Network Layer

4.1 IPv4 Addressing

An IPv4 address is a 32-bit number in dotted-decimal: 192.168.1.1.

IPv4 header format (20 bytes minimum):

Address classes:

Special addresses: 127.0.0.0/8 (loopback), 0.0.0.0 (this network), 255.255.255.255 (broadcast).

4.2 Subnetting and CIDR

Subnetting. Borrow bits from the host portion to create subnets.

Example. Network 192.168.1.0/24 with /26 mask (borrow 2 bits):

Each subnet has $2^6 - 2 = 62$ usable hosts.

CIDR (Classless Inter-Domain Routing). Notation: a.b.c.d/n where $n$ is the prefix length. Allows route aggregation (supernetting).

Example. Aggregate 192.168.0.0/24 and 192.168.1.0/24 into 192.168.0.0/23.

4.3 IPv6

128-bit addresses: 2001:0db8:85a3:0000:0000:8a2e:0370:7334. Abbreviation rules: leading zeros in a Group may be omitted; one consecutive group of all-zeros may be replaced with ::.

Key differences from IPv4:

• Address space: $2^{128}$.
• No broadcast (uses multicast).
• Simplified header for faster processing.
• Mandatory IPsec support.
• No fragmentation at routers (only at source).

IPv6 header format (40 bytes fixed):

IPv6 header analysis. The fixed 40-byte header with no options field is a deliberate simplification Over IPv4 (whose header ranges from 20 to 60 bytes). Every field is either fixed-size or has a defined offset. This allows routers to process IPv6 packets faster because they never need to Parse variable-length options. Optional functionality is moved to extension headers, which are Chained via the Next Header field:

Transition mechanisms: Dual stack, tunnelling (encapsulate IPv6 in IPv4), translation (NAT64).

4.4 ARP

Address Resolution Protocol resolves IP addresses to MAC addresses on a local network.

1. Host needs to send a packet to IP address $B$.
2. Host checks its ARP cache for $B$‘s MAC address.
3. If not cached, broadcast an ARP request: “Who has $B$? Tell $A$.”
4. Host $B$ replies with its MAC address (unicast).
5. Host $A$ caches the mapping ( with a timeout of minutes).

Gratuitous ARP. A host broadcasts its own IP-to-MAC mapping, on startup or interface Change. Used for duplicate address detection, cache updates, and failover in high-availability setups.

ARP spoofing. An attacker sends forged ARP messages to associate their MAC address with the IP Address of a legitimate device, enabling man-in-the-middle attacks. Defences include static ARP Entries, ARP inspection, and dynamic ARP protection (DAI).

4.5 NAT

Network Address Translation maps private addresses (RFC 1918: 10.0.0.0/8 172.16.0.0/12``192.168.0.0/16) to public addresses.

• Static NAT: One-to-one mapping.
• Dynamic NAT: Pool of public addresses assigned on demand.
• PAT (NAT overload): Multiple private addresses share one public address via port numbers. Translation table maps (private IP, private port) to (public IP, public port).

PAT limitation: Approximately 65,000 concurrent connections per public IP.

4.6 Routing Algorithms

Distance Vector Routing. Each router maintains a vector of distances to all destinations. Routers exchange vectors with neighbours periodically.

• Bellman-Ford equation: $d_x(y) = \min_v \{c(x,v) + d_v(y)\}$ where $c(x,v)$ is the link cost to neighbour $v$.
• RIP: Uses hop count (max 15 hops); updates every 30 seconds. Slow convergence; susceptible to count-to-infinity.

Count-to-infinity example. Routers A, B, C in a line with cost 1 each. If link A-B fails:

1. B sets $d_B(A) = \infty$Advertises to C.
2. C still has $d_C(A) = 2$ via B, advertises $d_C(A) = 2$ to B.
3. B sets $d_B(A) = 3$ via C. C then sets $d_C(A) = 4$. This continues.

Solution: Split horizon with poisoned reverse. B advertises $d_B(A) = \infty$ to A (since B’s Route to A goes through A).

Link State Routing. Each router has complete topology. Uses Dijkstra’s algorithm.

• OSPF: Hierarchical design (areas), VLSM support, fast convergence. Link-state advertisements (LSAs) flooded throughout the area. Each router runs Dijkstra on the full topology graph. Uses cost = $10^8 / \mathrm{bandwidth}(bps)$ by default.

OSPF area design:

• Backbone area (Area 0): All other areas must connect to it. All inter-area traffic passes through Area 0.
• Non-backbone areas: Summarise routes before advertising to Area 0. Types: standard, stub (no external routes), totally stubby (no external or inter-area routes), NSSA.
• LSA types: Type 1 (router LSA, intra-area), Type 2 (network LSA, intra-area), Type 3 (summary LSA, inter-area), Type 5 (external LSA, redistributed routes).

OSPF adjacency states: Down, Init, 2-Way, ExStart, Exchange, Loading, Full.

OSPF packet fields:

Path Vector Routing (BGP). Used for inter-domain routing. Carries the full AS path to each Destination, not just the distance.

• eBGP: Between different ASes. iBGP: Within the same AS.
• Attributes: AS_PATH (loop prevention), NEXT_HOP``LOCAL_PREF (exit preference), MED (entry preference), origin type.
• Decision process: Highest LOCAL_PREFShortest AS_PATHLowest origin, lowest MED eBGP over iBGP, lowest IGP cost to NEXT_HOPLowest router ID.

BGP route advertisement:

AS 65001 -> AS 65002: reach 203.0.113.0/24, AS_PATH = 65001
AS 65002 -> AS 65003: reach 203.0.113.0/24, AS_PATH = 65001 65002

AS 65003 rejects any route containing its own AS number (loop prevention).

BGP attributes in detail:

• Well-known mandatory: AS_PATH``NEXT_HOP``ORIGIN (IGP $\lt$ EGP $\lt$ Incomplete).
• Well-known discretionary: LOCAL_PREF (not sent to eBGP peers; influences outbound traffic).
• Optional transitive: COMMUNITY (tag routes for policy), MP_REACH_NLRI (IPv6/VPNv4).
• Optional non-transitive: MED (suggestion to neighbour about preferred entry point; lower is better; compared only for routes from the same neighbouring AS).

iBGP full mesh requirement. Within an AS, all iBGP speakers must be fully meshed (or use route Reflectors/confederations) because iBGP does not re-advertise routes learned from other iBGP peers. This prevents routing loops within the AS.

Routing protocol comparison:

A ---3--- B ---2--- C
|           |           |
4           1           5
|           |           |
D ---6--- E ---3--- F

4.7 ICMP

Internet Control Message Protocol provides error reporting and diagnostics. Encapsulated in IP (protocol number 1).

Traceroute. Sends packets with incrementing TTL. When TTL expires, the router returns an ICMP Time Exceeded message, revealing intermediate hops.

4.8 IP Fragmentation

When a packet exceeds the MTU, it must be fragmented. The IP header includes Identification, Flags (DF, MF), and Fragment Offset fields.

Fragmentation process:

1. The Identification field is the same for all fragments of the original datagram.
2. The MF (More Fragments) flag is 1 for all fragments except the last.
3. The Fragment Offset specifies the position of the fragment’s data in the original datagram (in 8-byte units).
4. Each fragment becomes an independent IP packet with its own IP header.
5. Only the receiver reassembles fragments; routers never reassemble.

Path MTU Discovery (PMTUD): The sender sets the DF flag. If a router cannot forward, it returns ICMP “Fragmentation Needed” and the sender reduces packet size. Preferred over fragmentation.

:::caution Common Pitfall When subnetting, remember that a /31 prefix (RFC 3021) has exactly 2 addresses and is valid for Point-to-point links with no network or broadcast address. A /32 is a single host route. The Formula $2^n - 2$ usable hosts applies only for prefixes of /30 or shorter.

:::