The network layer answers one question billions of times per second: given a destination address, which way does this packet go next? This page is the course-level treatment of that machinery — addressing and CIDR, the longest-prefix-match rule, interior and exterior routing protocols, and the NAT layer that reshaped the internet's addressing economy. The transport layer above it is covered in TCP/IP Fundamentals and TCP Congestion Control.
An IPv4 address is 32 bits; CIDR notation (192.168.0.0/24) says the first 24 bits are the network prefix and the rest identify hosts within it. The prefix length is the whole story: a /24 holds 254 usable hosts (two addresses reserved for network and broadcast), a /16 holds 65,534, and every halving of hosts adds one prefix bit. Subnetting splits an allocation into smaller prefixes (10.0.0.0/8 → departmental /16s → rack-level /24s); the arithmetic is binary masking, and fluency with it is the difference between reading a routing table and guessing. Private ranges (10/8, 172.16/12, 192.168/16) plus NAT are why the IPv4 internet still functions; IPv6's 128-bit space removes the scarcity (a standard site gets a /56, every LAN a /64) but the prefix logic is identical.
A router's forwarding table maps prefixes to next hops. For each packet, the router picks the most specific matching prefix — longest-prefix match. A default route is just 0.0.0.0/0, the least specific prefix of all, chosen only when nothing better matches. This single rule composes everything: aggregation (advertise one /16 instead of 256 /24s), traffic engineering (advertise a more-specific prefix to attract traffic), and the classic outage pattern (a leaked more-specific route hijacks traffic — the mechanism behind several famous BGP incidents). Hardware does the lookup with tries and TCAMs — the trie data structure earning its keep at line rate.
Within one administrative domain, routers run an interior gateway protocol to learn the topology and compute paths:
Costs are link weights, so "shortest" is whatever the operator encodes — bandwidth, latency, or policy.
Between autonomous systems (ASes — ISPs, clouds, large enterprises), the internet runs BGP, and its defining property is that it is a policy protocol, not a shortest-path one: routes carry the AS path (loop prevention + rough distance), and each AS applies business logic — prefer customer routes over peer routes over provider routes — before path length is even consulted. Consequences worth knowing: global convergence takes minutes, not milliseconds; announcements are trust-based, so prefix hijacks happen (RPKI origin validation is the slowly-deploying fix); and multihoming/anycast (announcing one prefix from many locations — how DNS roots and CDNs work) are BGP-native tricks. Cloudflare-style tunnels sidestep all of this for origin servers — the reason the home-lab model needs no inbound routing at all.
NAT rewrites private source addresses to a public one, tracking flows in a translation table keyed by (protocol, ports). It conserves addresses and incidentally acts as a stateful inbound filter — but breaks the end-to-end model: inbound connections need port forwarding, protocols embedding addresses need helpers, and peer-to-peer needs STUN/TURN-style traversal. Carrier-grade NAT stacks this twice. IPv6 restores end-to-end addressing; dual-stack deployment means engineers live with both indefinitely.
Routing delivers a packet to the destination's subnet; ARP (IPv6: Neighbor Discovery) then resolves the IP to a MAC address for final link-layer delivery, and switches forward frames by learned MAC tables. The layering discipline pays in diagnosis: ip route get answers "which way would it go," traceroute shows where the path dies, arp/ip neigh covers the last hop — the troubleshooting toolkit walks the same layers this page describes.