Cheat SheetsComputer NetworksNetwork Layer

Network Layer — Cheat Sheet

Computer Networks · 5 topics. Download the PDF or the Instagram carousel and share it.

Cheat Sheet · AiCanCode.org
Network Layer
Computer Networks5 topicsQuick revision reference
1

IP Addressing — IPv4 & IPv6

An IP address is a logical identifier assigned to every network interface. IPv4 uses 32-bit addresses (4.3 billion); IPv6 uses 128-bit addresses to solve exhaustion. Both coexist today via dual-stack.

  • ✓IPv4: 32-bit, ~4.3B addresses. IPv6: 128-bit, 3.4×10³⁸ addresses.
  • ✓Private IPv4 ranges: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 — not internet-routable.
  • ✓Loopback: 127.0.0.1 (IPv4), ::1 (IPv6). Bind-all: 0.0.0.0 (IPv4), :: (IPv6).
  • ✓IPv6 uses :: to compress consecutive zero groups.
  • ✓Dual-stack hosts run IPv4 and IPv6 simultaneously — modern OSes prefer IPv6 when available.
  • ✓IPv6 eliminates NAT — every device gets a globally unique address.
IPv4 private ranges and Java network interface listing
// IPv4 address = 32 bits = 4 octets
// Example: 192.168.1.10
// Binary: 11000000.10101000.00000001.00001010

// Private address ranges (RFC 1918) — NOT routable on internet:
// 10.0.0.0    – 10.255.255.255   (10.0.0.0/8)    — Class A, 16M hosts
// 172.16.0.0  – 172.31.255.255   (172.16.0.0/12) — Class B, 1M hosts
// 192.168.0.0 – 192.168.255.255  (192.168.0.0/16)— Class C, 65K hosts

// Special addresses:
// 127.0.0.1   — loopback (localhost)
// 0.0.0.0     — "any" interface (bind all)
// 255.255.255.255 — limited broadcast
// 169.254.x.x — APIPA (auto-assigned when DHCP fails)

// Java: get all local IP addresses
NetworkInterface.getNetworkInterfaces().asIterator().forEachRemaining(iface -> {
    iface.getInetAddresses().asIterator().forEachRemaining(addr -> {
        System.out.println(iface.getName() + " → " + addr.getHostAddress());
    });
});
// Typical output:
// lo → 127.0.0.1
// eth0 → 10.0.1.5  (private IP in cloud VPC)
2

Subnetting & CIDR

Subnetting divides a network into smaller segments using a subnet mask. CIDR (Classless Inter-Domain Routing) notation /prefix replaces the rigid class system and enables flexible, efficient IP allocation.

  • ✓CIDR /n means n bits are the network prefix; remaining 32-n bits are for hosts.
  • ✓Usable hosts per subnet = 2^(32-n) − 2 (minus network address and broadcast).
  • ✓/24 → 254 hosts, /28 → 14 hosts, /30 → 2 hosts, /32 → single IP.
  • ✓Subnet mask and CIDR prefix are equivalent: /24 = 255.255.255.0.
  • ✓Cloud VPCs are divided into public, private, and database subnets across Availability Zones.
  • ✓Security group rules use CIDR notation to allow/deny traffic from specific IP ranges.
CIDR calculation and Java subnet membership check
// CIDR notation: IP/prefix
// 192.168.1.0/24
//   Network:   192.168.1.  (first 24 bits fixed)
//   Hosts:     .0 – .255   (last 8 bits variable)
//   Usable:    192.168.1.1 – 192.168.1.254  (254 hosts)
//   Network:   192.168.1.0   (reserved)
//   Broadcast: 192.168.1.255 (reserved)

// Common subnet sizes:
// /8  → 16,777,214 hosts  (255.0.0.0)       — Class A equivalent
// /16 → 65,534 hosts      (255.255.0.0)     — Class B equivalent
// /24 → 254 hosts         (255.255.255.0)   — Class C equivalent
// /28 → 14 hosts          (255.255.255.240) — small subnet, cloud common
// /30 → 2 hosts           (255.255.255.252) — point-to-point links
// /32 → 1 host            (255.255.255.255) — single IP (security group rule)

// Hosts formula: 2^(32 - prefix) - 2
// /24 → 2^8 - 2 = 254
// /28 → 2^4 - 2 = 14
// /30 → 2^2 - 2 = 2

// Java: check if IP is in a CIDR range
InetAddress ip = InetAddress.getByName("192.168.1.50");
InetAddress network = InetAddress.getByName("192.168.1.0");
int prefix = 24;
byte[] ipBytes = ip.getAddress();
byte[] netBytes = network.getAddress();
int mask = 0xFFFFFFFF << (32 - prefix);
int ipInt  = ByteBuffer.wrap(ipBytes).getInt();
int netInt = ByteBuffer.wrap(netBytes).getInt();
boolean inSubnet = (ipInt & mask) == (netInt & mask);  // true
3

NAT — Network Address Translation

NAT maps private IP addresses to one or more public IPs, allowing many devices behind a router to share a single public IP. It extends IPv4 address space but breaks end-to-end connectivity.

  • ✓NAT replaces private source IPs with a public IP and tracks mappings by port.
  • ✓NAPT/PAT allows thousands of devices to share one public IP — used in home routers and cloud.
  • ✓NAT breaks end-to-end connectivity — external hosts cannot initiate connections to NATted devices.
  • ✓STUN discovers the public IP:port a NATted client appears as; TURN relays traffic when STUN fails.
  • ✓AWS NAT Gateway enables private subnet instances to access internet without being reachable from it.
  • ✓IPv6 eliminates the need for NAT — every device gets a routable global address.
NAPT translation table and packet flow
// NAPT translation table (inside a home router / AWS NAT Gateway):
// ┌────────────────────────┬─────────────────────────┬──────────────────────┐
// │ Private (src)          │ Public (translated src) │ Remote (dst)         │
// ├────────────────────────┼─────────────────────────┼──────────────────────┤
// │ 192.168.1.10:54231     │ 203.0.113.1:10001       │ 142.250.80.46:443    │
// │ 192.168.1.11:49812     │ 203.0.113.1:10002       │ 142.250.80.46:443    │
// │ 192.168.1.10:61002     │ 203.0.113.1:10003       │ 52.94.236.248:80     │
// └────────────────────────┴─────────────────────────┴──────────────────────┘

// Packet flow — outbound:
// Client 192.168.1.10:54231 → GET https://google.com (dst 142.250.80.46:443)
// NAT router rewrites:  src = 203.0.113.1:10001
// Google responds to:   203.0.113.1:10001
// NAT router looks up:  10001 → 192.168.1.10:54231
// NAT router rewrites:  dst = 192.168.1.10:54231 and forwards

// Types of NAT:
// Static NAT  — 1:1 mapping (one private IP → one public IP, always)
// Dynamic NAT — pool of public IPs, allocated as needed
// NAPT / PAT  — many private IPs share one public IP via port mapping (most common)
// Hairpin NAT — internal host reaches another internal host via public IP
4

Routing — OSPF, BGP & Static Routes

Routing determines the path packets take across a network. Static routes are manually configured; OSPF dynamically finds the shortest path within one organisation; BGP routes traffic between autonomous systems across the internet.

  • ✓Routing table lookup uses longest-prefix match — most specific route wins.
  • ✓Static routes: manually configured, predictable, no overhead, breaks on topology change.
  • ✓OSPF: link-state, intra-AS, uses Dijkstra, fast convergence (~seconds).
  • ✓BGP: path-vector, inter-AS, governs internet routing between ~70,000 Autonomous Systems.
  • ✓BGP path selection: LOCAL_PREF → AS_PATH length → MED → IGP cost.
  • ✓AWS VPC route tables are static routes; Direct Connect and VPN use BGP for dynamic routing.
Routing table, longest-prefix match, AWS VPC routes
// Routing table on a Linux host (ip route show):
// default via 10.0.0.1 dev eth0           — default gateway for all traffic
// 10.0.0.0/24 dev eth0 proto kernel       — directly connected subnet
// 10.0.1.0/24 via 10.0.0.254 dev eth0    — static route to another subnet
// 172.16.0.0/12 via 10.0.0.2 dev eth0    — route to corporate network via VPN

// Longest-prefix match — most specific wins:
// Destination: 10.0.1.50
// Matches: 10.0.0.0/8  (prefix /8)
// Matches: 10.0.1.0/24 (prefix /24) ← more specific, used
// Matches: default 0.0.0.0/0 (prefix /0)

// AWS VPC Route Table example:
// ┌───────────────┬───────────────────────────────────────────┐
// │ Destination   │ Target                                    │
// ├───────────────┼───────────────────────────────────────────┤
// │ 10.0.0.0/16   │ local (within VPC)                        │
// │ 0.0.0.0/0     │ igw-xxx (Internet Gateway — public subnet)│
// │ 0.0.0.0/0     │ nat-xxx (NAT Gateway — private subnet)    │
// │ 10.1.0.0/16   │ pcx-xxx (VPC Peering to another VPC)      │
// └───────────────┴───────────────────────────────────────────┘
5

ARP — Address Resolution Protocol

ARP resolves an IP address to a MAC address on a local network segment. Without ARP, a host knows where to send a packet logically (IP) but not physically (MAC address of the next hop).

  • ✓ARP resolves IP addresses to MAC addresses on the same LAN segment.
  • ✓ARP Request is broadcast (FF:FF:FF:FF:FF:FF); ARP Reply is unicast.
  • ✓ARP cache stores IP→MAC mappings, typically for 20 minutes.
  • ✓For off-subnet traffic, the host ARPs for the default gateway's MAC, not the final destination.
  • ✓Gratuitous ARP announces IP-to-MAC changes — used for virtual IP failover.
  • ✓ARP spoofing poisons caches to redirect traffic through an attacker — mitigated by Dynamic ARP Inspection.
ARP request/reply flow and ARP cache
// ARP in action — host A (10.0.1.5) sends to host B (10.0.1.10):
//
// 1. Host A checks ARP cache — no entry for 10.0.1.10
//
// 2. ARP Request (broadcast):
//    Src MAC:  AA:BB:CC:DD:EE:01  (Host A)
//    Dst MAC:  FF:FF:FF:FF:FF:FF  (broadcast — everyone on LAN)
//    Src IP:   10.0.1.5
//    Target IP: 10.0.1.10
//    "Who has 10.0.1.10? Tell 10.0.1.5"
//
// 3. Host B receives broadcast, recognises its IP, sends ARP Reply (unicast):
//    Src MAC:  AA:BB:CC:DD:EE:02  (Host B)
//    Dst MAC:  AA:BB:CC:DD:EE:01  (Host A)
//    "10.0.1.10 is at AA:BB:CC:DD:EE:02"
//
// 4. Host A caches: 10.0.1.10 → AA:BB:CC:DD:EE:02  (TTL ~20 min)
// 5. Host A constructs Ethernet frame with dst MAC = AA:BB:CC:DD:EE:02

// View ARP cache on Linux/Mac:
// arp -n             → show ARP table
// ip neigh show      → modern equivalent

// Example output:
// 10.0.1.10 dev eth0 lladdr aa:bb:cc:dd:ee:02 REACHABLE
// 10.0.1.1  dev eth0 lladdr 00:50:56:c0:00:08 REACHABLE  ← default gateway
Learn this free with Aria, your AI tutor → AiCanCode.org/learn/computer-networks