OSI Model - Overview

The data link layer moves frames between directly connected devices—a computer to its switch, a switch to a router. But what happens when you want to communicate with a server on another continent? The data link layer has no concept of 'route to Tokyo' or 'path through multiple networks.' That responsibility belongs to the Network Layer (Layer 3).

The network layer is the great abstraction of networking. It hides the bewildering complexity of the underlying infrastructure—the countless switches, routers, fiber optic cables, microwave links, and satellite hops—behind a simple model: every device has an address, and packets find their way from source to destination. Whether that destination is across the room or across the ocean, the process looks identical to higher layers.

This is where the Internet Protocol (IP) operates, along with its companion protocols (ICMP, ARP at the boundary, routing protocols). Understanding Layer 3 is essential for anyone working with network infrastructure, security, or distributed systems.

The network layer's fundamental purpose is end-to-end packet delivery across internetworks—getting a packet from its source host to its destination host, potentially traversing many intermediate networks and routers.

Core Functions:

1. Logical Addressing: Assigns addresses that identify devices independently of their physical network. Unlike MAC addresses (tied to hardware), IP addresses are hierarchical and location-based, enabling efficient routing decisions.

2. Routing: Determines the optimal path for packets to travel from source to destination. Routing protocols (OSPF, BGP, etc.) exchange information to build routing tables that guide forwarding decisions.

3. Packet Forwarding: The actual movement of packets from input to output. Routers examine the destination address, consult their routing table, and forward the packet toward its destination.

4. Fragmentation and Reassembly: When a packet is too large for a network's Maximum Transmission Unit (MTU), the network layer (in IPv4) can break it into smaller fragments. The destination host reassembles them.

5. Error Reporting: ICMP (Internet Control Message Protocol) reports errors and provides diagnostic functions (ping, traceroute).

IP addresses are the network layer's addressing mechanism, providing globally unique (or locally unique in private ranges) identification for network interfaces.

IPv4 Addressing:

IPv4 uses 32-bit addresses, written as four decimal octets (e.g., 192.168.1.1). This provides approximately 4.3 billion possible addresses—which seemed abundant in 1981 but proved woefully insufficient.

Address Structure:

An IPv4 address has two logical parts:

• Network portion: Identifies the network (which routing decisions care about)
• Host portion: Identifies the specific device within that network

The subnet mask determines where the network portion ends and the host portion begins:

• IP: 192.168.1.100
• Mask: 255.255.255.0 (/24)
• Network: 192.168.1.0
• Host: .100
• Broadcast: 192.168.1.255

Classless Inter-Domain Routing (CIDR):

The classful system wasted addresses (need 300 hosts? Class C is too small, Class B wastes 65,000). CIDR (introduced 1993) allows any prefix length:

• 192.168.1.0/26 → 26 network bits, 6 host bits = 62 usable hosts
• 10.0.0.0/8 → 8 network bits, 24 host bits = 16M+ hosts

CIDR notation: IP/prefix (e.g., 192.168.1.0/24)

Special Addresses:

Every packet traversing an IP network carries an IP header containing the information routers need for forwarding decisions. Understanding this header is essential for packet analysis and troubleshooting.

IPv4 Header Fields:

IPv6 Header (Simplified):

IPv6 redesigned the header for efficiency:

Key IPv6 improvements:

• Fixed 40-byte header (no IHL field needed)
• No header checksum (removed for performance—upper layers handle it)
• No fragmentation fields in base header (extension headers if needed)
• Extension headers for optional features (routing, fragmentation, security)

Routing is the process of selecting paths in a network along which to send packets. Every router maintains a routing table that maps destination networks to next-hop addresses or exit interfaces.

Routing Table Structure:

A routing table entry typically contains:

• Destination network: Network address and prefix length (e.g., 192.168.10.0/24)
• Next hop: IP address of the next router toward the destination
• Exit interface: Local interface to use for forwarding
• Metric: Cost or distance (used to choose between multiple routes)
• Administrative distance: Trustworthiness of the route source

Route Selection:

When a packet arrives:

1. Router examines destination IP
2. Searches routing table for matching entries
3. Uses longest prefix match: 192.168.10.5 matches 192.168.10.0/24 over 192.168.0.0/16
4. If multiple routes exist, preference by: Administrative Distance → Metric
5. If no match, use default route (0.0.0.0/0) if present; else drop packet

Types of Routing:

1. Static Routing:

• Routes manually configured by administrator
• Simple, secure, no protocol overhead
• Doesn't adapt to network changes
• Best for: Small networks, stub networks, specific policy routes

2. Dynamic Routing:

• Routes learned automatically via routing protocols
• Adapts to topology changes (link failures, new networks)
• Protocol overhead for updates
• Best for: Large networks, complex topologies, redundancy

Routing Protocol Categories:

Interior Gateway Protocols (IGPs): Within a single organization (Autonomous System)

• Distance Vector: RIP, EIGRP — share routing tables with neighbors
• Link State: OSPF, IS-IS — share topology information, compute routes locally

Exterior Gateway Protocols (EGPs): Between organizations (Autonomous Systems)

• BGP (Border Gateway Protocol): The protocol that runs the Internet backbone

Routing protocols use algorithms to determine optimal paths. The two fundamental approaches—distance vector and link state—have different characteristics, trade-offs, and use cases.

Distance Vector Algorithms:

"Tell your neighbors about the world."

Each router maintains a table of distances to every destination. Periodically, routers share their entire routing table with direct neighbors. Neighbors update their own tables based on received information.

Key Characteristics:

• Simple to implement and understand
• Low memory requirements (only stores best routes)
• Slow convergence—changes propagate hop-by-hop
• Vulnerable to routing loops (count-to-infinity problem)
• Examples: RIP, EIGRP (hybrid)

The Bellman-Ford Algorithm:

Distance vector protocols are based on the Bellman-Ford algorithm:

• For each destination, calculate: d(x,y) = min(cost(x,v) + d(v,y)) for all neighbors v
• Iteratively update until distances stabilize
• Guaranteed to find shortest paths if network is stable

Link State Algorithms:

"Tell the world about your neighbors."

Each router discovers its neighbors and link costs, then floods this information to all routers. Every router builds an identical topology database (Link State Database), then independently calculates shortest paths using Dijkstra's algorithm.

Key Characteristics:

• More complex and memory-intensive
• Every router has complete network view
• Fast convergence—all routers compute simultaneously
• Immune to routing loops (complete topology knowledge)
• Examples: OSPF, IS-IS

Dijkstra's Algorithm (Shortest Path First):

1. Start with source router; mark all others as infinity distance
2. From current node, update distances to all neighbors
3. Move to unvisited node with smallest distance
4. Repeat until all nodes visited
5. Result: Shortest path tree from source to every destination

While routing protocols determine what the routing table should contain, packet forwarding is the actual process of moving packets through a router. This happens for every single packet, at wire speed.

The Forwarding Process:

1. Receive packet on an ingress interface
2. Validate header (checksum, version, TTL > 0)
3. Decrement TTL by 1; if TTL becomes 0, drop and send ICMP Time Exceeded
4. Lookup destination in routing table (longest prefix match)
5. Determine next hop and exit interface
6. Recalculate header checksum (TTL changed)
7. Rewrite Layer 2 header (new source/destination MAC)
8. Transmit packet on egress interface

Forwarding Table vs. Routing Table:

The routing table (RIB—Routing Information Base) contains all known routes with full details. The forwarding table (FIB—Forwarding Information Base) is an optimized version used for actual packet forwarding—typically stored in fast memory or ASICs for wire-speed lookups.

Important Observations:

1. IP addresses don't change — Source and destination IP remain constant from source host to destination host

2. MAC addresses change at every hop — At each router, the frame is stripped and a new frame created with:

   • Source MAC = router's exit interface
   • Dest MAC = next-hop device's interface

3. TTL decreases at every hop — This is how packets eventually die if stuck in a loop

4. ARP bridges the gap — To send a packet to the next hop, the router must know the next-hop's MAC address. ARP resolves IP → MAC on the local segment.

Longest Prefix Match:

If multiple routes match a destination, the most specific (longest prefix) wins:

• Packet to 192.168.10.5
• Route 1: 0.0.0.0/0 (default) → matches
• Route 2: 192.168.0.0/16 → matches (16 bits)
• Route 3: 192.168.10.0/24 → matches (24 bits) ← WINNER

Different network technologies have different Maximum Transmission Unit (MTU) sizes—the largest packet that can traverse a link without fragmentation. When a packet exceeds the MTU of the next hop, fragmentation may occur.

Common MTU Values:

IPv4 Fragmentation:

In IPv4, when a packet exceeds the next-hop MTU:

1. Router checks the DF (Don't Fragment) flag
2. If DF=1: Drop packet, send ICMP 'Fragmentation Needed'
3. If DF=0: Fragment the packet into smaller pieces:
   • All fragments get same Identification field
   • Each fragment's offset indicates position in original
   • MF (More Fragments) flag = 1 for all but last fragment
   • Only the destination host reassembles

Problems with Fragmentation:

1. Performance overhead: Fragmentation at routers consumes CPU; reassembly at destination consumes buffers
2. Fragment loss = packet loss: If any one fragment is lost, the entire original packet is discarded
3. Security concerns: Fragment attacks can bypass firewalls (fragments may lack TCP/UDP headers)
4. Increased sensitivity to errors: More fragments = more chances for bit errors

Path MTU Discovery (PMTUD):

Modern approach to avoid fragmentation:

1. Send packets with DF flag set
2. If router needs to fragment: ICMP 'Fragmentation Needed' returns
3. Sender learns the maximum MTU for the path
4. Sender fragments locally if needed, or uses smaller packets
5. Result: No router fragmentation; less overhead

Caveat: PMTUD requires ICMP to work. Overzealous firewalls that block all ICMP can break PMTUD, causing "black hole" connections where data just disappears.

IP doesn't work alone. Two critical companion protocols support network layer operations:

ICMP (Internet Control Message Protocol):

ICMP is IP's error-reporting and diagnostic mechanism. It travels encapsulated in IP packets (Protocol = 1) but is considered part of the network layer.

Key ICMP Message Types:

Ping: Uses ICMP Echo Request/Reply to test reachability Traceroute: Sends packets with incrementing TTLs; ICMP Time Exceeded reveals each hop

ARP (Address Resolution Protocol):

ARP maps IP addresses to MAC addresses on the local network. It operates at the boundary between Layers 2 and 3.

How ARP Works:

1. Host needs to send to IP 192.168.1.5 on local network
2. Host checks ARP cache for MAC mapping—not found
3. Host broadcasts ARP Request: "Who has 192.168.1.5? Tell 192.168.1.1"
4. Device 192.168.1.5 responds: "192.168.1.5 is at AA:BB:CC:DD:EE:FF"
5. Host caches the mapping and sends the original packet

ARP Cache:

Devices maintain an ARP cache (table) to avoid repeated broadcasts:

• Dynamic entries expire after timeout (typically 20 minutes)
• Static entries are manually configured and never expire
• Command to view: arp -a (Windows/Linux), show arp (Cisco)

The network layer enables global communication by providing logical addressing and routing across interconnected networks. Let's consolidate the essential concepts:

What's Next:

With global addressing and routing established, we ascend to Layer 4: The Transport Layer—where the focus shifts from host-to-host to process-to-process communication. We'll explore how TCP and UDP deliver data to the right applications, provide reliability (or choose not to), and manage the flow of data end-to-end.