CSS334 — Network Layer (Part 2) Cheat Sheet

Exam-ready summary | Lecture 8 | All topics included

0. Quick Recap: 4 Techniques to Split IP Range

Rule of thumb:

• No condition → Classful private
• Given a range, easy equal split → CIDR
• Given a range, want efficient use → VLSM

⚠️ Always remember: Router-to-router WAN links count as a separate subnet! Don't forget to include them in your subnet count.

1. Why Classful Is Wasteful

Example: 5-subnet network (100, 300, 254 hosts + 2 WAN links)

Analogy: Classful is like renting an entire warehouse just to store a bicycle. Network B needs 300 IPs but gets 65,534.

2. CIDR — Classless Inter-Domain Routing

Pronounced "cider" 🍎

What is CIDR?

• Allocates IPs and routes with arbitrary prefix length (not locked to class boundaries)
• Address format: $a.b.c.d/x$ where $x$ = bits in the network portion

$\boxed{\text{Address: } a.b.c.d/x}$

• Example: 200.23.16.0/23 → 23-bit network, 9-bit host
• In classful, you'd be forced to /24 (Class C) or /16 (Class B) — no in between. CIDR lets you pick /23, /25, /20, etc.

Key Formulas

$\boxed{\text{Host bits} = 32 - \text{prefix length}}$ $\boxed{\text{Usable hosts per subnet} = 2^{\text{host bits}} - 2}$ $\boxed{\text{Total subnets} = 2^{\text{borrowed bits}}}$

Borrowed bits = (new prefix) − (original prefix). Every bit you borrow doubles the number of subnets and halves the hosts per subnet.

CIDR Worked Examples

Example 1: 128.143.137.144/20

• Host bits = 32 − 20 = 12
• Usable hosts = $2^{12} - 2 = {4094}$
• Network address: 128.143.128.0/20
  • Why? Zero out the last 12 bits of 137.144:
  • 137 = 10001001 → keep top 4 bits 1000 → 10000000 = 128
  • 144 = 10010000 → zero out → 00000000 = 0
• First host: 128.143.128.1 | Last host: 128.143.143.254 | Broadcast: 128.143.143.255

Example 2: 192.168.10.0/25 (mask 255.255.255.128)

• Host bits = 32 − 25 = 7 → $2^7 - 2 = 126$ usable hosts per subnet
• Produces 2 subnets:

CIDR Reference: Prefix → Subnet Mask

Memorise /30! It gives exactly 2 usable hosts — perfect for router-to-router WAN links.

3. CIDR: Splitting a /24 into Equal Subnets

Base network: 192.168.10.0/24

Split into 2 subnets → borrow 1 bit → /25

• $2^1 = 2$ subnets | $2^7 - 2 = 126$ hosts each
• Block size = 256 / 2 = 128 (jump between subnets)

Split into 4 subnets → borrow 2 bits → /26

• $2^2 = 4$ subnets | $2^6 - 2 = 62$ hosts each
• Block size = 256 / 4 = 64

Split into 5 subnets → round up to $2^3 = 8$ → borrow 3 bits → /27

• Need 5 subnets → $2^2=4$ is not enough → round up to $2^3 = 8$
• $2^5 - 2 = 30$ hosts each | Block size = 256 / 8 = 32

Exam tip: For "split into 5 subnets" questions, you still get 8 subnets (3 spare). You can use any 5 of the 8 — typically the first 5.

⚠️ Exam: Identify an IP's Role in a Subnet

Given an IP and prefix, determine if it is: Network Address, Broadcast Address, Valid Host, or Invalid/Reserved

Method:

1. Calculate network address (zero out host bits)
2. Calculate broadcast (set all host bits to 1)
3. Everything in between = valid host
4. First and last in range = not usable

4. CIDR: Equal-Subnet Network Design Example

Given: 192.168.0.0/20, split using CIDR → pick /23

Why /23? Largest subnet needs 300 hosts → $2^9 - 2 = 510 \geq 300$ ✓ (next smaller /24 only gives 254 ✗)

• Total subnets available from /20 using /23: $2^{23-20} = 2^3 = 8$

⚠️ Problem: All 5 subnets use /23 (510 hosts), even the WAN links that only need 2 IPs. This is where VLSM is needed.

5. VLSM — Variable Length Subnet Mask

What is VLSM?

• An extension of CIDR that allows each subnet to have a different prefix length
• Each subnet gets exactly (or tightly) what it needs
• Key rule: Always assign the LARGEST subnet first

Analogy: Cutting a rope into pieces of different sizes for different purposes — instead of equal chunks where most get wasted.

CIDR vs VLSM Comparison

6. VLSM Step-by-Step Method

Full Example: 204.15.5.0/24

Requirements: netA=14, netB=28, netC=2, netD=7, netE=28

Step 1 — Sort by size (largest first):

How to pick prefix: Find the smallest $n$ such that $2^n - 2 \geq \text{hosts needed}$

• 28 hosts → $2^5 - 2 = 30 \geq 28$ → /27 ✓
• 14 hosts → $2^4 - 2 = 14 \geq 14$ → /28 ✓
• 2 hosts → $2^2 - 2 = 2 \geq 2$ → /30 ✓

Step 2 — Assign from the start of the block:

204.15.5.0/24 (256 IPs)
├── netB: 204.15.5.0/27    [.0  – .31 ]  32 IPs
├── netE: 204.15.5.32/27   [.32 – .63 ]  32 IPs
├── Remaining: 204.15.5.64/26 (64 IPs) → split for /28s
│   ├── netA: 204.15.5.64/28  [.64 – .79 ]  16 IPs
│   └── netD: 204.15.5.80/28  [.80 – .95 ]  16 IPs
├── Remaining: 204.15.5.96/27 (32 IPs) → split for /30
│   └── netC: 204.15.5.96/30  [.96 – .99 ]   4 IPs
└── Unused: 204.15.5.100 onward

Step 3 — Final Assignment Table:

VLSM Network Design: 192.168.0.0/20

Requirements: B=300 hosts, C=254 hosts, A=100 hosts, R1-R2=2, R2-R3=2

How each split works:

192.168.0.0/20  →  /23: block size=2 → subnets at .0, .2, .4, .6, .8 …
192.168.2.0/23  →  /24: block size=1 → subnets at .2, .3
192.168.3.0/24  →  /25: block size=128 → subnets at .0, .128
192.168.3.128/25 → /30: block size=4 → subnets at .128, .132, .136 …

7. ISP Address Allocation & Route Aggregation

How Networks Get Their IP Block

• ISPs are allocated large blocks from IANA (Internet Assigned Numbers Authority) via ICANN
• ISPs subdivide and distribute to organisations

Example: ISP block 200.23.16.0/20 split into 8 × /23:

Route Aggregation (Supernetting)

• The ISP advertises one summary route (200.23.16.0/20) to the whole internet
• Covers all 8 customer /23 blocks in one routing entry
• Hierarchical addressing = efficient routing table advertisement
• Each ISP has a unique AS Number (Autonomous System Number) as a global identifier

8. IPv4 Address Exhaustion

• ICANN allocated the last IPv4 chunk in 2011
• IPv4 = 32-bit = ~4.3 billion addresses — not enough for the modern internet
• Two solutions:

9. IPv6

Why IPv6?

• 128-bit addresses = $2^{128} \approx 3.4 \times 10^{38}$ addresses (practically unlimited)
• Fixed 40-byte header for faster processing and forwarding at routers
• Enables per-flow treatment ("flow label")

IPv4 and IPv6 must coexist — there's no "flag day" where everything switches at once. Hardware constraints mean migration is gradual.

IPv6 Datagram Format

|<——————————— 32 bits ——————————————>|
|  ver (4) | priority (8) | flow label (20) |
|  payload length (16) | next hdr (8) | hop limit (8) |
|                                           |
|          source address (128 bits)        |
|                                           |
|        destination address (128 bits)     |
|                                           |
|               payload / data              |

What IPv6 Removed vs IPv4 (and Why)

IPv6 = express lane — removed all in-flight checks IPv4 did at every router. Result: much faster per-hop forwarding.

10. IPv4 → IPv6 Transition: Tunneling

The Challenge

• Cannot upgrade all routers simultaneously
• No "flag day" — IPv4 and IPv6 routers must coexist indefinitely
• Some routers understand IPv6, some only IPv4

Solution: Tunneling (Packet-within-a-Packet)

• IPv6 datagram is carried as the payload of an IPv4 datagram through IPv4-only regions
• The IPv4 "tunnel" wraps the IPv6 packet between two IPv6-capable routers
• Used in 4G/5G networks too

IPv4 datagram:
┌─────────────────────────────────────────────┐
│ IPv4 Header (src: B, dst: E)                │
│  ┌───────────────────────────────────────┐  │
│  │ IPv6 Header (src: A, dst: F)          │  │
│  │   Payload (actual data)               │  │
│  └───────────────────────────────────────┘  │
└─────────────────────────────────────────────┘

Tunneling Flow (A → B → C → D → E → F)

Analogy: Like putting an international package inside a domestic shipping box. The outer box travels through the local system; inside is the real package destined internationally.

11. NAT — Network Address Translation

What is NAT?

• All devices in a LAN share one public IPv4 address as seen by the internet
• Inside uses private IPs; router maps private ↔ public using a NAT translation table
• The table stores (Private IP : Private Port) ↔ (Public IP : Public Port) mappings

Analogy: Apartment building — many residents (private IPs) share one street address (public IP). The lobby receptionist (NAT router) knows which apartment each parcel goes to via a mapping table.

Private IP Ranges (RFC 1918)

Why Port Numbers in NAT Table?

• The public IP is one address — it alone can't distinguish which internal host a reply goes to
• Port numbers (16-bit = up to 65,535 mappings) are included to uniquely identify each internal connection
• So the full mapping is: (private IP, private port) ↔ (public IP, assigned port)

NAT Operation: Outbound (LAN → Internet)

Step 1: Internal host sends packet
  src: 10.0.0.1:3345  →  dst: 128.119.40.186:80

Step 2: NAT router rewrites source IP+port
  src: 138.76.29.7:5001  →  dst: 128.119.40.186:80
  NAT table entry: 138.76.29.7:5001 ↔ 10.0.0.1:3345

NAT Operation: Inbound (Internet → LAN)

Step 3: Reply arrives at NAT router
  src: 128.119.40.186:80  →  dst: 138.76.29.7:5001

Step 4: NAT router looks up table, rewrites destination
  src: 128.119.40.186:80  →  dst: 10.0.0.1:3345
  → forwarded to correct internal host

NAT Advantages

NAT Controversies (Know These!)

Port Forwarding (Accessing a Server Behind NAT)

• Problem: Server 10.0.0.3 has no public IP — how does the internet reach it?
• Solution: Port Forwarding — manually add a static entry in the NAT table
  • e.g., all traffic to 138.76.29.7:80 → forward to 10.0.0.3:80
• Tool for dynamic tunneling: ngrok — creates a public URL pointing to a local server
• If the server's private IP changes: use DDNS (Dynamic DNS) to keep a consistent domain name

12. ICMP — Internet Control Message Protocol

What is ICMP?

• Used by hosts and routers to communicate network-level information
• Sits above IP in the stack — carried inside IP datagrams (Protocol = 1)
• Handles two things:
  1. Error reporting — unreachable host/network/port/protocol
  2. Diagnostics — ping (echo request/reply), traceroute (TTL expired)

ICMP Message Format

Type (8-bit) | Code (8-bit) | Checksum (16-bit)
First 8 bytes of offending IP datagram header

Common ICMP Messages (Exam-Level — Know Type + Code)

13. Traceroute & ICMP

How traceroute Works (Step by Step)

1. Source sends 3 UDP probes to destination with TTL = 1
2. First router decrements TTL → 0 → drops datagram → sends back ICMP Type 11 Code 0 (TTL Expired)
3. Source records RTT and the router's IP from the ICMP reply
4. Repeat with TTL = 2 → second router replies, and so on
5. Eventually the UDP probe reaches the destination host
6. Destination has no process listening on that UDP port → sends ICMP Type 3 Code 3 (Port Unreachable)
7. Source sees Type 3 Code 3 → stops

Source ──TTL=1──► Router1 → ICMP TTL Expired → Source (records hop 1)
Source ──TTL=2──► Router1 → Router2 → ICMP TTL Expired → Source (hop 2)
Source ──TTL=n──► … → Destination → ICMP Port Unreachable → Source (STOP)

Analogy: Like shouting "Marco Polo!" with a reset counter at each wall. Each router shouts "Polo!" when the counter hits zero, telling you exactly how far away it is.

ping vs traceroute Summary