Back to Course Home

Objectives Overview QoS Models Router Arch IPv4 & Fragmentation Addressing & LPM DHCP & NAT IPv6 Architecture Practical Lab Homework

Chapter 4: The Network Layer – Data Plane

Kurose & Ross, Computer Networking: A Top-Down Approach, 9th edition (2025) – Optimized lecture with Smart Trimming

Learning Objectives

Understand Forwarding (data plane) vs. Routing (control plane).
Describe router internals: switching fabrics, queuing, buffer management, and scheduling.
Analyze IPv4 datagram format and IP Fragmentation (MTU, offset calculation).
Perform subnet calculations (CIDR) and understand Longest Prefix Matching (TCAMs).
Explain DHCP (DORA), NAT (translation table), and IPv6 transition mechanisms (tunneling).
Articulate the End-to-End argument and the IP hourglass architecture.

Chapter Roadmap

4.1 Network Layer Overview: data plane, control plane, service models
4.2 What's Inside a Router? Switching fabrics, queuing, scheduling
4.3 IP: Internet Protocol (IPv4, Addressing, DHCP, NAT, IPv6)
Architecture Internet Principles: Hourglass & End-to-End Argument

Prerequisites: Solid understanding of the Transport Layer (TCP/UDP multiplexing) and Encapsulation from Chapters 1 & 3.

1. Network Layer Overview

The network layer moves transport segments from a sending host to a receiving host. The sender encapsulates segments into datagrams; the receiver delivers them up to the transport layer. Every Internet device—hosts and routers—runs network layer protocols.

Forwarding (Data Plane)

Local, per-router function: Moving a packet from an input link interface to the appropriate output link interface.
Operates in the nanosecond timeframe.
Implemented in hardware (ASICs, TCAMs) at line speed.

Routing (Control Plane)

Network-wide logic: Determining the route (path) taken by packets from source to destination.
Operates in the seconds/milliseconds timeframe.
Implemented in software via routing protocols (traditional) or SDN controllers (remote).

Transit Analogy: Forwarding = navigating a single traffic interchange. Routing = planning the entire road trip from source to destination.

Data Plane vs. Control Plane: Two Approaches

Per-Router Control Plane

Individual routing algorithm components in each and every router interact in the control plane to compute forwarding tables. Traditional approach: OSPF, BGP running on each router.

SDN Control Plane

A remote controller computes and installs forwarding tables in routers via a protocol like OpenFlow. This decouples the data plane from the control plane.

2. Network Service Models & QoS

Q: What service model does the network provide for the "channel" transporting datagrams?

Network Architecture	Service Model	Bandwidth	Loss	Order	Timing
Internet	Best Effort (no guarantees)	None	No	No	No

Historical QoS Models (not widely deployed):

Model	Key Feature	Fate
ATM CBR/ABR	Constant / Available Bit Rate with strict guarantees	Legacy; ATM largely replaced by Ethernet/IP
Intserv (RFC 1633)	Per-flow resource reservation (RSVP)	Not scalable; never widely deployed
Diffserv (RFC 2475)	Traffic classes with differentiated treatment	Used in some enterprise/carrier networks

Why Best-Effort Won:

Simplicity enabled massive, rapid Internet deployment.
Sufficient bandwidth provisioning makes real-time apps (voice, video) work "good enough" most of the time.
CDNs and distributed services bring content close to users, reducing core network demands.
TCP congestion control helps maintain overall stability.

It's hard to argue with the success of the best-effort service model.

3. Router Architecture

A high-level generic router consists of: Input Ports, Switching Fabric, Output Ports, and the Routing Processor. The forwarding data plane operates in hardware at nanosecond timescales.

Input Port Functions

Line Termination & Link Layer

Physical layer: bit-level reception.
Link layer: e.g., Ethernet processing (Chapter 6).

Decentralized Switching

Using header field values, lookup output port via forwarding table in input port memory ("match plus action").
Goal: complete input port processing at line speed.
Destination-based forwarding: forward based only on destination IP address.

Switching Fabrics

Type	Operation	Pros / Cons
Memory	CPU copies packet to system memory, then to output. (1st generation routers)	Slow. Limited by memory bandwidth (2 bus crossings per datagram).
Bus	Datagram passes over a shared hardware bus from input to output port memory.	Limited by bus capacity (e.g., 32 Gbps Cisco 5600). Bus contention.
Interconnection Network	Crossbar, Clos networks, multistage switches. Fragment datagram into fixed-length cells, switch through fabric, reassemble at exit.	High-speed, scalable. Exploits parallelism. Cisco CRS: up to 100's Tbps.

Queuing: Input & Output Ports

Input Port Queuing & HOL Blocking

If the switch fabric is slower than input ports combined, queues form. Head-of-the-Line (HOL) Blocking occurs when a queued datagram at the front blocks others behind it, even if their output ports are free.

Output Port Queuing

Buffering required when arrival rate from the fabric exceeds output line speed. Causes queuing delay and potential packet loss. A drop policy decides which datagrams to drop if no free buffers exist.

Buffer Management & Scheduling

Drop Policies

Tail Drop: Drop arriving packet when buffer is full.
Priority Drop: Drop/remove packets based on priority.

Scheduling Disciplines

FCFS/FIFO: Order of arrival. Simplest.
Priority: Highest-priority non-empty queue first.
Round Robin (RR): Cyclic, one packet per class. Work-conserving.
Weighted Fair Queuing (WFQ): Weighted service per class; minimum bandwidth guarantees.

4. The IPv4 Datagram & Fragmentation

The IP datagram is the fundamental packet of the network layer. Key fields: Version (4 bits), Header Length, Type of Service (Diffserv + ECN), Total Length (max 64KB, typically ≤1500 bytes), 16-bit Identifier, Flags, Fragment Offset, TTL (decremented at each router), Protocol (e.g., TCP=6, UDP=17), Header Checksum, Source/Dest IP (32-bit each), Options (e.g., timestamp, record route).

Overhead: 20 bytes TCP + 20 bytes IP = 40 bytes + application layer overhead for every TCP+IP packet.

IP Fragmentation & Reassembly

Network links have an MTU (Maximum Transfer Unit) — the largest possible link-level frame. Different link types have different MTUs. If an IP datagram exceeds the MTU of a link, the router must fragment it. Fragments are reassembled only at the destination host.

Fragmentation Example (4000-byte datagram, MTU = 1500):
• Original datagram: 4000 bytes total (20-byte header + 3980 data bytes). ID = x, FragFlag = 0, Offset = 0.
• Max data per fragment: 1500 - 20 = 1480 bytes (must be divisible by 8).
• Fragment 1: Length = 1500, ID = x, FragFlag = 1 (More), Offset = 0. Data: 1480 bytes.
• Fragment 2: Length = 1500, ID = x, FragFlag = 1, Offset = 1480/8 = 185. Data: 1480 bytes.
• Fragment 3: Length = 1040 (20 header + 1020 data), ID = x, FragFlag = 0 (Last), Offset = (1480+1480)/8 = 370. Data: 1020 bytes.
• Remember: Fragment Offset is measured in units of 8 bytes (64 bits).

5. IP Addressing & Routing

If you are new to networking, this section will build your understanding from the ground up. By the end, you will know what an IP address is, how subnets work, and how routers forward packets using the Longest Prefix Match rule.

What is an IP Address?

An IP address (IPv4) is a 32‑bit binary number that uniquely identifies a device's connection to a network. It is usually written in dotted‑decimal notation, e.g. 192.168.1.10. Each of the four numbers represents 8 bits, so the full address is 4 × 8 = 32 bits.

An IP address is divided into two parts:

Network portion (prefix): identifies the network to which the device belongs.
Host portion: identifies the specific device on that network.

The dividing line between network and host bits is given by the subnet mask.

Subnet Mask and Prefix Length

A subnet mask is also a 32‑bit number. It has a series of consecutive 1s followed by a series of 0s. The 1s indicate the network bits, and the 0s indicate the host bits.

Example: 255.255.255.0 in binary is 11111111.11111111.11111111.00000000. This means the first 24 bits are the network part, and the last 8 bits are the host part.

Today we use CIDR notation (Classless Inter‑Domain Routing) to express the mask as a prefix length: /24. So 192.168.1.10/24 means the network prefix is 24 bits long.

Historical Classful Addressing (Background)

In the early Internet, IP addresses were divided into classes. Although classful addressing is obsolete, it helps you understand the original design and the meaning of "default" masks.

Class	First bits	Range	Default mask	Network / Host bits	Purpose
A	0	1.0.0.0 – 126.255.255.255	255.0.0.0 (/8)	8 net + 24 host	Large networks
B	10	128.0.0.0 – 191.255.255.255	255.255.0.0 (/16)	16 net + 16 host	Medium networks
C	110	192.0.0.0 – 223.255.255.255	255.255.255.0 (/24)	24 net + 8 host	Small networks
D	1110	224.0.0.0 – 239.255.255.255	–	–	Multicast
E	1111	240.0.0.0 – 255.255.255.255	–	–	Experimental

Classful addressing wasted many addresses, so the Internet moved to classless addressing (CIDR), where the dividing line can be anywhere.

Subnetting – Borrowing Bits

Organizations often need to split one large network into smaller subnetworks (subnets). This is done by borrowing host bits to extend the network portion.

Example: You are given 192.168.1.0/24 (256 addresses, from 192.168.1.0 to 192.168.1.255). You want 4 smaller subnets. Borrow 2 host bits → new prefix length = 26. The subnet mask becomes 255.255.255.192.

The four subnets are:

192.168.1.0/26 (hosts .1 – .62)
192.168.1.64/26 (hosts .65 – .126)
192.168.1.128/26 (hosts .129 – .190)
192.168.1.192/26 (hosts .193 – .254)

Notice that the first address of each subnet is the network address and the last is the broadcast address.

Broadcast Address

The broadcast address of a subnet is the address where all host bits are set to 1. A packet sent to this address is delivered to all devices on that subnet. For example, in 192.168.1.0/24, the broadcast address is 192.168.1.255. Routers usually do not forward broadcast packets to other networks.

Two special addresses per subnet:
• Network address (all host bits = 0) – identifies the subnet itself.
• Broadcast address (all host bits = 1) – sends to all hosts on the subnet.
Both are reserved and cannot be assigned to a device.

CIDR & Variable‑Length Subnet Masking

CIDR allows any prefix length, so address allocation can be tailored exactly to the number of hosts needed. A block is written as base address/prefix. For example, 10.0.0.0/12 means the first 12 bits are the network part.

Longest Prefix Matching (LPM)

When a router looks up the forwarding table, it may find several entries that match the destination IP. The router always chooses the entry with the longest prefix (the most specific match). This is implemented in hardware using TCAMs (Ternary Content Addressable Memories), which can perform the lookup in a single clock cycle.

LPM Example:

Prefix	Link Interface
`11001000 00010111 00010* ******`	0
`11001000 00010111 00011000 ********`	1
`11001000 00010111 00011* ******`	2
otherwise	3

Destination: 11001000 00010111 00011000 10101010 → Matches prefix 1 (00011000) → Interface 1 (longest match!).

Destination: 11001000 00010111 00010110 10100001 → Matches prefix 0 (00010***) → Interface 0.

Hierarchical Addressing & Route Aggregation

ISPs allocate address blocks in a hierarchical manner. An ISP with block 200.23.16.0/20 can assign smaller sub‑blocks (e.g., /23) to customers. The ISP then advertises only the aggregate route 200.23.16.0/20 to the rest of the Internet. This keeps global routing tables small.

Who allocates IP addresses? ICANN (Internet Corporation for Assigned Names and Numbers) allocates IP addresses through 5 regional registries (RRs), manages the DNS root zone, and delegates TLD management. ICANN allocated the last chunk of IPv4 addresses to RRs in 2011.

"Who the hell knew how much address space we needed?" — Vint Cerf

6. DHCP & NAT

DHCP (Dynamic Host Configuration Protocol)

Allows a host to dynamically obtain an IP address from a network server when it joins the network ("plug-and-play").

DORA Process:

Discover: Host broadcasts DHCP discover message.
Offer: DHCP server responds with DHCP offer (IP, subnet mask, router, DNS).
Request: Host requests the offered IP address.
Ack: Server finalizes the lease.

DHCP returns more than just an IP: first-hop router address, DNS server name & IP, and network mask. Typically, the DHCP server is co-located in the router.

NAT (Network Address Translation)

All devices in a local network use private IP addresses (10/8, 172.16/12, 192.168/16 prefixes) and share a single public IPv4 address to the outside world.

Outgoing: NAT router replaces (Src IP, Src Port) with (Public NAT IP, New Port), storing the mapping in the NAT translation table.
Incoming: NAT router uses the Dest Port to look up the table and reverse the translation.

Advantages: Only one public IP needed; can change internal addresses/ISP without notifying outside; devices not directly addressable from outside (security).

NAT Controversy: NAT violates the End-to-End argument (routers should only process up to layer 3; NAT manipulates port numbers at layer 4). It breaks P2P applications. Yet NAT is extensively used in home, institutional, and 4G/5G cellular networks — it's here to stay.

7. IPv6

Motivated by exhaustion of the 32-bit IPv4 address space. Uses 128-bit addresses. Additional motivations: speed processing/forwarding (40-byte fixed-length header) and enable different network-layer treatment of "flows" (Flow Label field).

Key Changes from IPv4

Fixed 40-byte header: No checksum, no fragmentation/reassembly at routers, no options (available as next-header).
No Fragmentation at routers: Router drops and sends ICMP "Packet Too Big" (Path MTU Discovery).
Flow Label & Priority: Identify datagrams in the same "flow" for special handling.
Transition (Tunneling): IPv6 datagram carried as payload inside an IPv4 datagram to traverse legacy IPv4 networks.

IPv6 Adoption (2023): Google reports ~40% of clients access services via IPv6. Deployment has taken 25+ years — the installed base of IPv4 + NAT works "well enough."

8. Internet Architecture & Principles

The IP Hourglass

The Internet has a "thin waist": one network layer protocol — IP — must be implemented by every Internet-connected device. Below IP: many physical and link-layer technologies. Above IP: many transport and application-layer protocols. Middleboxes have added "love handles" — operating inside the network, widening the once-narrow waist.

Architectural Principles (RFC 1958)

"The community believes that the goal is connectivity, the tool is the Internet Protocol, and the intelligence is end to end rather than hidden in the network."

Three cornerstone beliefs: (1) Simple connectivity, (2) IP as the narrow waist, (3) Intelligence & complexity at the network edge.

The End-to-End Argument

Some network functionality can be implemented in the network or at the network edge. The end-to-end argument states:

"The function in question can completely and correctly be implemented only with the knowledge and help of the application standing at the end points of the communication system. Therefore, providing that questioned function as a feature of the communication system itself is not possible. We call this line of reasoning against low-level function implementation the end-to-end argument."
— Saltzer, Reed, Clark, 1981

Where's the Intelligence?

Traditional (20^th Century Phone Network & Pre-2005 Internet)

Phone Network: Intelligence at network switches. Dumb end devices.
Early Internet: Intelligence at the edge. Simple, best-effort network core. Smart hosts, dumb network.

Modern Internet (Post-2005)

Programmable network devices (SDN, middleboxes, NFV) add intelligence inside the network.
Massive edge infrastructure: CDNs, cloud datacenters, application-level distributed services.
Result: Intelligence is now everywhere — edge, core, and in between.

Practical Lab: IP & Routing

Lab: Wireshark IP Fragmentation & ICMP

Open Wireshark and start capturing on your active interface.
Open Command Prompt/Terminal and ping a distant server with a large packet size to force fragmentation:
ping -l 3000 -n 4 8.8.8.8 (Windows) or ping -s 3000 8.8.8.8 (Linux/Mac).
Stop capture and filter by icmp.
Inspect the IP Header fields: Notice the Identification, Flags (DF, MF), and Fragment Offset.

Homework Assignment (Theoretical, Graded)

Instructions: Answer all questions in a separate document (PDF or Word). Submit via the learning platform. This assignment counts towards your final grade (5%).

Part I: Short Essays (40 points)

Explain the difference between Forwarding and Routing. Which one belongs to the data plane and which to the control plane? How does SDN change the traditional control plane?
What is Head-of-the-Line (HOL) blocking? Where does it occur in a router, and why is it a performance concern?
Explain how NAT allows multiple devices to share a single public IP. How does the router's translation table distinguish between simultaneous connections? Why is NAT controversial from an architectural standpoint?
State and explain the End-to-End Argument as articulated by Saltzer, Reed, and Clark (1981). Give an example of a function best implemented at the edge rather than in the network core.
Why does IPv6 eliminate fragmentation at routers? How does it handle packets that exceed the link MTU?

Part II: True/False + Correction (30 points)

In Longest Prefix Matching, the router forwards the packet to the interface associated with the shortest matching prefix. (True / False)
DHCP requires the client and server to be on the same subnet to function. (True / False)
Generalized forwarding (Match+Action) allows routers to make decisions based on TCP port numbers, not just destination IP. (True / False)
IPv6 datagrams are fragmented by intermediate routers when they exceed the MTU. (True / False)
The IP Hourglass model shows IP as the "thin waist" connecting diverse link and application layers. (True / False)

For each false statement, write the correct version.

Part III: Calculations & Analysis (30 points)

Longest Prefix Matching: Given the following forwarding table:
• Prefix 1: 11001000 00010111 00010*** ******** → Interface 0
• Prefix 2: 11001000 00010111 00011000 ******** → Interface 1
• Prefix 3: 11001000 00010111 00011*** ******** → Interface 2
Determine the output interface for:
(a) 11001000 00010111 00011111 11111111
(b) 11001000 00010111 00011000 10101010
Subnetting & CIDR: An ISP has the block 200.23.16.0/20. Allocate 8 equal-sized sub-blocks. What is the CIDR prefix (/x) for each organization? List the first and last organization's network address.
IP Fragmentation: A 4000-byte IP datagram (20-byte header, 3980 data bytes) must be sent over a link with MTU = 1500 bytes. Calculate the Total Length, Fragment Offset, and Flags for each resulting fragment. Show all work.

Deadline: Two weeks from the lecture date.

Chapter 4 Summary

Network Layer Functions: Forwarding (data plane, local, nanoseconds, hardware) vs. Routing (control plane, global, seconds, software or SDN controller).
Network Service Models: Internet provides best-effort (no guarantees). Historical QoS models (ATM, Intserv, Diffserv) largely not deployed at Internet scale.
Router Architecture: Input ports (line termination, decentralized lookup via TCAM), switching fabrics (memory → bus → interconnection network like Clos/Crossbar), output ports (queuing, scheduling, HOL blocking).
Buffer Management: Tail drop, priority drop.
Scheduling: FCFS, Priority, Round Robin, Weighted Fair Queuing (WFQ — minimum bandwidth guarantees).
IPv4 Datagram: 20-byte header (with TCP: 40 bytes overhead). TTL, Protocol, Checksum, and IP Fragmentation (MTU, Offset in 8-byte units, reassembly only at destination).
Addressing: CIDR (a.b.c.d/x), Subnets, Longest Prefix Matching via TCAM (one clock cycle), Hierarchical Route Aggregation. ICANN → Regional Registries → ISPs → Organizations.
DHCP: DORA process (Discover, Offer, Request, Ack). Returns IP, router, DNS, subnet mask.
NAT: Private IP → single public IP via translation table. Controversial (violates end-to-end) but ubiquitous.
IPv6: 128-bit addresses, fixed 40-byte header, no router fragmentation (Path MTU Discovery), Flow Label, tunneling through IPv4. ~40% global adoption (2023).
Architecture: IP as the "thin waist" (hourglass). End-to-End argument: keep intelligence at the edge. Post-2005: programmable networks + massive edge infrastructure.

Self-Review Questions (Exam Preparation):
• How does a router use TCAM for Longest Prefix Matching in a single clock cycle?
• Why is NAT considered a violation of the end-to-end argument?
• Walk through the math of IP Fragmentation if a 3000-byte packet (20-byte header) hits a 1000-byte MTU.
• Compare WFQ and Priority scheduling — which provides minimum bandwidth guarantees?
• Explain the Saltzer, Reed, Clark end-to-end argument in your own words.

Looking Ahead to Chapter 5:
Question: How are forwarding tables (destination-based forwarding) or flow tables (generalized forwarding) computed?
Answer: By the control plane — the topic of the next chapter. We'll study routing algorithms (Link State, Distance Vector), intra-AS routing (OSPF), inter-AS routing (BGP), and the SDN control plane in detail.