Rakin's Archive

03_Layer3_Network

7 min read

Section 3: Layer 3 - Network Protocols

3.1 Overview

The Network Layer (Layer 3) is responsible for:

  • Logical addressing (IP addresses)
  • Routing packets between networks
  • Path determination
  • Packet fragmentation and reassembly

Layer 3 Key Functions

  1. Logical Addressing

    • IP addresses identify hosts globally
    • Unlike MAC (physical), IP is logical and hierarchical

  2. Routing

    • Determines best path to destination
    • Uses routing tables and protocols (OSPF, BGP, RIP)

  3. Packet Forwarding

    • Moves packets hop-by-hop toward destination
    • Decrements TTL at each hop

  4. Fragmentation

    • Breaks large packets to fit MTU (Maximum Transmission Unit)
    • Reassembles at destination

3.2 IPv4 Header Structure

IPv4 HEADER FORMAT (20 bytes minimum, up to 60)

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|Version|  IHL  |    DSCP   |ECN|         Total Length          |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|         Identification        |Flags|      Fragment Offset    |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|  Time to Live |    Protocol   |         Header Checksum       |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                       Source IP Address                       |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                    Destination IP Address                     |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                    Options (if IHL > 5)                       |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

IPv4 Header Fields Explained

FieldSizeDescription
Version4 bitsIP version (4 for IPv4)
IHL4 bitsInternet Header Length (in 32-bit words). Min: 5 (20 bytes), Max: 15 (60 bytes)
DSCP6 bitsDifferentiated Services Code Point (QoS)
ECN2 bitsExplicit Congestion Notification
Total Length16 bitsTotal packet size (header + data). Max: 65,535 bytes
Identification16 bitsUnique ID for fragment reassembly
Flags3 bitsBit 0: Reserved (0), Bit 1: DF (Don’t Fragment), Bit 2: MF (More Fragments)
Fragment Offset13 bitsPosition of fragment in original packet
TTL8 bitsTime to Live (hop limit). Decremented at each router. Common values: 64, 128, 255
Protocol8 bitsUpper layer protocol (1=ICMP, 6=TCP, 17=UDP)
Header Checksum16 bitsError checking for header only
Source IP32 bitsSender’s IP address
Destination IP32 bitsReceiver’s IP address
OptionsVariableOptional fields (rarely used) - record route, timestamp, etc.

Protocol Numbers (Important)

NumberProtocol
1ICMP (Internet Control Message Protocol)
2IGMP (Internet Group Management Protocol)
6TCP (Transmission Control Protocol)
17UDP (User Datagram Protocol)
41IPv6 encapsulation
47GRE (Generic Routing Encapsulation)
50ESP (Encapsulating Security Payload)
51AH (Authentication Header)
58ICMPv6
89OSPF (Open Shortest Path First)
132SCTP (Stream Control Transmission Protocol)

3.3 IP Addressing

IPv4 Address Structure

Example: 192.168.1.138 (from your PCAP)

Dotted Decimal:   192    .    168    .    1      .    138
                   │          │          │            │
Binary:       11000000   10101000   00000001   10001010

32 bits total = 4 octets (bytes)

+--------------------------------------------+
|         Network Portion │ Host Portion     |
|       (Determined by subnet mask)          |
+--------------------------------------------+

With /24 subnet mask (255.255.255.0):
  - Network: 192.168.1.0
  - Host: 138
  - Broadcast: 192.168.1.255

IP Address Classes (Historical)

ClassFirst BitsRangeDefault MaskNetworksHosts
A01.0.0.0 - 126.255.255.255255.0.0.0 (/8)12816.7M
B10128.0.0.0 - 191.255.255.255255.255.0.0 (/16)16,38465,534
C110192.0.0.0 - 223.255.255.255255.255.255.0 (/24)2.1M254
D1110224.0.0.0 - 239.255.255.255N/AMulticast-
E1111240.0.0.0 - 255.255.255.255N/AReserved-

Tip

Classful addressing is obsolete. CIDR is now used.

Special/Reserved IP Addresses

Address/RangePurpose
0.0.0.0”This host” / Default route
127.0.0.0/8Loopback (localhost)
169.254.0.0/16Link-local (APIPA)
255.255.255.255Limited broadcast

Private IP Ranges (RFC 1918):

RangeClassDescription
10.0.0.0/8Class A private10.0.0.0 - 10.255.255.255
172.16.0.0/12Class B private172.16.0.0 - 172.31.255.255
192.168.0.0/16Class C private192.168.0.0 - 192.168.255.255

From your PCAP:

  • 192.168.1.x = Private network (Class C)
  • 192.168.0.x = Different private subnet
  • 192.168.56.x = VirtualBox host-only network

3.4 Subnetting Basics

CIDR Notation

CIDR (Classless Inter-Domain Routing)

Notation: IP_ADDRESS/PREFIX_LENGTH

Example: 192.168.1.0/24

The /24 means:

  • First 24 bits = Network portion
  • Remaining 8 bits = Host portion
  • Subnet mask = 255.255.255.0
Binary view:
11111111.11111111.11111111.00000000
├────────────────────────┤├────────┤
     Network (24 bits)     Host (8)

Common Subnet Masks

CIDRSubnet MaskHostsBinary Mask
/8255.0.0.016.7M11111111.00000000.00000000.00000000
/16255.255.0.065,53411111111.11111111.00000000.00000000
/24255.255.255.025411111111.11111111.11111111.00000000
/25255.255.255.12812611111111.11111111.11111111.10000000
/26255.255.255.1926211111111.11111111.11111111.11000000
/27255.255.255.2243011111111.11111111.11111111.11100000
/28255.255.255.2401411111111.11111111.11111111.11110000
/29255.255.255.248611111111.11111111.11111111.11111000
/30255.255.255.252211111111.11111111.11111111.11111100
/31255.255.255.2542*11111111.11111111.11111111.11111110
/32255.255.255.255111111111.11111111.11111111.11111111

* /31 is used for point-to-point links (RFC 3021)

Formula: Usable hosts = 2^(32-prefix) - 2
(Minus 2 for network address and broadcast address)

Subnetting Example

Given: 192.168.1.138/24 (from your PCAP)

Step 1: Convert to binary

IP:   11000000.10101000.00000001.10001010
Mask: 11111111.11111111.11111111.00000000

Step 2: Calculate network address (IP AND Mask)

Network: 11000000.10101000.00000001.00000000 = 192.168.1.0

Step 3: Calculate broadcast address

Broadcast: 11000000.10101000.00000001.11111111 = 192.168.1.255

Step 4: Determine host range

First host:  192.168.1.1
Last host:   192.168.1.254
Total hosts: 254 usable

Summary:

PropertyValue
Network Address192.168.1.0
Subnet Mask255.255.255.0 (/24)
First Usable192.168.1.1
Last Usable192.168.1.254
Broadcast192.168.1.255
Total Usable254 hosts

3.5 ICMP (Internet Control Message Protocol)

ICMP is used for network diagnostics and error reporting.

ICMP Header Structure

ICMP HEADER FORMAT

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|     Type      |     Code      |          Checksum             |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                   Type-specific Data                          |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Minimum size: 8 bytes

Common ICMP Types and Codes

TypeCodeDescription
00Echo Reply (ping response)
3-Destination Unreachable
30Network unreachable
31Host unreachable
32Protocol unreachable
33Port unreachable (important!)
34Fragmentation needed but DF set
313Communication prohibited (firewall)
40Source Quench (deprecated)
5-Redirect
50Network redirect
51Host redirect
80Echo Request (ping request)
90Router Advertisement
100Router Solicitation
11-Time Exceeded
110TTL expired in transit (traceroute uses this)
111Fragment reassembly time exceeded
130Timestamp Request
140Timestamp Reply

How Ping Works

Host A                                                       Host B
   │                                                            │
   │  ICMP Echo Request (Type 8, Code 0)                       │
   │───────────────────────────────────────────────────────────►│
   │                                                            │
   │  ICMP Echo Reply (Type 0, Code 0)                         │
   │◄───────────────────────────────────────────────────────────│
   │                                                            │

Command: ping 192.168.1.138
Output shows: RTT (Round Trip Time), TTL, packet loss

How Traceroute Works

Traceroute discovers the path packets take by:

  1. Sending packets with incrementing TTL values
  2. Each router decrements TTL and replies with “Time Exceeded”
Host ──► Router1 ──► Router2 ──► Router3 ──► Destination

TTL=1: Router1 replies (TTL expired)
TTL=2: Router2 replies (TTL expired)
TTL=3: Router3 replies (TTL expired)
TTL=4: Destination replies (Echo Reply or Port Unreachable)

Commands:

  • Windows: tracert 8.8.8.8
  • Linux: traceroute 8.8.8.8

ICMP Security Considerations

Attacks Using ICMP:

  • Ping of Death: Oversized ICMP packets crash systems
  • Smurf Attack: ICMP broadcast amplification DDoS
  • ICMP Flood: Overwhelm target with ping requests
  • ICMP Redirect: Manipulate routing tables
  • ICMP Tunneling: Covert data channel

Information Disclosure:

  • OS fingerprinting via ICMP responses
  • Network mapping via ping sweeps
  • Path discovery via traceroute

Mitigations:

  • Rate-limit ICMP at firewall
  • Block ICMP Redirect messages
  • Disable ICMP timestamp responses
  • Don’t block all ICMP (breaks Path MTU Discovery)

3.6 IGMP (Internet Group Management Protocol)

IGMP manages multicast group membership.

Purpose: Allows hosts to join/leave multicast groups

From your PCAP:

06:52:11.659560 IP 192.168.1.1 > 224.0.0.22: igmp v3 report
  • 224.0.0.22 = IGMP multicast address
  • IGMPv3 report = Membership report

IGMP Message Types:

  • Membership Query: Router asks “who wants this group?”
  • Membership Report: Host says “I want this group”
  • Leave Group: Host says “I’m leaving this group”

Common Multicast Addresses:

AddressPurpose
224.0.0.1All hosts on segment
224.0.0.2All multicast routers
224.0.0.22IGMP
224.0.0.251mDNS
224.0.0.252LLMNR

3.7 IPv6 Overview

IPv6 Header Format (Fixed 40 bytes)

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|Version| Traffic Class |           Flow Label                  |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|         Payload Length        |  Next Header  |   Hop Limit   |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                                                               |
+                                                               +
|                       Source Address                          |
+                        (128 bits)                             +
|                                                               |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                                                               |
+                                                               +
|                    Destination Address                        |
+                        (128 bits)                             +
|                                                               |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

IPv4 vs IPv6 Comparison

FeatureIPv4IPv6
Address Size32 bits128 bits
Address FormatDotted decimalHexadecimal with colons
Example192.168.1.138fe80::8946:45f6:719f:3edf
Address Space~4.3 billion~340 undecillion
Header Size20-60 bytesFixed 40 bytes
ChecksumYesNo (relies on L2/L4)
FragmentationRouters & hostsOnly source host
ARPYesNo (uses NDP)
BroadcastYesNo (uses multicast)
IPsecOptionalBuilt-in
ConfigurationDHCP/ManualSLAAC/DHCPv6

From your PCAP (IPv6 traffic):

fe80::8946:45f6:719f:3edf > ff02::16 (Multicast Listener Report)

3.8 Layer 3 Wireshark Filters

IPv4 Filters

FilterDescription
ipAll IPv4 traffic
ip.addr == 192.168.1.138Source OR destination
ip.src == 192.168.1.138Source only
ip.dst == 192.168.1.138Destination only
ip.src == 192.168.1.0/24Source subnet
ip.ttl < 10Low TTL (traceroute, attacks)
ip.ttl == 64Typical Linux TTL
ip.ttl == 128Typical Windows TTL
ip.proto == 6TCP traffic
ip.proto == 17UDP traffic
ip.proto == 1ICMP traffic
ip.flags.df == 1Don’t Fragment set
ip.flags.mf == 1More Fragments set
ip.frag_offset > 0Fragmented packets
ip.checksum_bad == 1Bad checksum

IPv6 Filters

FilterDescription
ipv6All IPv6 traffic
ipv6.addr == fe80::1Source OR destination
ipv6.src == fe80::1Source only
ipv6.dst == ff02::1Destination (all nodes multicast)
ipv6.hlim < 10Low hop limit

ICMP Filters

FilterDescription
icmpAll ICMP traffic
icmp.type == 8Echo Request (ping)
icmp.type == 0Echo Reply
icmp.type == 3Destination Unreachable
icmp.type == 3 && icmp.code == 3Port Unreachable
icmp.type == 11Time Exceeded (traceroute)
icmp.type == 5Redirect (suspicious!)

IGMP Filters

FilterDescription
igmpAll IGMP traffic
igmp.type == 0x22Membership Report v3

Subnet Filters

FilterDescription
ip.src == 10.0.0.0/8Source in 10.x.x.x
ip.dst == 172.16.0.0/12Destination in 172.16-31.x.x
ip.addr == 192.168.0.0/16Either in 192.168.x.x

Combination Examples

FilterDescription
ip.src == 192.168.1.138 && icmpICMP from specific host
ip.addr == 192.168.1.138 && !arpIP traffic, not ARP
ip.ttl < 5 && !icmp.type == 11Suspicious low TTL

3.9 Chapter Summary

Summary

Key Takeaways:

  • Layer 3 handles logical addressing and routing between networks
  • IPv4 header: 20+ bytes, includes TTL, Protocol, Source/Dest IP
  • IP addresses: Network portion + Host portion (defined by subnet mask)
  • CIDR notation: /24 = 255.255.255.0 = 254 usable hosts
  • Private IP ranges: 10.x.x.x, 172.16-31.x.x, 192.168.x.x
  • ICMP: Diagnostics (ping, traceroute) and error reporting
  • TTL prevents packets from looping forever (decremented each hop)

From your PCAP:

  • 192.168.1.x subnet (VoIP devices)
  • 192.168.0.x subnet (different network)
  • 192.168.56.x (VirtualBox)
  • IGMP multicast traffic present

Next: 04_Layer4_TCP_Deep_Dive - TCP 3-Way Handshake, Flags, Flow Control

Graph View

Backlinks