IP Addressing, Fragmentation, Routing and the Support Protocols
The network layer has one job — get a packet across networks it does not control — and three examinable consequences. Addressing is arithmetic on prefixes: CIDR replaced fixed classes with a slash length, and once you can turn
/27 into a mask, a network address, a broadcast address and a host count, most addressing questions are two lines of work. The one habit that makes it reliable is to work in the octet the prefix falls in and leave the others alone. Fragmentation exists because each link has its own MTU and a datagram may be larger than the next one, and it is the place where a specific detail decides the answer: the offset field counts units of 8 bytes, not bytes, so every fragment except the last must carry a payload that is a multiple of 8. Routing is the layer’s real algorithm, and the syllabus names two families that compute the same shortest paths by opposite means. Link state floods the topology so every router runs Dijkstra on a complete map. Distance vector never sees the map: each router knows only its neighbours’ claims and applies Bellman–Ford, which converges to the same answers and fails in a characteristic way when a link dies — the count to infinity, where two routers each believe the other still has a route and their estimates climb one hop at a time. Then the support protocols, which are best remembered by the question each answers: ARP maps an IP address to a MAC address on this link, DHCP hands a host its address in the first place, ICMP reports what went wrong, and NAT lets many private hosts share one public address by rewriting ports.Fragmentation, and the Field That Counts Eights
When a datagram is larger than the next link’s MTU, a router splits it. Three header fields carry the result: identification (the same in every fragment of one datagram), fragment offset (where this fragment’s data begins), and the more fragments flag. The detail that decides most questions is that offset is measured in units of 8 bytes, so every fragment except the last must carry a data length that is a multiple of 8 — and the header is repeated in each fragment, so it is the payload that gets divided, not the total length.
| Fragment | Data bytes | Total length | Offset field | MF |
|---|---|---|---|---|
| 1 | 1480 | 1500 | 0 | 1 |
| 2 | 1480 | 1500 | 185 | 1 |
| 3 | 1020 | 1040 | 370 | 0 |
🧠 The whole computation in four steps
For a datagram of total length 4000 with a 20-byte header over MTU 1500: (1) the payload to carry is 4000 − 20 = 3980 bytes. (2) Data per fragment is MTU − header = 1480, rounded down to a multiple of 8 — 1480 is already a multiple of 8, so it stays 1480. (3) The fragment count is ⌈3980 / 1480⌉ = 3, carrying 1480 + 1480 + 1020. (4) Offsets are the byte position divided by 8: 0/8 = 0, 1480/8 = 185, 2960/8 = 370, and MF is 1 on all but the last. Two checks catch most mistakes. Add the data back: 1480 + 1480 + 1020 = 3980 ✓. And confirm the last fragment’s total length includes its own header — 1020 + 20 = 1040, not 1020. When the MTU minus header is not a multiple of 8, step 2 bites: MTU 700 gives 680 exactly, but MTU 576 gives 556 which rounds down to 552, and using 556 puts every offset after the first one wrong.Two Algorithms, One Answer, One Failure Mode
Take the graph with links A–B 2, A–C 5, B–C 1, B–D 3, C–D 2, D–E 4. Link state floods the topology, so every router ends up with the whole graph and runs Dijkstra locally: from A the nodes become permanent in the order A(0), B(2), C(3), D(5), E(9), and the shortest-path tree has parents B←A, C←B, D←B, E←D — note that A reaches C through B for 3, not directly for 5. Distance vector never sees the graph: each router starts knowing only its own links and repeatedly applies Bellman–Ford to its neighbours’ advertised vectors. After one round A already has B 2, C 3, D 5 and E unreachable; after the second round E appears at 9; the third round changes nothing, so it has converged in two rounds to exactly Dijkstra’s answer. Same distances, opposite information: one algorithm needs the map, the other needs only its neighbours to be honest.
| Round | to B | to C | to D | to E |
|---|---|---|---|---|
| 1 | 2 | 3 (via B, not 5 direct) | 5 | ∞ |
| 2 | 2 | 3 | 5 | 9 |
| 3 | 2 | 3 | 5 | 9 — converged |
🎯 Count to infinity, traced: fourteen rounds to say “unreachable”
Distance vector’s failure is not slowness in general — it converged in two rounds above — it is what happens when a link dies. Take the chain A–B–C with cost 1 on each link: A reaches C at 2 via B, and B reaches C at 1 directly. Now B loses its link to C. B has no direct entry left, so it does the only thing it can: it believes a neighbour, and A is still advertising 2, so B records 1 + 2 = 3. A then hears B claim 3 and records 1 + 3 = 4. B hears 4 and records 5. Traced synchronously, the pair climbs (2,3), (4,3), (4,5), (6,5), (6,7) … and reaches the metric cap of 16 only at round 14. Neither router is wrong given what it knows; the defect is that neither can tell that the other’s route runs back through itself. Two fixes follow directly from that diagnosis. A metric cap — RIP calls 16 infinity — guarantees the climb terminates, which is why RIP cannot be used on a network more than 15 hops across. And split horizon attacks the cause: never advertise a route back to the neighbour you learned it from, so A stops telling B about a path that goes through B. Link state does not have this failure at all, because a router recomputes from a topology rather than from claims.| Property | Link state (OSPF) | Distance vector (RIP) |
|---|---|---|
| What a router knows | The whole topology | Only its neighbours’ distance vectors |
| Algorithm run locally | Dijkstra | Bellman–Ford |
| What is sent, and to whom | Link costs flooded to everyone | Whole table, to neighbours only |
| Count to infinity | Cannot happen | Happens; needs a cap and split horizon |
| Cost of the approach | Memory and CPU for the full map | Slow reconvergence after a failure |
ARP, DHCP, ICMP and NAT — One Question Each
| Protocol | The question it answers | Detail that gets examined |
|---|---|---|
| ARP | I have an IP address on this link — what is its MAC? | The request is a broadcast, the reply a unicast; results are cached |
| DHCP | I have no address at all — give me one | Four steps: discover, offer, request, ack; the lease expires |
| ICMP | Something went wrong — report it | Carries no user data; ping and traceroute are built on it |
| NAT | Many private hosts, one public address — share it | Rewrites address and port, so it breaks inbound connections |
⚠️ ARP is not a network-layer protocol, and traceroute is not a protocol at all
Three placement questions come up repeatedly. ARP resolves an IP address to a MAC address, which makes it sit between the layers — it is usually classified as a data link layer protocol (or as layer 2.5) because its whole job is to fill in a link-layer header, and it is confined to a single link: an ARP request never crosses a router, which is why a host needs its default gateway’s MAC and not the destination’s. ICMP is carried inside IP datagrams, which makes it look like a transport protocol, but it is a network layer protocol — it reports on IP’s behalf and offers nothing to applications, and it has no port numbers, which is the cleanest test. And traceroute is not a protocol: it is a technique that sends packets with deliberately small TTL values so each router in turn replies with an ICMP time-exceeded message. The examinable consequence of NAT is worth stating plainly too: because it rewrites the source port and remembers the mapping, an inbound connection to a private host has no entry to match and fails — NAT is not a firewall, but it behaves like one by accident.Key takeaways
- For /n: mask is n ones, hosts are 232−n − 2, and the block size is 232−n in the prefix octet.
- 200.10.11.144/27 → network .128, broadcast .159, 30 usable hosts. Use block size 32, no binary.
- A /22 broadcasts in the third octet: 10.0.0.0/22 ends at 10.0.3.255, not 10.0.0.255.
- The fragment offset counts 8-byte units, so all but the last fragment carry a multiple of 8.
- 4000 bytes over MTU 1500 → 3 fragments, offsets 0, 185, 370, last total length 1040.
- Link state runs Dijkstra on a flooded map; distance vector runs Bellman–Ford on neighbours’ claims.
- Both compute identical shortest paths — the difference is what each router has to know.
- Count to infinity climbs one hop per exchange; a metric cap terminates it, split horizon prevents it.
- An ARP request is a broadcast and never crosses a router; ICMP has no port numbers.
- NAT rewrites address and port, which is why unsolicited inbound connections fail.
Practice questions (8)
Attempt each one before opening the answer. Every explanation names the tempting wrong option as well as the right one, because that is where marks are lost.
A host has the address 200.10.11.144 with prefix /27. The number of usable host addresses in its subnet is ______
Numerical answer — type the value.
Show answer
Answer: 30
30. With /27 there are 32 − 27 = 5 host bits, giving 2⁵ = 32 addresses in the block, of which the network address and the broadcast address are not assignable: 32 − 2 = 30. The block itself is found without binary: the block size in the last octet is 32, so networks begin at 0, 32, 64, 96, 128, 160 …; the address 144 lies in the block starting at 128, so the network is 200.10.11.128, the broadcast is 160 − 1 = 200.10.11.159, and the usable range is .129 to .158 — thirty addresses, which you can also count directly as a check. The answer 32 forgets to subtract the two reserved addresses. The answer 62 solves for /26 instead, which is the neighbouring case and worth distinguishing by the block-size step rather than by recall.An IPv4 datagram of total length 4000 bytes (including a 20-byte header) must cross a link with MTU 1500 bytes. The fragment offset field of the last fragment is ______
Numerical answer — type the value.
Show answer
Answer: 370
370. The payload to carry is 4000 − 20 = 3980 bytes. Each fragment can hold MTU − header = 1480 data bytes, and 1480 is already a multiple of 8, so it needs no rounding. That gives ⌈3980 / 1480⌉ = 3 fragments carrying 1480, 1480 and 1020 bytes. The last fragment’s data begins at byte 1480 + 1480 = 2960, and the offset field counts 8-byte units, so it holds 2960 / 8 = 370. Two errors are common and both are worth guarding against. Answering 2960 reports the byte position and forgets the division by 8 — the field is defined in eight-byte units precisely so that 13 bits can address a 65 535-byte datagram. And answering 371 or 369 usually follows from mis-splitting the payload; check by adding it back, 1480 + 1480 + 1020 = 3980 ✓. Note the last fragment’s total length is 1020 + 20 = 1040, since the header is repeated in every fragment, and its MF flag is 0 while the first two carry MF = 1.In the network with links A–B 2, A–C 5, B–C 1, B–D 3, C–D 2, D–E 4, the shortest distance from A to E is:
Show answer
Answer: B — 9
9, via A→B→D→E for 2 + 3 + 4. Run Dijkstra and the nodes become permanent in the order A(0), B(2), C(3), D(5), E(9). The step worth noticing is C: the direct link A–C costs 5, but A–B–C costs 2 + 1 = 3, so the shortest path to C does not use the direct edge at all — which is exactly the kind of thing a glance at the diagram misses. For D there are two candidates, A–B–D at 2 + 3 = 5 and A–B–C–D at 3 + 2 = 5, a tie at 5 either way, so E is 5 + 4 = 9. Option A (11) comes from routing through the direct A–C edge, 5 + 2 + 4. Option C (10) usually follows from taking D as 6. A useful cross-check: distance vector on the same graph converges to the same answer in two rounds — round 1 gives A its neighbours’ bests (B 2, C 3, D 5, E unreachable) and round 2 brings E in at 9 — because both algorithms compute shortest paths and differ only in what information each router holds.Which of the following are true of distance vector routing?
Show answer
Answer: A — A router sends its entire table, but only to its immediate neighbours; B — It can suffer the count-to-infinity problem when a link fails; D — Split horizon prevents a router advertising a route back to the neighbour it learned it from
A, B and D. A captures the exact contrast with link state, which floods link costs to everyone while distance vector sends the whole table to neighbours only — both halves of that sentence are part of the distinction. B is the characteristic failure, traced on A–B–C: when B loses its link to C, the two routers’ estimates climb 2,3 then 4,3 then 4,5 … reaching a cap of 16 only at round 14, because neither can tell the other’s route runs back through itself. D is the fix aimed at that cause, and it works precisely because the problem is a router believing a path that goes through the listener. C is false, and it is the option worth being careful about: both algorithms compute the same shortest paths — on the graph above both give A→E = 9 — because Bellman–Ford and Dijkstra solve the same problem. What differs is the information each router holds and how badly each copes with a failure, not the answer they converge to.The blocks 200.10.11.0/25 and 200.10.11.128/25 are aggregated into a single prefix. The result is:
Show answer
Answer: B — 200.10.11.0/24
200.10.11.0/24. Each /25 holds 128 addresses; the first covers .0 to .127 and the second .128 to .255, so together they cover exactly .0 to .255 — which is one /24 and nothing more. Aggregation always moves the prefix shorter by one bit when two blocks of equal size are adjacent and the first begins on a boundary of the merged size, so two /25s make a /24, two /24s make a /23, and so on. Option A moves the wrong way: a longer prefix is a smaller block, so /26 covers only 64 addresses and could not hold even one of the inputs. Option C is one bit too far — a /23 would span 200.10.11.0 through 200.10.12.255 and would claim addresses the two inputs do not include, which matters because advertising a supernet you do not own attracts traffic you cannot deliver. Option D would be right if the blocks were not adjacent, or if the lower one did not start on a /24 boundary; here both conditions hold.A host wants to send an IP packet to a destination on a different network. Whose MAC address does it put in the frame?
Show answer
Answer: B — Its default gateway’s MAC address, obtained by ARP on the local link
The default gateway’s MAC address. A MAC address is only meaningful on the local link, and an ARP request never crosses a router — so the sender cannot learn a remote host’s MAC even in principle, which rules out option A. The addressing therefore splits across two layers and this is the central idea: the IP destination stays the final destination for the whole journey, while the MAC destination changes at every hop to the next router along the way. The host ARPs for its gateway, frames the packet to that MAC, and the gateway strips the frame, looks up the IP destination, ARPs on the next link, and reframes. Option C would be wasteful and unnecessary — ARP already used a broadcast to find the gateway, and once the MAC is cached the frame is a unicast. Option D forgets that the packet has to cross a link at all, and every link-layer frame needs a link-layer destination.Why does an unsolicited inbound connection to a host behind NAT normally fail?
Show answer
Answer: B — Because the translation table has no entry to map the incoming port to a private host
NAT builds its table from outbound traffic: when an internal host opens a connection, NAT rewrites the source address and port and records the mapping so replies can be sent back. An unsolicited inbound packet arrives at the public address with a port the table has never seen, so there is nothing to translate it to and it is discarded — which is why incoming services behind NAT need an explicit port-forwarding entry, and why NAT behaves like a firewall by accident rather than by design. Option A invents a function NAT does not have; it rewrites headers and leaves the payload alone. Option C is a true statement about private addresses that does not explain this failure — the packet is addressed to the public address and arrives perfectly well; the problem is what happens next. Option D would break outbound TCP too, which plainly works.Which protocol does
tracerouterely on to discover the routers along a path?Show answer
Answer: B — ICMP
ICMP.tracerouteis a technique, not a protocol: it sends packets with a TTL of 1, then 2, then 3, and each router that decrements the TTL to zero discards the packet and reports back with an ICMP time-exceeded message, whose source address names that router. Collecting those replies in order reconstructs the path. Option D is the distinction the question is testing — nothing in any stack is called the traceroute protocol. Option A is confined to a single link and could never report on a remote router; an ARP request does not cross a router at all. Option C answers a different question entirely: DHCP assigns a host its own address at startup. Worth noting alongside:pingis built on ICMP too, using echo request and echo reply, and the reason ICMP can carry both is that it is a network layer protocol reporting on IP’s behalf — which is also why it has no port numbers.