Internet Layer

The Internet Layer is where the 'inter' in 'Internet' comes from. While the Network Interface Layer handles communication within a single network segment, the Internet Layer enables communication across multiple, heterogeneous networks. It provides the logical addressing and routing mechanisms that allow a packet to travel from a smartphone in Tokyo, through dozens of routers, across undersea cables, and arrive at a server in Virginia—all within milliseconds.

This layer is dominated by a single, remarkably successful protocol: the Internet Protocol (IP). Originally designed in the 1970s for a research network of a few hundred hosts, IP now addresses billions of devices and handles exabytes of traffic daily. Understanding the Internet Layer is understanding the core of how the global Internet functions.

The Internet Layer's primary mission is host-to-host delivery across network boundaries. Unlike the Network Interface Layer, which only handles local delivery, the Internet Layer provides an abstraction that spans the entire global Internet. Any device with an IP address can (theoretically) communicate with any other device, regardless of the physical networks between them.

The Critical Abstraction

The Internet Layer's genius lies in its abstraction: from the Transport layer's perspective, the network between source and destination is a 'black box' that accepts packets and (usually) delivers them. The Transport layer doesn't need to know:

• How many networks are between source and destination
• What physical technologies those networks use
• What routing protocols routers are running
• Whether packets take different paths for each transmission

This abstraction enables the remarkable flexibility of the Internet: new networks can be added, old technologies can be replaced, and routing can change dynamically—all without applications being aware.

IPv4, specified in RFC 791 (1981), uses 32-bit addresses, providing approximately 4.3 billion unique addresses. While this seemed vast in 1981, address exhaustion became critical by the 2010s, driving the transition to IPv6. Despite this, IPv4 remains the dominant protocol on the Internet today.

Address Notation

IPv4 addresses are written in dotted-decimal notation: four decimal numbers (0-255) separated by dots, each representing one byte of the 32-bit address.

Binary:   11000000.10101000.00000001.00001010
Decimal:  192     .168      .1       .10

Network and Host Portions

Every IP address is divided into two parts:

• Network portion: Identifies the network (shared by all hosts on that network)
• Host portion: Identifies the specific host within that network

The boundary between these portions is defined by the subnet mask (or prefix length in CIDR notation).

Special IPv4 Addresses

Private vs. Public Addresses

The RFC 1918 private address ranges (10.x.x.x, 172.16-31.x.x, 192.168.x.x) are not globally routable. They're used within organizations, with Network Address Translation (NAT) providing access to the public Internet. This dramatically extends IPv4's usable lifetime by allowing billions of private devices to share limited public addresses.

IPv6, standardized in RFC 2460 (1998) and updated in RFC 8200 (2017), uses 128-bit addresses—providing 340 undecillion (3.4 × 10³⁸) addresses. This is enough to assign trillions of addresses to every human on Earth, eliminating the address exhaustion problem and enabling end-to-end connectivity without NAT.

Address Notation

IPv6 addresses are written as eight groups of four hexadecimal digits, separated by colons:

2001:0db8:85a3:0000:0000:8a2e:0370:7334

Simplification Rules:

1. Leading zeros can be omitted in each group: 2001:db8:85a3:0:0:8a2e:370:7334

2. One sequence of consecutive all-zero groups can be replaced with ::: 2001:db8:85a3::8a2e:370:7334

3. :: can only appear once to avoid ambiguity

Examples:

• Loopback: ::1 (full: 0000:0000:0000:0000:0000:0000:0000:0001)
• IPv4-mapped: ::ffff:192.168.1.1
• Link-local: fe80::1 (automatically configured on every interface)

IPv6 Address Structure (Global Unicast)

A typical global unicast address (2000::/3) is structured:

The 64-bit Interface ID is often derived from the MAC address using the EUI-64 method (inserting FF:FE in the middle and flipping the 7th bit), or generated randomly for privacy.

Key IPv6 Features

• No broadcast: Replaced by multicast
• No ARP: Replaced by Neighbor Discovery Protocol (NDP)
• Stateless autoconfiguration (SLAAC): Hosts can configure addresses automatically without DHCP
• Simplified header: Fixed 40-byte header, extension headers for options
• No fragmentation by routers: End hosts must use Path MTU Discovery

The IP packet (or datagram) is the fundamental unit of communication at the Internet layer. Understanding its structure is essential for packet analysis, troubleshooting, and understanding protocol behavior.

Key IPv4 Header Fields

Version (4 bits): IP version (4 for IPv4, 6 for IPv6)

IHL (4 bits): Internet Header Length in 32-bit words. Minimum 5 (20 bytes), maximum 15 (60 bytes with options)

DSCP/ECN (8 bits): Differentiated Services and Explicit Congestion Notification for QoS

Total Length (16 bits): Entire packet size including header and data. Maximum 65,535 bytes

Identification (16 bits): Unique ID for fragmentation/reassembly

Flags (3 bits): Control fragmentation. DF (Don't Fragment) and MF (More Fragments)

Fragment Offset (13 bits): Position of this fragment within the original packet

TTL (8 bits): Time To Live. Decremented by each router; packet discarded when reaching 0 (prevents infinite loops)

Protocol (8 bits): Upper-layer protocol. 1=ICMP, 6=TCP, 17=UDP

Header Checksum (16 bits): Error detection for header only (not payload)

Source/Destination IP (32 bits each): Sender and receiver IP addresses

IPv6 Header Simplification

IPv6's header is a fixed 40 bytes—simpler despite larger addresses:

Notice what's removed: fragmentation fields (handled by extension headers), header checksum (upper layers and link layer provide this), IHL (fixed header size), and options (replaced by extension headers).

Routing is the process of selecting paths for packets to travel from source to destination across interconnected networks. Routers—devices that operate at the Internet layer—examine each packet's destination address and forward it toward its destination based on their routing tables.

Routing Table Essentials

A routing table entry typically contains:

Destination     Gateway         Genmask         Iface
192.168.1.0     0.0.0.0         255.255.255.0   eth0     # Directly connected
10.0.0.0        192.168.1.1     255.0.0.0       eth0     # Via gateway
0.0.0.0         192.168.1.254   0.0.0.0         eth0     # Default route

Routing Process:

1. Packet arrives with destination IP 10.5.3.7
2. Router checks routing table for longest match
3. 10.0.0.0/8 matches (10.5.3.7 begins with 10)
4. Next hop is 192.168.1.1
5. Router looks up 192.168.1.1's MAC address (ARP)
6. Packet is encapsulated in a new Ethernet frame and sent to next hop
7. Process repeats at each router until packet reaches destination network

The Internet Control Message Protocol (ICMP), defined in RFC 792, provides error reporting and diagnostic capabilities for IP networks. ICMP messages are carried within IP packets (protocol number 1 for IPv4, 58 for ICMPv6) but are considered part of the Internet layer, not an upper-layer protocol.

Destination Unreachable Codes

The Type 3 (Destination Unreachable) message includes a code specifying why:

Ping: Echo Request/Reply

The ping utility sends ICMP Echo Request messages and measures the time until Echo Reply returns. This verifies:

• IP connectivity between two hosts
• Round-trip time (latency)
• Packet loss (when replies don't return)

$ ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8): 56 data bytes
64 bytes from 8.8.8.8: icmp_seq=0 ttl=117 time=14.2 ms
64 bytes from 8.8.8.8: icmp_seq=1 ttl=117 time=13.8 ms

Traceroute: Mapping the Path

Traceroute exploits ICMP Time Exceeded messages to discover the path to a destination:

1. Send packet with TTL=1 → First router decrements to 0, sends Time Exceeded
2. Send packet with TTL=2 → Second router sends Time Exceeded
3. Continue incrementing TTL until destination responds with Echo Reply

Each Time Exceeded reveals a router along the path:

$ traceroute google.com
 1  192.168.1.1 (192.168.1.1)  1.234 ms
 2  10.20.30.1 (10.20.30.1)  5.678 ms
 3  core-rtr.isp.com (198.51.100.1)  12.345 ms
 4  ....

Note: Some routers drop ICMP or deprioritize it, causing timeouts (* * *) in traceroute output.

Different link-layer technologies have different maximum frame sizes. Ethernet's MTU is typically 1500 bytes, but some WAN links may be smaller. When an IP packet is larger than the outgoing link's MTU, it must be fragmented into smaller pieces that can traverse the link.

IPv4 Fragmentation

In IPv4, any router along the path can fragment packets:

1. Router receives 4000-byte packet
2. Outgoing link has 1500-byte MTU
3. Router splits packet into fragments:
   • Fragment 1: bytes 0-1479, MF=1, Offset=0
   • Fragment 2: bytes 1480-2959, MF=1, Offset=185 (1480/8)
   • Fragment 3: bytes 2960-3999, MF=0, Offset=370

All fragments share the same Identification field. The destination host reassembles them.

Fragmentation Header Fields:

• Identification: Same value for all fragments of one packet
• MF (More Fragments) flag: 1 if more fragments follow, 0 for last
• Fragment Offset: Position in original packet (in 8-byte units)

Problems with Fragmentation:

• If any fragment is lost, entire packet must be retransmitted
• Reassembly requires memory at the destination
• Fragments can arrive out of order
• Security devices may have trouble inspecting fragmented packets

Path MTU Discovery (PMTUD)

To avoid fragmentation, hosts can discover the path's minimum MTU:

1. Source sends packets with DF (Don't Fragment) flag set
2. If a router can't forward without fragmenting, it drops the packet and sends ICMP 'Fragmentation Needed'
3. Source reduces packet size and retries
4. Process continues until packets reach destination

This discovers the path MTU without relying on router fragmentation.

IPv6 Changes:

IPv6 takes a stricter approach:

• Routers never fragment packets
• Only the source can fragment using extension headers
• PMTUD is required for IPv6
• Minimum link MTU is 1280 bytes (guaranteed to work everywhere)