The Network layer, or OSI Layer 3, provides services to exchange the individual pieces of data over the network between identified end devices. To accomplish this end-to-end transport, Layer 3 uses four basic processes:
Addressing
Encapsulation
Routing
Decapsulation

Addressing= First, the Network layer must provide a mechanism for addressing these end devices. If individual pieces of data are to be directed to an end device, that device must have a unique address. In an IPv4 network, when this address is added to a device, the device is then referred to as a host.
Encapsulation = Second, the Network layer must provide encapsulation. Not only must the devices be identified with an address, the individual pieces - the Network layer PDUs - must also contain these addresses. During the encapsulation process, Layer 3 receives the Layer 4 PDU and adds a Layer 3 header, or label, to create the Layer 3 PDU. When referring to the Network layer, we call this PDU a packet. When a packet is created, the header must contain, among other information, the address of the host to which it is being sent. This address is referred to as the destination address. The Layer 3 header also contains the address of the originating host. This address is called the source address.
After the Network layer completes its encapsulation process, the packet is sent down to the Data Link layer to be prepared for transportation over the media.
Routing = Next, the Network layer must provide services to direct these packets to their destination host. The source and destination hosts are not always connected to the same network. In fact, the packet might have to travel through many different networks. Along the way, each packet must be guided through the network to reach its final destination. Intermediary devices that connect the networks are called routers. The role of the router is to select paths for and direct packets toward their destination. This process is known as routing.
During the routing through an internetwork, the packet may traverse many intermediary devices. Each route that a packet takes to reach the next device is called a hop. As the packet is forwarded, its contents (the Transport layer PDU), remain intact until the destination host is reached.
Decapsulation = Finally, the packet arrives at the destination host and is processed at Layer 3. The host examines the destination address to verify that the packet was addressed to this device. If the address is correct, the packet is decapsulated by the Network layer and the Layer 4 PDU contained in the packet is passed up to the appropriate service at Transport layer.
Unlike the Transport layer (OSI Layer 4), which manages the data transport between the processes running on each end host, Network layer protocols specify the packet structure and processing used to carry the data from one host to another host. Operating without regard to the application data carried in each packet allows the Network layer to carry packets for multiple types of communications between multiple hosts.
Network Layer Protocols
Protocols implemented at the Network layer that carry user data include:
Internet Protocol version 4 (IPv4)
Internet Protocol version 6 (IPv6)
Novell Internetwork Packet Exchange (IPX)
AppleTalk
Connectionless Network Service (CLNS/DECNet)
The Internet Protocol (IPv4 and IPv6) is the most widely-used Layer 3 data carrying protocol and will be the focus of this course. Discussion of the other protocols will be minimal.
IPv4 basic characteristics:
Connectionless - No connection is established before sending data packets.
Best Effort (unreliable) - No overhead is used to guarantee packet delivery.
Media Independent - Operates independently of the medium carrying the data.
Connectionless Service
An example of connectionless communication is sending a letter to someone without notifying the recipient in advance. As shown in the figure, the postal service still takes the letter and delivers it to the recipient. Connectionless data communications works on the same principle. IP packets are sent without notifying the end host that they are coming.
Connection-oriented protocols, such as TCP, require that control data be exchanged to establish the connection as well as additional fields in the PDU header. Because IP is connectionless, it requires no initial exchange of control information to establish an end-to-end connection before packets are forwarded, nor does it require additional fields in the PDU header to maintain this connection. This process greatly reduces the overhead of IP.
Connectionless packet delivery may, however, result in packets arriving at the destination out of sequence. If out-of-order or missing packets create problems for the application using the data, then upper layer services will have to resolve these issues.
Best Effort Service (unreliable)
The IP protocol does not burden the IP service with providing reliability. Compared to a reliable protocol, the IP header is smaller. Transporting these smaller headers requires less overhead. Less overhead means less delay in delivery. This characteristic is desirable for a Layer 3 protocol.
The mission of Layer 3 is to transport the packets between the hosts while placing as little burden on the network as possible. Layer 3 is not concerned with or even aware of the type of communication contained inside of a packet. This responsibility is the role of the upper layers as required. The upper layers can decide if the communication between services needs reliability and if this communication can tolerate the overhead reliability requires.
IP is often referred to as an unreliable protocol. Unreliable in this context does not mean that IP works properly sometimes and does not function well at other times. Nor does it mean that it is unsuitable as a data communications protocol. Unreliable means simply that IP does not have the capability to manage, and recover from, undelivered or corrupt packets.
Since protocols at other layers can manage reliability, IP is allowed to function very efficiently at the Network layer. If we included reliability overhead in our Layer 3 protocol, then communications that do not require connections or reliability would be burdened with the bandwidth consumption and delay produced by this overhead. In the TCP/IP suite, the Transport layer can choose either TCP or UDP, based on the needs of the communication. As with all layer isolation provided by network models, leaving the reliability decision to the Transport layer makes IP more adaptable and accommodating for different types of communication. The header of an IP packet does not include fields required for reliable data delivery. There are no acknowledgments of packet delivery. There is no error control for data. Nor is there any form of packet tracking; therefore, there is no possibility for packet retransmissions.
Media Independent = The Network layer is also not burdened with the characteristics of the media on which packets will be transported. IPv4 and IPv6 operate independently of the media that carry the data at lower layers of the protocol stack. As shown in the figure, any individual IP packet can be communicated electrically over cable, as optical signals over fiber, or wirelessly as radio signals.
It is the responsibility of the OSI Data Link layer to take an IP packet and prepare it for transmission over the communications medium. This means that the transport of IP packets is not limited to any particular medium.
There is, however, one major characteristic of the media that the Network layer considers: the maximum size of PDU that each medium can transport. This characteristic is referred to as the Maximum Transmission Unit (MTU). Part of the control communication between the Data Link layer and the Network layer is the establishment of a maximum size for the packet. The Data Link layer passes the MTU upward to the Network layer. The Network layer then determines how large to create the packets. In some cases, an intermediary device - usually a router - will need to split up a packet when forwarding it from one media to a media with a smaller MTU. This process is called fragmenting the packet or fragmentation.
IPv4 encapsulates, or packages, the Transport layer segment or datagram so that the network can deliver it to the destination host. Click the steps in the figure to see this process. The IPv4 encapsulation remains in place from the time the packet leaves the Network layer of the originating host until it arrives at the Network layer of the destination host.
The process of encapsulating data by layer enables the services at the different layers to develop and scale without affecting other layers. This means that Transport layer segments can be readily packaged by existing Network layer protocols, such as IPv4 and IPv6 or by any new protocol that might be developed in the future.
Routers can implement these different Network layer protocols to operate concurrently over a network to and from the same or different hosts. The routing performed by these intermediary devices only considers the contents of the packet header that encapsulates the segment.
In all cases, the data portion of the packet - that is, the encapsulated Transport layer PDU - remains unchanged during the Network layer processes.
This course will consider these 6 key fields:
IP Source Address
IP Destination Address
Time-to-Live (TTL)
Type-of-Service (ToS)
Protocol
Fragment Offset
Key IPv4 Header Fields
Roll over each field on the graphic to see its purpose.
IP Destination Address=The IP Destination Address field contains a 32-bit binary value that represents the packet destination Network layer host address.
IP Source Address=The IP Source Address field contains a 32-bit binary value that represents the packet source Network layer host address.
Time-to-Live=The Time-to-Live (TTL) is an 8-bit binary value that indicates the remaining "life" of the packet. The TTL value is decreased by at least one each time the packet is processed by a router (that is, each hop). When the value becomes zero, the router discards or drops the packet and it is removed from the network data flow. This mechanism prevents packets that cannot reach their destination from being forwarded indefinitely between routers in a routing loop. If routing loops were permitted to continue, the network would become congested with data packets that will never reach their destination. Decrementing the TTL value at each hop ensures that it eventually becomes zero and that the packet with the expired TTL field will be dropped.
Protocol=This 8-bit binary value indicates the data payload type that the packet is carrying. The Protocol field enables the Network layer to pass the data to the appropriate upper-layer protocol.
Example values are:
01 ICMP
06 TCP
17 UDP
Type-of-Service=The Type-of-Service field contains an 8-bit binary value that is used to determine the priority of each packet. This value enables a Quality-of-Service (QoS) mechanism to be applied to high priority packets, such as those carrying telephony voice data. The router processing the packets can be configured to decide which packet it is to forward first based on the Type-of-Service value.
Fragment Offset=As mentioned earlier, a router may have to fragment a packet when forwarding it from one medium to another medium that has a smaller MTU. When fragmentation occurs, the IPv4 packet uses the Fragment Offset field and the MF flag in the IP header to reconstruct the packet when it arrives at the destination host. The fragment offset field identifies the order in which to place the packet fragment in the reconstruction.
More Fragments flag=The More Fragments (MF) flag is a single bit in the Flag field used with the Fragment Offset for the fragmentation and reconstruction of packets. The More Fragments flag bit is set, it means that it is not the last fragment of a packet. When a receiving host sees a packet arrive with the MF = 1, it examines the Fragment Offset to see where this fragment is to be placed in the reconstructed packet. When a receiving host receives a frame with the MF = 0 and a non-zero value in the Fragment offset, it places that fragment as the last part of the reconstructed packet. An unfragmented packet has all zero fragmentation information (MF = 0, fragment offset =0).
Don't Fragment flag=The Don't Fragment (DF) flag is a single bit in the Flag field that indicates that fragmentation of the packet is not allowed. If the Don't Fragment flag bit is set, then fragmentation of this packet is NOT permitted. If a router needs to fragment a packet to allow it to be passed downward to the Data Link Other IPv4 Header Fields
Roll over each field on the graphic to see its purpose.
Version - Contains the IP version number (4).
Header Length (IHL) - Specifies the size of the packet header.
Packet Length - This field gives the entire packet size, including header and data, in bytes.
Identification - This field is primarily used for uniquely identifying fragments of an original IP packet.
Header Checksum - The checksum field is used for error checking the packet header.
Options - There is provision for additional fields in the IPv4 header to provide other services but these are rarely used. layer but the DF bit is set to 1, then the router will discard this packet
Typical IP Packet
The figure represents a complete IP packet with typical header field values.
Ver = 4; IP version.
IHL = 5; size of header in 32 bit words (4 bytes). This header is 5*4 = 20 bytes, the minimum valid size.
Total Length = 472; size of packet (header and data) is 472 bytes.
Identification = 111; original packet identifier (required if it is later fragmented).
Flag = 0; denotes packet can be fragmented if required.
Fragment Offset = 0; denotes that this packet is not currently fragmented (there is no offset).
Time to Live = 123; denotes the Layer 3 processing time in seconds before the packet is dropped (decremented by at least 1 every time a device processes the packet header).
Protocol = 6; denotes that the data carried by this packet is a TCP segment .
Dividing Networks
Rather than having all hosts everywhere connected to one vast global network, it is more practical and manageable to group hosts into specific networks. Historically, IP-based networks have their roots as one large network. As this single network grew, so did the issues related to its growth. To alleviate these issues, the large network was separated into smaller networks that were interconnected. These smaller networks are often called subnetworks or subnets.
Network and subnet are terms often used interchangeably to refer to any network system made possible by the shared common communication protocols of the TCP/IP model.
Similarly, as our networks grow, they may become too large to manage as a single network. At that point, we need to divide our network. When we plan the division of the network, we need to group together those hosts with common factors into the same network.
As shown in the figure, networks can be grouped based on factors that include:
Geographic location
Purpose
Ownership
Grouping Hosts Geographically
We can group network hosts together geographically. Grouping hosts at the same location - such as each building on a campus or each floor of a multi-level building - into separate networks can improve network management and operation.
Grouping Hosts for Ownership
Using an organizational (company, department) basis for creating networks assists in controlling access to the devices and data as well as the administration of the networks. In one large network, it is much more difficult to define and limit the responsibility for the network personnel. Dividing hosts into separate networks provides a boundary for security enforcement and management of each network.
As mentioned previously, as networks grow larger they present problems that can be at least partially alleviated by dividing the network into smaller interconnected networks.
Common issues with large networks are:
Performance degradation
Security issues
Address Management mproving Performance
Large numbers of hosts connected to a single network can produce volumes of data traffic that may stretch, if not overwhelm, network resources such as bandwidth and routing capability.
Dividing large networks so that hosts who need to communicate are grouped together reduces the traffic across the internetworks.
The logical 32-bit IPv4 address is hierarchical and is made up of two parts. The first part identifies the network and the second part identifies a host on that network. Both parts are required for a complete IP address.
Given that an IPv4 address is 32 bits, when host bits are used to divide a network the more subnetworks created results in fewer hosts for each subnetwork. Regardless of the number of subnetworks created however, all 32 bits are required to identify an individual host.
The number of bits of an address used as the network portion is called the prefix length. For example if a network uses 24 bits to express the network portion of an address the prefix is said to be /24. In the devices in an IPv4 network, a separate 32-bit number called a subnet mask indicates the prefix.
The router also needs a route that defines where to forward the packet next. This is called the next-hop address. If a route is available to the router, the router will forward the packet to the next-hop router that offers a path to the destination network. f communication is between hosts in different networks, the local network delivers the packet from the source to its gateway router. The router examines the network portion of the packet destination address and forwards the packet to the appropriate interface. If the destination network is directly connected to this router, the packet is forwarded directly to that host. If the destination network is not directly connected, the packet is forwarded on to a second router that is the next-hop router
The gateway, also known as the default gateway, is needed to send a packet out of the local network. If the network portion of the destination address of the packet is different from the network of the originating host, the packet has to be routed outside the original network. To do this, the packet is sent to the gateway. This gateway is a router interface connected to the local network. The gateway interface has a Network layer address that matches the network address of the hosts. The hosts are configured to recognize that address as the gateway.
Default Gateway
The default gateway is configured on a host. On a Windows computer, the Internet Protocol (TCP/IP) Properties tools are used to enter the default gateway IPv4 address. Both the host IPv4 address and the gateway address must have the same network (and subnet, if used) portion of their respective addresses.
Confirming the Gateway and Route
As shown in the figure, the IP address of the default gateway of a host can be viewed by issuing the ipconfig or route print commands at the command line of a Windows computer. The route command is also used in a Linux or UNIX host.
No packet can be forwarded without a route. Whether the packet is originating in a host or being forwarded by an intermediary device, the device must have a route to identify where to forward the packet.
A host must either forward a packet to the host on the local network or to the gateway, as appropriate. To forward the packets, the host must have routes that represent these destinations.
Like end devices, routers also add routes for the connected networks to their routing table. When a router interface is configured with an IP address and subnet mask, the interface becomes part of that network. The routing table now includes that network as a directly connected network. All other routes, however, must be configured or acquired via a routing protocol. To forward a packet the router must know where to send it. This information is available as routes in a routing table.
The routing table stores information about connected and remote networks. Connected networks are directly attached to one of the router interfaces. These interfaces are the gateways for the hosts on different local networks. Remote networks are networks that are not directly connected to the router. Routes to these networks can be manually configured on the router by the network administrator or learned automatically using dynamic routing protocols.
Routes in a routing table have three main features:
Destination network
Next-hop
Metric
Host Routing Table
A host creates the routes used to forward the packets it originates. These routes are derived from the connected network and the configuration of the default gateway.
Hosts automatically add all connected networks to the routes. These routes for the local networks allow packets to be delivered to hosts that are connected to these networks. n some circumstances, you may want to indicate more specific routes from a host. You can use the following options for the route command to modify the routing table contents: route ADD route DELETE route CHANGE
Routing Table Entries
The destination network shown in a routing table entry, called a route, represents a range of host addresses and sometimes a range of network and host addresses.
Default Route=A router can be configured to have a default route. A default route is a route that will match all destination networks. In IPv4 networks, the address 0.0.0.0 is used for this purpose. The default route is used to forward packets for which there is no entry in the routing table for the destination network. Packets with a destination network address that does not match a more specific route in the routing table are forwarded to the next-hop router associated with the default route.
Routing is done packet-by-packet and hop-by-hop. Each packet is treated independently in each router along the path. At each hop, the router examines the destination IP address for each packet and then checks the routing table for forwarding information.
The router will do one of three things with the packet:
Forward it to the next-hop router
Forward it to the destination host
Drop it
Packet Examination=As an intermediary device, a router processes the packet at the Network layer. However, packets that arrive at a router's interfaces are encapsulated as a Data Link layer (Layer 2) PDU. As show in the figure, the router first discards the Layer 2 encapsulation so that the packet can be examined.
Routes to remote networks with the associated next hops can be manually configured on the router. This is known as static routing. A default route can also be statically configured.
Common routing protocols are:
Routing Information Protocol (RIP)
Enhanced Interior Gateway Routing Protocol (EIGRP)
Open Shortest Path First (OSPF)