What Is the Network Layer? (OSI Model Layer 3)

The network layer is the third layer of the OSI model. It handles logical addressing and routing — deciding which path data packets take from source to destination across multiple networks.

What Is the Network Layer?

The network layer is the third layer of the OSI (Open Systems Interconnection) model. Its primary job is to move data packets from one device to another across different networks — even when those networks are halfway around the world from each other.

If the data link layer (Layer 2-address-resolution-protocol-explained)) is responsible for getting data between devices on the same network, the network layer handles the bigger problem: getting data between devices on different networks. It does this through two core functions: logical addressing and Routing.

How the Network Layer Works

When you visit a website, your request must travel through several networks before it reaches the server. Here is a simplified version of what happens:

  1. Your device creates a data packet-the-internets-core-protocol)-ip-the-internets-core-protocol) and stamps it with a source IP address-and-addressing-explained)-ipv6-and-addressing-explained) (yours) and a destination IP address (the website's server).
  2. The packet-the-internets-core-protocol)-ip-the-internets-core-protocol) is handed to your local router-network-address-translation-explained).
  3. The router-network-address-translation-explained) examines the destination IP and consults its Routing table to decide where to send the packet-ip-the-internets-core-protocol) next.
  4. The packet-the-internets-core-protocol)-ip-the-internets-core-protocol) hops from router-network-address-translation-explained) to router — each one making the same forwarding decision — until it reaches the destination network.
  5. The packet-the-internets-core-protocol)-ip-the-internets-core-protocol) is delivered to the target device.

This hop-by-hop forwarding is the essence of packet-the-internets-core-protocol)-ip-the-internets-core-protocol) switching, the method the internet uses to route traffic efficiently.

Key Protocols at the Network Layer

IP (Internet Protocol)

IP is the backbone of the network layer. It defines the format of packets and the addressing scheme that makes global Routing possible. There are two versions in use today:

  • IPv4-address-ipv4-IPv6-and-addressing-explained) — uses 32-bit addresses (e.g., 192.168.1.1). Supports ~4.3 billion unique addresses.
  • IPv6-address-ipv4-ipv6-and-addressing-explained) — uses 128-bit addresses (e.g., 2001:0db8:85a3::8a2e:0370:7334). Supports a virtually unlimited number of addresses.

Because the world ran out of IPv4-address-ipv4-IPv6-and-addressing-explained) addresses years ago, the internet is gradually migrating to IPv6, though both coexist today.

ICMP (Internet Control Message Protocol)

ICMP-and-network-diagnostics-explained) is used for diagnostics and error reporting. When a router-network-address-translation-explained) cannot deliver a packet-the-internets-core-protocol)-ip-the-internets-core-protocol), it sends an ICMP message back to the sender explaining what went wrong. The everyday tools ping and traceroute both use ICMP-and-network-diagnostics-explained):

# Test if a host is reachable
ping 8.8.8.8

# Trace the route packets take to a destination
traceroute google.com

OSPF and BGP (Routing Protocols)

Routers use Routing protocols to share information about network topology:

  • OSPF-border-gateway-protocol-explained) (Open Shortest Path First) — used inside a single organization's network.
  • BGP (Border Gateway [protocol](/learning-center/what-is-bgp-border-gateway-protocol-explained)) — used between ISPs to route traffic across the global internet. BGP is what keeps the internet's backbone connected.

IP Addressing Explained

An [IP address](/learning-center/what-is-an-ip-address-IPv4-and-addressing-explained)-ipv6-and-addressing-explained) is a unique numerical label assigned to every device on a network. Think of it like a postal address — without one, the network wouldn't know where to deliver your data.

IPv4 Structure

An [IPv4-address-ipv4-IPv6-and-addressing-explained) address](/learning-center/what-is-an-ip-address-ipv4-ipv6-and-addressing-explained) has four groups of numbers (0–255) separated by dots:

192 . 168 . 1 . 100
 ↑       ↑       ↑
 Network  Subnet  Host

The address is split into a network portion and a host portion using a [subnet-subnets-and-CIDR-explained) mask](/learning-center/what-is-subnetting-ip-subnets-and-cidr-explained) (e.g., 255.255.255.0 or /24 in CIDR-subnets-and-cidr-explained) notation).

Public vs. Private IP Addresses

| Type | Example range | Who uses it | |---------|----------------------|----------------------------------| | Private | 192.168.0.0/16 | Home and office networks (LAN) | | Private | 10.0.0.0/8 | Large enterprise networks | | Public | Everything else | Internet-facing servers, ISPs |

Private addresses are not routable on the public internet. Your home router-network-address-translation-explained) uses NAT ([network address-address-IPv4-and-addressing-explained)-ipv6-and-addressing-explained) translation](/learning-center/what-is-nat-network-address-translation-explained)) to map many private addresses to a single public IP.

Routers: The Network Layer's Workhorse

A router-network-address-translation-explained) is the device that operates at the network layer. Every router maintains a Routing table — a map that lists known networks and the best path to reach them.

When a packet-the-internets-core-protocol)-ip-the-internets-core-protocol) arrives, the router-network-address-translation-explained):

  1. Reads the destination [IP address](/learning-center/what-is-an-ip-address-IPv4-and-addressing-explained)-ipv6-and-addressing-explained) in the packet-ip-the-internets-core-protocol) header.
  2. Looks up the destination in its Routing table.
  3. Forwards the packet-the-internets-core-protocol)-ip-the-internets-core-protocol) out of the correct interface (the "next hop").

If no matching route exists, the router-network-address-translation-explained) drops the packet-the-internets-core-protocol)-ip-the-internets-core-protocol) and may send an ICMP-and-network-diagnostics-explained) "destination unreachable" message back to the sender.

Static vs. Dynamic Routing

  • Static Routing — an administrator manually configures routes. Simple but doesn't adapt to network changes.
  • Dynamic Routing — routers automatically exchange route information using protocols like OSPF-border-gateway-protocol-explained) or BGP and adapt when links fail.

Network Layer vs. Other OSI Layers

| OSI Layer | Name | What it does | |-----------|--------------|-------------------------------------------| | Layer 2-address-resolution-protocol-explained) | Data Link | Moves frames between devices on same LAN | | Layer 3 | Network | Routes packets between different networks | | Layer 4 | Transport | Manages end-to-end connections (TCP-the-internets-core-protocol)/UDP) |

Why the Network Layer Matters for Security

Understanding Layer 3 is essential for cybersecurity-the-internets-core-protocol)-the-backbone-of-reliable-internet-communication) professionals because most network-based attacks operate at this level:

  • IP spoofing — attackers forge the source IP address-and-addressing-explained)-ipv6-and-addressing-explained) in packets to hide their identity or impersonate trusted systems.
  • [ICMP-and-network-diagnostics-explained) flood](/learning-center/what-is-icmp-ping-and-network-diagnostics-explained) (Ping flood) — sending massive volumes of ICMP echo requests to overwhelm a target.
  • Route hijacking ([BGP hijacking](/learning-center/what-is-bgp-border-gateway-protocol-explained)) — malicious actors advertise false BGP routes to redirect internet traffic through their infrastructure.
  • traceroute-and-network-diagnostics-explained)-ping-and-network-diagnostics-explained)-based reconnaissance — attackers use traceroute to map network topology before launching targeted attacks.

Network-layer firewalls and ACLs (Access Control Lists) on routers are the primary defenses at this layer — they inspect source/destination IP addresses and drop unauthorized packets before they reach their target.

Quick Recap

  • The network layer (OSI Layer 3) provides logical addressing and Routing.
  • IP is the core protocol — it assigns unique addresses to devices and defines packet-ip-the-internets-core-protocol) format.
  • Routers forward packets hop-by-hop using Routing tables.
  • IPv4-address-ipv4-IPv6-and-addressing-explained) addresses are 32-bit; IPv6 addresses are 128-bit.
  • Key protocols include IP, ICMP-and-network-diagnostics-explained), OSPF-border-gateway-protocol-explained), and BGP.
  • Security threats at this layer include IP spoofing, ICMP-and-network-diagnostics-explained) floods, and [BGP hijacking](/learning-center/what-is-bgp-border-gateway-protocol-explained).

Mastering the network layer is a foundation for understanding firewalls, VPNs, intrusion detection-intrusion-detection-and-prevention-explained)-and-ips-intrusion-detection-and-prevention-explained) systems, and most [Network Security)](/learning-center/what-is-a-firewall-and-how-does-it-protect-your-network) certifications like CEH and CompTIA Security+.