Network Layer: Building Blocks of the Internet
===
Topics Covered: IP, Addressing, NAT
## Overview of Responsibilities
Network layer protocol runs in every single device connected to the Internet. This includes hosts and routers. Therefore, all TCP/UDP/QUIC packets are encapsulated within IP packets. The network layer is also tasked with decapsulating received IP packets, and delivering the contents to the transport layer.

**Aside**: Remember from discussion, a good way to conceptualize encapsulation is that the layer above is placed in the payload of the layer below. From project one, you implemented the HTTP (application layer) protocol within the payload of the TCP packet sent over the `SOCK_STREAM` (connection-based) protocol. In project two, you will implement the security layer (TLS-ish) within the payload of a UDP packet, and within that security layer, its payload will contain the encrypted file contents.
## The IP Packet
The format of the IP packet is not super important, aside for a few features.
- The **IP version number** determines whether we are using IPv4 or IPv6.
- The **TTL** (time to live) is determined by a maximum number of remaining hops it can take.
- There is a **protocol** header which determines what the upper layer protocol is. Usually it's either TCP or UDP.
- **Source** and **destination** IP addresses. Self explanatory.

The above are headers. In the payload, we usually have a TCP or UDP packet, with its own headers.

We also have an options field, where we can store options for TCP such as whether we use selective ACK, or choosing values for flow control (window size).

## Addressing
### IPv4
32 bits long (4 bytes), uniquely identifying a host or router *inferface*. An interface is any connection between a host/router and a physical link.

Modern addressing revolves around the idea of a subnet. This involves splitting the address space into two parts. Each individual network is identified by its Network ID. Note that a subnet is assigned a block of IP addresses, but not all blocks of IP addresses necessarily belong to the same subnet.
CIDR is the way we define this separation (it's just the slash notation). It states that the network ID can be some arbitrary number of bits, and we denote this using `/x` notation, where `x` is the number of bits. Backbone routers (routers which exist to forward internet traffic) pretty much only use the most specific network ID available. Additionally, each subnet has two reserved addresses. The broadcast address is the last address within the block (remaining bits after the network ID all 1's) and the network address is the first address (remaining bits after network ID all 0's).

Let's do a quick example.

Say we have a subnet A defined as `200.23.16.0/23`. We are trying to forward a packet to `200.23.16.100`, we would know it's within that subnet. If we have to choose between subnet B `200.23.16.96/27` and subnet A, we would pick subnet B, since it is more specific. Why? If we allocate 27 bits, then we are left with 5 bits, so the possible address space is 2^5 = 32 - 2. Remember to subtract two, for the broadcast and network addresses. Using the same logic, calculate the size and range of the address space of A on your own.

### IPv6
IPv6 tries to solve the issue of running out of IPv4 addresses, but also simplifies the IP header. Instead of being variable length, the header is fixed 40 bytes. This includes 20 bit flow label, next header (protocol of upper layer), and 8 bits priority. The checksum is removed. Options are also moved outside the header.


There's one big issue though. A lot of the Internet still runs on IPv4. So how can we gradually introduce IPv6 while still maintaining compatibility? One easy solution is IP tunneling.

Let's say we have two IPv6 networks, but to communicate between them we must go through an IPv4 network.


Our first IPv6 host sends a packet with source IP `2002:c0a8:101:1::1` and destination IP `4002:c0a8:202:2::2`. Our devices A and B are dual-stack routers, meaning they understand and speak both IPv4 and IPv6. Router A encapsulates the IPv6 header within an IPv4 header with IP `12.34.5.6`. Router A knows B's public IPv4 is `78.9.10.11`. So our source address over the tunnel is `12.34.5.6` and destination address is `78.9.10.11`, with our original IPv6 source and destination encapsulated. Once we reach B, B will decapsulate, and forward the packet to the correct IPv6 host with the original headers. Tunneling can also be used in VPNs, which we will discuss in discussion further with an example :)

## NAT
We're running out of IPv4 addresses to hand out. NAT (Network Address Translation) helps solve some of these issues, and also introduces a bit of security/privacy. This is a bit of a hack, with IPv6 as the main long-term goal.

There exist some address spaces specifically reserved for private addresses (`10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`). What makes these private? Remember that each router interface has an IP address assigned to it. In the case of a private network, say you have one physical link to the rest of the Internet on your router. That interface has a public IP address, which is reachable by any host or router connected to the Internet. That router knows about your private network addresses, and is able to act as a proxy for your IP packet, pretending that it is the source and not your private host. An example should help explain this best.

Let's say we are sending a packet from host `10.20.0.3` with port 3345 on the left, and we want to reach the host on right, `65.23.78.45` on port 80 (web server).

1. `10.20.0.3:3345` sends the packet with source IP `10.20.0.3`, source port `3345`, destination IP `65.23.78.45`, destination port `80`.
2. The NAT router creates an entry in its NAT table, stating that `10.20.0.3, 3345` is translated to `24.65.45.89, 5001` (the **public IP** associated with the interface to the rest of the Internet). The 5001 port number is chosen by the router temporarily, by RFC6056. It then forwards the packet to the next hop, with source IP `24.65.45.89`, source port `5001`, destination IP `65.23.78.45`, destination port `80`.
3. Packet arrives at destination, and the (probably web server) replies with source IP `65.23.78.45`, source port `80`, destination IP `24.65.45.89`, destination port `5001`.
4. After arriving at the NAT router, we can use the translation table entry to determine that port `5001` was created for private host `10.20.0.3`, and we can deliver the packet to that host through our LAN link. Note: after some time, we have to remove the entry from the translation table, or we risk running out of port numbers.

Therefore, private address spaces can allow each private network to use the same address space, as long as these IP addresses are not exposed to the greater Internet as source or destination IPs. One major issue with NAT is that the private hosts are not aware of what their "public" IP is, so it is difficult to develop applications. Host can either learn through UPnP (Plug and Play), or the port allocated by the NAT router for a given private host can be defined statically (pretty bad solution, why?).

## Routing vs Forwarding Addendum
Let's quickly clarify the difference between routing and forwarding.

**Routing**: Filling in the forwarding table for a router with the best path to each destination. So if a router needs to deliver a packet to host A within a network, it knows the optimal path to get there.

**Forwarding**: The actual act of sending the IP packet to the next hop, based on the forwarding table. So if we know the best path from A to C is through B, then we forward the packet from A to B.

#### Next Week's Topics: ICMP, DHCP, Routing Algorithms