Chapter 4 · The Network Layer (IP)The student-friendly guide + hands-on Kali labs

Chapter 4 · The student-friendly guide

The Network Layer:
Meet IP

Layer 3: the addresses and the packet header that let data cross from one network to any other — anywhere on Earth.

Why IP?The IPv4 HeaderTTL & FragmentationMasks & Classes

Use ← → arrows, the dots, or the ☰ menu. Switch to the Lab Guide up top.

The big picture

Your 4-stop journey through Layer 3

💡
Think of it like… the global postal system — but now we zoom into the ADDRESS LABEL itself: why it works across cities, what every field on it means, and how the post office reads it to route your parcel.
🌎
1

Why IP exists

MAC can’t cross networks. IP gives every device a routable location.

⚙️
2

What L3 does

Its four jobs, and IP’s casual personality.

🏷️
3

The IPv4 header

The shipping label every router reads: TTL, fragmentation & more.

🗺️
4

Addressing

Masks & the AND trick, the host math, classes & special addresses.

Part 1 · Why IP exists

Why isn’t a MAC address enough?

🔧

MAC = identity

Ethernet-specific & burned in · carries NO location info · works only on the local link · can’t move data network-to-network.

📍

IP = location

Tells WHERE a device sits · has a network part + host part · routable across networks · works across the whole Internet.

💡
Think of it like… you can’t post a letter with only someone’s NAME (their MAC). You need their ADDRESS (their IP) — that’s what tells the postal network which city, street and house to route to.

Part 1 · Why IP exists

Same network? Or remote? It changes everything

Same network → deliver direct

Source & destination share the network portion → the frame uses the destination’s REAL MAC.

PC1
Server

Remote network → via the gateway

Different network → send the frame to the DEFAULT GATEWAY (router) first; it routes onward.

PC1
R1
🌐
💡
Think of it like… the default gateway is your building’s lobby exit. Mail for a neighbour goes straight to their door; mail for anywhere else goes out through the lobby — and the IP destination never changes.

Part 2 · What L3 does

The network layer’s four jobs

📍
Address
📦
Encapsulate
🗺️
Route
📭
De-encapsulate

Give every device a logical IP (source & dest).

Wrap the transport segment inside an IP packet.

Choose a path; every L3 device reads the header.

At the destination, strip the IP header, pass up.

🧠
Memory hook: “A Eager Robot Delivers” → Address · Encapsulate · Route · De-encapsulate. The IP addressing stays the SAME from source to destination.

Part 2 · What L3 does

IP’s personality: 3 traits

🔗

Connectionless

No setup, no shared itinerary. Each packet travels independently.

✋

Best-effort

Unreliable: IP tries, but may discard packets and never promises delivery.

🔀

Media-independent

Runs over any link — copper, fibre, Wi-Fi, satellite — it doesn’t care.

Low overhead by design. Reliability (retransmits, timeouts) is left to upper layers like TCP. Big packets get fragmented (max 64 KB; Ethernet payload ≤ 1500 B).

💡
Think of it like… IP is a casual courier: no booking (connectionless), no guarantee or refund (best-effort), and it’ll use any vehicle going your way (media-independent).

Self-Test #1

Why IP & What L3 Does

Tap a green answer to reveal it.

Q Why can’t MAC addresses move data between networks?
A They carry no location info & are Ethernet-only — local link only. IP encodes WHERE a device is, so it’s routable.
Q Destination is on a remote network — where does the frame go first?
A To the default gateway (the local router interface).
Q Name the network layer’s four operations.
A Addressing, Encapsulation, Routing, De-encapsulation.
Q Give IP’s three defining characteristics.
A Connectionless, best-effort (unreliable), media-independent.

Part 3 · The IPv4 Header

The shipping label every router reads

20–60 bytes, read 4 bytes per row. The two most important fields: source & destination IP.

Version4bIHL×4=lenToS8bTotal Length16b
Identificationfrag groupFlagsDF·MFFragment Offset13b
TTLhop budgetProtocol8bHeader Checksum16b
Source IP Address32b
Destination IP Address32b

■ src/dst IP (most important)   ■ header length   ■ TTL   ■ fragmentation

💡
Think of it like… a parcel’s shipping label: most of it is admin, but the part that matters for delivery is the FROM and TO address — read by every depot (router) on the way.

Part 3 · The IPv4 Header

The header-length ×4 trick

A 4-bit field for a 20–60 byte header?

4 bits only count 0–15 — too small for byte counts. The trick: the value is stored in units of 4 bytes.
header bytes = field value × 4.

0101 = 5 × 4 = 20 B minimum — no options
0110 = 6 × 4 = 24 B 4 bytes of options
0100 = 4 × 4 = 16 B < 20 → invalid → DROP
💡
Think of it like… a recipe that says “5 cups” when each cup is 4 spoons — multiply by 4 to get spoons. A value under 5 can’t fit the basic header, so the router bins the packet.

Part 3 · The IPv4 Header

TTL & fragmentation

TTL — Time To Live (a hop budget, not a timer)

Each router decrements TTL by 1. At 0, the packet is destroyed — this stops packets looping forever.

64
63
…
0
✗ dropped

Fragmentation — when a packet is too big for the link (MTU)

Identification = which mother packet · Fragment Offset = where it fits · Flags: DF = don’t fragment, MF = more fragments.

big packet
frag 1
frag 2
frag 3
💡
Think of it like… TTL is a bus ticket good for N stops — at zero you’re off. Fragmentation is sawing a big sofa to fit a narrow door, numbering each piece so it’s rebuilt correctly.

Part 3 · The IPv4 Header

Why did a router DROP my packet?

⏳

TTL hit 0

Hop budget ran out (often a loop).

📏

Bad header length

IHL < 5 can’t hold a valid header.

🐞

Checksum / error

Header error or failed length check.

🚫

DF set, too big

“Don’t Fragment” but exceeds the MTU.

💡
Think of it like… the post office rejecting a parcel: the postage clock ran out (TTL), the label is malformed (bad header), the seal is broken (checksum), or it’s too big for the van and marked “do not cut” (DF).

Self-Test #2

The IPv4 Header

Tap a green answer to reveal it.

Q A header-length field holds 0101. How many bytes is the header?
A 5 × 4 = 20 bytes (the value is in 4-byte units).
Q What does TTL do, and what happens at 0?
A It’s a hop count; each router −1; at 0 the packet is dropped (prevents loops).
Q In fragmentation, what do Identification & Fragment Offset do?
A Identification groups fragments of one packet; the offset says where each fits when reassembled.
Q Give two reasons a router drops a packet.
A TTL reached 0; invalid header length (< 20 B). Also checksum errors, or DF set but too big.

Part 4 · Addressing

The mask & the AND trick

A mask is a row of 1s marking the network bits. AND the IP with the mask to reveal the network address.

IP   192.168.100.23   11000000.10101000.01100100.00010111
Mask 255.255.255.0    11111111.11111111.11111111.00000000
= Net 192.168.100.0   11000000.10101000.01100100.00000000
🧠
Memory hook: Mask bit = 1 → KEEP (network). Mask bit = 0 → ZERO it (host). The mask is a stencil that hides the house number and shows only the street.

Part 4 · Addressing

How many hosts fit in a network?

For a /24 (192.168.100.0): 32 − 24 = 8 host bits → 2⁸ = 256 addresses → 256 − 2 = 254 usable.
Minus 2: the first address (host bits 0) is the network address; the last (host bits 1) is the broadcast — neither can be a host.

.0network .1first usable (gateway) .2 – .253usable hosts .254last usable .255broadcast
💡
Think of it like… a street of 256 houses, but two are reserved: number .0 is the street name-sign (network), and .255 is the town crier (broadcast). 254 are left to live in.

Part 4 · Addressing

Classes A–E — read the first octet

Class1st octetDefault maskNet / Host splitPurpose
A1 – 127/8N.H.H.HHuge networks
B128 – 191/16N.N.H.HMedium
C192 – 223/24N.N.N.HSmall
D224 – 239——Multicast
E240 – 255——Experimental
🧠
Memory hook: A/B/C are for normal hosts; D = “Delivery to a group” (multicast); E = Experimental. Boundaries 127·191·223 are just 128·192·224 minus one.

Part 4 · Addressing

Special & private addresses

🔁

Loopback

127.0.0.1

Tests your own NIC.

⚠️

APIPA

169.254.x.x

Self-assigned when DHCP fails.

📢

Broadcast

255.255.255.255

To all on the local net.

🗂️

Network addr

host bits = 0

Names the whole network.

🔒
Private ranges (RFC 1918 — internal only, need NAT to reach the Internet): 10.0.0.0/8 · 172.16.0.0–172.31.255.255 · 192.168.0.0/16

Self-Test #3

Addressing & Masks

Tap a green answer to reveal it.

Q How do you get the network address from an IP and mask?
A Logically AND the IP with the mask — 1-bits keep the network, 0-bits zero the host.
Q For a /24, how many usable hosts — and why minus 2?
A 2⁸ − 2 = 254 (subtract the network address .0 and the broadcast .255).
Q What are the three private (RFC 1918) ranges?
A 10.0.0.0/8, 172.16.0.0–172.31.255.255, and 192.168.0.0/16.
Q What is 169.254.x.x used for?
A APIPA — a self-assigned address when DHCP fails / no static IP.

One-page cheat sheet

Chapter 4 in a single glance

Why IP?

  • MAC = identity (local only)
  • IP = location (routable)
  • Needed to cross networks

Remote delivery

  • Different network →
  • send to default gateway
  • IP stays; MAC changes per hop

L3's 4 jobs

  • Address · Encapsulate ·
  • Route · De-encapsulate
  • Hook: A Eager Robot Delivers

IP traits

  • Connectionless
  • Best-effort (unreliable)
  • Media-independent

IPv4 header

  • 20–60 bytes
  • Key = source & dest IP
  • Read by every L3 device

Header length

  • 4-bit field × 4 = bytes
  • 5→20 (min) · 6→24
  • < 20 → invalid → drop

TTL & frag

  • TTL −1 per hop; 0 → drop
  • Frag: ID + offset + DF/MF
  • stops loops; fits the MTU

Mask & AND

  • IP AND mask = network
  • 1 = keep · 0 = host
  • /24 → 2⁸ − 2 = 254 hosts

Special / private

  • 127.0.0.1 loop · 169.254 APIPA
  • 255.255.255.255 broadcast
  • 10 / 172.16 / 192.168 = private

You can read an IP packet now.

From why IP exists, through every field of the header, to masking out a network address by hand — Layer 3 is no longer a mystery. Revise with the cheat sheet, test yourself with the quizzes.

Next up → Chapter 5 (ICMP & NAT)

Ready to make it real? Switch to the 🧪 Lab Guide — read an IP header, bend the TTL, and fragment a packet on Kali Linux.

1 / 19

Chapter 4 · Hands-on labs

Inside IP — live on Kali Linux

Six small, beginner-friendly labs using only built-in Linux commands. Read a real IP header, bend the TTL to see a router drop a packet, force fragmentation, and work out a network address — type the command, read the output.

SET-UP  ·  Open the Kali Terminal. A couple of labs use two terminals (A & B). Capturing packets needs sudo. Tools are built into Kali; the only optional add-on is ipcalc: sudo apt install -y ipcalc. The ❯ is just the prompt — Copy grabs only the command. Replace eth0 with your interface if it differs.
USE RESPONSIBLY  ·  Only send traffic to / capture on networks you own or are allowed to test. These labs use your own machine, your gateway, and public test hosts.
1 · Why IP2 · IP header3 · TTL 4 · Fragmentation5 · Masks6 · Special IPs✓ Answers
1

Why IP? Local vs the Whole World

Maps to Ch.4:MAC works only on the local link; IP is routable, so it reaches across networks — via the gateway. You’ll learn:See that a far-away host is reached by IP through your gateway, not by any MAC of its own. Tools:ip, ping
1

Your local neighbours (MAC only works between these — same link):

ip neigh
2

Your gateway — the only way off your LAN:

ip route | grep default
3

Reach a host across the world by IP — it works even though it shares no link with you:

ping -c 2 8.8.8.8
Representative
64 bytes from 8.8.8.8: icmp_seq=1 ttl=118 time=12.3 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=118 time=12.1 ms
Why it matters  ·  8.8.8.8 isn’t in your ip neigh list and has no MAC you know — yet IP still reaches it, hop by hop, starting at your gateway. That’s the whole point of IP: a routable, cross-network address that MAC can’t provide.
Your turn  ·  Is 8.8.8.8 listed in your ip neigh output? If not, how did your ping still reach it? (answer below)
2

Read a Real IP Header

Maps to Ch.4:The IPv4 header — version, TTL, identification, flags, protocol, length, source & destination IP. You’ll learn:Capture one packet and read its IP header fields, straight off the wire. Tools:tcpdump, ping (two terminals)
1

Capture with full detail in Terminal A (-v prints the IP header):

sudo tcpdump -i any -v -c 1 -nn icmp
2

Send one ping in Terminal B:

ping -c 1 8.8.8.8
3

Read the header in Terminal A:

Verified format — the IP header fields
IP (tos 0x0, ttl 64, id 1, offset 0, flags [none], proto ICMP (1), length 28)
    192.168.1.23 > 8.8.8.8: ICMP echo request

There they are: ttl (hop budget), id (fragment group), flags (DF/MF), proto (what’s inside — ICMP/TCP/UDP), length, and the two stars: source & destination IP.

Why it matters  ·  Every field from the slide is right here on a real packet. Each router along the path reads this same header to decide where the packet goes next.
Your turn  ·  What is the starting ttl value your machine used? (Common defaults are 64, 128 or 255.) (answer below)
3

TTL: The Hop Budget

Maps to Ch.4:TTL is a hop count — each router −1; at 0 the packet is dropped. (Traceroute is built on this trick.) You’ll learn:Set a tiny TTL and watch the very first router drop your packet and report back. Tools:ping, traceroute
1

Send a packet that can only take ONE hop (-t 1 sets TTL = 1):

ping -c 1 -t 1 8.8.8.8
Representative — the first router kills it at TTL 0
From 192.168.1.1 icmp_seq=1 Time to live exceeded

Your gateway decremented TTL 1 → 0, dropped the packet, and sent back an ICMP “Time exceeded”. That’s a router dropping a packet, live.

2

Now let it go further (TTL = 2 reaches the second router):

ping -c 1 -t 2 8.8.8.8
3

Traceroute IS this trick — TTL 1, 2, 3… reveals every router on the way:

traceroute -n 8.8.8.8
Why it matters  ·  TTL stops packets circling forever. Each router subtracts 1; at 0 the packet dies and the router reports it — which is exactly how traceroute maps the path, one hop at a time.
Your turn  ·  Which device replied to your -t 1 ping — and is it the same as your default gateway from Lab 1? (answer below)
4

Fragmentation & the MTU

Maps to Ch.4:A packet too big for the link’s MTU is fragmented; the DF flag says “don’t fragment”. You’ll learn:See your link’s MTU, force a big packet to fragment, then block it with the DF flag. Tools:ip, ping, tcpdump
1

Find your link’s MTU (the biggest a frame can be — usually 1500):

ip link show eth0
Representative — look for “mtu 1500”
2: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 ...
2

Send a packet bigger than the MTU (-s 2000 = 2000-byte payload) — it gets split:

ping -c 1 -s 2000 8.8.8.8

Watch it as fragments in another terminal: sudo tcpdump -i any -nn 'icmp' shows two pieces of one packet.

3

Now forbid fragmentation (-M do sets the DF flag) — the kernel refuses:

ping -c 1 -M do -s 2000 8.8.8.8
Representative — DF set + too big = blocked
ping: local error: message too long, mtu=1500
Why it matters  ·  When a packet won’t fit the MTU, IP fragments it (and reassembles using the ID + offset fields). But if the DF flag is set, it can’t be cut — so it’s dropped instead, exactly like the “DF set, too big” drop reason from the slides.
Your turn  ·  What is your eth0 MTU, and why did the 2000-byte ping need to be fragmented? (answer below)
5

Masks: Find the Network Address

Maps to Ch.4:The mask splits an IP into network + host; AND gives the network address. Classes & host counts. You’ll learn:Let ipcalc work out the network, broadcast, host range and class — the mask/AND done for you. Tools:ip, ipcalc (sudo apt install ipcalc)
1

Find your IP & mask:

ip -br addr show eth0
2

Let ipcalc apply the mask (it does the AND and shows everything):

ipcalc 192.168.100.23/24
Representative output
Address:   192.168.100.23
Netmask:   255.255.255.0 = 24
Network:   192.168.100.0/24
HostMin:   192.168.100.1
HostMax:   192.168.100.254
Broadcast: 192.168.100.255
Hosts/Net: 254          Class C, Private Internet

The Network (.0) is the IP AND the mask; Broadcast is the .255; there are 254 usable hosts; and it’s Class C.

3

Try a Class A address and compare the scale:

ipcalc 10.0.0.5/8
Why it matters  ·  ANDing the IP with the mask reveals the network address — every IPv4 idea from the slides (network, broadcast, host count, class) in one command. This is the engine behind subnetting in Chapter 6.
Your turn  ·  For 10.0.0.5/8, what class is it and roughly how many hosts? (answer below)
6

Special & Private Addresses

Maps to Ch.4:Loopback (127.0.0.1), private ranges (RFC 1918), APIPA (169.254.x.x) and the network/broadcast addresses. You’ll learn:Talk to your own NIC via loopback, and check whether your real IP is a private one. Tools:ping, ip
1

Talk to yourself — the loopback address tests your own NIC, no network needed:

ping -c 2 127.0.0.1
Representative
64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.03 ms
2

Check your real IP — is it a private (RFC 1918) address?

ip -br addr show eth0

If it starts with 10., 172.16–31., or 192.168., it’s private — your router uses NAT to reach the Internet for you (that’s Chapter 5).

3

See the loopback interface itself — its address is always 127.0.0.1:

ip -br addr show lo
Why it matters  ·  127.0.0.1 always means “me” — a built-in self-test. And most home/office machines use a private RFC 1918 address that can’t travel the public Internet on its own, which is exactly why NAT exists.
Your turn  ·  Is your eth0 address public or private? Which RFC 1918 range (if any) does it fall in? (answer below)
✓

Answer Key & Where Next

Lab 1. No — 8.8.8.8 isn’t a neighbour. Your ping reached it because IP is routable: the packet went to your gateway first, which forwarded it across networks (MAC alone could never do that).

Lab 2. Whatever your ttl line showed at the sender (Linux usually starts at 64; Windows 128). It counts down by 1 at each router.

Lab 3. The device that replied to the -t 1 ping is your default gateway — the first router, one hop away (the same IP as ip route’s default).

Lab 4. Your MTU is typically 1500 bytes. A 2000-byte ping is bigger than that, so IP must split it into fragments to fit the link — unless DF is set, in which case it’s dropped.

Lab 5. 10.0.0.5/8 → first octet 10 → Class A; a /8 has about 16.7 million hosts (16,777,214 usable).

Lab 6. Most likely private — if it begins with 10., 172.16–31., or 192.168., it’s an RFC 1918 address and needs NAT to reach the public Internet.

This lab’s toolReturns in…
TTL / traceroute (Lab 3)Chapter 5 — ICMP Time Exceeded & how traceroute works
private addresses (Lab 6)Chapter 5 — NAT translates private → public
masks / ipcalc (Lab 5)Chapter 6 — subnetting (splitting a network up)
tcpdump IP header (Lab 2)Every later chapter — your packet X-ray
Nice work  ·  With nothing but built-in Linux commands you’ve read a real IP header, bent the TTL to drop a packet, forced fragmentation, and worked out a network address — Layer 3, hands-on.
Chapter 4 — The Network Layer (IP) · Slides + Hands-On Kali Labs