Network Layer Protocols and Routing
Addressing and routing dominate this domain: subnetting arithmetic, protocol behaviour, and the operational differences between RIP, OSPF and BGP. Expect one or two multi-step subnetting questions.
IPv4 header and helper protocols
- Minimum header 20 bytes; key fields are TTL, protocol (1 ICMP, 6 TCP, 17 UDP, 89 OSPF), identification/flags/fragment offset, header checksum.
- ARP resolves IPv4 to MAC with a broadcast request and unicast reply; gratuitous ARP announces an address and detects duplicates.
- ICMP: echo request/reply (8/0), destination unreachable (3), time exceeded (11) - the basis of ping and traceroute.
Addressing and subnetting
- Classes are legacy; CIDR notation governs. RFC 1918 private space: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16. APIPA 169.254.0.0/16 signals DHCP failure.
- Usable hosts per subnet = 2^h − 2. VLSM allocates the largest requirement first; route summarisation must cover whole prefixes.
Routing protocols
- RIP: distance vector, hop count, maximum 15 (16 = unreachable), updates every 30 s over UDP 520; mitigations include split horizon and poison reverse.
- OSPF: link state, Dijkstra SPF, hierarchical areas with area 0 as backbone, cost = reference bandwidth (10^8) / interface bandwidth, Hello 10 s / Dead 40 s on broadcast links, DR/BDR election by priority then router ID.
- BGP: path vector, runs over TCP 179, used between autonomous systems; eBGP for inter-AS, iBGP for intra-AS.
NAT, multicast, IPv6
- Static NAT is one-to-one; dynamic NAT uses a pool; PAT uses ports to multiplex many hosts on one address - the home/office norm.
- Multicast 224.0.0.0/4 with IGMP for group membership; 224.0.0.1 is all-hosts.
- IPv6 is 128 bits, colon-hexadecimal, no broadcast (multicast and anycast instead), NDP replaces ARP, and EUI-64 can derive interface IDs.
Worked example
Split 192.168.1.0/24 into /26. The block size is 64, so subnets are .0, .64, .128, .192, each with 2^6 − 2 = 62 usable hosts. For 192.168.1.64/26: network .64, first host .65, last host .126, broadcast .127. A requirement for five subnets of 50 hosts cannot use /26 across a /24 - you would use VLSM.
Traps that cost marks
- Forgetting to subtract 2 for network and broadcast addresses.
- Writing RIP's unreachable metric as 15 rather than 16.
- Assuming OSPF cost scales above 100 Mbps without changing the reference bandwidth.
- Treating BGP as an interior gateway protocol.