x)
Unicast — Loopback	`::1`	Localhost (like 127.0.0.1)
Multicast	`FF00::/8`	One-to-many (replaces broadcast)
Anycast	Same as unicast	One-to-nearest (routed to closest node in group)
Unspecified	`::`	Source before address assigned (like 0.0.0.0)

No broadcast in IPv6! Replaced by multicast (e.g., All-nodes: FF02::1, All-routers: FF02::2)

IPv6 Address Shortening Rules

Drop leading zeros in each group: 0042 → 42
Replace one longest run of all-zero groups with :: (only once)

2001:0db8:0000:0000:0000:0000:0000:0001 → 2001:db8::1

Multicasting (IPv4 & IPv6)

Multicast = one source → multiple interested receivers simultaneously. Efficient — source sends one copy; network replicates at branch points.

Feature	IPv4 Multicast	IPv6 Multicast
Address Range	224.0.0.0–239.255.255.255 (Class D)	FF00::/8
Group mgmt protocol	IGMP (Internet Group Management Protocol)	MLD (Multicast Listener Discovery)
Example	224.0.0.5 — all OSPF routers	FF02::1 — all nodes on link
Well-known groups	224.0.0.1 all hosts, 224.0.0.2 all routers	FF02::2 all routers

IGMP — hosts use IGMP to tell routers which multicast groups they want to join/leave.

NAT

Network Address Translation

NAT — translates private IP addresses to a public IP (and vice versa) at the router/gateway. Solves IPv4 exhaustion by letting many devices share one public IP.

How NAT Works

Types of NAT

Type	Mapping	Use Case
Static NAT	1 private IP ↔ 1 public IP (permanent)	Servers that need fixed public IP
Dynamic NAT	Private IP → any available public IP from pool	Multiple users sharing a pool
PAT / NAT Overload	Many private IPs → 1 public IP (differentiated by port)	Home routers (most common)

PAT (Port Address Translation) = most common. Each session gets unique source port. The NAT table maps (private IP:port) ↔ (public IP:port).

NAT Pros & Cons

Conserves IPv4 addresses
Hides internal topology (security)
Easy to change ISP (only public IP changes)

Breaks end-to-end connectivity
Complicates P2P apps (VoIP, gaming)
State table overhead on router
Not needed with IPv6 (enough addresses)

Error Reporting

ICMP — Internet Control Message Protocol

ICMP — Layer 3 protocol (encapsulated in IP). Used for error reporting and diagnostics — NOT for data transfer. Protocol number = 1.

ICMP Message Types

Type	Code	Meaning	Sent by
Echo Request	8	Ping — "are you alive?"	Source host
Echo Reply	0	Ping response — "yes, alive"	Destination host
Dest Unreachable	3	Packet can't reach destination	Router/dest host
Time Exceeded	11	TTL reached 0 (used by traceroute)	Router
Redirect	5	Better route available	Router
Source Quench	4	Congestion — slow down (deprecated)	Router
Frag Needed	3/4	Packet too big, DF bit set	Router

ping uses Echo Request/Reply. traceroute uses TTL Exceeded — sends packets with incrementing TTL to map the path.

ICMPv6 — New in IPv6

Combines ICMPv4 + ARP + IGMP functions
Neighbor Discovery Protocol (NDP) — replaces ARP for MAC address resolution
Router Solicitation/Advertisement — for SLAAC autoconfiguration
MLD (Multicast Listener Discovery) — replaces IGMP
Path MTU Discovery — finds minimum MTU along path

Routing

Forwarding, Delivery & Routing Algorithms

Routing = determining the optimal path from source to destination through the network. Routing algorithms populate the routing table used for forwarding decisions.

Routing Algorithm Classification

Algorithm Comparison

Property	Distance Vector (DVR)	Link State (LSR)
Algorithm	Bellman-Ford	Dijkstra's SPF
Information shared	Distance vector (routing table) with neighbors	Full topology (LSAs) flooded to all routers
Knowledge	Local — only knows what neighbors say	Global — each router has complete map
Convergence	Slow — count-to-infinity problem	Fast — immediate after LSA flood
Bandwidth	Low overhead	High overhead (flooding LSAs)
CPU/Memory	Low	High (Dijkstra per router)
Protocols	RIP (max 15 hops)	OSPF, IS-IS
Scale	Small networks	Large enterprise networks

DVR

Distance Vector Routing — Bellman-Ford

Each router maintains a table: for every destination, the distance (cost) and the next hop. Routers periodically share this table with direct neighbors and update based on received info.

Bellman-Ford Equation

      Dx(y) = min over all neighbors v { cost(x,v) + Dv(y) }
    

D_x(y) = best known distance from x to y. For each neighbor v, add link cost to v + v's known distance to y. Take the minimum.

DVR Algorithm Steps

Each router initializes table: distance to itself = 0, to direct neighbors = link cost, to others = ∞
Periodically sends its full distance table to all direct neighbors
On receiving a neighbor's table, recalculates distances using Bellman-Ford
If a shorter path is found, update table and next-hop entry
Repeat until no more updates (convergence)

DVR Example

Count-to-Infinity Problem

Problem: When a link fails, routers may iteratively and incorrectly increment distance, slowly counting up to infinity (∞ = 16 in RIP) before marking route as unreachable.

Fix	How
Split Horizon	Don't advertise a route back to the neighbor you learned it from
Poison Reverse	Advertise failed routes with ∞ cost back to source neighbor
Hold-down timers	Don't accept updates about a failed route for a fixed period
Triggered updates	Send update immediately when route changes (don't wait for timer)

RIP — Routing Information Protocol

DVR protocol, uses hop count as metric
Max hop count = 15 (16 = unreachable/∞)
Updates every 30 seconds
RIPv1 = classful; RIPv2 = classless (CIDR support)
Suitable only for small networks

LSR + Dijkstra

Link State Routing & Dijkstra's Algorithm

Each router builds a complete map of the network topology using Link State Advertisements (LSAs) flooded to all routers. Then runs Dijkstra's Shortest Path First (SPF) to calculate best routes.

LSR Process (5 Steps)

Discover neighbors — send Hello packets to learn directly connected routers and link costs
Build LSA — create Link State Advertisement: {router ID, neighbor list, link costs}
Flood LSAs — broadcast LSA to ALL routers in network (reliable flooding)
Build topology map — each router assembles a Link State Database (LSDB) — complete network graph
Run Dijkstra's SPF — compute shortest path tree from self to every destination

OSPF (Open Shortest Path First) is the dominant LSR protocol in enterprise networks.

Dijkstra's Shortest Path Algorithm

Finds shortest path from a source node to all other nodes in a weighted graph with non-negative weights.

Algorithm

Initialize: dist[src]=0, dist[all others]=∞, visited={}
Repeat until all nodes visited:
  1. Pick unvisited node u with minimum dist[u]
  2. Mark u as visited
  3. For each neighbor v of u:
       if dist[u] + cost(u,v) < dist[v]:
           dist[v] = dist[u] + cost(u,v)
           prev[v] = u  // track path
    

Worked Example

Dijkstra Table (Source = A)

Step	Visited	A	B	C	D	E	F
Init	—	0	∞	∞	∞	∞	∞
1	A	—	4(A)	2(A)	∞	∞	∞
2	A,C	—	4(A)	—	∞	7(C)	∞
3	A,C,B	—	—	—	7(B)	7(C)	∞
4	A,C,B,D	—	—	—	—	8(D)	9(D)
5	A,C,B,D,E	—	—	—	—	—	9(D)
Final	All	0	4	2	7	8	9

Shortest path A→F = A→C→B→D→E... wait: A→C(2)→B? No. A→B(4)→D(7)→E? D→E=1 → 8. D→F=2 → 9. So A→F = 9 via A→B→D→F. ✓

Time Complexity: O(V²) naive, O((V+E) log V) with priority queue. Used in OSPF.

OSPF — Open Shortest Path First

LSR protocol, uses Dijkstra's SPF
Metric = cost (based on bandwidth: 100Mbps/link bandwidth)
Uses Hello packets to discover and maintain neighbor relationships
Hierarchical: organizes into Areas (Area 0 = backbone)
Fast convergence, scales to large networks
Supports VLSM (Variable Length Subnet Mask) and CIDR

Transition

IPv4 to IPv6 Transition Mechanisms

The internet cannot switch from IPv4 to IPv6 overnight. Transition mechanisms allow coexistence and gradual migration so IPv4 and IPv6 devices can communicate.

Three Main Transition Strategies

Strategy	How it Works	Use Case
Dual Stack	Device runs both IPv4 and IPv6 simultaneously. Uses IPv6 when available, falls back to IPv4.	Most common today — OS/router level support
Tunneling	IPv6 packets are encapsulated inside IPv4 packets to cross IPv4-only networks. IPv6-in-IPv4 tunnel.	Connecting IPv6 islands over IPv4 backbone
Translation (NAT64)	Gateway translates between IPv4 and IPv6 headers. IPv6-only device can communicate with IPv4-only server.	Operators migrating to IPv6-only networks

Tunneling Types

Type	Description
6in4	Manual tunnel — IPv6 encapsulated in IPv4 protocol 41
6to4	Automatic — uses 2002::/16 prefix. Embeds IPv4 address in IPv6 address
Teredo	Tunnels through NAT using UDP. Last-resort method (Microsoft)
ISATAP	Intra-site — tunnels IPv6 within IPv4 enterprise networks

IPv4 vs IPv6 — Complete Comparison

Feature	IPv4	IPv6
Address length	32 bits (4 bytes)	128 bits (16 bytes)
Address notation	Dotted decimal: 192.168.1.1	Hex colon: 2001:db8::1
Total addresses	~4.3 billion	~340 undecillion
Header size	20–60 bytes (variable)	40 bytes (fixed)
Fragmentation	Routers & source	Source only
Checksum	Yes (in header)	No (removed for efficiency)
Broadcast	Yes	No (multicast replaces it)
Security (IPSec)	Optional	Mandatory
Config	Manual / DHCP	SLAAC / DHCPv6
Address classes	A, B, C, D, E	Unicast, Multicast, Anycast
NAT needed	Yes (address exhaustion)	No
QoS	ToS field	Flow Label (dedicated QoS)

Study

Flashcards

Tap card to reveal answer

∑

Quick Ref

Master Cheatsheet

All Key Facts — One Table

Topic	Key Fact
Network Layer	OSI Layer 3 — end-to-end delivery, IP addressing, routing
Packet Switching	Data split into packets; each routed independently; reassembled at dest
MTU	Max packet size; Ethernet = 1500 bytes; fragmentation if exceeded
Hub	Layer 1, broadcasts to all ports, shared collision domain
Switch	Layer 2, MAC table (CAM), unicast forwarding, separate collision domains
Router	Layer 3, IP addresses, routing table, connects different networks
Gateway	Layer 7, protocol converter, heterogeneous network bridge
Firewall types	Stateless (packet filter) \| Stateful \| Proxy
IPv4 address	32-bit, dotted-decimal, ~4.3B addresses
Class A	1–126, /8, ~16M hosts
Class B	128–191, /16, ~65K hosts
Class C	192–223, /24, 254 hosts
Class D	224–239, Multicast
Private ranges	10.x, 172.16-31.x, 192.168.x (RFC 1918)
IPv6 address	128-bit, hex colon notation, 2¹²⁸ addresses
IPv6 loopback	::1
IPv6 link-local	FE80::/10
IPv6 multicast	FF00::/8; All-nodes FF02::1; All-routers FF02::2
NAT types	Static (1:1), Dynamic (pool), PAT/Overload (many:1 via port)
ICMP Echo	Type 8 = Request, Type 0 = Reply (ping)
ICMP Time Exceeded	Type 11 — TTL = 0 (used by traceroute)
DVR algorithm	Bellman-Ford; shares routing table with neighbors; slow convergence
DVR problem	Count-to-infinity; fix: split horizon, poison reverse
RIP max hops	15; 16 = unreachable; updates every 30s
LSR algorithm	Dijkstra's SPF; floods LSAs globally; fast convergence
OSPF metric	Cost = 100Mbps / link bandwidth; uses Hello packets
Dijkstra complexity	O(V²) naive; O((V+E)logV) with priority queue
IPv4→IPv6 transition	Dual Stack \| Tunneling (6in4, 6to4, Teredo) \| NAT64 Translation
Multicast (IPv4)	Class D (224–239), IGMP for group management
SLAAC	IPv6 Stateless Address Autoconfiguration — no DHCP needed
ICMPv6 / NDP	Replaces ARP + IGMP; used for neighbor discovery & SLAAC