Network Layer and Routing Protocols

Learning Objectives

• Explain the role of the network layer in the OSI model and how it differs from the data link and transport layers
• Describe the key functions of the network layer: logical addressing, routing, fragmentation, and error handling
• Compare distance-vector and link-state routing approaches using RIP and OSPF as concrete examples
• Trace how a router builds and updates its routing table
• Explain why BGP is treated differently from interior routing protocols like RIP and OSPF
• Identify common misconceptions about hop count, convergence, and "best path" selection

Quick Answer

The network layer (Layer 3 of the OSI model) is responsible for getting a packet from a source host to a destination host, even when they sit on completely different networks. It does this through logical addressing (IP addresses) and routing — the process by which routers decide, hop by hop, which path a packet should take. Routing protocols like RIP, OSPF, and BGP are the algorithms routers use to learn about the network and build their routing tables automatically, instead of an administrator typing every route in by hand. Without the network layer, the internet would just be a collection of isolated local networks with no way to talk to each other.

What the Network Layer Actually Does

Definition. The network layer sits between the data link layer and the transport layer in the OSI model (it corresponds to the Internet layer in the TCP/IP model). Its job is end-to-end delivery of packets across multiple, potentially very different, networks — while the data link layer only worries about delivery across a single physical link.

How it works. Every device that sends or receives IP traffic gets a logical address (an IP address) that is independent of its physical hardware address (MAC address). When a packet needs to go somewhere, the network layer figures out the best next hop toward that destination and hands the packet down to the data link layer to actually put it on the wire. It repeats at every router along the path — this hop-by-hop decision-making is what "routing" means.

The core functions are:

1. Logical addressing — assigning IP addresses so devices can be identified independent of the physical network they sit on.
2. Routing — determining the best path from source to destination across possibly many intermediate networks.
3. Fragmentation and reassembly — splitting a packet into smaller pieces when it needs to cross a network whose maximum transmission unit (MTU) is smaller than the packet, and reassembling it at the destination.
4. Error handling and diagnostics — protocols like ICMP report problems (e.g., "destination unreachable," "time exceeded") back to the sender, which is what makes tools like ping and traceroute work.

Concrete example. Say your laptop (IP 192.168.1.10) wants to reach a server at 8.8.8.8. Your laptop doesn't know a full path to Google's network — it just knows to hand the packet to its default gateway (your home router). That router checks its routing table, sees it doesn't have a direct route either, and forwards to your ISP's router. This repeats, router by router, until the packet reaches a router that knows how to reach 8.8.8.8 directly. No single device needs to know the entire path — each just needs to know the next hop.

Real-world example. Every time you run traceroute google.com, you're watching the network layer's hop-by-hop nature directly: each line of output is a router along the path, discovered because that router's TTL-expiry generates an ICMP "Time Exceeded" message back to you.

Why it matters. Without a network layer, you'd need one giant, flat network to connect any two devices — which doesn't scale past a few hundred hosts, let alone billions. Routing is what lets independently-administered networks (your home network, your ISP, Google's data centers) interconnect into a single internet.

Common misunderstanding. Students often think routing "finds a path" once, like a GPS calculating an entire route in advance. It doesn't. Each router makes an independent, local decision — "which neighbor should I send this to?" — based only on its own routing table. There's no router anywhere that knows the complete end-to-end path of a packet.

Routing Protocols

Definition. A routing protocol is the mechanism routers use to automatically learn about the network topology and populate their routing tables, instead of relying on an administrator to configure every route (static routing) by hand.

How it works. Routers running the same routing protocol exchange information with their neighbors — either full routing tables (distance-vector protocols) or descriptions of their directly connected links (link-state protocols). Each router then processes what it receives to decide the best next hop for every known destination network.

Routing protocols generally fall into two families:

• Distance-vector protocols (e.g., RIP) — each router tells its neighbors "here is my distance to every network I know about," and neighbors use that to update their own tables. Simple, but slow to adapt to changes.
• Link-state protocols (e.g., OSPF) — each router floods information about its own direct links to every other router in the area, so every router ends up with a full map of the topology and calculates shortest paths itself.

A third category, path-vector protocols (BGP), is used specifically for routing between autonomous systems on the internet, where "shortest" is less important than policy.

Example: RIP (Routing Information Protocol)

RIP is one of the oldest routing protocols still seen in small/legacy networks. Its mechanics:

1. Routing tables — each router keeps a table of known networks and the number of hops (routers) to reach each one.
2. Periodic updates — routers broadcast their entire routing table to directly connected neighbors every 30 seconds, regardless of whether anything changed.
3. Hop count as the only metric — RIP picks the path with the fewest hops, even if that path is slower (e.g., a 3-hop path over a slow serial line "wins" over a 4-hop path over a fast link).
4. Maximum hop count of 15 — any network 16 hops away is considered unreachable. This caps RIP's usable network size and helps prevent routing loops.

Worked example. Router A connects Network 1 and Network 2. Router B connects Network 2 and Network 3. Initially, A doesn't know Network 3 exists. When B advertises its routing table to A, A learns "Network 3 is 1 hop away via B" and adds that entry. A then advertises this back out, and B learns about Network 1 through A. This keeps happening every 30 seconds until every router's table stabilizes — this stabilization process is called convergence, and RIP's convergence is notoriously slow (it can take minutes in a larger network) because updates only crawl outward one hop per 30-second cycle.

Why it matters. RIP illustrates the simplest possible routing algorithm, which makes it a great teaching tool, but its slow convergence and hop-count-only metric make it a poor choice for anything beyond a small, simple network today.

Common misunderstanding. Students often assume "fewest hops" always means "fastest path." It doesn't — RIP has no concept of bandwidth or latency, so it can happily route traffic over a slow link if it has fewer hops than a faster, longer path.

Example: OSPF (Open Shortest Path First)

OSPF is the modern replacement for RIP inside most enterprise networks.

1. Link-State Advertisements (LSAs) — each router describes its own directly connected links (and their cost) and floods this information to every other router in its area.
2. Link-State Database — every router assembles the LSAs it receives into an identical map of the topology.
3. Dijkstra's shortest-path algorithm — each router independently runs Dijkstra's algorithm on that map to compute the shortest path (by configurable cost, often based on bandwidth) to every destination.
4. Areas — large OSPF networks are divided into areas (Area 0 is the backbone) to limit how far LSAs need to flood, which keeps overhead manageable as the network grows.
5. Fast convergence — because routers react to specific LSA changes rather than waiting for a periodic full-table broadcast, OSPF adapts to topology changes in seconds rather than minutes.

Real-world example. Large enterprise networks and ISPs commonly run OSPF (or its cousin IS-IS) internally to route traffic across their own routers, precisely because it scales and converges far better than RIP.

Why it matters. OSPF's use of actual link cost (not just hop count) means it can route around a slow or congested link even if that path has more hops — a meaningfully better real-world outcome than RIP.

Common misunderstanding. Some students think OSPF eliminates hierarchy issues entirely with a single flat area. In practice, without areas, LSA flooding and Dijkstra recomputation on very large single-area networks becomes expensive — hierarchy (splitting into areas) is what makes OSPF scale.

BGP and the Big Picture

BGP (Border Gateway Protocol) is different from RIP and OSPF: it's an exterior gateway protocol, used to route between autonomous systems (ASes) — independently administered networks like ISPs, universities, or large companies. Rather than picking the mathematically shortest path, BGP path selection is driven heavily by business policy (peering agreements, cost, and administrative preference), which is why "shortest AS path" is only one of many tie-breaking factors BGP considers. BGP is what literally holds the internet together — it's how your ISP knows how to reach Google's network, and vice versa.

Key Terms

Term	Definition
Network layer	Layer 3 of the OSI model; responsible for logical addressing and end-to-end routing of packets across networks.
Logical addressing	Assigning IP addresses to devices, independent of physical hardware (MAC) addresses.
Routing table	A router's local list of known networks and the next hop/interface used to reach each.
Hop count	The number of routers a packet must pass through to reach its destination; RIP's only metric.
Convergence	The state where all routers in a network have consistent, up-to-date routing information after a topology change.
Distance-vector protocol	A routing protocol (e.g., RIP) where routers share their full routing table with neighbors periodically.
Link-state protocol	A routing protocol (e.g., OSPF) where routers flood information about their own links so every router can build a full topology map.
LSA (Link-State Advertisement)	A message OSPF routers use to describe their directly connected links to the rest of the area.
Dijkstra's algorithm	A shortest-path graph algorithm used by link-state protocols like OSPF to compute optimal routes.
Autonomous System (AS)	An independently administered network (e.g., an ISP) with its own routing policy, identified by an AS number.
BGP	Path-vector protocol used to route between autonomous systems across the internet.
Fragmentation	Splitting a packet into smaller pieces to fit within a network segment's maximum transmission unit (MTU).
ICMP	Internet Control Message Protocol; used for network diagnostics and error reporting (e.g., ping, traceroute).

Common Mistakes

Misconception	Why it's wrong	Correct understanding
"Routing protocols find the complete end-to-end path in advance."	Each router only makes a local, hop-by-hop decision based on its own routing table — no router computes or stores the full path.	Routing is a distributed, iterative process; the "path" only becomes evident by following each router's individual next-hop decision.
"RIP's hop count always means the fastest route."	RIP has no concept of bandwidth or latency — it only counts routers, so a slow 2-hop link "beats" a fast 3-hop link.	Link-state protocols like OSPF use configurable cost (often tied to bandwidth), producing genuinely faster paths, not just fewer hops.
"BGP picks routes the same way OSPF does — shortest path wins."	BGP is a path-vector protocol driven by policy (peering agreements, business relationships), not pure path length.	BGP considers AS-path length as only one of several attributes; administrative policy often overrides the "shortest" path.

Comparison and Connections

Protocol	Type	Metric	Convergence Speed	Typical Use
RIP	Distance-vector (interior)	Hop count (max 15)	Slow (minutes)	Small/legacy networks
OSPF	Link-state (interior)	Cost (often bandwidth-based)	Fast (seconds)	Enterprise/ISP internal routing
EIGRP	Advanced distance-vector (interior)	Composite (bandwidth, delay, etc.)	Fast	Cisco-centric enterprise networks
BGP	Path-vector (exterior)	Policy + AS-path attributes	Slow to moderate	Routing between autonomous systems (the internet backbone)

Practice Questions

Recall

1. What are the four key functions of the network layer? Answer guidance: Logical addressing, routing, fragmentation, and error handling (e.g., via ICMP).
2. What is the maximum hop count in RIP, and what happens beyond it? Answer guidance: 15 hops; any network 16+ hops away is considered unreachable, which caps network size and limits routing loops.

Understanding

3. Explain why OSPF converges faster than RIP. Answer guidance: OSPF reacts immediately to specific LSA changes and floods only the change; RIP waits for periodic (30-second) full-table broadcasts that propagate slowly hop by hop.
4. Why is BGP classified separately from RIP and OSPF rather than just being "a bigger link-state protocol"? Answer guidance: BGP routes between independently administered autonomous systems and is policy-driven (business agreements, cost, filtering) rather than purely metric-driven like interior protocols.

Application

5. A network has two paths to a destination: Path A is 2 hops but only 1 Mbps; Path B is 3 hops but 100 Mbps. Which would RIP choose, and which would OSPF likely choose? Explain. Answer guidance: RIP chooses Path A (fewer hops, metric-blind to bandwidth). OSPF would likely choose Path B because its cost metric typically factors in bandwidth, making the higher-bandwidth path cheaper despite more hops.
6. You run traceroute to a website and see the packet passing through 12 routers. What does this tell you about the network layer's operation? Answer guidance: Each router made an independent next-hop decision; TTL expiry at each hop triggered an ICMP Time Exceeded reply, which is how traceroute reconstructs the hop-by-hop path.

Analysis

7. Compare distance-vector and link-state routing in terms of information shared, computation location, and scalability. Answer guidance: Distance-vector shares full tables with neighbors only, computation is distributed and incremental (Bellman-Ford style); link-state floods link info to all routers in the area, each computes the full map independently (Dijkstra), which scales better but requires more memory/CPU per router.
8. Why might an organization deliberately configure static routes instead of relying entirely on a routing protocol? Answer guidance: Static routes are predictable, secure (no risk of protocol misconfiguration or spoofed advertisements), and useful for small/stub networks with only one path out (e.g., a default route to an ISP) where dynamic protocol overhead isn't justified.

FAQ

Q: Is the network layer the same as "the internet"? No. The network layer is one layer of the OSI/TCP-IP model responsible for addressing and routing. The internet is the actual global collection of interconnected networks that relies on the network layer (specifically IP, plus routing protocols like BGP) to function.

Q: Why doesn't everyone just use OSPF instead of RIP? Most large networks do prefer OSPF. RIP survives mainly in very small or legacy networks because it's dead simple to configure and doesn't need administrators to understand areas, cost metrics, or link-state databases.

Q: Can a router run multiple routing protocols at once? Yes — this is common in real networks (e.g., OSPF internally and BGP toward the ISP). Routers use administrative distance to decide which protocol's route to trust when multiple protocols report a route to the same destination.

Q: What's the difference between a routed protocol and a routing protocol? A routed protocol (like IP) is what actually gets forwarded across the network. A routing protocol (like OSPF or BGP) is what routers use to build the routing tables that decide how to forward that traffic. Easy to mix up — the names are almost identical.

Q: Does fragmentation still happen a lot today? Less than it used to. Modern hosts use Path MTU Discovery to find the largest packet size that will travel without fragmentation, avoiding it proactively, but the network layer still supports fragmentation as a fallback mechanism.

Quick Revision

• Network layer = Layer 3, handles logical addressing, routing, fragmentation, error handling.
• Routing is hop-by-hop and local — no single router knows the complete end-to-end path.
• RIP = distance-vector, hop count only, max 15 hops, 30-second periodic updates, slow convergence.
• OSPF = link-state, uses LSAs + Dijkstra's algorithm, supports areas, converges fast, cost-based metric.
• BGP = path-vector, routes between autonomous systems, policy-driven not just shortest-path.
• Interior protocols (RIP, OSPF, EIGRP) route within one organization's network; exterior protocols (BGP) route between organizations.
• Convergence = time for all routers to agree on current topology after a change.
• ICMP carries error/diagnostic messages (ping, traceroute, destination unreachable).
• Fragmentation splits packets to fit a network's MTU; reassembled at the destination.
• Static routes are manually configured; dynamic routes are learned automatically via a routing protocol.

Related Topics

Prerequisites

• OSI and TCP/IP Models
• Data Link Layer
• IP Addressing and Subnetting

Related Topics

• Transport Layer Protocols
• Network Security and Cryptography
• Internet of Things (IoT) Networking

Next Topics

• Transport Layer Protocols
• Application Layer Protocols
• Network Design and Architecture