IP

1. Learning Objectives

By the end of this lesson, you will be able to:

• Explain the core routing and logical addressing mechanisms of the Internet Protocol (IP) operating at Layer 3 (Network Layer) of the OSI model.
• Understand the structural differences, header formats, and address spaces of IPv4 and IPv6.
• Calculate network ranges, subnets, and host capacities using CIDR (Classless Inter-Domain Routing) notation and subnet masks.
• Analyze how Network Address Translation (NAT) translates private IPs to public IPs and operates NAT tables.
• Identify security flaws like IP spoofing and header injection in reverse proxy setups and safely extract client IPs using X-Forwarded-For.
• Design VPC CIDR blocks that prevent overlapping address spaces and support microservice scaling in production systems.

2. Prerequisites

To get the most out of this lesson, you should have:

• Basic Networking Concepts: Understanding of client-server communication models and IP port numbers.
• Binary and Hexadecimal Basics: Familiarity with binary representations (bits and bytes) and hexadecimal notation used in IPv6.
• OSI Model Knowledge: Basic understanding of the 7-layer OSI networking stack.
• Development Experience: Basic knowledge of backend applications (like Node.js/Express) and HTTP request-response headers.

3. Why This Topic Matters

IP addressing is the foundational plumbing of the global internet and modern cloud infrastructure. In system design, IP configuration is not a trivial detail; it has massive architecture-level implications:

• Cloud Architecture Capacity Planning: Allocating too small a CIDR block (e.g., /28) to your Virtual Private Cloud (VPC) subnets can prevent Kubernetes pods or server instances from scaling up due to IP address exhaustion.
• VPC Peering and VPNs: Overlapping IP address blocks across corporate networks or acquired companies make it impossible to peer VPCs, establish site-to-site VPNs, or route traffic between databases without costly re-addressing or complex NAT proxies.
• Security and Rate Limiting: Inaccurate client IP extraction behind reverse proxies or CDNs leads to massive security loopholes, allowing malicious actors to bypass rate limiters, web application firewalls (WAFs), and geographical access controls using spoofed HTTP headers.
• Modern IPv6 Adoption: With public IPv4 addresses exhausted and cloud providers charging premium hourly rates for them, understanding IPv6 and hybrid (dual-stack) configurations is crucial for reducing infrastructure costs.

4. Real-world Analogy

Think of the Internet Protocol as the global postal mail system:

• Physical Mailing Address (IP Address): Every building has a unique physical address containing a zip code, city, street name, and building number. Similarly, every device on the internet has a unique IP address that specifies its logical location on the network.
• The Sealed Envelope (IP Packet): To mail a letter, you put it in an envelope, write the recipient's address (Destination IP) and your own address (Source IP) on the outside. In networking, data payload is encapsulated inside an IP packet containing source and destination headers.
• Mail Carriers and Sorting Facilities (Routers): Postal workers do not read the letters inside your envelope. They read only the ZIP code (Network Address) and forward the letter from local post offices to regional distribution centers. Similarly, routers inspect the destination IP address and hop the packet across the internet toward the target network.
• Corporate Mailroom (NAT Router): A massive office building might have only one public street address. Incoming mail arrives at the mailroom, which looks at the employee's name (Port Number) and delivers it to their specific desk (Private IP). The mailroom translates the single public address to internal department desk numbers.

5. Core Concepts

To design network-aware systems, you must master the fundamental components of the Internet Protocol:

1. Layer 3 (Network Layer) Protocol

IP operates at Layer 3 of the OSI model. Its primary duty is logical addressing and routing. IP is connectionless (it does not establish a handshake before sending) and best-effort (it does not guarantee delivery, packet order, or error correction). Reliability is delegated to Layer 4 protocols like TCP.

2. IP Address Anatomy (Network ID vs. Host ID)

An IP address is split into two components: the Network ID (which specifies the sub-network) and the Host ID (which identifies the specific device on that sub-network). The boundary between these two is defined by the Subnet Mask.

3. CIDR (Classless Inter-Domain Routing)

In CIDR notation, an IP is written followed by a slash and a number (e.g., 192.168.1.0/24). The number after the slash represents the subnet mask length—i.e., how many of the leading bits are reserved for the Network ID. A /24 subnet mask blocks out the first 24 bits (e.g., 255.255.255.0), leaving 8 bits (32 - 24) for Host IDs. This yields 256 total addresses (254 usable for hosts, after subtracting network and broadcast addresses).

4. Public vs. Private IP Addresses (RFC 1918)

Not all IP addresses can route across the public internet. RFC 1918 defines three private IP address ranges reserved for internal networks:

• Class A: 10.0.0.0 to 10.255.255.255 (Subnet mask: 10.0.0.0/8)
• Class B: 172.16.0.0 to 172.31.255.255 (Subnet mask: 172.16.0.0/12)
• Class C: 192.168.0.0 to 192.168.255.255 (Subnet mask: 192.168.0.0/16)

Private IP addresses are non-routable on the public internet. Routers drop them immediately. To access the internet, devices on private networks must have their source IPs translated to a public IP using Network Address Translation (NAT).

6. Visualization

The diagram below illustrates how Network Address Translation (NAT) bridges the gap between private and public IP addresses. Multiple client machines within a private network run on local RFC 1918 addresses. The NAT Router translates their private source IPs to its single Public IP address, tracking individual outgoing connections via dynamic port allocation in its state table:

Here is the detailed packet lifecycle and state mapping flow during NAT translation:

7. How It Works

An IP packet travels from a source to a destination through a highly standardized sequence of layers, protocols, and routing decisions:

1. Packetization & Header Encapsulation: The operating system's TCP/IP stack takes the application data, segments it at the Transport Layer (adding a TCP or UDP header), and hands it to the Network Layer. The IP protocol adds the IP header containing the Source IP address, Destination IP address, Protocol ID, and Time-To-Live (TTL).
2. Local Subnet Comparison: The source device checks the destination IP address against its own IP address and subnet mask (using a bitwise AND operation). If the destination is on the same local subnet, the host skips Layer 3 routing and uses the Address Resolution Protocol (ARP) to map the destination IP to its physical MAC address, delivering it directly over Layer 2 (Ethernet/Wi-Fi).
3. Forwarding to the Gateway: If the destination IP is outside the local network, the host forwards the packet to its local Default Gateway (a router connecting it to external networks). The host uses ARP to find the default gateway's MAC address and dispatches the packet.
4. Hop-by-Hop Routing: When a router receives the packet:
   • It verifies the IP header checksum.
   • It decrements the Time to Live (TTL) by 1. If TTL reaches 0, the router discards the packet and sends an ICMP "Time Exceeded" packet back to the sender.
   • It inspects its routing table for the longest prefix match corresponding to the destination IP and forwards the packet out the designated network interface.
5. NAT Boundary Crossing (If Applicable): If the packet crosses from a private network (like a home network or VPC) to the public internet, the NAT device modifies the packet header: rewriting the private source IP (and source port) to its own public IP (and a dynamic NAT port), saving this mapping in its translation table.
6. Decapsulation & Application Delivery: Once the packet reaches the target server, the receiving host validates the IP header. It removes (decapsulates) the Layer 3 header and reads the Protocol field (e.g., 6 for TCP, 17 for UDP) to hand the payload to the corresponding Layer 4 transport protocol engine.

8. Internal Architecture

To fully comprehend the mechanics of IP communication, we must inspect the inner workings of IPv4 and IPv6 packet headers and the hardware architectures that process them.

1. IPv4 Header Structure

An IPv4 header contains 20 to 60 bytes of metadata (depending on the presence of Options fields):

2. IPv6 Header Structure (Simplified and Streamlined)

IPv6 replaces IPv4's complex layout with a streamlined, fixed 40-byte header. Routers process IPv6 headers much faster since fields are aligned and options are moved to Extension Headers:

3. Router Internals and Components

To route packets at line-rate, standard routers separate computing responsibilities into distinct functional components:

9. Request Lifecycle

To see how the components operate together, let's trace a client device in a private home network fetching a resource from a backend server inside an AWS VPC:

Phase 1: Local Resolution and Subnet Check

• The client application resolves the server's domain name (e.g. api.example.com) to a public IP address (e.g. 203.0.113.50) via DNS.
• The client checks its own network settings (IP: 192.168.1.75, Subnet Mask: 255.255.255.0). Because the target (203.0.113.50) is on a different subnet, the client directs the packets to the MAC address of its default gateway (the home router).

Phase 2: NAT Translation and WAN Routing

• The home router processes the outgoing TCP SYN packet. Because it is bound for the public internet, the router rewrites the source IP from 192.168.1.75:52001 to its ISP-assigned Public IP (e.g., 198.51.100.99:61234) and registers this translation in its state table.
• The packet traverses intermediate ISP routers, hopping across Autonomous Systems (AS) via the Border Gateway Protocol (BGP). At each router along the path, the TTL field is decremented by 1.

Phase 3: VPC Ingress and Security Rules

• The packet arrives at the Cloud Edge (AWS Internet Gateway). The IGW checks the VPC's routing table and directs the packet to the subnet hosting the Application Load Balancer (ALB).
• Network Access Control Lists (NACLs) evaluate the packet at the subnet boundary. If allowed, security groups evaluate it at the instance/resource boundary.

Phase 4: Load Balancing and Backend Proxying

• The ALB terminates the client's TCP connection. It acts as a reverse proxy, opening a new TCP connection to a backend microservice instance (IP: 10.0.2.14).
• To keep track of the original client's IP address (198.51.100.99), the ALB appends this value to the X-Forwarded-For HTTP header and forwards the request to the backend microservice.

10. Deep Dive

Let's explore key engineering concepts in IP networking that are critical during system design interviews and live infrastructure deployments.

1. Subnetting Math and CIDR Conversions

To divide a network, you borrow bits from the host portion of the IP address and allocate them to the network portion. Consider the block 10.0.0.0/22:

• A /22 mask means the first 22 bits are network bits. The remaining 10 bits ($32 - 22$) are host bits.
• The total number of IP addresses in this block is $2^{10} = 1024$.
• In dot-decimal notation, a /22 mask is 255.255.252.0.
• In standard routing, the first address is the Network Address (e.g. 10.0.0.0) and the last address is the Broadcast Address (e.g. 10.0.3.255). Thus, the number of usable hosts is $2^{10} - 2 = 1022$ (Note: Cloud providers like AWS reserve 5 addresses per subnet, leaving 1019 usable).

2. Path MTU Discovery (PMTUD) and Black Holes

Each network link has a Maximum Transmission Unit (MTU)—the largest frame size it can transmit. The Ethernet standard is 1500 bytes.

To prevent costly intermediate packet fragmentation, hosts perform Path MTU Discovery (PMTUD):

• The source host sends IP packets with the DF (Don't Fragment) bit set to 1 in the IPv4 header.
• If an intermediate router cannot forward a packet because it is larger than the next hop's MTU, it drops the packet and sends back an ICMP Type 3 Code 4 message: "Destination Unreachable (Fragmentation Needed and DF Set)".
• The source host reads this ICMP message and shrinks its outbound packet size accordingly.

The PMTUD Black Hole: Many security administrators configure network firewalls to drop all ICMP packets unconditionally. If these ICMP error messages are dropped, the source host never receives the warning. The TCP connection establishes successfully (since the initial SYN packets are tiny), but when the application attempts to send full-sized data payloads, the packets are silently dropped. The connection hangs indefinitely, causing a "black hole".

3. Unicast vs. Broadcast vs. Multicast vs. Anycast

Packets are routed differently based on the transmission scheme:

• Unicast (One-to-One): The packet is sent to a single designated recipient. This is standard web browsing and database traffic.
• Broadcast (One-to-All): The packet is sent to all hosts in the local subnet (e.g., ARP requests). Broadcast is unsupported in IPv6 (which uses multicast groups instead) and blocked by cloud routers.
• Multicast (One-to-Many): The packet is sent to a dedicated group address. Only hosts that subscribed to the group receive the packet (e.g., media streaming protocols, network discovery).
• Anycast (One-to-Closest): Multiple physically distinct servers are configured with the exact same IP address. Routers announce this IP using BGP. Packets are routed to the physically or topologically closest server. This is used by global DNS servers (e.g. Cloudflare's 1.1.1.1 or Google's 8.8.8.8) and CDNs to terminate connections close to users.

11. Production Example

Let's look at how large-scale tech companies leverage IP features to solve complex infrastructure scaling requirements:

1. Amazon Web Services (AWS) Subnetting Reservations

When setting up a subnet inside an AWS VPC, you must account for AWS's internal networking requirements. In every subnet, AWS reserves 5 IP addresses. For example, in a 10.0.0.0/24 subnet (which has 256 total IP addresses):

• 10.0.0.0: Network address.
• 10.0.0.1: Reserved for the AWS VPC router.
• 10.0.0.2: Reserved for the AWS DNS server (AmazonProvidedDNS).
• 10.0.0.3: Reserved by AWS for future use.
• 10.0.0.255: Network broadcast address (AWS VPC does not support broadcast routing, but retains the address standard).

If you design subnets with a /28 CIDR block, you only get $16 - 5 = 11$ usable addresses, which can quickly block your Kubernetes nodes or server clusters from scaling.

2. Cloudflare's Anycast Edge Network

Cloudflare uses Anycast addressing to absorb massive Distributed Denial of Service (DDoS) attacks. They advertise the exact same IP addresses (like 1.1.1.1) from all of their 300+ data centers worldwide via BGP. If a DDoS attack generates 100 Terabits/second of malicious traffic, BGP routing naturally disperses the load to the closest regional Cloudflare data center, containing the impact locally rather than overwhelming a single centralized location.

3. Netflix and IPv6 Transition

Netflix streams massive volumes of media to mobile devices globally. By migrating their streaming delivery network to IPv6, Netflix bypassed Carrier-Grade NAT (CGNAT) gateways. CGNAT introduces latency, state-table bottlenecks, and packet overhead because mobile carriers must rewrite packet headers for millions of cellular phones sharing a single public IP. Deploying native IPv6 addresses to streaming endpoints reduced connection initiation times and improved video playback stability for subscribers.

12. Advantages

• Universal Compatibility: IP decouples the logical network layer from physical hardware. It operates identically over optical fiber, copper ethernet, satellite links, and cellular networks.
• Extremely Scalable: CIDR enables hierarchical routing. Rather than maintaining routes to every individual device, core internet routers only track broad CIDR ranges, preventing routing tables from growing excessively.
• Connectionless Efficiency: IP does not consume memory or establish state before routing packets. Each packet is handled independently, allowing rapid rerouting if a network link drops.
• IPv6 Elimination of NAT: With its 128-bit address space, IPv6 provides enough addresses for every device on Earth, restoring true end-to-end connectivity without NAT traversal.

13. Limitations

• No Quality of Service (QoS) Guarantees: Standard IP is best-effort. It does not prevent congestion, packet loss, duplicate arrivals, or out-of-order packet delivery.
• Address Exhaustion (IPv4): The 32-bit address space limits IPv4 to 4.3 billion addresses. This requires complex workarounds like NAT, proxy servers, and IP sharing which complicate deployment topologies.
• Plaintext Headers (No Built-in Security): IP addresses, flags, and options are sent in plaintext in the header. Attackers on path can easily sniff routing patterns, inspect source/destination metadata, or perform spoofing attacks.
• Fragmentation Vulnerability: Large IP packets must be fragmented by routers (in IPv4) if a link has a small MTU. This increases CPU usage on routers and risks dropping the entire packet if even a single fragment is lost.

14. Trade-offs

When designing your network architecture, you must balance several core trade-offs:

1. IPv4 vs. IPv6 Adoption

Continuing to run an IPv4-only network avoids immediate migration costs and guarantees compatibility with legacy systems. However, it incurs secondary costs (like cloud provider fees for public IPv4s and complex NAT routing maintenance). Migrating to IPv6 or a dual-stack configuration eliminates NAT bottlenecks but requires complex firewall updates, dual-stack configurations, and routing changes.

2. CIDR Range Allocation: Large vs. Small Subnets

Allocating a large CIDR block (e.g., /16) to your development VPC ensures you never run out of IP addresses when provisioning new microservices or containers. However, it risks overlapping with other VPCs, which blocks VPC peering. Selecting a tiny CIDR block (e.g., /26) simplifies peering and conserves IP addresses but can quickly exhaust IP capacity, causing runtime errors when scaling services.

3. Direct Public Access vs. Private IP behind Proxies

Giving every server a public IP address reduces routing hops, simplifies network topology, and lowers latency. However, it exposes the servers directly to the internet, increasing the attack surface. Placing servers in private subnets behind a NAT Gateway and Application Load Balancer improves security, but adds cost, overhead, and potential performance degradation from translation layers.

15. Performance Considerations

Several critical networking parameters dictate how IP performance shapes application behavior:

• IP Fragmentation Overhead: When an IPv4 packet exceeds link MTU, routers split it into multiple fragments. The receiving host cannot pass the data up to the transport layer until every single fragment has arrived. If one fragment is dropped, the entire group of fragments is discarded, forcing a TCP retransmission of the complete original packet.
• NAT Port Exhaustion: A NAT gateway maps multiple internal clients to a single public IP using unique source ports. Because there are only 65,535 TCP/UDP ports available per public IP, a highly concurrent application initiating thousands of outbound requests (e.g. scraper bots or high-throughput API integrations) can exhaust the pool of available NAT ports. This causes subsequent connection attempts to fail with connection timeout errors.
• BGP Anycast Suboptimal Routing: While Anycast routes traffic to the topologically closest server, BGP does not account for physical server performance or actual link latency. Under heavy BGP routing updates or ISP configuration changes, Anycast traffic can occasionally be misrouted to a datacenter across an ocean, raising latency spikes.

16. Failure Scenarios

Here are four critical real-world failure patterns encountered in systems engineering:

1. Subnet IP Address Exhaustion

Scenario: You run an autoscaling Kubernetes cluster inside a private AWS VPC subnet allocated with a /24 block. During a traffic surge, Kubernetes attempts to spin up 200 new microservice pods. However, the subnet already has 50 nodes and AWS has reserved 5 IP addresses, leaving only 201 usable IPs. Pod deployments stall in a CreateContainerConfigError state, causing a system bottleneck.

2. Overlapping IP Networks in Peering

Scenario: Company A (VPC: 10.0.0.0/16) acquires Company B (VPC: 10.0.0.0/16). They need to establish high-speed database synchronization between the networks. When setting up a VPC Peering connection, the routers reject the link because the IP ranges overlap. Resolving this requires migrating one network to a new IP range or configuring complex, high-maintenance Private NAT translation tables.

3. ICMP Black Holes (PMTUD Failures)

Scenario: A client connects to your service via a VPN link that limits the MTU to 1420 bytes. When the client requests a large payload, the server sends a packet of 1500 bytes with the DF bit set. An intermediate router drops the packet and sends an ICMP Type 3 Code 4 message back to the server. However, the server's firewall blocks all ICMP packets. The server never gets the MTU warning and keeps trying to send 1500-byte packets. The client's connection times out after hanging.

4. IP Spoofing and X-Forwarded-For Header Injection

Scenario: Your backend rate-limiting middleware reads x-forwarded-for to track API requests per client. An attacker realizes this and sends a flood of API requests, randomly varying the X-Forwarded-For header value (e.g. X-Forwarded-For: 12.34.56.78) with every request. The backend treats these as distinct clients, bypassing the rate limiter and overwhelming the database.

17. Best Practices

• Design Non-Overlapping IPAM: Before setting up public clouds, establish an IP Address Management (IPAM) system. Allocate clean, distinct CIDR blocks to different regions (e.g., 10.1.0.0/16 for US-East, 10.2.0.0/16 for EU-West) to enable seamless VPC peering and hybrid cloud routing.
• Secure Client IP Extraction: Do not trust the X-Forwarded-For header unless the request is coming directly from a verified, trusted proxy (e.g., your AWS ALB or Cloudflare WAF). Configure your proxies to strip user-supplied X-Forwarded-For headers at the edge, or parse the header from right-to-left based on the number of trusted proxies you control.
• Enable ICMP for Path MTU Discovery: Do not block all ICMP messages. Ensure your firewalls permit ICMP Type 3, Code 4 (Destination Unreachable / Fragmentation Needed) and ICMPv6 Type 2 (Packet Too Big) to prevent PMTUD black holes.
• Leverage Subnet Architecture: Organize systems into public and private subnets. Place public load balancers in public subnets with NAT Gateways, and keep database engines and microservices in private subnets with no direct public route.

18. Common Mistakes

19. Implementation (Only If Applicable)

The following TypeScript implementation shows how to construct a secure Express server that extracts client IP addresses, validates their structures, prevents IP spoofing by trusting only specific upstream proxies, and executes a basic rate-limiting mechanism:

20. Interview Questions

Easy Question: What is the difference between a public IP address and a private IP address?

Answer: Public IP addresses are globally unique and routable across the public internet, enabling direct communication between servers worldwide. Private IP addresses (defined in RFC 1918) are reserved for use inside closed local networks (such as a home Wi-Fi network or a private cloud VPC). They are non-routable on the public internet, meaning internet routers will drop them immediately. Private devices must use a NAT router to translate their private IP addresses into a public IP before they can communicate with public web servers.

Medium Question: How does the X-Forwarded-For header work, and how do you secure it from IP spoofing?

Answer: The X-Forwarded-For header is a comma-separated list of IP addresses populated by reverse proxies as a request travels through them. It follows the format: X-Forwarded-For: client, proxy1, proxy2. To secure it from spoofing, you must configure your edge proxy (the first load balancer or CDN that receives traffic from the open internet) to either overwrite or strip any incoming, user-controlled X-Forwarded-For headers. In application code, instead of reading the first IP in the list blindly, you should traverse the IP list from right-to-left, checking each IP against a list of trusted internal proxy IPs. The first IP that is not in your trusted list is the verified client IP.

Hard Question: Explain how a PMTUD "black hole" occurs, and how engineers mitigate this problem at the network boundary.

Answer: A Path MTU Discovery (PMTUD) black hole occurs when a host sends packets with the Don't Fragment (DF) bit set, and an intermediate router with a smaller link MTU drops the packet and returns an ICMP Type 3 Code 4 message ("Fragmentation Needed"), but that ICMP message is dropped by a security firewall before reaching the sender. The sender is left unaware that its packets are too large, leading to connection hangs after the TCP handshake completes.

Engineers mitigate this by:

• Configuring firewalls to permit ICMP Type 3 Code 4 packets.
• Implementing TCP MSS Clamping on routers. During the TCP handshake, the router intercepts the SYN packet and modifies the Maximum Segment Size (MSS) value, forcing both endpoints to negotiate a smaller segment size that safely fits within the path's bottleneck MTU without triggering fragmentation or ICMP errors.

21. Practice Exercises

Easy Exercise: Subnet Address Scope Calculation

Given the CIDR block 192.168.100.128/26, calculate:

1. The subnet mask in dot-decimal format.
2. The Network IP address.
3. The Broadcast IP address.
4. The total number of usable IP addresses for hosts on a standard network.

Medium Exercise: NAT Translation Table State Simulation

Host A (IP: 10.0.0.5) and Host B (IP: 10.0.0.12) reside behind a NAT Router with Public IP 203.0.113.10. Both hosts simultaneously open a TCP connection to a web server at 8.8.8.8:443. Simulate the state mapping table inside the NAT router for both outgoing packets and their corresponding return packets.

Hard Exercise: Designing a Multi-VPC Peering Routing Table

You have three VPCs:

• VPC A: 10.1.0.0/16
• VPC B: 10.2.0.0/16
• VPC C: 10.3.0.0/16

You need to peer VPC A with VPC B, and VPC B with VPC C. Assuming transitive routing is disabled by default in cloud routing architectures, design the explicit routing tables for each VPC to permit communications between VPC A and VPC B, and VPC B and VPC C, while preventing VPC A from communicating directly with VPC C.

22. Challenge Problem

23. Summary

In this lesson, we explored the Internet Protocol (IP), the Network Layer standard that underpins global data routing:

• Routing and Subnets: IP handles logical addressing by separating networks into subnet ranges mapped via CIDR notation.
• IPv4 vs IPv6: IPv4 uses 32-bit addresses and relies heavily on NAT to stay functional. IPv6 uses 128-bit addresses, rendering NAT obsolete while offering faster, hardware-friendly header designs.
• NAT Mechanics: NAT translates private RFC 1918 IP addresses to public IPs, allowing millions of internal devices to share a single public IP.
• Proxy Client IP Preservation: Reverse proxies hide client IPs; systems must use verified configuration chains like X-Forwarded-For to reconstruct original client context for WAFs and rate limiters.

24. Cheat Sheet

25. Quiz

26. Further Reading

• RFC 791: The official Internet Protocol (IPv4) specification.
• RFC 8200: The official Internet Protocol, Version 6 (IPv6) specification.
• RFC 1918: Address Allocation for Private Internets.
• AWS VPC Subnetting Guide: Official documentation on AWS VPC design principles.
• "Computer Networking: A Top-Down Approach" by Kurose & Ross: Chapter 4 (The Network Layer).

27. Next Lesson Preview

In the next lesson, we will move up the OSI stack to Layer 4 (Transport Layer) to study TCP (Transmission Control Protocol). We will discover how TCP takes IP's best-effort, connectionless, and packet-drop-prone medium and transforms it into a highly reliable, ordered, flow-controlled byte stream through the use of handshakes, sliding windows, and congestion-control algorithms.