Part 5 — Layer 3: Network

How it works

1. The IPv4 header (20 bytes, field by field):

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
┌───────┬───────┬───────────┬───┬───────────────────────────────┐
│Version│  IHL  │   DSCP    │ECN│         Total Length          │  4 | 5 | 0 | 0 | 1500
├───────┴───────┴───────────┴───┼─────┬─────────────────────────┤
│        Identification         │Flags│    Fragment Offset      │  0x1c46 | DF | 0
├───────────────┬───────────────┼─────┴─────────────────────────┤
│      TTL      │   Protocol    │        Header Checksum        │  64 | 6 (TCP) | ...
├───────────────┴───────────────┴───────────────────────────────┤
│                    Source IP: 192.168.1.23                    │
├───────────────────────────────────────────────────────────────┤
│                 Destination IP: 198.51.100.20                 │
└───────────────────────────────────────────────────────────────┘

The fields that matter in real life:

2. Routing = longest-prefix match. Every router has a table of prefixes and picks the most specific one that matches:

Destination 198.51.100.20
  0.0.0.0/0         → upstream            (matches, /0)
  198.51.100.0/22   → peer A              (matches, /22)
  198.51.100.0/24   → peer B              (matches, /24)  ← WINNER: most specific

3. BGP: how the Internet agrees on routes. The Internet is about 75,000 Autonomous Systems (ASes: ISPs, clouds, large companies). Each one announces the prefixes it owns to its neighbours via BGP. Your ISP knows how to reach 198.51.100.0/24 because the cloud provider's AS announced it and that announcement spread. BGP chooses paths by policy and business relationships, not by shortest latency. That's why traffic sometimes takes odd detours.

4. NAT: the home router's trick. IPv4 has only about 4.3 billion addresses, so your whole home shares one public IP. The router keeps a translation table:

Inside (private)            Outside (public)          Remote
192.168.1.23:54012   ⇄   203.0.113.7:61001   ⇄   198.51.100.20:443
192.168.1.40:51877   ⇄   203.0.113.7:61002   ⇄   142.250.x.x:443   (your phone)

Consequences for software engineers:

• NAT is stateful. Idle mappings expire (often after 30 s to 5 min for TCP), which silently breaks long-idle connections. That's why WebSockets and gRPC streams need keepalives.
• Many mobile and some broadband users sit behind Carrier-Grade NAT (the 100.64.0.0/10 range): thousands of customers share one IP. Rate-limiting or blocking by IP punishes innocent users.
• Servers can't initiate connections to clients behind NAT. That's why push notifications, WebRTC (STUN/TURN), and "phone home" agents exist.

5. ICMP: L3's messaging channel. ping (Echo), traceroute (Time Exceeded), and Path MTU Discovery (Fragmentation Needed) all depend on it. Blocking all ICMP is a classic misconfiguration that causes the MTU black-hole from Part 4.

6. IPv6 in one paragraph. 128-bit addresses, so every device can have a global address and no NAT is needed. A fixed 40-byte header, no fragmentation by routers, and ARP is replaced by Neighbour Discovery (ICMPv6). Browsers try IPv6 and IPv4 in parallel (Happy Eyeballs) and use whichever connects first. If your AAAA record points to a broken IPv6 path, some users get a 250 ms penalty on every new connection.

7. L3 in the cloud.