Lecture 3: Network Layer
Network Layer Characteristics
The Network Layer
• Provides services to allow end devices to exchange data
• IP version 4 (IPv4) and IP version 6 (IPv6) are the principle
network layer communication protocols.
• The network layer performs four basic operations:
• Addressing end devices
• Encapsulation
• Routing
• De-encapsulation
Network Layer Characteristics
IP Encapsulation
• IP encapsulates the transport layer
segment.
• IP can use either an IPv4 or IPv6 packet
and not impact the layer 4 segment.
• IP packet will be examined by all layer 3
devices as it traverses the network.
• The IP addressing does not change from
source to destination.
Note: NAT will change addressing, but will
be discussed in a later module.
Network Layer Characteristics
Characteristics of IP
IP is meant to have low overhead and may be described as:
• Connectionless
• Best Effort
• Media Independent
Network Layer Characteristics
Connectionless
IP is Connectionless
• IP does not establish a connection with the destination before sending the packet.
• There is no control information needed (synchronizations, acknowledgments, etc.).
• The destination will receive the packet when it arrives, but no pre-notifications are sent by IP.
• If there is a need for connection-oriented traffic, then another protocol will handle this (typically TCP at
the transport layer).
Network Layer Characteristics
Best Effort
IP is Best Effort
• IP will not guarantee delivery of the
packet.
• IP has reduced overhead since there is no
mechanism to resend data that is not
received.
• IP does not expect acknowledgments.
• IP does not know if the other device is
operational or if it received the packet.
Network Layer Characteristics
Media Independent
IP is unreliable:
• It cannot manage or fix undelivered or
corrupt packets.
• IP cannot retransmit after an error.
• IP cannot realign out of sequence packets.
• IP must rely on other protocols for these
functions.
IP is media Independent:
• IP does not concern itself with the type of
frame required at the data link layer or the
media type at the physical layer.
• IP can be sent over any media type: copper,
fiber, or wireless.
Network Layer Characteristics
Media Independent (Contd.)
The network layer will establish the Maximum
Transmission Unit (MTU).
• Network layer receives this from control
information sent by the data link layer.
• The network then establishes the MTU
size.
Fragmentation is when Layer 3 splits the IPv4
packet into smaller units.
• Fragmenting causes latency.
• IPv6 does not fragment packets.
• Example: Router goes from Ethernet to a
slow WAN with a smaller MTU
IPv4 Packet
IPv4 Packet Header
IPv4 is the primary communication protocol for the network layer.
The network header has many purposes:
• It ensures the packet is sent in the correct direction (to the destination).
• It contains information for network layer processing in various fields.
• The information in the header is used by all layer 3 devices that handle the packet
IPv4 Packet
IPv4 Packet Header Fields
The IPv4 network header characteristics:
• It is in binary.
• Contains several fields of information
• Diagram is read from left to right, 4 bytes per
line
• The two most important fields are the source
and destination.
Protocols may have may have one or more functions.
IPv4 Packet
IPv4 Packet Header Fields
Significant fields in the IPv4 header:
Function Description
Version This will be for v4, as opposed to v6, a 4 bit field= 0100
Differentiated Services Used for QoS: DiffServ – DS field or the older IntServ – ToS or Type
of Service
Header Checksum Detect corruption in the IPv4 header
Time to Live (TTL) Layer 3 hop count. When it becomes zero the router will discard
the packet.
Protocol I.D.s next level protocol: ICMP, TCP, UDP, etc.
Source IPv4 Address 32 bit source address
Destination IPV4 32 bit destination address
Address
IPv6 Packets
Limitations of IPv4
IPv4 has three major limitations:
• IPv4 address depletion – We have basically run out of IPv4 addressing.
• Lack of end-to-end connectivity – To make IPv4 survive this long, private addressing and NAT
were created. This ended direct communications with public addressing.
• Increased network complexity – NAT was meant as temporary solution and creates issues on the
network as a side effect of manipulating the network headers addressing. NAT causes latency
and troubleshooting issues.
IPv6 Packets
IPv6 Overview
• IPv6 was developed by Internet
Engineering Task Force (IETF).
• IPv6 overcomes the limitations of
IPv4.
• Improvements that IPv6 provides:
• Increased address space – based on 128
bit address, not 32 bits
• Improved packet handling – simplified
header with fewer fields
• Eliminates the need for NAT – since there
is a huge amount of addressing, there is no
need to use private addressing internally
and be mapped to a shared public address
IPv6 Packets
IPv6 Packet Header
Significant fields in the IPv6 header:
Function Description
Version This will be for v6, as opposed to v4, a 4 bit field= 0110
Traffic Class Used for QoS: Equivalent to DiffServ – DS field
Flow Label Informs device to handle identical flow labels the same way, 20 bit
field
Payload Length This 16-bit field indicates the length of the data portion or payload
of the IPv6 packet
Next Header I.D.s next level protocol: ICMP, TCP, UDP, etc.
Hop Limit Replaces TTL field Layer 3 hop count
Source IPv4 Address 128 bit source address
Destination IPV4 128 bit destination address
IPv6 Packets
IPv6 Packet Header (Cont.)
IPv6 packet may also contain extension headers (EH).
EH headers characteristics:
• provide optional network layer information
• are optional
• are placed between IPv6 header and the payload
• may be used for fragmentation, security, mobility support, etc.
Note: Unlike IPv4, routers do not fragment IPv6 packets.
How a Host Routes
Host Forwarding Decision
• Packets are always created at the source.
• Each host devices creates their own routing table.
• A host can send packets to the following:
• Itself – 127.0.0.1 (IPv4), ::1 (IPv6)
• Local Hosts – destination is on the same LAN
• Remote Hosts – devices are not on the same LAN
How a Host Routes
Host Forwarding Decision (Cont.)
• The Source device determines whether the destination is local or remote
• Method of determination:
• IPv4 – Source uses its own IP address and Subnet mask, along with the destination IP address
• IPv6 – Source uses the network address and prefix advertised by the local router
• Local traffic is dumped out the host interface to be handled by an intermediary device.
• Remote traffic is forwarded directly to the default gateway on the LAN.
How a Host Routes
Default Gateway
A router or layer 3 switch can be a default-gateway.
Features of a default gateway (DGW):
• It must have an IP address in the same range as the rest of the LAN.
• It can accept data from the LAN and is capable of forwarding traffic off of the LAN.
• It can route to other networks.
If a device has no default gateway or a bad default gateway, its traffic will not be able to
leave the LAN.
How a Host Routes
A Host Routes to the Default Gateway
• The host will know the default gateway
(DGW) either statically or through DHCP
in IPv4.
• IPv6 sends the DGW through a router
solicitation (RS) or can be configured
manually.
• A DGW is static route which will be a
last resort route in the routing table.
• All device on the LAN will need the DGW
of the router if they intend to send
traffic remotely.
How a Host Routes
Host Routing Tables
• On Windows, route print or
netstat -r to display the PC
routing table
• Three sections displayed by
these two commands:
• Interface List – all
potential interfaces and
MAC addressing
• IPv4 Routing Table
• IPv6 Routing Table
Introduction to Routing
Router Packet Forwarding Decision
What happens when the router receives the frame from the host device?
Introduction to Routing
IP Router Routing Table
There three types of routes in a router’s routing table:
• Directly Connected – These routes are automatically added by the router, provided the interface
is active and has addressing.
• Remote – These are the routes the router does not have a direct connection and may be learned:
• Manually – with a static route
• Dynamically – by using a routing protocol to have the routers share their information with each other
• Default Route – this forwards all traffic to a specific direction when there is not a match in the
routing table
Introduction to Routing
Static Routing
Static Route Characteristics:
• Must be configured manually
• Must be adjusted manually by the
administrator when there is a change in
the topology
• Good for small non-redundant networks
• Often used in conjunction with a dynamic
routing protocol for configuring a default
route
Introduction to Routing
Dynamic
Routing
Dynamic Routes Automatically:
• Discover remote networks
• Maintain up-to-date information
• Choose the best path to the destination
• Find new best paths when there is a
topology change
Dynamic routing can also share static default
routes with the other routers.
Introduction to Routing
Introduction to an IPv4 Routing Table
The show ip route command shows
the following route sources:
• L - Directly connected local interface
IP address
• C – Directly connected network
• S – Static route was manually
configured by an administrator
• O – OSPF
• D – EIGRP
This command shows types of routes:
• Directly Connected – C and L
• Remote Routes – O, D, etc.
• Default Routes – S*
Address Resolution: MAC and IP
Destination on Same Network
There are two primary addresses assigned to a device on an Ethernet LAN:
• Layer 2 physical address (the MAC address) – Used for NIC to NIC communications on the same
Ethernet network.
• Layer 3 logical address (the IP address) – Used to send the packet from the source device to the
destination device.
Layer 2 addresses are used to deliver frames from one NIC to another NIC on the same network. If a
destination IP address is on the same network, the destination MAC address will be that of the
destination device.
MAC and IP
Destination on Remote Network
When the destination IP address is on a remote network, the destination MAC address is that of the
default gateway.
• ARP is used by IPv4 to associate the IPv4 address of a device with the MAC address of the
device NIC.
• ICMPv6 is used by IPv6 to associate the IPv6 address of a device with the MAC address of the
device NIC.
ARP
ARP Overview
A device uses ARP to determine the
destination MAC address of a local device
when it knows its IPv4 address.
ARP provides two basic functions:
• Resolving IPv4 addresses to MAC
addresses
• Maintaining an ARP table of IPv4 to
MAC address mappings
ARP
ARP Functions
To send a frame, a device will search its ARP table for a destination IPv4 address and a
corresponding MAC address.
• If the packet’s destination IPv4 address is on the same network, the device will search the
ARP table for the destination IPv4 address.
• If the destination IPv4 address is on a different network, the device will search the ARP table
for the IPv4 address of the default gateway.
• If the device locates the IPv4 address, its corresponding MAC address is used as the
destination MAC address in the frame.
• If there is no ARP table entry is found, then the device sends an ARP request.
ARP
Removing Entries from an ARP Table
• Entries in the ARP table are not permanent and are removed when an ARP cache timer expires
after a specified period of time.
• The duration of the ARP cache timer differs depending on the operating system.
• ARP table entries can also be removed manually by the administrator.
ARP
ARP Tables on Networking Devices
• The show ip arp command displays the ARP table on a Cisco router.
• The arp –a command displays the ARP table on a Windows 10 PC.
R1# show ip arp
Protocol Address Age (min) Hardware Addr Type Interface
Internet 192.168.10.1 - a0e0.af0d.e140 ARPA GigabitEthernet0/0/0
C:\Users\PC> arp -a
Interface: 192.168.1.124 --- 0x10
Internet Address Physical Address Type
192.168.1.1 c8-d7-19-cc-a0-86 dynamic
192.168.1.101 08-3e-0c-f5-f7-77 dynamic
ARP
ARP Issues – ARP Broadcasting and ARP Spoofing
• ARP requests are received and processed by every device on the local network.
• Excessive ARP broadcasts can cause some reduction in performance.
• ARP replies can be spoofed by a threat actor to perform an ARP poisoning attack.
• Enterprise level switches include mitigation techniques to protect against ARP attacks.
IPv6 Neighbor Discovery
IPv6 Neighbor Discovery Messages
IPv6 Neighbor Discovery (ND) protocol provides:
• Address resolution
• Router discovery
• Redirection services
• ICMPv6 Neighbor Solicitation (NS) and Neighbor Advertisement (NA) messages are
used for device-to-device messaging such as address resolution.
• ICMTPv6 Router Solicitation (RS) and Router Advertisement (RA) messages are used
for messaging between devices and routers for router discovery.
• ICMPv6 redirect messages are used by routers for better next-hop selection.
IPv6 Neighbor Discovery
IPv6 Neighbor Discovery – Address Resolution
• IPv6 devices use ND to resolve the
MAC address of a known IPv6
address.
• ICMPv6 Neighbor Solicitation
messages are sent using special
Ethernet and IPv6 multicast
addresses.
Configure Initial Router Settings
Basic Router Configuration Steps
• Configure the device name. Router(config)# hostname hostname
• Secure privileged EXEC mode. Router(config)# enable secret password
• Secure user EXEC mode. Router(config)# line console 0
Router(config-line)# password password
• Secure remote Telnet / SSH Router(config-line)# login
access. Router(config)# line vty 0 4
Router(config-line)# password password
• Encrypt all plaintext passwords. Router(config-line)# login
Router(config-line)# transport input {ssh | telnet}
• Provide legal notification and save
the configuration. Router(config)# service password encryption
Router(config)# banner motd # message #
Router(config)# end
Router# copy running-config startup-config
Configure Initial Router Settings
Basic Router Configuration Example
• Commands for basic router R1(config)# hostname R1
R1(config)# enable secret class
configuration on R1.
R1(config)# line console 0
R1(config-line)# password cisco
• Configuration is saved to NVRAM. R1(config-line)# login
R1(config-line)# line vty 0 4
R1(config-line)# password cisco
R1(config-line)# login
R1(config-line)# transport input ssh telnet
R1(config-line)# exit
R1(config)# service password encryption
R1(config)# banner motd #
Enter TEXT message. End with a new line and the #
***********************************************
WARNING: Unauthorized access is prohibited!
**********************************************
R1(config)# exit
R1# copy running-config startup-config
Configure Interfaces
Configure Router Interfaces
Configuring a router interface includes issuing the following commands:
Router(config)# interface type-and-number
Router(config-if)# description description-text
Router(config-if)# ip address ipv4-address subnet-mask
Router(config-if)# ipv6 address ipv6-address/prefix-length
Router(config-if)# no shutdown
• It is a good practice to use the description command to add information
about the network connected to the interface.
• The no shutdown command activates the interface.
Configure Interfaces
Configure Router Interfaces Example
The commands to configure interface G0/0/0 on R1 are shown here:
R1(config)# interface gigabitEthernet 0/0/0
R1(config-if)# description Link to LAN
R1(config-if)# ip address 192.168.10.1 255.255.255.0
R1(config-if)# ipv6 address 2001:db8:acad:10::1/64
R1(config-if)# no shutdown
R1(config-if)# exit
R1(config)#
*Aug 1 01:43:53.435: %LINK-3-UPDOWN: Interface GigabitEthernet0/0/0, changed state to down
*Aug 1 01:43:56.447: %LINK-3-UPDOWN: Interface GigabitEthernet0/0/0, changed state to up
*Aug 1 01:43:57.447: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/0/0,
changed state to up
Configure Interfaces
Configure Router Interfaces Example (Cont.)
The commands to configure interface G0/0/1 on R1 are shown here:
R1(config)# interface gigabitEthernet 0/0/1
R1(config-if)# description Link to R2
R1(config-if)# ip address 209.165.200.225 255.255.255.252
R1(config-if)# ipv6 address 2001:db8:feed:224::1/64
R1(config-if)# no shutdown
R1(config-if)# exit
R1(config)#
*Aug 1 01:46:29.170: %LINK-3-UPDOWN: Interface GigabitEthernet0/0/1, changed state to down
*Aug 1 01:46:32.171: %LINK-3-UPDOWN: Interface GigabitEthernet0/0/1, changed state to up
*Aug 1 01:46:33.171: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/0/1,
changed state to up
Configure Interfaces
Verify Interface Configuration
To verify interface configuration use the show ip interface brief and show
ipv6 interface brief commands shown here:
R1# show ip interface brief
Interface IP-Address OK? Method Status Protocol
GigabitEthernet0/0/0 192.168.10.1 YES manual up up
GigabitEthernet0/0/1 209.165.200.225 YES manual up up
Vlan1 unassigned YES unset administratively down down
R1# show ipv6 interface brief
GigabitEthernet0/0/0 [up/up]
FE80::201:C9FF:FE89:4501
2001:DB8:ACAD:10::1
GigabitEthernet0/0/1 [up/up]
FE80::201:C9FF:FE89:4502
2001:DB8:FEED:224::1
Vlan1 [administratively down/down]
unassigned
R1#
Configure Interfaces
Configure Verification Commands
The table summarizes show commands used to verify interface configuration.
Commands Description
show ip interface brief Displays all interfaces, their IP addresses, and their current
show ipv6 interface brief status.
show ip route Displays the contents of the IP routing tables stored in RAM.
show ipv6 route
show interfaces Displays statistics for all interfaces on the device. Only displays
the IPv4 addressing information.
show ip interfaces Displays the IPv4 statistics for all interfaces on a router.
show ipv6 interfaces Displays the IPv6 statistics for all interfaces on a router.
Configure Interfaces
Configure Verification Commands (Cont.)
View status of all interfaces with the show ip interface brief and show ipv6 interface brief
commands, shown here:
R1# show ip interface brief
Interface IP-Address OK? Method Status Protocol
GigabitEthernet0/0/0 192.168.10.1 YES manual up up
GigabitEthernet0/0/1 209.165.200.225 YES manual up up
Vlan1 unassigned YES unset administratively down down
R1#
R1# show ipv6 interface brief
GigabitEthernet0/0/0 [up/up]
FE80::201:C9FF:FE89:4501
2001:DB8:ACAD:10::1
GigabitEthernet0/0/1 [up/up]
FE80::201:C9FF:FE89:4502
2001:DB8:FEED:224::1
Vlan1 [administratively down/down]
unassigned
R1#
Configure Interfaces
Configure Verification Commands (Cont.)
Display the contents of the IP routing tables with the show ip route and show ipv6 route
commands as shown here:
R1# show ip route
< output omitted>
Gateway of last resort is not set
192.168.10.0/24 is variably subnetted, 2 subnets, 2 masks
C 192.168.10.0/24 is directly connected, GigabitEthernet0/0/0
L 192.168.10.1/32 is directly connected, GigabitEthernet0/0/0
209.165.200.0/24 is variably subnetted, 2 subnets, 2 masks
C 209.165.200.224/30 is directly connected, GigabitEthernet0/0/1
L 209.165.200.225/32 is directly connected, GigabitEthernet0/0/1
R1#
R1# show ipv6 route
<output omitted>
C 2001:DB8:ACAD:10::/64 [0/0]
via GigabitEthernet0/0/0, directly connected
L 2001:DB8:ACAD:10::1/128 [0/0]
via GigabitEthernet0/0/0, receive
C 2001:DB8:FEED:224::/64 [0/0]
via GigabitEthernet0/0/1, directly connected
L 2001:DB8:FEED:224::1/128 [0/0]
via GigabitEthernet0/0/1, receive
L FF00::/8 [0/0]
via Null0, receive
R1#
Configure Interfaces
Configure Verification Commands (Cont.)
R1# show interfaces gig0/0/0
Display statistics for all GigabitEthernet0/0/0 is up, line protocol is up
interfaces with the show Hardware is ISR4321-2x1GE, address is a0e0.af0d.e140 (bia a0e0.af0d.e140)
Description: Link to LAN
interfaces command, as Internet address is 192.168.10.1/24
MTU 1500 bytes, BW 100000 Kbit/sec, DLY 100 usec,
shown here: reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive not supported
Full Duplex, 100Mbps, link type is auto, media type is RJ45
output flow-control is off, input flow-control is off
ARP type: ARPA, ARP Timeout 04:00:00
Last input 00:00:01, output 00:00:35, output hang never
Last clearing of "show interface" counters never
Input queue: 0/375/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
Output queue: 0/40 (size/max)
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 0 bits/sec, 0 packets/sec
1180 packets input, 109486 bytes, 0 no buffer
Received 84 broadcasts (0 IP multicasts)
0 runts, 0 giants, 0 throttles
<output omitted>
R1#
Configure Interfaces
Configure Verification Commands (Cont.)
R1# show ip interface g0/0/0
Display IPv4 statistics for GigabitEthernet0/0/0 is up, line protocol is up
router interfaces with the Internet address is 192.168.10.1/24
Broadcast address is 255.255.255.255
show ip interface command, Address determined by setup command
as shown here: MTU is 1500 bytes
Helper address is not set
Directed broadcast forwarding is disabled
Outgoing Common access list is not set
Outgoing access list is not set
Inbound Common access list is not set
Inbound access list is not set
Proxy ARP is enabled
Local Proxy ARP is disabled
Security level is default
Split horizon is enabled
ICMP redirects are always sent
ICMP unreachables are always sent
ICMP mask replies are never sent
IP fast switching is enabled
IP Flow switching is disabled
<output omitted>
R1#
Configure Interfaces
Configure Verification Commands (Cont.)
R1# show ipv6 interface g0/0/0
Display IPv6 statistics for GigabitEthernet0/0/0 is up, line protocol is up
router interfaces with the IPv6 is enabled, link-local address is
FE80::868A:8DFF:FE44:49B0
show ipv6 interface No Virtual link-local address(es):
command shown here: Description: Link to LAN
Global unicast address(es):
2001:DB8:ACAD:10::1, subnet is 2001:DB8:ACAD:10::/64
Joined group address(es):
FF02::1
FF02::1:FF00:1
FF02::1:FF44:49B0
MTU is 1500 bytes
ICMP error messages limited to one every 100 milliseconds
ICMP redirects are enabled
ICMP unreachables are sent
ND DAD is enabled, number of DAD attempts: 1
ND reachable time is 30000 milliseconds (using 30000)
ND NS retransmit interval is 1000 milliseconds
R1#
Configure the Default Gateway
Default Gateway on a Host
• The default gateway is used when a
host sends a packet to a device on
another network.
• The default gateway address is
generally the router interface
address attached to the local
network of the host.
• To reach PC3, PC1 addresses a
packet with the IPv4 address of
PC3, but forwards the packet to its
default gateway, the G0/0/0
interface of R1.
Note: The IP address of the host and the router
interface must be in the same network.
Configure the Default Gateway
Default Gateway on a Switch
• A switch must have a default
gateway address configured
to remotely manage the
switch from another
network.
• To configure an IPv4 default
gateway on a switch, use the
ip default-gateway ip-
address global configuration
command.
