Follow the packet.
Understand the network.

IPv4 addressing: finding the network and the interface

Why does an IP address need more than a unique number? Routers must forward packets across many networks. IPv4 gives addresses a hierarchy: leading bits identify a network prefix; remaining bits identify a point of connection within it. This chapter explains CIDR blocks, subnet division, and how a host learns its address.

An IP address belongs to an interface

An IPv4 address is a 32-bit network-layer address assigned to an interface, where a host or router connects to a network. Calling it “the computer’s address” is shorthand: a router with three network connections normally has three IP addresses. If a laptop moves from campus to home, its network connection changes and it may receive a different address.

Think of a postal address as identifying a delivery point, not the person who owns the house. A person can move and the delivery address changes; one building can also contain many delivery points. Similarly, an IP address locates a network interface in its current network context. The address must be unique within the relevant Internet addressing scope, and the shared format lets routers interpret it consistently.

Forouzan §7.4.1, p. 211; Slide deck 8, slides 2–3; Kurose and Ross §4.3, pp. 334–335.

Three ways to write the same 32 bits

IPv4 has 2³² possible patterns. The value is always 32 bits; notation changes only how it is displayed.

• Binary: all 32 bits are shown, such as 11000000 10101000 00000001 00001010.
• Dotted decimal: divide the bits into four 8-bit octets, convert each octet to decimal, and put dots between them. The example becomes 192.168.1.10. Each octet ranges from 0 through 255.
• Hexadecimal: write each group of four bits as one hex digit. The same value is C0A8010A. Hex is compact and convenient in programming; dotted decimal is easier to scan in network configuration.

For quick conversion, remember octet bit weights 128, 64, 32, 16, 8, 4, 2, 1. Thus 11000000 is 128 + 64 = 192. Each decimal octet must be between 0 and 255.

Worked conversion. 14.24.74.0 in binary is 00001110 00011000 01001010 00000000, one 32-bit value rather than four separate addresses.

Forouzan §7.4.1, pp. 211–212; Slide deck 8, slides 3–4.

The prefix and suffix create hierarchy

Suppose a postal address names a country, city, street, then a house. A delivery system can first move mail toward the right city and only later distinguish a street and house. IP addressing uses a related idea. The prefix is the leading network portion. The suffix is the remaining portion used within that network to distinguish addresses. The exact boundary is a design choice and is written explicitly in modern CIDR notation.

A longer prefix leaves fewer suffix bits and a smaller block; a shorter prefix leaves more suffix bits and a larger block. The number of patterns is 2^(32 − n), where n is the prefix length, though not every pattern is necessarily an ordinary host address.

Trap: “Network part” and “host part” are useful teaching labels, but suffix bits identify an address within the block; they do not always correspond to a physical computer. Routers have interface addresses, and special addresses in a conventional subnet are not ordinary host assignments.

Forouzan §7.4.1, pp. 212–214; Slide deck 8, slides 5–6; Kurose and Ross §4.3, pp. 337–338.

Classful addressing: the historical fixed boundaries

Early IPv4 addressing inferred the prefix length from the first bits. This was called classful addressing. Classes A, B, and C provided fixed prefix lengths of 8, 16, and 24 bits. Class D was reserved for multicast, and Class E was reserved. The table gives the bit-pattern counts taught by the lecture and the familiar leading-octet ranges.

The class marker uses some prefix bits: for Class B, initial 10 leaves 14 network-ID bits in its 16-bit prefix. The slide’s 2^14 is theoretical, not a guarantee every pattern could be assigned.

Keep three counts separate. The lecture’s 2^7, 2^14, and 2^21 are possible network identifiers after class marker bits; 2^24 counts patterns in one Class A /8. Usable hosts are fewer under conventional subnet rules, and historical assignments may exclude special ranges or identifiers. Do not mistake theoretical counts for actual allocations. Classful sizing became wasteful: a network needing thousands of addresses faced a /24 too small or a /16 too large. CIDR replaced this rigid fit.

Forouzan §7.4.1, pp. 212–213; Slide deck 8, slides 7–10; Kurose and Ross §4.3, p. 338.

CIDR and masks: state the boundary directly

CIDR (Classless Interdomain Routing, pronounced “cider”) writes an address with a slash prefix, as in 192.168.1.10/24. The slash number says exactly how many leading bits belong to the prefix. CIDR blocks must contain a power-of-two number of addresses. For prefix /n, the suffix has 32 − n bits, so the block has 2^(32 − n) address patterns.

A subnet mask is the same boundary written as 32 bits: prefix bits are all 1 and suffix bits are all 0. For /24, the mask is 11111111.11111111.11111111.00000000, or 255.255.255.0. For /26, it is 11111111.11111111.11111111.11000000, or 255.255.255.192 because 128 + 64 = 192 in the last octet.

Mask conversion, step by step. Convert /20 to dotted decimal. Fill the first 20 bits with 1s: two complete octets give 255.255; the next four bits are 1 and the next four are 0, so that octet is 11110000 = 240; the last octet is all zero. Thus the mask is 255.255.240.0. Reverse the check: 8 + 8 + 4 = 20 one-bits.

Prefix length n → mask with n leading 1s → block size N = 2³²⁻ⁿ. Conversely, a block with N addresses has prefix length n = 32 − log₂N.

Trap: The slash number counts bits, not octets and not the number of hosts. A /26 has 26 prefix bits and 6 suffix bits, so it contains 64 address patterns.

Forouzan §7.4.1, pp. 213–215; Slide deck 8, slides 11–13; Kurose and Ross §4.3, pp. 337–339.

Block addresses, usable hosts, and bitwise boundaries

In the standard subnet calculation, the first address in a block is the network address: set every suffix bit to zero. The last address is the directed broadcast address: set every suffix bit to one. Every address pattern between them is conventionally available for host or router interfaces. For common IPv4 subnets with at least two suffix bits, the familiar usable count is block size − 2. This is the distinction between total addresses and ordinary usable interface addresses.

Two edge cases need care. A /31 contains two addresses and is commonly used on point-to-point links, where both can be used as interface endpoints under the special /31 convention; do not blindly subtract two there. A /32 contains one address and identifies a single address/route, not a conventional multi-host subnet. Follow the convention stated in a problem if it specifies one; otherwise state the conventional rule and its /31 exception.

Worked /26 range. Find the block containing 192.168.1.77/26. A /26 has six suffix bits and 2^6 = 64 addresses. The mask is 255.255.255.192. AND the address and mask: in the last octet, 77 is 01001101 and 192 is 11000000; the result is 01000000 = 64. Therefore the network address is 192.168.1.64. Set the six suffix bits to 1: last octet 01111111 = 127, so broadcast is 192.168.1.127. The block is .64–.127 inclusive (64 total); conventional usable range is 192.168.1.65–192.168.1.126 (62 interfaces).

Distinguish this subnet-directed broadcast from the limited broadcast address 255.255.255.255. A directed broadcast has the subnet prefix plus all-one host bits—for example, 192.168.1.127 is the directed broadcast for 192.168.1.64/26. It targets hosts on that subnet, and routers may forward it subject to policy. The limited broadcast reaches the local link/subnet only and is not forwarded by routers; a newly connected DHCP client uses it before it knows its subnet.

The bitwise operations provide a general method that works even when a prefix boundary cuts through an octet. For any address in the block, network = address AND mask. The broadcast is address OR (NOT mask). Here, NOT the /26 mask leaves six 1s at the right; OR replaces the suffix with 1s. To find the total count, either compute 2^(32−n) or invert the mask and add 1.

Worked /20 range. Find the block containing 18.14.27.9/20. The /20 mask is 255.255.240.0, leaving 12 suffix bits and 2^12 = 4096 addresses. The third octet is grouped in increments of 16 because the mask’s third octet is 240. The value 27 lies in the 16–31 block. AND gives network 18.14.16.0; set the last 12 bits to one to get broadcast 18.14.31.255. Total count is 4096 and conventional usable count is 4094, with usable range 18.14.16.1–18.14.31.254.

Forouzan §7.4.1, pp. 214–216; Slide deck 8, slides 12–15; Kurose and Ross §4.3, pp. 338–339.

Subnetting: give each island a correctly sized block

Subnetting divides an allocated address range into smaller ranges, one per subnetwork. The reliable procedure is: (1) sort requirements from largest to smallest; (2) round each requested number of addresses up to the next power of two; (3) convert that block size to a prefix; (4) place each block at a correctly aligned boundary without overlap; and (5) account for the unused remainder. Allocate largest first because small blocks can fit into the leftover gaps, while placing a large block after several small ones can fragment the space.

Professor’s VLSM allocation. Divide 14.24.74.0/24 for needs of 120, 60, and 10 addresses. The parent /24 has 256 patterns. Start with 120: round up to 128 = 2⁷, giving /25 because 32 − 7 = 25. Allocate 14.24.74.0–14.24.74.127 (/25). Next, 60 rounds up to 64 = 2⁶, hence /26. The next aligned 64-address boundary is .128, so allocate 14.24.74.128–14.24.74.191. Finally, 10 rounds up to 16 = 2⁴, hence /28; the next aligned boundary is .192, giving 14.24.74.192–14.24.74.207. Sum: 128 + 64 + 16 = 208 allocated address patterns. The remaining reserve is 14.24.74.208–14.24.74.255, 48 patterns. Under conventional network/broadcast reservations, those three subnets provide 126, 62, and 14 interface addresses respectively; this comfortably meets the requested 120, 60, and 10.

Slide deck 8, slides 16–19; Forouzan §7.4.1, pp. 216–217.

Alignment and aggregation: matching prefixes matters

A block of N addresses must start at a numeric address divisible by N. A /22 has 2^(32−22) = 1024 addresses. The lecture’s 18.14.12.0/22 satisfies alignment: its integer value is 302,910,464, or 295,811×1024. Its range is 18.14.12.0–18.14.15.255. In the third octet, /22 blocks advance by 4, and 12 is aligned.

Address aggregation combines adjacent blocks under a shorter common prefix, letting a router advertise one summary instead of many individual routes. For example, four contiguous /24 blocks 192.0.2.0/24 through 192.0.5.0/24 cannot be summarized as one /22: they are not a four-block aligned group. Two adjacent blocks 192.0.2.0/24 and 192.0.3.0/24 do combine cleanly into 192.0.2.0/23, because the pair is contiguous and the first block is aligned to 512 addresses. The /23 covers exactly those two /24s.

For an aggregation to be exact, the component blocks must be contiguous, equal-sized sibling ranges, and begin on the larger block’s boundary. Two adjacent /24 blocks starting at 192.0.2.0 and 192.0.3.0 satisfy the /23 boundary; 192.0.3.0/24 plus 192.0.4.0/24 does not, because the first is not aligned to a /23 boundary. A summary that includes addresses outside the intended set may be a broader route in some routing designs, but it is not an exact aggregation of just those component blocks. CIDR allocation is valuable partly because well-aligned related allocations can be summarized in routing tables.

Alignment trap: “There are enough free addresses after this point” is not sufficient. The starting address must be divisible by the block size. For /26 blocks, last-octet boundaries are 0, 64, 128, and 192. Starting a 64-address block at .96 would overlap boundaries and cannot describe a single /26.

Slide deck 8, slides 15–20; Forouzan §7.4.1, pp. 216–218; Kurose and Ross §4.3, pp. 339–340.

Find subnets as islands of connected interfaces

A subnet is not necessarily “one building” or “one router.” Kurose and Ross give a practical diagram method: detach every host and router interface from its device, leaving each network segment as an island with interfaces at its endpoints. Each island is a subnet. An Ethernet LAN connecting several host interfaces and one router interface is one subnet. A point-to-point router link is also a subnet, even though it has no group of end hosts. A router connecting three LANs has interfaces in three different subnets, plus more subnet interfaces if it has point-to-point links.

Every interface in an island must share its subnet prefix. For example, 223.1.1.1, 223.1.1.2, and router interface 223.1.1.4 can belong to 223.1.1.0/24; the router’s interface on 223.1.2.0/24 belongs to another island.

Kurose and Ross §4.3, pp. 334–337; Slide deck 8, slides 5 and 20.

DHCP: how a new host gets an address (DORA)

A newly connected host may not know its own address, the subnet mask, the default gateway, or the local DNS server. The Dynamic Host Configuration Protocol (DHCP) lets it request this configuration from a server. A server can assign a stable address to a host or lease a temporary one for a limited time. A DHCP relay agent, often a router, can pass requests to a server on another subnet.

Remember the four-message sequence with DORA: Discover, Offer, Request, Acknowledge. At the start, the client does not know the DHCP server address, so it uses source IP 0.0.0.0 and broadcast destination 255.255.255.255. DHCP uses UDP ports 68 (client) and 67 (server) in the described exchange.

1. Discover: the client broadcasts “is there a DHCP server?” It has no configured address yet.
2. Offer: one or more servers reply with an offered address plus configuration and a lease duration. The offer is broadcast so the unconfigured client can receive it.
3. Request: the client broadcasts its choice, naming the requested address and selected server. Broadcasting also informs other offering servers that their offers were not selected.
4. Acknowledge: the selected server confirms the lease and configuration. The client can then configure its interface.

Sequence trap: The first packet cannot be a normal unicast request to the server because the client does not yet know where the server is. Keep Discover and Request distinct: Discover locates possible servers; Request tells the servers which offer the client selected.

Mobility limitation (Slide 11 overview): when a node joins a new subnet, DHCP normally gives it a new IP address. An ongoing TCP connection to a remote application may then be disrupted because its endpoint address has changed. Mobile IP is intended to let a moving node retain one permanent address across subnet changes. This is only the lecture’s overview; detailed Mobile IP mechanisms in Forouzan §7.4.5 are outside this chapter.

Kurose and Ross §4.3, pp. 341–344; Slide deck 8 references Kurose §4.3.

Exam method: write the boundary before the answer

For address problems, write the prefix and mask, count suffix bits, calculate block size, and find the aligned network address. Verify the endpoints; distinguish total patterns from usable interfaces. For subnetting, allocate largest-first, show each size, prefix, and range, then account for reserve. Check contiguity and alignment for aggregation. For topology, count network islands; for DHCP, write DORA.

Common mistakes: applying class boundaries to CIDR, rounding subnet needs down, accepting an unaligned start, forgetting reserve, and assigning one address to a router.

Forouzan §7.4.1; Slide deck 8; Kurose and Ross §4.3.

Quick checks

Connecting devices, MAC addresses, and ARP

Why do a LAN and an internetwork need different kinds of connecting devices? A bit signal must first travel across a medium, a local frame must reach the right interface, and a packet may need to cross several networks. A tap, repeater or hub, link-layer switch, and router help at different layers. This section follows a message through those layers and shows how switches learn where interfaces are and how ARP finds a next-hop MAC address.

1. Connecting devices act at different layers

A connecting device joins hosts into a network or joins networks into an internetwork. Its layer tells us what information it can use: signals and bits, frames and MAC addresses, or IP packets and routes between networks.

Think of a repeater as a person who hears a weak message and repeats it clearly to extend how far the signal can travel. A hub is that helper connected to several rooms: the message is repeated into every other room. The hub does not understand the addressee. A switch is like a building’s mailroom with a directory of room numbers. A router is more like a post office that reads the destination area and sends the parcel toward another town.

A tap splices into a cable or contacts its metallic core; it is a physical-medium connection, not a frame-processing device. A repeater addresses attenuation and corruption by regenerating and retiming the bit pattern before it becomes unreadable. It does not merely increase signal amplitude, which would also amplify noise; it reconstructs and emits a refreshed bit pattern.

A hub is a multiport repeater commonly associated with star wiring. It repeats a signal through all ports except the one it arrived on. Every attached station sees the frame; the destination accepts it and the others discard it. The hub does not know which station is intended, and hubs and repeaters have no MAC address for filtering.

A link-layer switch also regenerates the signal, but reads source and destination MAC fields. It leaves those addresses unchanged within the LAN. Its MAC switching table maps an address to the port where it was observed. A router adds the network-layer decision: each interface has link-layer and network-layer addresses, and forwarding to the next link requires a new frame.

Forouzan, Data Communication and Networking, §§6.1, 6.1.1–6.1.3; Slide deck 10, “Connecting Devices.”

2. Switch learning: source to learn, destination to forward

Remember this division of work: the source MAC address teaches the switch where the sender is; the destination MAC address is looked up to decide where to forward. A switch does not learn the destination address from the frame as a destination. It learns from the source. It can update an existing source entry if that MAC now arrives on a different port.

If the destination is known on another port, the switch sends the frame only there. If it is known on the arrival port, the switch filters it instead of sending it back. If unknown, it floods all ports except the arrival port. Broadcast frames also go to other ports in the same LAN/VLAN.

This behavior is the basis of a transparent switch: end stations need no reconfiguration when it is inserted or removed. The system must forward correctly, learn the forwarding table from frame movement, and prevent loops. If a station moves and sends from another port, the switch can update its source-MAC entry. A quiet station that has never transmitted may have no entry yet.

Redundant switch links improve resilience, but a physical loop can make flooded frames circulate and multiply. MAC learning alone does not make a loop safe. A spanning tree logically disables selected paths so the active topology has no loop and only one path through the tree. If a path fails, the process can re-form the usable topology.

Collision and broadcast domains are related but different. A hub repeats signals across its ports, so attached devices share the medium and, in classic half-duplex Ethernet, one collision domain. A switch usually gives each port its own link and collision domain; on modern full-duplex switched Ethernet, the link has no Ethernet collisions. This qualification matters: a switch connected to a hub shares that hub segment’s collision domain on that port. A switch does not, by itself, stop Layer 2 broadcasts: a broadcast is flooded within its LAN or VLAN. A router normally does not forward that link-layer broadcast onto another network, so a router interface marks a broadcast-domain boundary. VLAN configuration can create separate broadcast domains on switching equipment; “one switch equals one broadcast domain” is therefore too broad.

Common trap: say “unknown destination floods,” but do not say “the switch learns the destination port from that destination field.” The switch learns the source-to-arrival-port mapping. Also distinguish flooding a frame within the local LAN/VLAN from a router forwarding an IP packet to another network.

Forouzan, §6.1.2, “Link-Layer Switches,” “Transparent Switches,” and “Loop Problem”; Slide deck 10, “Link-layer Switches” and “Transparent Link-layer Switches.”

3. MAC addresses: local delivery labels

A link-layer address, Layer 2 address, LAN address, physical address, or MAC address names a network interface on a link. For common Ethernet and Wi-Fi LANs, it is 48 bits (six bytes), usually written as six pairs of hexadecimal digits, such as 02:34:45:11:92:F1. A frame has a destination MAC and a source MAC. Ethernet’s all-ones broadcast destination is FF:FF:FF:FF:FF:FF.

There are unicast, broadcast, and multicast destination types. Unicast is one-to-one; broadcast is one-to-all interfaces on the link; multicast is one-to-a-selected group. In a standard MAC address, the least significant bit of the first octet is the I/G (individual/group) bit: 0 marks an individual address and 1 a group address. Thus A2 has I/G=0, while A3 has I/G=1. The lecture slide labels A3:34:45:11:92:F1 unicast, but that is an error: A3 is a group address. A unicast example is A2:34:45:11:92:F1. The all-ones broadcast is also a group destination.

An IP address is like a postal address: its network prefix gives location and its host portion identifies a destination in that location. When a device moves to another network, its IP configuration may change. A MAC address is more like an Aadhaar or PAN number in the lecture analogy: it is a flat identifier associated with an interface rather than a hierarchical location. The analogy helps separate “who/which interface” from “where”; it is not a claim that a MAC address is a personal identity.

In the simplified model used for learning, assume an adapter keeps a fixed MAC address while IP addressing changes with network attachment. Real systems can use locally administered addresses, privacy randomization, or software overrides, and replacing a network adapter can also change its MAC address. The fixed-MAC assumption is a useful classroom simplification, not a guarantee that an observed address can never change. Keeping IP and MAC addressing separate also means a change in the network-layer protocol does not require rebuilding every network adapter’s hardware address.

Why have both? Network-layer IP addresses identify packet endpoints and support routing across networks. Link-layer addresses deliver a frame over one local link. A packet’s source and destination IP addresses generally remain the same across its route; each new link gets a new frame with the local sender and next-hop MAC addresses. Thus the MAC pair can change at every routed hop, while the IP pair is carried end-to-end (ignoring special functions such as address translation, which are outside this model).

Forouzan, §3.4, “Link-Layer Addressing”; Slide deck 9, “Link Layer Addressing” and “IP Addresses Vs. MAC Addresses.”

4. ARP: resolve a next hop on the local subnet

ARP, the Address Resolution Protocol, maps a known IPv4 address to a link-layer address on the same subnet (local LAN). It does not route between networks. A host first decides whether the destination IP is local. If remote, it needs the MAC of its next hop, normally the local router interface; the IP destination remains the remote host.

If A lacks B’s IP-to-MAC entry on the same subnet, A broadcasts an ARP request on the local link. It carries A’s hardware/MAC and protocol/IP addresses and B’s protocol/IP address; the target hardware address is unknown. On Ethernet the destination is FF:FF:FF:FF:FF:FF. B recognizes its IP and usually replies by unicast with its IP-to-MAC mapping. A caches the answer; B may learn A’s mapping from the request. A switch may learn A’s source MAC-to-port from the Ethernet frame carrying the request.

ARP cache entries reduce repeated requests and expire; the lecture gives about 20 minutes as an example. An entry might be 192.0.2.20 → 02:34:45:11:92:F1. The hardware address is the link-layer MAC; the protocol address is IPv4. ARP fields specify hardware/protocol types and lengths, operation (request or reply), and sender/target addresses.

Common trap: for remote B, A does not ARP for B’s far-away MAC. A ARPs for its local gateway’s MAC, sends the IP packet addressed to B inside that frame, and lets the router continue delivery.

Forouzan, §§3.4 and 7.4.2; Slide deck 9, “Address Resolution Protocol” and “ARP Table.”

5. Quick checks

Network layer: moving packets across networks

The network layer gives transport protocols a way to send a packet from one host to another even when many routers and different link technologies lie between them. It has two related jobs: choose paths across the network, and move each arriving packet to the correct outgoing link. The first is a network-wide decision; the second happens locally at every router.

Two jobs: routing and forwarding

Imagine sending a registered letter. Routing is the planning that selects a sequence of towns and post offices. Forwarding is the local clerk reading the destination and placing this particular letter in the outgoing sack for the next stop. The analogy separates two jobs, but packet forwarding uses header fields and a table rather than a postal worker remembering a route.

Forwarding is the per-router data-plane action that maps an arriving datagram to an output interface. A router consults its forwarding table for each packet. Routing is the control-plane process that determines paths through multiple routers and supplies the local forwarding information. The forwarding table is the interface between these jobs: control logic computes or installs entries; the data plane applies them quickly.

In traditional per-router control, each router runs routing logic, exchanges routing information with other routers, and calculates its own forwarding table. With software-defined networking (SDN), forwarding remains in the routers, while a logically centralized controller computes and distributes rules. “Logically centralized” describes one coordinated network-wide view; the controller can be physically distributed for reliability. This distinction does not change the basic packet-forwarding task at an individual router.

Kurose and Ross §4.1; Lecture 11, Network Layer: Data Plane; Lecture 12, Control Plane.

What service does IP promise?

The Internet Protocol offers a best-effort datagram service. “Best effort” means IP tries to deliver a packet, but does not promise delivery, a maximum delay, in-order arrival, bandwidth, or protection against duplicate delivery. A packet can be lost, delayed, corrupted, or arrive out of order. IP is connectionless: routers treat each datagram independently rather than establishing a network-layer connection with reserved state before sending.

A network service model could, in principle, promise guaranteed delivery, delivery within a delay bound, in-order delivery, a minimum bandwidth, or security such as encryption. These possibilities describe what the network layer might offer to transport; they are not all promises made by IP. The Internet’s basic IP service is best effort: it provides none of those guarantees. Applications that need reliability commonly rely on a higher layer, such as TCP; real-time applications may prefer to tolerate some loss rather than wait for retransmission. A common exam trap is to say “IP guarantees delivery because it routes packets.” Path selection and reliable delivery are different problems.

Kurose and Ross §4.1; Forouzan §7.4 (IPv4 service and datagram approach).

IPv4 datagram header: fields that guide delivery

An IPv4 datagram has a header followed by payload. The header is at least 20 bytes; the IHL field expresses its length in 4-byte words. Thus IHL = 5 means 20 bytes, not 5 bytes. The total-length field counts the complete datagram, header plus payload. A router reads fields such as the destination address to make its forwarding decision, while other fields support delivery, lifetime limits, and fragmentation.

Keep the three “where does it go?” layers distinct: the IP protocol field identifies which next protocol gets the payload at the destination (often a transport protocol); a TCP/UDP port identifies an application endpoint; and an IP destination address guides network-layer delivery. The IPv4 header also includes fields such as version and service/traffic markings, but the table above emphasizes the fields needed for this lesson’s calculations.

Forouzan §7.4, “Datagram Format” (field descriptions); Lecture 11, IPv4 Datagram Format.

Header numbers you should know

Read the IPv4 header as a labeled form on a parcel. Version: 4 bits (value 4 for IPv4); IHL: 4 bits; service/DS field: 8 bits (traffic treatment, including congestion notification); total length: 16 bits; identification: 16 bits; flags: 3 bits; fragment offset: 13 bits; TTL: 8 bits; protocol: 8 bits; header checksum: 16 bits; source and destination: 32 bits each. Options and padding can extend the header, but the syllabus excludes the detailed options section.

IHL ranges from 5 to 15, meaning 20–60 bytes. The total-length field allows at most 65,535 bytes including the header. Payload length = total length − 4×IHL. The flags are a reserved bit, DF (Don’t Fragment) and MF (More Fragments). If DF=1 and a datagram exceeds the outgoing MTU, the router cannot fragment it and must discard it. MF=0 can indicate a final fragment or an unfragmented packet; use the offset as well.

Header checksum: add, wrap, invert

The IPv4 checksum checks only the header. Split its bytes into 16-bit words, temporarily set the checksum word to zero, add all words using one’s-complement addition (wrap any carry back into the low 16 bits), and invert all 16 bits. A receiver adds the header including the checksum: a valid result is all ones, FFFF in hexadecimal. This detects many errors; it does not correct them or guarantee reliable delivery.

Forouzan §7.4, datagram format, checksum and fragmentation (including Examples 7.15–7.16); slide deck 11, IPv4 Datagram Format. The checksum header values above are an original exercise.

Worked fragmentation: 4000-byte datagram over MTU 1500

Problem. A 4000-byte IPv4 datagram, including its 20-byte header, must cross a link with MTU 1500 bytes. Find the fragments and their offsets. Assume no options and that the router fragments it.

1. Each fragment’s total length must be at most 1500. Subtract its 20-byte header: at most 1480 bytes of payload fit.
2. The payload of every non-final fragment must be a multiple of 8 bytes because offsets are counted in 8-byte units. 1480 is already divisible by 8 (185 × 8), so use 1480 payload bytes for each full fragment.
3. The original payload is 4000 − 20 = 3980 bytes. Split it as 1480 + 1480 + 1020. The last piece may be non-multiple-of-8 because no later offset needs to point past it.
4. Fragment offsets are payload start positions divided by 8: 0/8 = 0; 1480/8 = 185; 2960/8 = 370. Total lengths add each fragment’s own 20-byte header.

Check: payload total = 1480 + 1480 + 1020 = 3980; fragment total lengths = 1500 + 1500 + 1040 = 4040 because each fragment carries its own 20-byte header.

The destination groups fragments by source address, destination address, protocol, and identification; it uses offsets and MF to place the pieces and detect the final fragment. Reassembly happens at the destination host, not at every intermediate router. If a piece is missing, the original datagram cannot be fully reassembled for the transport layer. Do not add the fragment headers to the original payload calculation: headers are overhead introduced per fragment.

Forouzan §7.4, fragmentation and offset fields; Lecture 11, IPv4 Datagram Fragmentation.

Longest-prefix match: choose the most specific route

A forwarding table can summarize many destinations with CIDR prefixes. A router compares the destination address with the table entries that match, then chooses the matching prefix with the greatest number of leading bits: longest-prefix matching. The longest entry is the most specific. If no other entry matches, a default route (often written 0.0.0.0/0) can provide a next hop.

Use this small table. The ranges are chosen so the matches can be checked by prefix:

• Destination 10.1.2.77 matches /8, /16, and /24. Choose C, because /24 is longest.
• Destination 10.1.9.4 matches /8 and /16, but not /24. Choose B.
• Destination 10.8.3.5 matches /8 only. Choose A.
• Destination 192.168.5.9 falls inside 192.168.4.0/22 (the /22 range spans 192.168.4.0 through 192.168.7.255), so choose D.
• Destination 172.16.1.2 matches none of the listed specific prefixes. Choose the default next hop E.

Aggregation makes this manageable: an upstream router may store one organization prefix rather than a separate entry for every host. Inside the organization, more-specific prefixes can direct traffic to individual subnets. Longest-prefix match lets these broad and narrow routes coexist. Do not select the first matching row; select the matching prefix with the most bits.

Hierarchical aggregation through Fig. 7.36. Forouzan’s regional ISP example starts with 120.14.64.0/18, a block of 16,384 addresses. It divides that block into four /20 subblocks, each containing 4096 addresses. One local ISP receives 120.14.64.0/20; the regional ISP can send that entire range toward this local ISP using one entry. The local ISP divides its /20 again: for example, its first /23 is 120.14.64.0/23, and that block can be split into /30 groups of four addresses for households. The outside Internet needs only the regional /18 route to reach the whole region; the regional ISP uses /20 entries to select a local ISP; the local ISP uses more-specific entries for its customers. This is the hierarchy: broad prefixes upstream, progressively narrower prefixes closer to the destination. A /18 contains 2^(32−18) = 16,384 addresses; a /20 contains 4096; a /23 contains 512; a /30 contains 4. The key idea is aggregation and more-specific internal forwarding, not a requirement that every router store every household route.

Forouzan §7.4.6, “Address Aggregation” and “Hierarchical Routing,” Example 7.22 and Fig. 7.36; Kurose and Ross §4.3.2; Lecture 11, Address/Route Aggregation and Longest Prefix Matching.

NAT: several private hosts share one public IPv4 address

Network address translation (NAT) lets a local network use private IPv4 addresses internally while its gateway uses a public address on the Internet-facing interface. The gateway changes the outgoing packet’s source address and often its source transport port, recording a mapping. When a reply arrives, it looks up the destination public-address/port pair and restores the private destination address and port. Port multiplexing allows many simultaneous conversations to share one public IPv4 address, provided the mappings remain distinct.

Private IPv4 blocks commonly used inside networks are 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. These are not globally routed as public destinations. A private address can be reused in separate networks; the public address is what remote Internet hosts see. NAT does not create additional globally unique addresses, and it is not the same thing as routing: it rewrites selected header values and keeps translation state.

Worked mapping. Host 192.168.1.10 opens TCP connection from source port 51514 to web server 128.119.40.86:443. The NAT’s public address is 24.34.112.235; it assigns external port 40001. A second host 192.168.1.11 uses source port 51514 to the same server, and receives external port 40002.

On the way out, the first packet’s source changes from 192.168.1.10:51514 to 24.34.112.235:40001. A reply addressed to 24.34.112.235:40001 matches the first row, so the NAT changes the destination back to 192.168.1.10:51514. The second connection returns via port 40002 to the other host. The translation table is what makes the reply unambiguous. A common trap is to say that an incoming packet can be delivered to a private host by looking only at the public IP address: when several hosts share it, the transport port and mapping matter.

Kurose and Ross §4.3.3 (NAT); Lecture 11, Network Address Translation.

IPv6 and the transition from IPv4

IPv6 expands addresses from 32 to 128 bits and uses a streamlined, fixed 40-byte base header. The base header has no header checksum. Its hop limit serves the same purpose as IPv4 TTL; next header identifies what follows, much like IPv4 protocol. IPv6 also has traffic-class and flow-label fields. A key fragmentation difference: IPv6 routers do not fragment a packet in transit; a too-large packet prompts a “packet too big” message so the sender can adjust. IPv4 fragmentation instead uses identification, flags, and offset fields as described above.

IPv4-to-IPv6 transition is gradual because not every deployed system can interpret IPv6. Dual stack means a host or router supports both protocol versions and can use the appropriate one. Tunneling carries an IPv6 datagram as payload inside an IPv4 datagram across an IPv4-only region; the outer IPv4 Protocol value is 41 to indicate IPv6. At the far tunnel endpoint, the IPv4 wrapper is removed and the IPv6 packet continues. Header translation converts between IPv6 and IPv4 header formats when one side cannot understand the other version; translation has to account for differences in fields and capabilities, not merely swap address widths.

Kurose and Ross §4.3.4 (IPv6); Forouzan §7.6, “Transition from IPv4 to IPv6” (dual stack, tunneling, header translation); Lecture 11, IPv6 Datagram Format and Transitioning from IPv4 to IPv6.

Quick recall

Recall checks review Kurose and Ross §§4.1, 4.3; Forouzan §§7.4 and 7.6; Lecture 11.

Routing algorithms: choosing paths through the network

A router forwards one packet using local information; a routing algorithm helps determine which local choices will carry packets toward their destinations across the network. This chapter turns “find a good route” into a graph problem, then studies two ways to solve it: link-state (LS), which gathers a network-wide view, and distance-vector (DV), which learns through neighbors.

Control plane and network graph

The data plane applies a router’s forwarding entries to arriving packets. The control plane supplies the network-wide logic: it determines how packets should travel across routers and can configure network components. A destination-based forwarding table maps destination prefixes to next hops. In SDN, a logically centralized controller computes or manages forwarding rules and installs them through a control agent; in traditional per-router control, routers run routing logic and exchange information with one another. In both cases, packets still need local forwarding at each router.

Represent a network as a graph G = (V, E): vertices V are routers, and edges E are links between neighboring routers. Give each edge a cost c(u,v). Cost can model a configured administrative preference, distance, monetary expense, capacity, or some other metric. A nonexistent link can be treated as cost ∞. The cost of a path is the sum of its link costs; a least-cost route minimizes that sum. Cost is not necessarily physical distance or milliseconds, and the “best” path depends on the metric chosen by the network.

Routing algorithms can be classified along several independent axes. Centralized (often LS) algorithms use a complete topology-and-cost view at the node running the calculation. Decentralized (often DV) algorithms learn from directly connected neighbors. Static routes change slowly, often after a human changes configuration; dynamic algorithms react to topology or metric changes. A dynamic algorithm can adapt quickly, but changes can also cause loops or oscillation. A load-sensitive metric changes with congestion; a load-insensitive metric does not react to current traffic load. Load-sensitive routing can be unstable: traffic moves away from a busy path, makes another path look busy, and then moves back.

Worked load-sensitive oscillation. Consider two equal-cost alternative paths, P and Q, carrying two source-destination flows. Assume a path costs 1 when it carries at most one flow and 5 when both flows use it; each flow chooses the cheaper path using the current costs, and both update routes at the same time. If both flows start on P, then P costs 5 and Q costs 1, so both move to Q. Now Q costs 5 and P costs 1, so both move back to P. This repeats: each path alternates between empty/cheap and full/expensive because every flow reacts to the same current load. This simplified synchronous example shows why using load-sensitive metrics can cause route oscillation; real protocols may update at different times and the exact outcome depends on the metric and timing.

Kurose and Ross §5.1; Lecture 12, Routing Algorithms and Route Oscillation Example. The two-path numbers are an original illustration of the slide’s load-sensitive oscillation concept.

Link-state: learn the graph, then run Dijkstra

In link-state routing, routers distribute link-state information so that each router can build a topology view containing links and their costs. Given a consistent view, each router can independently calculate shortest paths from itself. Dijkstra’s algorithm grows a set N′ of nodes whose least-cost paths from the source are settled. It repeatedly selects the unsettled node with the smallest tentative distance, adds it to N′, then checks whether reaching each neighbor through that node improves the neighbor’s current estimate.

Let D(v) be the current best-known cost from source A to v, and p(v) the predecessor on that tentative path. When a node w is settled, update each unsettled neighbor v using D(v) = min(D(v), D(w) + c(w,v)). Once all nodes are settled, the predecessor links reconstruct paths. A router’s forwarding entry uses the first neighbor on that complete path as its next hop.

Worked example. Use the graph above, start at A, and calculate shortest paths to B, C, D, and E. Initial estimates come only from A’s direct links: D(B)=4, D(C)=2, D(D)=∞, D(E)=∞. Parentheses below show the predecessor for each finite estimate.

Now trace predecessors to make paths: B has predecessor C, and C has predecessor A, so A→C→B costs 2+1=3. D’s predecessor is B, so A→C→B→D costs 2+1+5=8. E’s predecessor is D, so A→C→B→D→E costs 10. The resulting forwarding table at A is:

Notice the difference between a predecessor and the forwarding next hop. The predecessor of D is B, but A does not forward directly to B; A first sends the packet to C. A path’s first edge determines the local next hop. Also, costs—not number of links—decide the winner: A→B costs 4, but A→C→B costs 3.

With a simple array-based search for the lowest tentative distance, Dijkstra’s running time is O(V²) in the common simplified analysis. A heap-based implementation is often described as O((V+E) log V), depending on the data structure and graph representation. These are algorithm implementation bounds, not a guarantee about how long a network takes to exchange link-state information. The lecture’s simpler bound counts repeated scans of the vertices.

Kurose and Ross §5.2.1; Lecture 12, Link-State Routing Algorithm and Dijkstra’s Algorithm. Graph and values in this worked example are original for this guide.

Distance-vector: learn routes from neighbors

Distance-vector routing is decentralized, iterative, and asynchronous. Each router knows the costs of its directly attached links and receives distance estimates from its neighbors. For destination y, the Bellman–Ford relationship says the least cost from x is the minimum, over neighbors v, of the direct cost from x to v plus v’s advertised distance to y:

d_x(y) = min_{v ∈ neighbors(x)} { c(x,v) + d_v(y) }

In practice, each node stores estimates D_x(y) and updates them when a neighbor sends a new vector or a local link cost changes. The neighbor that achieves the minimum becomes the next hop for y. Nodes send changed estimates to their neighbors, repeat the calculation, and stop sending updates when values stabilize. The procedure does not require all routers to update at precisely the same instant.

Worked convergence over synchronous rounds. Use the four-node line A—B—C—D with link costs A–B=1, B–C=2, C–D=1, and an additional direct A–D link of cost 7. Each vector is ordered (distance to A, B, C, D). At round 0, each node knows only its directly attached links (and distance zero to itself). For this table only, define one synchronous round as every node updating from the neighbor vectors frozen at the end of the previous round; this makes the arithmetic easy to trace. Actual distance-vector routing exchanges updates asynchronously.

For example, A initially estimates the route to D as 7 on its direct edge. In round 1, A learns from B that B-to-D costs ∞, so that route cannot yet improve. After B learns in round 1 that D is reachable through C for cost 3, A uses that previous-round advertisement in round 2: A-to-B 1 plus B-to-D 3 gives 4. Symmetrically, D learns a cost-4 route to A through C. The stable vectors give each node its least costs and, by recording which neighbor produced each minimum, its next hops.

Small numeric update. In a line X—Y—Z, suppose c(X,Y)=4 and c(Y,Z)=3. Y currently advertises D_Y(Z)=3. X’s direct distance to Z is ∞, so its candidate through Y is 4+3=7. X therefore sets D_X(Z)=7 and installs Y as the next hop to Z. This is one Bellman–Ford update: local link cost plus the neighbor’s advertised distance. If Y later advertises 5 after its own route changes, X recomputes 4+5=9 and may update its entry.

Kurose and Ross §5.2.2; Lecture 12, Distance-Vector Routing Algorithm. The X—Y—Z arithmetic is an original explanatory example.

Bad news travels slowly: count to infinity

A DV node’s estimate can be wrong when a neighbor’s route actually loops back through it. The classic bad-news example has three routers: x—y with cost 4 initially, y—z with cost 1, and z—x with cost 50. Before a change, y reaches x directly at cost 4; z reaches x through y at cost 1+4=5. Now the x–y link cost rises from 4 to 60. Once the estimates converge, y should reach x through z at cost 1+50=51, which is cheaper than the direct cost 60. The transient loop occurs because y and z initially rely on stale estimates instead of this current route.

Follow the asynchronous updates as presented in the lecture. Before the increase, D_y(x)=4 and D_z(x)=5. At t₀, y detects the direct link increase to 60 but still has z’s old advertisement, 5. It calculates min(60, 1+5)=6 and selects z. That estimate is stale: z’s route to x used y, so y is now routing to z while z routes to y. At t₁, z hears 6 and calculates min(50, 1+6)=7 via y. Then y hears 7 and calculates 8; z hears 8 and calculates 9; the two advertised estimates rise one at a time.

This phenomenon is called count to infinity: estimates increase through repeated exchanges until a node finally prefers its direct route or reaches the protocol’s defined infinity. The sequence is a routing loop during convergence, not a real sequence of physical link costs. With y–z=1 and z–x=50, the converged least-cost y–x route is 51, not 60.

Poisoned reverse partially prevents this two-node loop. If z reaches x through y, z advertises D_z(x)=∞ specifically to y. When y’s direct x-link changes from 4 to 60, its poisoned neighbor advertisement means y will not treat z’s old “5” as an independent path; y selects the direct 60 route and tells z. Z then uses its direct cost 50 and advertises 50 to y. Y switches to cost 51 through z and, in turn, advertises ∞ back to z for destination x. Poisoned reverse hides a route from the neighbor that is already on that route. It is only a partial fix: loops involving three or more routers may remain.

Trap: the phrase “good news travels fast, bad news travels slowly” describes a convergence problem, not a claim that every DV update is slow. A new short route can be adopted quickly; withdrawal or worsening of a route can leave stale neighbor estimates that feed a loop.

Kurose and Ross §5.2.2 (Bellman–Ford, count to infinity, poisoned reverse); Lecture 12, Distance-Vector Routing Algorithm and the x–y–z bad-news example.

LS and DV: what information is available?

Do not confuse “centralized versus decentralized control” with “forwarding versus routing.” Forwarding is the local action in every router. Control can be per-router or logically centralized. LS versus DV describes how a routing algorithm obtains and uses information. These are related classifications, but they answer different questions.

Kurose and Ross §§5.1–5.2; Lecture 12, Routing Algorithms and LS/DV descriptions.

Quick recall

Recall checks review Kurose and Ross §§5.1–5.2 and Lecture 12.

Check your subnet arithmetic

Do it on paper first. Then use this to catch mask, boundary and host-count mistakes.

Can you explain it without the notes?

Spend 20–30 minutes here after reading. These are original practice questions, not a prediction of your quiz. Commit to an answer before checking.

Paper practice: show the working

For these, the intermediate steps matter as much as the final answer.

Your last 10 minutes

Say these aloud. If you cannot justify a line, return to its worked example.

What this guide covers

The screenshot is the authority for textbook boundaries. Slides 8–12 provide the professor’s emphasis and explanation style. Cross references below let you return to the local originals.

Files inspected

• SLIDES/8_Layer_3_IP_Addresses.pdf
• SLIDES/9_Layer_2_MAC_Addresses.pdf
• SLIDES/10_CONNECTING_DEVICES.pdf
• SLIDES/11_Network_Layer_Data_Plane.html
• SLIDES/12_Network_Layer_Control_Plane.html
• BOOKS/1_Behrouz A. Forouzan … (2022).pdf
• BOOKS/2_James W. Kurose, Keith W. Ross … (2021).pdf

These are original explanatory notes and original diagrams derived from your supplied materials. Textbooks and slide decks are not republished. Modern caveats are marked where classroom simplifications could otherwise mislead. Exact quiz questions and lecture-only additions are unknown.