🌐 Phase 3 · Network Layer 🟡 Intermediate MODULE 08

Network Layer

⏱️ 3 hours

📖 Theory + Code

🧩 10 Questions

🔬 Phase 3 · Module 8

CCNA Module 8 progress0%

🎯 What you'll learn: Network layer characteristics (connectionless, best effort, media independent), IPv4 packet header fields, IPv6 improvements and header, how hosts make forwarding decisions, the default gateway, and an introduction to routing (static vs dynamic).

Section 1

Network Layer Characteristics

Layer 3 — the Network Layer — provides end-to-end logical addressing and routing across multiple networks. Routers operate at Layer 3, reading IP headers to forward packets toward their final destination regardless of how many intermediate networks they cross.

IP is the primary Layer 3 protocol. It comes in two versions: IPv4 (32-bit addresses, still dominant today) and IPv6 (128-bit addresses, the long-term future). Both share three defining characteristics:

📦

Connectionless

No session is established before sending packets. Each packet is forwarded independently — like mailing letters, not making a phone call.

No Handshake

🎲

Best Effort

No guarantee of delivery, order, or timing. If reliability is needed, upper-layer protocols (TCP at L4) provide it.

Unreliable

📡

Media Independent

IP doesn't care about the physical medium below — it works identically over copper, fiber, wireless, or satellite.

Any Medium

IPv4 address bits → 4.3B addresses

128

IPv6 address bits → 340 undecillion

<1ms

Typical router CPU time per packet

900K+

Internet routing table entries (2024)

💡

Why "connectionless" matters for the exam

CCNA tests this distinction heavily. IP (Layer 3) is connectionless — no setup, no teardown, no acknowledgement. TCP (Layer 4) is connection-oriented — it uses a 3-way handshake (SYN, SYN-ACK, ACK) to establish a session first. When a question mentions "no connection established before data transfer," that describes IP/UDP. When it says "guaranteed delivery and ordering," that is TCP.

Section 2

IPv4 Packet Header

Every IPv4 packet has a header of at least 20 bytes (5 × 32-bit words). Knowing each field and its purpose is a CCNA exam requirement. The header is followed by the upper-layer data (payload).

Version (4 bits)

IP Version

Always 4 for IPv4. Tells the router which version of IP to apply.

IHL (4 bits)

Header Length

Header length in 32-bit words. Minimum value = 5 (= 20 bytes). Needed because Options can expand the header.

DSCP/ToS (8 bits)

Quality of Service

Differentiated Services Code Point — marks packet priority for QoS. EF (101110) = voice priority.

Total Length (16 bits)

Packet Size

Total packet size including header + data, in bytes. Maximum 65,535 bytes.

TTL (8 bits)

Time to Live

Decremented by 1 at each router. When TTL=0, packet is dropped and ICMP Time Exceeded is returned. Prevents loops. Default: Windows=128, Linux/Cisco=64.

Protocol (8 bits)

Upper-Layer Protocol

Identifies what is carried in the payload: 6=TCP, 17=UDP, 1=ICMP, 89=OSPF. Must memorise for CCNA.

Flags (3 bits)

Fragmentation Flags

DF = Don't Fragment (drop if too large). MF = More Fragments (more fragments follow). Used when a large packet crosses a link with a smaller MTU.

Source IP (32 bits)

Source Address

IP address of the originating host. Does NOT change as the packet is routed (unlike the MAC address).

Destination IP (32 bits)

Destination Address

IP address of the final destination host. Routers use this to make forwarding decisions.

⚠️

TTL (Time to Live) — critical for CCNA

Every router decrements TTL by 1. When TTL reaches 0, the packet is dropped and an ICMP "Time Exceeded" message is sent back to the source. This prevents routing loops from living forever in the network. Default TTL values: Windows = 128, Linux/Cisco = 64. The traceroute command uses TTL manipulation — it sends packets with TTL=1, then TTL=2, etc., to map each hop along the path.

Wireshark IPv4 header — annotated

Wireshark

Internet Protocol Version 4
  Version: 4
  Header Length: 20 bytes (5)
  Differentiated Services: 0x00 (DSCP: Default, ECN: Not-ECT)
  Total Length: 84
  Identification: 0x1234 (4660)
  Flags: 0x40 (Don't Fragment)
  Fragment Offset: 0
  Time to Live: 64         ! Started at 64 on Linux source
  Protocol: ICMP (1)       ! This is a ping packet
  Header Checksum: 0x... [correct]
  Source: 192.168.1.100
  Destination: 8.8.8.8

Section 3

IPv6 Packet Header

IPv4 addresses were exhausted: IANA ran out in 2011, APNIC (Asia-Pacific) in 2011, and ARIN (North America) in 2015. IPv6 solves this with 128-bit addresses — enough for 3.4 × 10³⁸ unique addresses.

But IPv6 is not just bigger addresses. The header was completely redesigned to be simpler, faster, and more efficient:

Fixed 40-byte header — routers never need to parse variable-length options in the base header (extension headers are used instead)
No header checksum — lower layers (Ethernet, etc.) handle error detection, removing redundant work from every router
No fragmentation by routers — hosts are responsible for path MTU discovery; routers simply drop oversized packets and send ICMPv6 "Packet Too Big"
IPsec built-in — security is part of the standard, not an add-on
No ARP — replaced by ICMPv6 Neighbor Discovery Protocol (NDP), which uses efficient multicast

Version (4 bits)

Always 6

Identifies this as an IPv6 packet.

Traffic Class (8 bits)

QoS (like DSCP)

Equivalent to DSCP/ToS in IPv4. Used for traffic prioritisation.

Flow Label (20 bits)

New in IPv6

Identifies a specific traffic flow (e.g., a video stream). Routers can treat all packets in a flow identically without inspecting upper-layer headers.

Payload Length (16 bits)

Data Size

Length of the data following the 40-byte header. The header itself is not counted (it's always 40 bytes).

Next Header (8 bits)

Upper Layer / Extension

Like IPv4 Protocol field: 6=TCP, 17=UDP, 58=ICMPv6. May also point to an extension header (routing, fragmentation, etc.).

Hop Limit (8 bits)

Same as TTL

Decremented at each router hop. When it reaches 0, the packet is dropped. Functionally identical to IPv4 TTL.

💡

IPv6 header is simpler than IPv4 — intentionally

IPv6's fixed 40-byte header removes the Identification, Flags, Fragment Offset, Header Checksum, and IHL fields from the base header. Fragmentation is handled by extension headers if needed, and the checksum is handled by lower layers. This makes IPv6 processing faster — critical for backbone routers forwarding hundreds of gigabits per second. The tradeoff: the base header is actually larger (40 bytes vs minimum 20 bytes), but it is uniform, so routers can parse it in hardware at line rate.

Section 4

How Hosts Make Forwarding Decisions

Every time a PC wants to send a packet, it must answer one question: is the destination on my local network, or on a remote network?

To decide, the host performs a logical AND operation with its own subnet mask on both the source IP and the destination IP. If the results match, they are on the same network — send directly. If they differ, the destination is on a remote network — send to the default gateway.

🔀 Host Forwarding Decision Process

📦 Host wants to send packet to Destination IP

↓

AND Source IP with Subnet Mask = Network A
AND Dest IP with Subnet Mask = Network B

↓

Network A = Network B

↓

Send directly
(ARP for dest MAC)

Network A ≠ Network B

↓

Send to Default Gateway
(ARP for gateway MAC)

The default gateway is the router interface on the local network — the "door out" to all remote networks. It must be on the same subnet as the host. If the default gateway is unreachable, the host cannot communicate with any remote network.

Host forwarding decision — example

Cisco IOS

! PC1: IP 192.168.1.10/24, Gateway: 192.168.1.1
! Wants to reach 10.0.0.5

! Is 10.0.0.5 on same network?
! 192.168.1.10 AND 255.255.255.0 = 192.168.1.0  (my network)
! 10.0.0.5    AND 255.255.255.0 = 10.0.0.0     (different!)
! → Different network → send to default gateway 192.168.1.1

! ARP for 192.168.1.1 (gateway's MAC)
! Encapsulate packet in frame:
!   Dest MAC:  gateway's MAC        (changes at each hop)
!   Dest IP:   10.0.0.5             (REAL destination — never changes!)

✨

Key exam concept: IP address vs MAC address in forwarding

The destination IP address never changes as a packet travels across the internet — it always stays as the final destination. But the destination MAC address changes at every router hop — it becomes the next router's MAC address. This is the fundamental difference between L2 (local delivery by MAC) and L3 (end-to-end routing by IP).

Section 5

Host Routing Tables

Every device — including PCs and laptops — maintains a routing table that determines where to send packets based on the destination IP address. A typical PC routing table has three key entries:

Loopback (127.0.0.0/8): the device itself — used for local process communication
Local network: the directly connected subnet — send directly
Default route (0.0.0.0/0): catch-all for everything else — send to the gateway

Routing tables — Windows, Linux, and Cisco

IOS + OS

! Windows
C:\> route print
Network Destination  Netmask          Gateway        Interface
0.0.0.0              0.0.0.0          192.168.1.1    192.168.1.10  ! Default route
127.0.0.0            255.0.0.0        On-link        127.0.0.1      ! Loopback
192.168.1.0          255.255.255.0    On-link        192.168.1.10   ! Local network

! Linux
$ ip route
default via 192.168.1.1 dev eth0        ! Default route (0.0.0.0/0)
192.168.1.0/24 dev eth0 proto kernel    ! Local network

! On Cisco router
R1# show ip route
C    192.168.1.0/24 is directly connected, GigabitEthernet0/0  ! Direct
S    10.0.0.0/8 [1/0] via 172.16.0.1                           ! Static
O    172.16.10.0/24 [110/2] via 172.16.0.1                     ! OSPF

Section 6

Introduction to Routing

Routers build and maintain routing tables to determine the best path for each packet. There are two methods to populate a routing table:

Static routing: manually configured by the admin. Simple, predictable, secure, no CPU/bandwidth overhead — but does not scale and requires manual updates when topology changes.
Dynamic routing: routers exchange routing information automatically using protocols like OSPF, EIGRP, or BGP. Scales to large networks and adapts automatically to failures.

AD = 0

Directly Connected

Most trusted source. Routes to networks directly attached to an interface. Added automatically when interface is up/up.

AD = 1

Static Route

Manually configured. Second most trusted. Used for simple, predictable routing or default routes.

AD = 110

OSPF

Open Shortest Path First — link-state protocol. Uses bandwidth as metric. Most common enterprise IGP.

AD = 120

RIP

Routing Information Protocol — distance vector. Uses hop count as metric. Max 15 hops. Legacy, rarely used today.

Longest Prefix

Most Specific Match

Router always picks the most specific (longest prefix) matching route. /30 beats /24 beats /0. Most specific wins.

Metric

Route Cost

Used when multiple paths to the same destination exist. OSPF uses bandwidth (cost = 10^8 / bandwidth). Lower metric = better path.

Static route configuration — Cisco IOS

Cisco IOS

R1# configure terminal
R1(config)# ip route 10.0.0.0 255.255.255.0 192.168.0.2
! ip route [destination network] [mask] [next-hop IP]
! This tells R1: to reach 10.0.0.0/24, forward to 192.168.0.2

R1(config)# ip route 0.0.0.0 0.0.0.0 192.168.0.1
! Default route: matches EVERYTHING not matched by a more specific route
! This is the "gateway of last resort"

R1# show ip route static
S    10.0.0.0/24 [1/0] via 192.168.0.2
S*   0.0.0.0/0 [1/0] via 192.168.0.1  ! S* = static default route

✨

Reading the routing table: [AD/Metric]

The numbers in brackets after a route — e.g., [110/2] — are [Administrative Distance / Metric]. AD=110 means OSPF. Metric=2 means two OSPF cost units to reach the destination. Lower AD = more trusted source. Lower metric = better path within the same protocol. These numbers are essential for CCNA troubleshooting questions.

🧩 Knowledge Check

10 questions — Network Layer

1. IP is described as "connectionless" because:

2. What happens when a packet's TTL reaches 0?

3. The IPv4 Protocol field value 6 identifies which upper-layer protocol?

4. How many bits are in an IPv6 address?

5. What is the default gateway?

6. When a host determines the destination is on a remote network, it:

7. Which routing source has the lowest administrative distance (most trusted)?

8. A "default route" matches:

9. The IPv6 "Hop Limit" field is equivalent to which IPv4 field?

10. Longest prefix match means the router:

Finished this module?

Mark it complete to track your progress.

Phase 3 · Network LayerModule 8 of 17