The network layer is where Computer Networks stops being definitions and becomes arithmetic. One wrong unit in a fragmentation offset or header length can flip a simple answer. IPv4 concepts, fragmentation arithmetic, and common GATE and interview traps all matter at the network layer.
What the network layer actually does
The network layer provides host-to-host delivery across interconnected networks. Routers examine its information to choose the next hop, so they operate up to this layer while forwarding.
There are two broad service models:
In a datagram service, each packet is independent and may follow a different route. IP uses this connectionless model.
In a virtual-circuit service, a logical path is set up first, then packets follow it.
IPv4 provides best-effort delivery. It does not guarantee delivery, ordering or duplicate prevention. TCP handles reliability one layer above when needed. Support mechanisms include ARP, ICMP, DHCP and NAT.
The IPv4 header, field by field
An IPv4 header is 20 to 60 bytes. IHL (often called HLEN) counts 4-byte words, so IHL 5 means 20 bytes and IHL 15 means 60 bytes. The base header is 20 bytes; options and padding can add at most 40 bytes.
Each header field has a distinct job:
Version and IHL: Version is 4. IHL gives the full header length, which tells the receiver where the payload starts.
DSCP/ECN and Total Length: DSCP selects traffic handling, while ECN carries congestion signals. Total Length is the entire datagram, header plus data, in bytes; its 16 bits allow at most 65,535 bytes.
Identification and Flags: Identification stays the same in every fragment. The reserved flag is zero, DF forbids fragmentation, and MF says more fragments follow.
Fragment Offset: It locates a fragment's data in the original payload. Its unit is 8 bytes, not one byte.
TTL and Protocol: TTL is decremented by every router; a packet starting at 64 and crossing three routers continues with 61. Protocol identifies the next handler: ICMP is 1, TCP is 6 and UDP is 17.
Header Checksum: This 16-bit one's-complement checksum covers the header only. Every router recomputes it after changing TTL.
Source and Destination Address: These 32-bit fields identify the sender and intended receiver. Ordinary forwarding leaves them unchanged; address translation is the important exception.
Options and Padding: Options are optional control information. Zero padding makes the final header length a multiple of 32 bits, as required by IHL.
IPv4 addressing in one screen
An IPv4 address has 32 bits and is written in dotted decimal. Under historical classful addressing, first octets 1 to 126 indicated class A, 128 to 191 class B, and 192 to 223 class C. Class D was multicast and class E reserved. Thus, 145.32.59.24 was class B.
CIDR replaced this fixed-class model. A /26 block contains 2^(32-26) = 2^6 = 64 addresses. Modern problems normally give a prefix, so solve from that prefix rather than guessing from the first octet. For the full method, continue with IP Addressing and Subnetting Explained, then use the Computer Networks Subnetting and IP Addressing MCQs to practise it.
Worked example: fragmenting a 4000-byte datagram
A datagram has Total Length 4000 bytes, comprising a 20-byte header and 3980 bytes of data. Its Identification is 345 and DF is 0. It reaches a router whose outgoing link has an MTU of 1500 bytes.
First find the largest data payload per fragment:
1500 - 20 = 1480 bytes
The value 1480 is divisible by 8, so it can be used for every non-final fragment.
Fragment 1 carries data bytes 0 to 1479, which is 1480 bytes. Total Length is
1480 + 20 = 1500, Offset is 0, and MF is 1.Fragment 2 carries data bytes 1480 to 2959, again 1480 bytes. Total Length is 1500, Offset is
1480 / 8 = 185, and MF is 1.Fragment 3 carries data bytes 2960 to 3979. Its data length is
3979 - 2960 + 1 = 1020bytes, so Total Length is1020 + 20 = 1040. Its Offset is2960 / 8 = 370, and MF is 0.
All three fragments retain Identification 345. Together they transmit 1500 + 1500 + 1040 = 4040 bytes. The original datagram was 4000 bytes, so fragmentation added 40 bytes, exactly two extra 20-byte headers.
Reassembly happens only at the destination. It groups fragments using source, destination, Identification and Protocol, while MF 0 identifies the last fragment. If DF had been 1, the router could not fragment the datagram. It would drop it and return ICMP Destination Unreachable with the fragmentation-needed indication, which supports Path MTU Discovery.
ARP, ICMP, DHCP and NAT
These mechanisms support IPv4 delivery but do not all occupy the network layer. ICMP is carried inside IP, ARP resolves the next hop on the local link, DHCP is an application-layer configuration protocol over UDP, and NAT is an address-translation function.
ARP maps a next-hop IP address to a MAC address. Its request is a link-layer broadcast and its reply normally unicast. For a remote destination, the sender resolves the default gateway's MAC address, not the far host's.
ICMP carries error reports and diagnostics inside IP using Protocol 1. Echo Request is type 8, Echo Reply 0, Time Exceeded 11, and Destination Unreachable 3. Ping uses echo messages. Traceroute sends packets with TTL 1, 2, 3 and so on, then reads which router returns Time Exceeded. ICMP reports but does not repair problems, and an ICMP error never triggers another ICMP error.
DHCP supplies IP configuration through DORA: Discover, Offer, Request and Ack. It uses UDP port 67 at the server and 68 at the client. A new client can begin without an address because the early exchange uses broadcast.
NAT, commonly combined with port translation, rewrites address and port mappings so private hosts can share public connectivity. The private ranges are 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. It weakens the end-to-end model because an intermediate device changes addressing.
IPv4 traps that cost marks
Offset in bytes: the wrong instinct is to write 1480 for Fragment 2. Divide by 8, so the correct offset is 185.
MTU as data capacity: the wrong instinct is to place 1500 data bytes in each fragment. Total Length includes the header, leaving 1480 data bytes here.
Checksum over everything: the IPv4 checksum covers only its header. TCP and UDP provide their own checks over transport-layer content.
Reassembly at a router: intermediate routers forward fragments. Only the destination reassembles them, and one missing fragment causes the whole original datagram to be abandoned after the reassembly timer expires.
TTL as time: TTL limits router hops, not wall-clock seconds. Reaching 0 causes discard and ICMP Time Exceeded.
ARP for the remote host: across a router, ARP resolves the next hop, which is usually the default gateway.
How GATE and interviews test the network layer
GATE-style numericals can ask for fragment count, offsets and total transmitted bytes. Header-length conversion, protocol numbers, checksum scope, traceroute and TTL also become short questions. Verify the current topic list and paper wording on the official GATE 2027 test-papers and syllabus page.
Routing algorithms, especially distance vector versus link state, form the adjacent study block after IPv4. Interviews often go wider: explain what happens after typing a URL, why NAT and fragmentation are considered harmful, or contrast 32-bit IPv4 with 128-bit IPv6. Use the GATE CS exam category to place these concepts in a structured preparation path.
The short version, and your next step
The IPv4 header is 20 to 60 bytes, and IHL (HLEN) counts 4-byte words.
Fragment Offset counts 8-byte units.
The IPv4 checksum covers only the header and changes at each router.
Fragments are reassembled only at the destination.
ICMP, TCP and UDP use protocol numbers 1, 6 and 17.
ARP finds the next hop's MAC address, not always the final host's MAC address.
Learn Computer Networks in sequence with GATE Guidance by Sanchit Sir. Once the concepts are stable, use the GATE Test Series to pressure-test the arithmetic under time.
