The Network Layer (Layer 3) handles logical host addressing, packet fragmentation, and path selection across global networks. Mastery of IP headers, CIDR calculations, and routing protocols is mandatory for analyzing firewall logs, SIEM telemetry, and packet captures.
1. The IPv4 Header Breakdown
An IPv4 header has a standard base length of 20 bytes (up to 60 bytes with optional fields). Each 32-bit row contains vital protocol fields:
4 bits
4 bits
8 bits
16 bits
16 bits
(0, DF, MF)
13 bits
8 bits
8 bits (6=TCP, 17=UDP, 1=ICMP)
16 bits
The TTL (Time to Live) field prevents packets from circulating endlessly in routing loops. Every Layer 3 hop decrements TTL by 1; when it reaches 0, the router discards the packet and sends back an ICMP Type 11 (Time Exceeded) message—this is the fundamental mechanism behind traceroute.
Passive OS Fingerprinting: Different operating systems initialize outgoing packets with distinct default TTL values:
- Linux / Android / macOS: Default TTL =
64 - Windows OS: Default TTL =
128 - Cisco / Network Appliances: Default TTL =
255
2. IPv4 Addressing, RFC 1918 & Subnetting
An IPv4 address consists of 32 binary bits grouped into four 8-bit octets (e.g., 192.168.1.1).
RFC 1918 Private IP Address Spaces
To prevent global IPv4 exhaustion, RFC 1918 designated three non-routable private address blocks reserved for internal networks:
- Class A Private:
10.0.0.0/8(10.0.0.0 – 10.255.255.255, 16,777,216 hosts) - Class B Private:
172.16.0.0/12(172.16.0.0 – 172.31.255.255, 1,048,576 hosts) - Class C Private:
192.168.0.0/16(192.168.0.0 – 192.168.255.255, 65,536 hosts) - Loopback:
127.0.0.0/8(e.g.,127.0.0.1) - APIPA (Link-Local):
169.254.0.0/16(assigned automatically when DHCP fails)
CIDR Subnetting Arithmetic
Classless Inter-Domain Routing (CIDR) uses prefix notation (e.g. /24) indicating the number of contiguous leading bits belonging to the Network ID. The remaining bits belong to the Host ID.
| CIDR Prefix | Subnet Mask | Total IP Addresses | Usable Hosts (2^(32-prefix) - 2) | Common Use Case |
|---|---|---|---|---|
/24 |
255.255.255.0 |
256 | 254 | Standard office LAN segment |
/28 |
255.255.255.240 |
16 | 14 | Small DMZ or management network |
/29 |
255.255.255.248 |
8 | 6 | Firewall HA clustering subnet |
/30 |
255.255.255.252 |
4 | 2 | Point-to-point router link |
/32 |
255.255.255.255 |
1 | 1 (Host route) | Single host firewall rule / Loopback |
For any subnet with prefix length /N:
- Total Addresses:
2^(32 - N) - Usable Hosts:
2^(32 - N) - 2(Subtracting Network Address and Broadcast Address) - Network Address: All Host bits set to
0 - Broadcast Address: All Host bits set to
1
3. NAT & PAT (Network Address Translation)
NAT (RFC 1631) enables private RFC 1918 subnets to access the public Internet by translating private source IP addresses into a public IP on the perimeter firewall or router.
PAT (Port Address Translation / NAT Overload): Maps multiple internal private IPs to a single public IP by multiplexing unique ephemeral source port numbers (e.g., 192.168.1.50:49152 → 203.0.113.1:60001).
4. IPv6 Architecture & Fundamentals
IPv6 resolves IPv4 address exhaustion with 128-bit addresses (providing 3.4 × 1038 unique addresses), written in hexadecimal grouped into 8 hextets: 2001:0db8:85a3:0000:0000:8a2e:0370:7334.
- Zero Compression: Consecutive sections of zeroes can be replaced once per address with
::(e.g.,2001:db8:85a3::8a2e:370:7334). - No Broadcast: IPv6 replaces L2/L3 broadcasts with scoped Multicast and Anycast.
- Neighbor Discovery Protocol (NDP): Replaces legacy unauthenticated ARP using ICMPv6 messages (Neighbor Solicitation & Neighbor Advertisement).
- SLAAC (Stateless Address Autoconfiguration): Hosts generate their own globally unique IPv6 address using network router advertisements.