Getting Packets Across the World
Layer 2 gets data across a single room. Layer 3 gets data across the planet. If Layer 2 is the local postal service within a city, Layer 3 is the international postal system — it knows how to route a package from any address on Earth to any other address.
Layer 3: The Network Layer
Layer 3 handles routing data between different networks. It introduces IP addresses (Internet Protocol addresses) — hierarchical, globally routable identifiers that tell routers where to forward packets.
- Unit: Packet
- Address: IP address (IPv4:
192.168.1.1, IPv6:2001:db8::1) - Hardware: Routers
- Protocols: IPv4, IPv6, ICMP (Internet Control Message Protocol — used by
pingandtraceroute)
How routing works: Every router maintains a routing table — a list of network prefixes and the next hop to reach them. When a packet arrives, the router reads the destination IP, finds the longest matching prefix in its routing table, and forwards the packet to the next hop. This process repeats at every router along the path until the packet reaches its destination network. Every routing table includes a default route (0.0.0.0/0) — the "if I don't know where else to send it, send it here" rule that points at the gateway to the wider internet.
The Switch vs. Router distinction — precisely stated:
| Scenario | Device | Layer | Address Used |
|---|---|---|---|
| Moving data between two computers in the same office | Switch | Layer 2 | MAC address |
| Moving data from your office to a server in another country | Router | Layer 3 | IP address |
| Moving data between two VLANs on the same switch | Layer 3 Switch or Router | Layer 3 | IP address |
A router strips the Layer 2 frame at each hop (because MAC addresses are only locally meaningful), reads the Layer 3 IP header to determine the next hop, then wraps the packet in a new Layer 2 frame with the next hop's MAC address. The IP header stays intact end-to-end; the Ethernet header is rebuilt at every hop.
ICMP and ping: The ping command uses ICMP Echo Request and Echo Reply messages — a Layer 3 protocol. A successful ping proves that Layer 1, 2, and 3 are all functioning between you and the target. It does not prove that any application is running on the target.
Traceroute extends this by sending packets with incrementally increasing TTL (Time To Live) values, causing each router along the path to respond with an ICMP "Time Exceeded" message. This reveals every hop between you and the destination, in order.
Senior depth — TTL and routing loops: Every IP packet contains a TTL field (an 8-bit integer, max 255). Each router that forwards the packet decrements the TTL by 1. If TTL reaches 0, the router drops the packet and sends an ICMP "Time Exceeded" message back to the sender. This prevents packets from circulating forever in routing loops. When you see * * * in a traceroute output, it means a router along the path is not responding to ICMP — it's not necessarily a failure, just a firewall policy.