STUDY GUIDE

Chapter 4: Network Layer — Data Plane

Computer Networking: A Top-Down Approach, 8th Edition
Jim Kurose & Keith Ross | Pearson, 2020

Topics Covered:
Network Layer Overview • Data Plane vs. Control Plane • SDN
IP Datagram Format • IP Addressing & Subnets • CIDR
DHCP • NAT • IPv6 • Tunneling • Practice Questions

Chapter 4: Network Layer — Data Plane | Page 1

TABLE OF CONTENTS
Section 1: Network Layer Overview & Services
— Data Plane vs. Control Plane
— Forwarding vs. Routing
— Per-Router Control vs. SDN
— Network Service Model & Best-Effort
Section 2: What's Inside a Router — Functions
— Two Key Network Layer Functions
— Internet Network Layer Components
Section 3: IP: The Internet Protocol — Datagram Format
— IP Datagram Header Fields
— IP Overhead
Section 4: IP Addressing & Subnets
— IP Address Introduction
— Subnets & Subnet Masks
— CIDR — Classless InterDomain Routing
Section 5: DHCP — Dynamic Host Configuration Protocol
— DHCP Goal & 4-Message Exchange
— DHCP Detailed Example
— What DHCP Returns
Section 6: How Networks Get IP Addresses — ISP & ICANN
Section 7: NAT — Network Address Translation
— NAT Motivation & Operation
— NAT Translation Table
— NAT Controversy
Section 8: IPv6
— Motivation for IPv6
— IPv6 Datagram Format
— IPv4-to-IPv6 Transition & Tunneling
— IPv6 Adoption
Section 9: Practice Questions
— MCQs (25 Questions with Answers)
— Short Answer Questions (8)
— Long/Descriptive Questions (3)

Chapter 4: Network Layer — Data Plane | Page 2

 SECTION 1: NETWORK LAYER OVERVIEW &
SERVICES

1.1 What is the Network Layer?

The Network Layer is the 3rd layer in the TCP/IP protocol stack. Its primary responsibility is to
transport segments from the sending host to the receiving host. Unlike the transport layer (which
handles process-to-process communication), the network layer handles host-to-host communication
across multiple routers and networks.

KEY DEFINITION: Network Layer

The layer responsible for moving packets across the network from source host to destination host. It
operates in every Internet device — both hosts AND routers. The sender encapsulates transport-layer
segments into datagrams; the receiver delivers those datagrams to the transport layer.

1.2 The Two Key Network Layer Functions

The network layer has exactly two core functions that you must understand clearly:

Function Definition Analogy Who Does It

Forwarding Moving packets from a Getting through a Each individual router

router's INPUT link to the single road (data plane action)
appropriate OUTPUT link. A interchange
local, per-router action.

Routing Determining the complete Planning your entire Routing algorithms

route/path taken by packets road trip from start to (control plane action)
from source to destination. A finish
network-wide decision.

EXAM TIP
Forwarding = local, single-router action (data plane). Routing = global, network-wide decision (control
plane).
A common exam question: "What is the difference between forwarding and routing?" Forwarding is fast
(hardware-level); routing is the intelligent path-selection process.

1.3 Data Plane vs. Control Plane

This is one of the most critical distinctions in modern networking:

Aspect Data Plane Control Plane

Scope Local, per-router function Network-wide logic

Chapter 4: Network Layer — Data Plane | Page 3

 Question Answered "Where does THIS packet go from THIS "What is the best path from source to
router?" destination?"

Speed Very fast (implemented in hardware) Slower (can be software-based)

Function Forwarding Routing

Implementation Forwarding table in each router Routing algorithms or SDN controller

Example A router looks at packet header, checks OSPF algorithm computes shortest
table, sends to port 3 paths across the network

1.4 Two Control Plane Approaches

There are two main approaches to implementing the control plane:

Approach 1: Traditional Per-Router Control Plane

• Each router runs its own routing algorithm.
• Individual routing algorithm components in each router interact with each other via routing
protocols (OSPF, BGP).
• This is the classical, distributed approach.

Approach 2: Software-Defined Networking (SDN) Control Plane

• A remote, centralized controller computes forwarding tables and installs them into routers.
• Routers themselves are "dumb" — they just follow the forwarding table set by the controller.
• The controller has a global view of the network and can optimize paths globally.
• Control agents (CA) in each router communicate with the remote controller.

Feature Traditional (Per-Router) SDN

Intelligence location Distributed (inside each router) Centralized (remote controller)

Forwarding table Computed locally by each router Computed by controller, installed

remotely

Flexibility Less flexible Very flexible

(protocol-dependent) (software-programmable)

Failure resilience More resilient (no single point of Controller is a single point of failure
failure)

Use case Traditional ISP networks Data centers, cloud networks, 5G

1.5 Network Service Model

The network layer provides a service model — the set of guarantees the network offers when
transporting datagrams. The Internet uses the "best effort" model.

Chapter 4: Network Layer — Data Plane | Page 4

Architecture Service Model Bandwidth Loss Orderin Timing
Guarantee Guarantee g

Internet Best Effort None No guarantee No guara No guara

ntee ntee

ATM Constant Bit Rate Constant rate Yes (no loss) Yes Yes
(CBR) guaranteed (in-order) (timing pr
eserved)

ATM Available Bit Rate Guaranteed No guarantee Yes No

(ABR) minimum (in-order)

Internet (Intserv) Guaranteed Yes Yes Yes Yes

Service (RFC
1633)

Internet (Diffserv) Differentiated Possible Possibly Possibly No

Service (RFC
2475)

1.6 Why Best-Effort Works — Reflections

Despite providing no guarantees, the Internet's best-effort service model has been remarkably
successful. Here's why:
• Simplicity of mechanism: allowed Internet to be widely deployed and adopted globally.
• Sufficient bandwidth provisioning: enough bandwidth means real-time apps (voice, video) work
"good enough" most of the time.
• Replicated application-layer services: CDNs and data centers place content close to clients,
reducing the need for network-level guarantees.
• Congestion control of elastic services: TCP congestion control prevents network collapse.

EXAM TIP
Best-effort provides NO guarantees on: delivery, timing, ordering, or bandwidth.
The Internet chose simplicity in the network and complexity at the edges (end systems) — this design
philosophy is key.
ATM provides the strictest guarantees (CBR) but is complex and expensive.

Chapter 4: Network Layer — Data Plane | Page 5

 SECTION 2: INTERNET NETWORK LAYER
COMPONENTS

2.1 Key Components of the Internet Network Layer

The Internet's network layer has three main components working together:

Component Role Key Protocols/Features

IP Protocol Core protocol: defines how Datagram format, addressing,

datagrams are formatted, fragmentation/reassembly, packet
addressed, and handled handling conventions

ICMP Protocol Internet Control Message Error messages (TTL expired,

Protocol: error reporting and unreachable), ping (echo request/reply),
router signaling traceroute

Path-Selection Determine routes through the OSPF (Open Shortest Path First), BGP
Algorithms network (Border Gateway Protocol), SDN
controller

These components all interact: IP handles individual packet forwarding; ICMP handles errors and
control; routing algorithms populate the forwarding tables that IP uses.

Network Layer in Context

The network layer sits between the transport layer (TCP/UDP above) and the link layer (Ethernet, WiFi
below).
Every host and every router runs the network layer protocol (IP).
Routers only go up to the network layer — they don't need transport or application layers.
Hosts implement all 5 layers (physical through application).

Chapter 4: Network Layer — Data Plane | Page 6

 SECTION 3: IP — THE INTERNET PROTOCOL
DATAGRAM FORMAT

3.1 IP Datagram Header Fields

Every IP datagram has a minimum 20-byte header. Understanding each field is essential for exam
success.

Field Size Description & Purpose

Version (ver) 4 bits IP protocol version number. IPv4 = 4, IPv6 = 6. Router uses this to
interpret the rest of the datagram.

Header Length 4 bits Header length in 32-bit words. Needed because of variable-length
(head. len) options. Minimum value = 5 (= 20 bytes).

Type of Service 8 bits Contains Diffserv bits (0:5) for differentiated services and ECN bits (6:7)
(TOS) for explicit congestion notification.

Total Length 16 bits Total datagram length in bytes (header + data). Maximum = 65,535
bytes. Typically 1,500 bytes or less (due to Ethernet MTU).

16-bit Identifier 16 bits Used for fragmentation/reassembly. All fragments of the same
datagram share the same identifier.

Flags (flgs) 3 bits Fragmentation flags. Bit 1: "Don't Fragment" (DF). Bit 2: "More
Fragments" (MF). Bit 0: reserved.

Fragment Offset 13 bits Position of this fragment's data within the original datagram (in 8-byte
units). Used for reassembly.

Time to Live (TTL) 8 bits Maximum remaining hops. Decremented at each router. If TTL = 0,
router discards datagram (prevents infinite loops). Router sends ICMP
"Time Exceeded" message back.

Upper Layer 8 bits Transport layer protocol that should receive the payload. TCP = 6, UDP
Protocol = 17. Similar to port numbers but at network layer.

Header Checksum 16 bits Error detection for the IP header only (not the data). Recomputed at
each router (because TTL changes at every hop).

Source IP Address 32 bits IPv4 address of the sender.

Destination IP 32 bits IPv4 address of the intended receiver.

Address

Options Variable Optional fields: timestamp, record route taken, specify list of routers to
visit. Complicates processing — rarely used.

Chapter 4: Network Layer — Data Plane | Page 7

 Data (Payload) Variable The transport-layer segment (TCP or UDP) being carried by this
datagram.

3.2 IP Overhead
IP + TCP Overhead
20 bytes: TCP header (minimum)
20 bytes: IP header (minimum)
= 40 bytes of overhead before any application data
Example: Sending 1 byte of data costs 40 bytes of headers!
This is why pipelining and large segment sizes are important for efficiency.

EXAM TIP
TTL is DECREMENTED at each router — not set to a fixed value. When it reaches 0, the packet is
dropped.
The header checksum covers only the IP header, NOT the payload. This is different from UDP
checksum.
Fragmentation uses: Identifier (same for all fragments), Fragment Offset (position of data), MF flag
(more fragments coming), DF flag (don't fragment).
Upper Layer Protocol field = 6 means TCP payload; 17 means UDP payload.

Chapter 4: Network Layer — Data Plane | Page 8

 SECTION 4: IP ADDRESSING & SUBNETS

4.1 IP Address Introduction

An IP address is a 32-bit identifier associated with each host or router interface, not with the
host/router itself.

KEY DEFINITION: IP Address

32-bit identifier associated with a network INTERFACE (the connection between a host/router and a
physical link). Written in dotted-decimal notation (e.g., [Link] =
11011111.00000001.00000001.00000001). A router with 3 links has 3 interfaces and 3 IP addresses.

Key facts about IP addresses:

• IP addresses are per-interface, not per-device. Routers have multiple interfaces (one per link) →
multiple IP addresses.
• Hosts typically have 1–2 interfaces (wired Ethernet + wireless 802.11).
• Written in dotted-decimal notation: each of the 4 octets written as a decimal number (0–255),
separated by dots.

Dotted-Decimal Example
[Link] in binary = 11011111 . 00000001 . 00000001 . 00000001
Octet 1 Octet 2 Octet 3 Octet 4
= 223 = 1 = 1 = 1
To convert: each group of 8 bits is converted to decimal.
Range: each octet can be 0–255.

4.2 Subnets
IP addresses have hierarchical structure: a subnet part (high-order bits) and a host part (low-order
bits).

KEY DEFINITION: Subnet

A set of device interfaces that can physically reach each other WITHOUT passing through an
intervening router. Devices in the same subnet share the same high-order bits in their IP address (the
subnet part).

How to Identify Subnets:

1. Detach each interface from its host or router, creating "islands" of isolated networks.
2. Each isolated network = one subnet.
3. All devices in that subnet share the same subnet prefix.

Chapter 4: Network Layer — Data Plane | Page 9

 Subnet Example
Network with 3 subnets:
• [Link]/24 — devices [Link], [Link], [Link], [Link]
• [Link]/24 — devices [Link], [Link], [Link]
• [Link]/24 — devices [Link], [Link], [Link]
The /24 subnet mask means: the first 24 bits are the SUBNET part,
and the last 8 bits are the HOST part.
So [Link]/24 can have 2^8 - 2 = 254 usable host addresses.

Subnet Mask:
• /24 notation (CIDR notation): the number after the slash = number of bits in the subnet part
• Example: [Link]/24 → 24 bits for subnet, 8 bits for hosts → 254 hosts possible
• Also written as: [Link] (24 ones followed by 8 zeros)

4.3 CIDR — Classless InterDomain Routing

KEY DEFINITION: CIDR
Classless InterDomain Routing (pronounced "cider"). The subnet portion of the address can be of
ARBITRARY length (not fixed to 8, 16, or 24 bits as in the old classful scheme). Format: a.b.c.d/x where
x = number of bits in the subnet portion.

CIDR replaced the old "classful" addressing scheme that had fixed subnet sizes:

Class First Octet Range Subnet Host Bits Max Hosts Problem
Bits

A 1–126 8 24 16 million Wasted for small orgs

B 128–191 16 16 65,534 Still too large

C 192–223 24 8 254 Too small for many

CIDR solved this by allowing any prefix length — an organization can get exactly the size they need.

Chapter 4: Network Layer — Data Plane | Page 10

CIDR Example from Slides
ISP block: [Link]/20
Binary: 11001000 00010111 00010000 00000000
ISP allocates /23 blocks to organizations (split into 8 smaller blocks):
Org 0: [Link]/23 ([Link] – [Link])
Org 1: [Link]/23
Org 2: [Link]/23
...up to...
Org 7: [Link]/23
The ISP's /20 block perfectly contains all 8 of the /23 blocks.
This is called "route aggregation" or "supernetting."

EXAM TIP
CIDR notation: a.b.c.d/x — x bits for network, (32-x) bits for hosts.
Number of hosts = 2^(32-x) - 2 (subtract 2 for network and broadcast addresses).
Subnet mask of /24 = [Link]. /16 = [Link]. /8 = [Link].
Exam question: "How many hosts can a /26 subnet support?" → 2^6 - 2 = 62 hosts.

Chapter 4: Network Layer — Data Plane | Page 11

 SECTION 5: DHCP — DYNAMIC HOST
CONFIGURATION PROTOCOL

5.1 How Hosts Get IP Addresses

A host needs an IP address to communicate. There are two ways to get one:
• Hard-coded (static): A system administrator manually configures the IP address in a config file
(e.g., /etc/[Link] in UNIX). Used for servers and network devices that need fixed addresses.
• DHCP (Dynamic): The host automatically gets an IP address from a DHCP server when it joins the
network. This is "plug-and-play" — used for laptops, phones, and most client devices.

KEY DEFINITION: DHCP

Dynamic Host Configuration Protocol. A client-server protocol where a host dynamically obtains an IP
address and other network configuration from a DHCP server when it joins the network. The assigned
address has a "lease" that must be renewed periodically.

5.2 DHCP Goals & Features

• Goal: Host dynamically obtains IP address from network server when it "joins" the network.
• Lease renewal: Client can renew its lease on the address while still connected.
• Address reuse: Addresses are only held while the device is connected — freed when device
leaves. Efficient use of limited IP addresses.
• Mobile support: Supports users who join and leave networks frequently (laptops, phones).

5.3 The DHCP 4-Message Exchange

DHCP uses 4 messages to assign an IP address. All messages are BROADCAST (sent to
[Link]) because the client doesn't yet have an IP address:

Ste Message From → To Key Fields Purpose

p

1 DHCP Client → src: [Link]:68, dst: "Is there a DHCP server out
DISCOVER Broadcast [Link]:67, yiaddr: there?" Client has no IP
[Link], transaction ID: 654 yet, so uses [Link] as
source.

2 DHCP OFFER Server → src: [Link]:67, dst: "I'm a DHCP server! Here's
Broadcast [Link]:68, yiaddr: an IP address you can
[Link], lifetime: 3600 secs use." Offers an IP + lease
duration.

3 DHCP Client → src: [Link]:68, dst: "OK, I would like to use this
REQUEST Broadcast [Link]:67, yiaddr: IP address!" (Still no IP, so
[Link], transaction ID: 655 still broadcast.)

Chapter 4: Network Layer — Data Plane | Page 12

 4 DHCP ACK Server → src: [Link]:67, dst: "OK! You've got that IP
Broadcast [Link]:68, yiaddr: address!" Client can now
[Link], lifetime: 3600 secs use the IP.

Why Broadcast? (Important Detail)

The client uses [Link] as its source IP because it doesn't have one yet.
All DHCP messages are sent to [Link] (broadcast) so all devices on the subnet receive
them.
The DHCP server is typically co-located in the router.
Steps 1 & 2 can be SKIPPED if the client remembers a previously allocated address
and wants to reuse it — in that case, it goes directly to DHCP REQUEST.

5.4 What DHCP Returns

DHCP returns much more than just an IP address. A complete DHCP ACK contains:
• Allocated IP address for the client (yiaddr field)
• IP address of the first-hop router (default gateway) for the client
• Name and IP address of the DNS server
• Network mask (indicating which bits are network vs. host portion)
• Lease duration (how long the IP address is valid)

5.5 DHCP Encapsulation (Layered View)

The DHCP message travels through multiple protocol layers:
1. DHCP message (application layer) is encapsulated in UDP
2. UDP is encapsulated in IP datagram (dest: [Link])
3. IP datagram is encapsulated in Ethernet frame (dest: FF:FF:FF:FF:FF:FF — broadcast)
4. Ethernet frame is broadcast on the LAN — received by all devices, including the router running
DHCP
5. Router demultiplexes: Ethernet → IP → UDP → DHCP
6. DHCP server processes the request and sends back DHCP ACK, same path in reverse

EXAM TIP
DHCP uses UDP, not TCP. Port 67 (server) and port 68 (client).
All 4 DHCP messages are broadcast (dest: [Link]) because the client lacks an IP address.
DHCP Discover → Offer → Request → ACK. Remember: DORA.
DHCP returns: IP address, subnet mask, default gateway, DNS server IP, and lease time.
Steps 1 & 2 (Discover & Offer) are OPTIONAL — can be skipped for address renewal.

Chapter 4: Network Layer — Data Plane | Page 13

 SECTION 6: HOW NETWORKS GET IP ADDRESSES
— ISP & ICANN

6.1 How Does a Network Get Its Subnet Address?

The subnet portion of an IP address is obtained from the provider ISP. The ISP allocates a portion of
its own address space to the organization:

Address Allocation Hierarchy

LEVEL 1 — ICANN allocates large blocks to Regional Internet Registries (RIRs)
LEVEL 2 — RIRs allocate blocks to ISPs
LEVEL 3 — ISPs allocate smaller blocks to organizations/customers
LEVEL 4 — Organizations use their block for their subnets
Example from slides:
ISP's block: [Link]/20 (a block of 4096 addresses)
ISP gives /23 blocks (512 addresses each) to organizations:
Org 0: [Link]/23
Org 1: [Link]/23
...up to Org 7: [Link]/23
This hierarchical allocation enables efficient routing (route aggregation).

6.2 ICANN — Internet Corporation for Assigned Names and Numbers

ICANN ([Link] is the organization responsible for global IP address management:
• Allocates IP addresses through 5 Regional Registries (RRs) worldwide
• Manages the DNS root zone, including delegation of TLDs (.com, .edu, .org, etc.)
• ICANN allocated the LAST chunk of IPv4 addresses to RRs in 2011 — IPv4 is exhausted!

Regional Registry Region Covered

ARIN (American Registry for Internet Numbers) North America

RIPE NCC (Réseaux IP Européens) Europe, Middle East, Central

Asia

APNIC (Asia-Pacific Network Information Centre) Asia-Pacific

LACNIC (Latin America and Caribbean Network Information Latin America & Caribbean
Centre)

AFRINIC (African Network Information Centre) Africa

Chapter 4: Network Layer — Data Plane | Page 14

IPv4 Address Exhaustion
"Who the hell knew how much address space we needed?" — Vint Cerf (co-inventor of TCP/IP)
IPv4 uses 32-bit addresses → maximum 2^32 ≈ 4.3 billion unique addresses.
With billions of devices (phones, IoT, servers), we ran out!
Two solutions:
1. NAT (Network Address Translation) — extend IPv4 lifespan by reusing private addresses
2. IPv6 — 128-bit addresses → 2^128 ≈ 340 undecillion addresses (more than enough!)

EXAM TIP
ICANN manages global IP address allocation and DNS root zone.
There are 5 Regional Internet Registries (RIRs) that distribute addresses to ISPs.
IPv4 exhaustion is a real problem — ICANN allocated the last blocks in 2011.
NAT and IPv6 are the two responses to IPv4 exhaustion.

Chapter 4: Network Layer — Data Plane | Page 15

 SECTION 7: NAT — NETWORK ADDRESS
TRANSLATION

7.1 What is NAT?

KEY DEFINITION: NAT (Network Address Translation)
A mechanism where a router translates between PRIVATE IP addresses (used inside a local network)
and a single PUBLIC IP address (used on the Internet). All devices in the local network share ONE
public IP address as far as the outside world is concerned.

NAT Example from the slides:

• Local network (home): [Link]/24 — all devices have private addresses ([Link], [Link], etc.)
• Outside world sees only ONE address: [Link] (the NAT router's public IP)
• The NAT router translates between the two

7.2 Private IP Address Spaces

NAT uses reserved 'private' IP address ranges that are NOT routable on the public Internet:

Private Range CIDR Notation Addresses Common Use

Available

[Link] – [Link]/8 16.7 million Large enterprises, cloud

[Link] networks

[Link] – [Link]/12 1.05 million Medium enterprises

[Link]

[Link] – [Link]/16 65,536 Home networks, small

[Link] offices

7.3 How NAT Works — Step by Step

NAT uses a NAT Translation Table to track all active connections:

NAT Translation Table Example

WAN Side Address | LAN Side Address
[Link] : 5001 | [Link] : 3345
[Link] : 5002 | [Link] : 7890
[Link] : 5003 | [Link] : 4444
All three internal devices share ONE public IP but have different port numbers!

Chapter 4: Network Layer — Data Plane | Page 16

 Ste Action Detail
p

1 Internal host sends Host [Link] sends to [Link]:80 Source: [Link]:3345,

datagram Dest: [Link]:80

2 NAT router replaces Outgoing datagrams: replace (source IP, port#) with (NAT IP, new
source port#) New source: [Link]:5001 | Updates NAT table

3 Remote server Server sends reply to: [Link]:5001 (It only knows the public
responds NAT address)

4 NAT router translates NAT looks up port 5001 in table → finds [Link]:3345 Replaces
incoming ([Link]:5001) with ([Link]:3345) in destination field

5 Packet delivered to Packet arrives at [Link]:3345 — the original sender!

correct host

7.4 NAT Advantages

• Just ONE public IP address needed from provider ISP for ALL devices in the local network
• Can change addresses of hosts in local network without notifying the outside world
• Can change ISP (and get new public IP) without changing the private addresses of internal devices
• Security: devices inside local net are NOT directly addressable or visible from outside — provides
basic protection

7.5 NAT Controversy

NAT is widely used but also controversial among networking purists:

Criticism Explanation

Layer violation Routers "should" only process up to Layer 3 (network). Modifying port
numbers (Layer 4) breaks layering principles.

End-to-end violation The Internet's end-to-end principle says the network should be
transparent. NAT violates this — port numbers are modified by a middle
device.

IPv6 should solve this The "right" solution to address shortage is IPv6 (128-bit addresses), not
NAT tricks.

NAT traversal problem If a client outside wants to connect to a SERVER inside a NAT, it can't
directly — the server has no public address. Requires NAT traversal
techniques (STUN, TURN, UPnP).

Despite controversy, NAT is here to stay — extensively used in home networks, enterprises, and
4G/5G cellular networks.

Chapter 4: Network Layer — Data Plane | Page 17

EXAM TIP
NAT translates (private IP, port) ↔ (public IP, new port) using a NAT Translation Table.
All devices in local network share ONE public IP.
Private address ranges: [Link]/8, [Link]/12, [Link]/16.
NAT violates: (1) end-to-end principle, (2) layer separation (touches port #s which are layer 4).
NAT traversal is needed when external client wants to reach server behind NAT.

Chapter 4: Network Layer — Data Plane | Page 18

 SECTION 8: IPv6

8.1 Motivation for IPv6

IPv4 was designed in the 1970s with 32-bit addresses. The Internet's explosive growth made
exhaustion inevitable:

Motivation Explanation

Primary: Address 32-bit IPv4 → 4.3 billion addresses. ICANN allocated the last block in 2011.
exhaustion With smartphones, IoT, etc., we need far more.

Faster processing 40-byte FIXED-length header (vs. variable-length IPv4 header). Routers
can process it faster — no variable options to parse.

Flow label New "flow label" field enables different network-layer treatment of different
flows (QoS support built in).

Built-in security IPsec support was built into IPv6 from the start (though now retrofitted into
IPv4 as well).

No fragmentation IPv6 routers do NOT fragment packets. If a packet is too big, the router
drops it and sends an ICMPv6 "Packet Too Big" message back.

8.2 IPv6 Datagram Format

IPv6 has a FIXED 40-byte header (simpler than IPv4's variable header):

Field Size Description

Version (ver) 4 bits IP version = 6

Priority (pri) 8 bits Identifies priority among datagrams in same flow. Similar to IPv4
TOS/DSCP.

Flow Label 20 bits Identifies datagrams in the same "flow." Allows routers to treat
packets in the same flow consistently.

Payload Length 16 bits Length of the IPv6 payload (data following the 40-byte header).

Next Header 8 bits Identifies the type of header that follows. Similar to IPv4's "Upper
Layer Protocol" field. Can point to TCP (6), UDP (17), or an
extension header.

Hop Limit 8 bits Like TTL in IPv4 — decremented by 1 at each router. Packet
discarded when it reaches 0.

Source Address 128 bits IPv6 source address (16 bytes = 4x larger than IPv4!)

Chapter 4: Network Layer — Data Plane | Page 19

 Destination 128 bits IPv6 destination address
Address

Data (Payload) Variable Transport-layer segment or extension headers followed by data

8.3 What IPv6 REMOVED vs IPv4

IPv6 deliberately removed some IPv4 fields to simplify router processing:

Removed Feature Why Removed Impact

Checksum Transport (TCP/UDP) and link layers Faster routing; error

already have checksums. Removing detection done at other
header checksum speeds up router layers
processing (no need to recompute at every
hop).

Fragmentation / IPv6 performs path MTU discovery — Simpler routers;

Reassembly source sends probe packets to determine end-to-end MTU
the right size. Routers never fragment. negotiation

Options field The fixed 40-byte header has no options. Fixed-length header
Extension headers can be added but are enables fast hardware
not processed by intermediate routers. processing

8.4 IPv6 vs IPv4 — Key Differences

Feature IPv4 IPv6

Address size 32 bits (4 bytes) 128 bits (16 bytes)

Header size 20–60 bytes (variable) 40 bytes (fixed)

Fragmentation Routers AND hosts can fragment Only source hosts; routers never
fragment

Checksum Yes (in header) No (removed for speed)

Options In header (variable length) Extension headers (not processed by

routers)

TTL field TTL (Time to Live) Hop Limit (same concept, new name)

Broadcast Has broadcast addresses No broadcast — uses multicast instead

Address notation Dotted decimal: [Link] Hex colon notation:

2001:0db8:85a3::8a2e:0370:7334

Auto-configuration Via DHCP Stateless Address Autoconfiguration

(SLAAC) built in

Chapter 4: Network Layer — Data Plane | Page 20

8.5 IPv4 to IPv6 Transition — Tunneling
Not all routers can be upgraded simultaneously. Tunneling is the solution for running IPv6 over an
IPv4 network:

KEY DEFINITION: Tunneling

IPv6 datagrams are carried as the PAYLOAD of IPv4 datagrams when they need to traverse an
IPv4-only part of the network. This is "packet within a packet." The IPv6 packet is encapsulated in a
standard IPv4 datagram with protocol type = 41 (IPv6).

How Tunneling Works (from slides):

1. Routers A and B are IPv6/IPv4 dual-stack routers at the edge.
2. Between B and E is an IPv4-only network.
3. Router B takes the IPv6 datagram (src A, dest F) and encapsulates it into an IPv4 datagram (src
B, dest E).
4. The IPv4 datagram travels through the IPv4 network normally.
5. Router E receives the IPv4 datagram, extracts the IPv6 datagram from the payload.
6. Router E forwards the IPv6 datagram to F normally.

Tunneling — Physical vs. Logical View

PHYSICAL VIEW: A — IPv6 — B — [IPv4 network: C, D] — E — IPv6 — F
LOGICAL VIEW: A ——————— IPv6 tunnel ——————— F
Messages in the tunnel (B to C segment):
Outer header: IPv4, src=B, dest=E
Inner payload: IPv6 datagram (src=A, dest=F, data)
Key insight: The IPv4 routers (C, D) only see the outer IPv4 header.
They don't know there's an IPv6 datagram inside!

8.6 IPv6 Adoption

• ~30% of clients access Google services via IPv6 (as of ~2020 data in slides)
• 1/3 of all US government domains are IPv6 capable (NIST)
• Deployment has been SLOW — 25+ years since IPv6 was standardized (1998), still not universal!

Why Has IPv6 Adoption Been So Slow?

1. NAT effectively extended IPv4's life — the 'urgency' decreased.
2. Upgrading infrastructure costs money — ISPs and enterprises delay upgrades.
3. Dual-stack operation is complex and adds management overhead.
4. No direct incentive for end users to care — they just want it to 'work'.
5. The Internet has seen massive application-level changes (WWW, social media, streaming)
but the underlying IPv4 infrastructure barely changed.

Chapter 4: Network Layer — Data Plane | Page 21

EXAM TIP
IPv6 uses 128-bit addresses. IPv4 uses 32-bit. IPv6 has 2^128 ≈ 3.4 × 10^38 addresses.
IPv6 FIXED 40-byte header. IPv4 has variable 20-60 byte header.
IPv6 removed: checksum, fragmentation at routers, options field.
IPv6 tunneling: IPv6 datagram encapsulated inside IPv4 datagram. Protocol type = 41.
IPv4-to-IPv6 transition uses: (1) Dual-stack, (2) Tunneling, (3) Translation (NAT64).
IPv6 address notation: 8 groups of 4 hex digits separated by colons. E.g., 2001:0db8::1.

Chapter 4: Network Layer — Data Plane | Page 22

 SECTION 9: PRACTICE QUESTIONS

9.1 Multiple Choice Questions (MCQs)

Select the BEST answer for each question. Answers and explanations follow each question.

1. The network layer is responsible for:

A) Process-to-process communication
B) Host-to-host communication across the network
C) Frame delivery between adjacent nodes
D) Application-level data formatting
Answer: B — The network layer handles host-to-host delivery. Transport layer = process-to-process. Link
layer = adjacent-node delivery.

2. What is the difference between forwarding and routing?

A) Forwarding is network-wide; routing is per-router
B) Forwarding moves packets through a single router; routing determines the end-to-end path
C) Forwarding uses routing tables; routing uses forwarding tables
D) There is no difference — the terms are synonymous
Answer: B — Forwarding = local (single router) action → data plane. Routing = network-wide path
determination → control plane.

3. The Data Plane in a router is responsible for:

A) Running routing algorithms to compute paths
B) Communicating with other routers to exchange routing information
C) Determining how a datagram arriving at an input port is forwarded to an output port
D) Managing BGP sessions with neighboring ASes
Answer: C — The data plane performs forwarding — the local, per-router function of moving packets from
input to output. The control plane handles routing.

4. In Software-Defined Networking (SDN), where are forwarding tables computed?

A) Inside each router independently
B) By a remote, centralized controller that installs tables into routers
C) By the end hosts sending control messages
D) By DHCP servers on the network
Answer: B — SDN moves intelligence to a centralized remote controller. Routers just follow the tables
installed by the controller.

5. The Internet's 'best-effort' service model means:

A) Datagrams are always delivered reliably
B) Delivery is guaranteed within 40ms delay
C) No guarantees on delivery, timing, ordering, or bandwidth
D) At least 50% of packets are guaranteed to be delivered
Answer: C — Best-effort = no guarantees whatsoever. This simplicity is why the Internet scaled so well.

Chapter 4: Network Layer — Data Plane | Page 23

6. An IP address is associated with:
A) A host device
B) A network interface (the connection between host/router and link)
C) A process running on a host
D) A MAC address
Answer: B — IP addresses are per-INTERFACE, not per-device. A router with 3 interfaces has 3 IP
addresses.

7. What does the /24 in '[Link]/24' indicate?

A) The network has 24 hosts
B) The first 24 bits are the subnet (network) portion of the address
C) The TTL is 24
D) The address is 24 bits long
Answer: B — CIDR notation: /x means x bits for the network prefix. /24 = 24-bit prefix, 8-bit host part →
254 usable hosts.

8. How many usable host addresses does a /26 subnet provide?

A) 26
B) 62
C) 64
D) 30
Answer: B — Host bits = 32 - 26 = 6. Hosts = 2^6 - 2 = 64 - 2 = 62 (subtract network and broadcast
addresses).

9. In the DHCP protocol, the initial DHCP DISCOVER message is sent to:
A) The DHCP server's known IP address
B) The default gateway
C) [Link] (broadcast) because the client doesn't have an IP yet
D) The DNS server
Answer: C — The client uses [Link] as source and [Link] as destination because it has no IP
address yet. All DHCP messages are broadcast.

10. What does DHCP return to a newly connected host? (Choose the MOST complete answer)
A) Only the IP address
B) IP address and subnet mask only
C) IP address, subnet mask, default gateway IP, and DNS server IP (and lease time)
D) IP address and MAC address
Answer: C — DHCP returns: allocated IP, subnet mask, first-hop router (default gateway) IP, DNS server
name/IP, and lease duration.

11. In NAT, all devices in the local network share:

A) The same private IP address
B) The same MAC address
C) A single public IP address as seen from the outside world
D) The same port number

Chapter 4: Network Layer — Data Plane | Page 24

Answer: C — NAT allows many private IP devices to share ONE public IP. The NAT router uses different
port numbers to distinguish between connections.

12. Which of the following is a valid PRIVATE IP address (used in NAT)?

A) [Link]
B) [Link]
C) [Link]
D) [Link]
Answer: B — 192.168.x.x is a private range. 10.x.x.x and 172.16-31.x.x are also private. [Link] is
Google's public DNS server.

13. What does the NAT Translation Table store?

A) IP-to-MAC address mappings
B) DNS name-to-IP mappings
C) Mappings between (WAN-side: public IP, port) and (LAN-side: private IP, port)
D) Routing table entries for next-hop routers
Answer: C — NAT table maps each (public IP, port#) pair to its corresponding (private IP, port#) to
properly route incoming replies.

14. Which of the following is a CRITICISM of NAT?

A) NAT makes addresses too long
B) NAT violates the end-to-end principle and modifies layer-4 port numbers in a layer-3 device
C) NAT requires too much memory
D) NAT only works with TCP, not UDP
Answer: B — NAT violates layering (router touches port numbers) and the end-to-end principle (middle
device modifies packet headers beyond IP).

15. The primary motivation for creating IPv6 was:

A) IPv4 packets were too small
B) IPv4 had security vulnerabilities that couldn't be fixed
C) IPv4's 32-bit address space was exhausted — not enough addresses for all devices
D) IPv4 routing was too slow
Answer: C — IPv4 address exhaustion is the primary driver. ICANN allocated the last IPv4 blocks in 2011.

16. How large is an IPv6 address?

A) 32 bits
B) 64 bits
C) 128 bits
D) 256 bits
Answer: C — IPv6 uses 128-bit addresses, providing 2^128 ≈ 3.4 × 10^38 possible addresses —
effectively unlimited.

17. Which field is present in IPv4 but REMOVED in IPv6?

A) Source address
B) Destination address
C) TTL/Hop Limit
D) Header checksum

Chapter 4: Network Layer — Data Plane | Page 25

Answer: D — IPv6 removed the header checksum (to speed up router processing). It also removed
fragmentation fields and options. TTL became 'Hop Limit' (same concept, new name).

18. In IPv6 tunneling, what happens to an IPv6 datagram when it crosses an IPv4-only
network?
A) The datagram is discarded and regenerated on the other side
B) The IPv6 datagram is encapsulated as the payload of an IPv4 datagram
C) The IPv6 header is converted to an IPv4 header
D) The IPv6 datagram is split into IPv4-sized fragments
Answer: B — Tunneling = IPv6 datagram as payload inside IPv4 datagram. 'Packet within a packet.' The
IPv4 routers see only the outer IPv4 header.

19. The TTL field in an IPv4 datagram is:

A) Set by the receiver to indicate lifetime
B) Decremented at each router; packet dropped when TTL = 0 to prevent infinite loops
C) A timestamp indicating when the packet was sent
D) The number of hops the packet has already traversed
Answer: B — TTL (Time to Live) prevents packets from looping forever. Each router decrements TTL by 1.
At TTL=0, router drops packet and sends ICMP Time Exceeded.

20. What is ICANN's role in Internet addressing?

A) ICANN assigns MAC addresses to network hardware
B) ICANN allocates IP address blocks to Regional Internet Registries and manages the DNS root zone
C) ICANN runs all DHCP servers on the Internet
D) ICANN manufactures network routers
Answer: B — ICANN (Internet Corporation for Assigned Names and Numbers) is the top-level authority for
IP address allocation and DNS management.

21. A host in a NAT network with private address [Link]:4444 communicates through NAT.
An external server sees the packet as coming from:
A) [Link]:4444
B) The NAT router's public IP with a NAT-assigned port number
C) [Link]:4444
D) [Link]:4444
Answer: B — NAT replaces ([Link]:4444) with (public_IP:new_port). The external server sees only the
NAT router's public IP and the assigned port.

22. The 'flow label' field in IPv6 is used to:

A) Fragment large packets
B) Identify datagrams belonging to the same flow for consistent treatment
C) Specify the TTL value
D) Indicate the transport-layer protocol
Answer: B — The 20-bit flow label identifies packets belonging to the same flow, enabling routers to
provide consistent (QoS) treatment to all packets in a flow.

23. CIDR replaced classful addressing because:

A) Classful addressing was insecure

Chapter 4: Network Layer — Data Plane | Page 26

 B) The fixed class sizes (A, B, C) led to massive address waste — organizations got too many or too
few addresses
C) Classful addressing didn't support routing
D) Classful addressing was too slow to process
Answer: B — Class A gave 16M addresses (wasteful for most), Class C gave only 254 (too few for many).
CIDR allows exact-fit allocation.

24. In the DHCP 4-step process (DORA), what does the 'R' (Request) message accomplish?
A) The server requests the client's MAC address
B) The client formally requests to use the IP address offered by the server
C) The router requests a routing update
D) The DNS server requests resolution permission
Answer: B — After receiving a DHCP Offer, the client broadcasts a DHCP Request saying 'I accept this IP
address offer.' This is needed because multiple DHCP servers might have sent offers.

25. Which component of the Internet network layer handles error reporting?
A) TCP
B) UDP
C) ICMP (Internet Control Message Protocol)
D) ARP
Answer: C — ICMP (Internet Control Message Protocol) handles error reporting (TTL expired,
unreachable) and router signaling. It works alongside IP at the network layer.

Chapter 4: Network Layer — Data Plane | Page 27

9.2 Short Answer Questions
Q1: What are the two key functions of the network layer? Explain both.
Forwarding (Data Plane): A LOCAL, per-router function. When a packet arrives at a router's input port, the
router looks up the destination IP in its forwarding table and sends the packet to the correct output port.
This is fast hardware-level operation.

Routing (Control Plane): A NETWORK-WIDE function. Routing algorithms determine the best path from
source to destination across the entire network. This involves routing protocols (OSPF, BGP) or a
centralized SDN controller computing paths. Routing populates the forwarding tables used by forwarding.

Key difference: Forwarding = 'where does THIS packet go at THIS router?' Routing = 'what is the best path
from A to Z across the entire network?'

Q2: Describe the 4-step DHCP process (DORA).

D — DHCP Discover: Client broadcasts 'Is there a DHCP server?' (src: [Link]:68, dst:
[Link]:67). Client has no IP yet.

O — DHCP Offer: Server broadcasts 'Here is an IP you can use' with an offered IP address and lease
time.

R — DHCP Request: Client broadcasts 'I accept this IP offer.' This is broadcast so all DHCP servers know
which offer was accepted.

A — DHCP ACK: Server broadcasts final confirmation 'The IP is yours!' with all configuration details (IP,
mask, default gateway, DNS server, lease time).

After ACK: Client knows its IP, default gateway, and DNS server. Steps 1 & 2 can be skipped for address
renewal.

Q3: Explain how NAT allows multiple devices to share a single public IP address.
NAT maintains a translation table mapping (private IP, port) ↔ (public IP, new port).

OUTGOING: When an internal device ([Link]:3345) sends a packet to the Internet, the NAT router
replaces the source with ([Link]:5001) and records this mapping in the NAT table.

INCOMING: When the Internet sends a reply to ([Link]:5001), the NAT router looks up port 5001 in
its table, finds the original internal address ([Link]:3345), and replaces the destination before forwarding
to the internal host.

This allows many internal devices to share ONE public IP — each is distinguished by a different port
number assigned by the NAT router.

Q4: What is CIDR and why was it introduced?

CIDR (Classless InterDomain Routing, pronounced 'cider') is a method of IP address allocation using
prefix notation (a.b.c.d/x) where x is the number of bits in the network prefix (subnet part).

Why introduced: The old 'classful' addressing (Class A=/8, Class B=/16, Class C=/24) led to massive
address waste. A company needing 500 hosts had to get a Class B (/16 = 65,534 hosts), wasting 65,000
addresses. CIDR allows exact-fit allocation — the company gets a /23 (512 hosts) instead.

CIDR also enables route aggregation: an ISP with [Link]/20 can advertise just ONE route that
covers all its customers' subnets, reducing the size of Internet routing tables.

Q5: What fields were removed in IPv6 compared to IPv4, and why?

Chapter 4: Network Layer — Data Plane | Page 28

Three major things were removed:

1. Header Checksum: Removed because TCP and UDP already have checksums, and link-layer
protocols also check for errors. Removing the IP checksum means routers don't have to
recompute it at every hop (TTL change would require recomputation), speeding up processing.

2. Fragmentation/Reassembly: IPv6 routers never fragment packets. Instead, the source performs
path MTU discovery. If a packet is too big, the router drops it and sends ICMPv6 'Packet Too
Big.' This simplifies routers greatly.

3. Options Field: Replaced by extension headers. The base IPv6 header is always exactly 40 bytes
— routers can process it at line speed without checking for variable-length options.

Q6: Explain IPv4-to-IPv6 tunneling.

Tunneling is the technique for running IPv6 over an existing IPv4 infrastructure.

Scenario: Routers A, B are IPv6/v4 dual-stack. Between B and E is an IPv4-only network. A sends IPv6
packet to F.

How it works:
1. Router B takes the IPv6 datagram (src=A, dst=F)
2. Encapsulates it as the PAYLOAD of an IPv4 datagram (src=B, dst=E, protocol=41)
3. IPv4 network carries this 'IPv6-in-IPv4' packet normally
4. Router E receives the IPv4 datagram, extracts the IPv6 payload
5. E forwards the IPv6 datagram normally to F
This is 'packet within a packet.' IPv4 routers (C, D) in the middle never see the IPv6 datagram — they just
forward the outer IPv4 packet.

Q7: What is a subnet and how do you identify subnets in a network diagram?
A subnet is a set of device interfaces that can physically reach each other WITHOUT passing through an
intervening router. Devices in the same subnet share the same high-order bits (subnet prefix) in their IP
addresses.

To identify subnets:
1. Imagine removing all devices — only interfaces and links remain
2. 'Detach' each interface from its host or router
3. Each resulting 'island' of connected links/interfaces = one subnet
Each subnet gets a network address (e.g., [Link]/24). The /24 means the first 24 bits are the same for
all devices in that subnet. Hosts in [Link]/24 have addresses [Link] through [Link] (and 255
for broadcast).

Q8: Compare the traditional per-router control plane with the SDN control plane.
Traditional Per-Router Control Plane:
• Intelligence is DISTRIBUTED — each router runs its own routing algorithm
• Routers communicate via routing protocols (OSPF, BGP) to share topology information
• Each router independently computes its own forwarding table
• More resilient (no single point of failure)
• Less flexible (changing behavior requires changing router software everywhere)

Chapter 4: Network Layer — Data Plane | Page 29

SDN (Software-Defined Networking) Control Plane:
• Intelligence is CENTRALIZED in a remote controller
• Controller has global view of the network topology
• Controller computes optimal forwarding tables and INSTALLS them into routers via a control
channel
• Routers are 'dumb' — they just match packets to forwarding table entries
• More flexible (can program any behavior from the controller)
• Controller is a potential single point of failure
• Used in: Google's backbone, data centers, 5G networks

Chapter 4: Network Layer — Data Plane | Page 30

9.3 Long / Descriptive Questions
Q1: Explain in detail how the Internet's network layer works — from the moment a sender's
application generates data to when it arrives at the receiver. Include: encapsulation, IP
datagram fields, forwarding, routing, and decapsulation.

Step 1: Application Data to Transport Layer

The sending application generates data (e.g., an HTTP request). The transport layer (TCP/UDP)
adds its header (port numbers, seq#, etc.) creating a segment.

Step 2: Network Layer Encapsulation (Sender)

The network layer (IP) takes the transport-layer segment and encapsulates it into an IP datagram.
The IP header includes: source IP (sender's address), destination IP (receiver's address), TTL
(initially set, e.g., 64 or 128), upper layer protocol (TCP=6, UDP=17), header checksum, and other
fields. The total datagram length is added.

Step 3: Forwarding at Each Router

The datagram travels hop by hop through routers. At EACH router:
(a) Router extracts the destination IP from the datagram header
(b) Router looks up destination IP in its forwarding table
(c) Forwarding table maps destination IP prefix → output port
(d) Router decrements TTL by 1 (if TTL = 0, drops packet & sends ICMP error)
(e) Router recomputes header checksum (because TTL changed)
(f) Forwards datagram out the correct output port

Step 4: Routing — How the Forwarding Table is Built

The forwarding tables that routers use during forwarding are built by routing algorithms (control
plane). In traditional networks: OSPF (within an AS) and BGP (between ASes) compute optimal
paths. In SDN: a centralized controller computes paths and installs tables remotely.

Step 5: Decapsulation (Receiver)

When the datagram arrives at the destination host:
(a) Network layer strips the IP header
(b) Checks the destination IP matches the host's interface IP
(c) The 'upper layer protocol' field tells it which transport protocol handles the payload
(d) Payload is passed to TCP or UDP
(e) Transport layer passes data to the correct application via port number demultiplexing

Q2: Compare IPv4 and IPv6 in detail — motivation, header differences, addressing,
fragmentation, and transition mechanisms.

1. Motivation
IPv4: 32-bit addresses, designed in 1970s, 4.3 billion max addresses. ICANN allocated the last
blocks in 2011. Smartphones, IoT, and billions of devices made exhaustion inevitable.

Chapter 4: Network Layer — Data Plane | Page 31

IPv6: 128-bit addresses → 2^128 ≈ 3.4 × 10^38 addresses. Also motivated by: fixed-length header
for faster processing, built-in flow labels for QoS, elimination of fragmentation at routers.

2. Header Comparison
IPv4 header: 20-60 bytes (variable due to options). Contains: version(4b), header length(4b),
TOS(8b), total length(16b), ID(16b), flags(3b), fragment offset(13b), TTL(8b), protocol(8b),
checksum(16b), src IP(32b), dst IP(32b), options(variable).
IPv6 header: Fixed 40 bytes. Contains: version(4b), priority(8b), flow label(20b), payload length(16b),
next header(8b), hop limit(8b), src address(128b), dst address(128b).
Key removals in IPv6: checksum (speed), fragmentation fields (simplicity), options (use extension
headers instead).

3. Addressing
IPv4: 32 bits, dotted-decimal notation (e.g., [Link]). Hierarchical: network prefix + host portion.
Classes were replaced by CIDR.
IPv6: 128 bits, hexadecimal colon notation (e.g., 2001:0db8:85a3::8a2e:0370:7334). :: notation
compresses consecutive zero groups. Auto-configuration (SLAAC) built in — no DHCP needed.

4. Fragmentation
IPv4: Both routers AND hosts can fragment packets. If a datagram is too large for a link's MTU, the
router breaks it into fragments. Reassembly happens only at the destination.
IPv6: Routers NEVER fragment. The source performs path MTU discovery — it sends packets and
uses ICMPv6 'Packet Too Big' feedback to learn the minimum MTU along the path. Only the source
adjusts packet size.

5. Transition (IPv4 → IPv6)

Three main transition mechanisms:
(a) DUAL STACK: Routers/hosts run both IPv4 and IPv6 simultaneously. They use IPv4 to talk to
IPv4-only nodes and IPv6 for IPv6 nodes.
(b) TUNNELING: IPv6 datagram encapsulated as payload in IPv4 datagram. Used when IPv6 traffic
must cross IPv4-only network segments. Outer IPv4 header wraps the entire IPv6 packet.
Protocol field = 41.
(c) TRANSLATION (NAT64): Translates between IPv6 and IPv4 packets at the network border.
Allows IPv6-only clients to communicate with IPv4-only servers.

Q3: Explain NAT in detail — how it works, the role of the NAT translation table, advantages,
limitations, and its impact on the end-to-end principle.

What is NAT?
NAT (Network Address Translation) allows all devices in a private local network to share a SINGLE
public IP address for Internet communication. The NAT router acts as a proxy — translating between
private (internal) and public (external) addresses.

How NAT Works — Detailed Steps

Chapter 4: Network Layer — Data Plane | Page 32

SCENARIO: Home network [Link]/24, NAT router public IP [Link].

OUTGOING (LAN → WAN):

1. Host [Link]:3345 sends packet to server [Link]:80
2. NAT router intercepts: replaces source ([Link]:3345) → ([Link]:5001)
3. NAT table entry created: WAN=[Link]:5001 ↔ LAN=[Link]:3345
4. Modified packet sent to Internet

INCOMING (WAN → LAN):

5. Server replies to [Link]:5001
6. NAT router receives reply, looks up port 5001 in NAT table
7. Finds: port 5001 → [Link]:3345
8. Replaces destination ([Link]:5001) → ([Link]:3345)
9. Packet forwarded to correct internal host

Advantages of NAT
1. Address conservation: ONE public IP serves unlimited internal devices.
2. Internal flexibility: Change internal addresses without ISP notification.
3. ISP portability: Change ISPs without changing internal addresses.
4. Security (basic): Internal hosts are not directly reachable from Internet — provides a basic firewall
effect.

Limitations & Controversy

1. End-to-end principle violation: The Internet was designed so that end hosts are transparent
intermediaries. NAT introduces a stateful middlebox that modifies packet headers — violating the
principle.
2. Layer violation: NAT modifies transport-layer port numbers (Layer 4) inside a network-layer
(Layer 3) device.
3. NAT traversal: A host inside NAT cannot be a SERVER — external clients can't initiate
connections because the server has no public address. Solutions: (a) Static port forwarding rules
in NAT table. (b) STUN/TURN servers for VoIP/WebRTC. (c) UPnP for automatic port mapping.
4. Long-term: IPv6 is the 'right' solution — NAT is a workaround, not a fix.

Impact on End-to-End Principle

The end-to-end principle states that intelligent processing should be at the ends of the network, with
the network core being simple and transparent. NAT breaks this by:
• Making the network stateful (must maintain translation table)
• Making devices behind NAT 'invisible' to the Internet
• Requiring special handling for protocols that embed IP addresses in payload (FTP, SIP, H.323)
Despite these issues, NAT is ubiquitous — found in every home router, enterprise firewall, and
cellular network gateway.

Chapter 4: Network Layer — Data Plane | Page 33