Network Layer Protocol Practice Questions

The Bellman-Ford equation (distance vector routing): D(x, y) = min over all neighbors v of {cost(x, v) + D(v, y)}, where D(x, y) is the estimated cost from router x to destination y, cost(x, v) is the link cost from x to neighbor v, and D(v, y) is neighbor v's estimated cost to y. Each router x updates its distance table whenever it receives an updated table from a neighbor or a link cost changes. This is the distributed Bellman-Ford - each router only knows local link costs and its neighbors' distance vectors, yet converges to the global shortest paths (assuming no negative cycles).

ICMP (RFC 792) operates within IP packets and provides error reporting and diagnostic functions: (1) Echo Request/Reply (Type 8/0) - used by ping to test reachability. (2) Destination Unreachable (Type 3) - sent when a packet cannot be delivered (host unreachable, port unreachable, fragmentation needed). (3) Time Exceeded (Type 11) - sent when TTL reaches 0; used by traceroute. (4) Redirect (Type 5) - informs a host of a better route. (5) Source Quench (deprecated) - congestion notification. ICMP does NOT provide reliability (that's TCP), does NOT assign addresses (that's DHCP), and does NOT route packets (that's IP with routing protocols).

Starting network: /24 (24 network bits). New mask: /28 (28 network bits). Subnet bits borrowed = 28 - 24 = 4 bits. Number of subnets = 2^4 = 16. Host bits = 32 - 28 = 4 bits. Hosts per subnet = 2^4 - 2 = 14 (subtract network and broadcast addresses). Subnets: 192.168.1.0/28, 192.168.1.16/28, 192.168.1.32/28, ..., 192.168.1.240/28. Each subnet has 16 addresses (14 usable).

OSPF uses Dijkstra's algorithm and supports hierarchical routing by dividing the network into areas (with Area 0 as the backbone). This allows it to scale to large networks, unlike RIP.

Link State Routing (e.g., OSPF) uses Dijkstra's shortest path first (SPF) algorithm. Each router builds a complete topology map via LSAs and runs Dijkstra locally to compute shortest paths.

CIDR allows flexible allocation of IP address blocks (not constrained to class boundaries) and route aggregation (supernetting), which both conserves IPv4 address space and reduces internet routing table size.

Requirements: 4 subnets, at least 30 hosts each. For subnets: need at least 2 subnet bits → 2^2 = 4 subnets ✓. For hosts: need at least 30 usable hosts → 2^h - 2 ≥ 30 → 2^h ≥ 32 → h ≥ 5 bits. With /27 mask: subnet bits = 3 (from /24 to /27), subnets = 2^3 = 8 ≥ 4 ✓; host bits = 5, usable hosts = 2^5 - 2 = 30 ≥ 30 ✓. With /26: host bits = 6, usable = 62 ✓ but only 4 subnets (2^2). /26 also works for 4 subnets with 62 hosts each. /27 is the most efficient: 8 subnets of 30 hosts. Answer: /27.

OSPF ECMP (Equal-Cost Multi-Path): when multiple paths to the same destination have identical OSPF cost, OSPF installs ALL equal-cost paths in the routing table as multiple next-hops. Traffic is load-balanced across all equal-cost paths. OSPF supports up to a configurable number of equal-cost paths (default 4-16 depending on implementation). Load balancing methods: per-destination (same destination always uses same next-hop), per-flow (5-tuple hash), or per-packet (round-robin, may reorder). ECMP effectively multiplies available bandwidth to a destination and provides automatic failover - if one path fails, the other remains. This is a key feature used in data center and enterprise networks.

Mask /27 = 255.255.255.224. Block size = 2^(32-27) = 2^5 = 32. Subnets of the /27: .0-.31, .32-.63, .64-.95, .96-.127, .128-.159, .160-.191, .192-.223, .224-.255. 192.168.5.100: 100 falls in range 96-127 → subnet 192.168.5.96/27, broadcast .127. 192.168.5.140: 140 falls in range 128-159 → subnet 192.168.5.128/27, broadcast .159. Since 100 and 140 are in different subnets, the packet must be sent to the default gateway (router) for inter-subnet routing.

IPv4 vs IPv6 comparison: Header: IPv4 minimum 20 bytes (variable length with options); IPv6 fixed 40 bytes (simpler, no options field - uses extension headers instead). Address space: IPv4 = 32 bits = ~4.3 billion addresses (exhausted); IPv6 = 128 bits = 3.4×10^38 addresses. Other IPv6 improvements: no router fragmentation (source-only), no checksum in IP header (handled by transport), built-in IPsec support, stateless address autoconfiguration (SLAAC), no broadcast (uses multicast instead), neighbor discovery protocol (NDP) replaces ARP.

Multicast routing uses either a source-based shortest path tree (one tree per source, used in PIM-DM) or a shared tree rooted at a rendezvous point (used in PIM-SM), both minimizing redundant packet transmission.

The TTL (Time to Live) field is decremented by 1 at each router. When it reaches 0, the packet is discarded and an ICMP 'Time Exceeded' message is sent, preventing infinite loops.

RIP (RFC 2453) properties: A: TRUE - metric = hop count (number of routers between source and destination); maximum valid metric = 15. B: TRUE - RIP sends complete routing table updates via UDP (port 520) to all directly connected neighbors every 30 seconds. RIPv1 uses broadcast; RIPv2 uses multicast (224.0.0.9). C: TRUE - metric 16 = infinity, meaning the destination is unreachable. This small infinity limits RIP to small networks (maximum diameter = 15 hops). D: FALSE - RIP uses the distributed Bellman-Ford algorithm (distance vector), not Dijkstra's. OSPF uses Dijkstra's (link-state). RIP convergence is slow, especially prone to count-to-infinity.

Distance Vector (RIP, IGRP): each router knows only distances to destinations and which neighbor to use (Bellman-Ford). Routers exchange their full routing tables with direct neighbors periodically. Disadvantages: slow convergence, count-to-infinity problem. Link State (OSPF, IS-IS): each router knows the entire network topology (link states). Routers flood LSAs to all routers; each builds a complete topology map and runs Dijkstra's SPF. Advantages: faster convergence, no count-to-infinity, more scalable with areas. B is FALSE (reversed). D is FALSE (also reversed - link-state has global view; distance vector has local view).

NAT (specifically NAPT/PAT - Port Address Translation): (1) Outgoing packet from private host (e.g., 192.168.1.10:1234) arrives at NAT router. (2) NAT replaces source IP:port with the router's public IP and a new port (e.g., 203.0.113.1:5001) and records this mapping in the NAT translation table. (3) The packet is forwarded to the internet with the public IP:port. (4) Response arrives at the public IP:5001. (5) NAT looks up the table, replaces destination IP:port with 192.168.1.10:1234, and forwards to the private host. NAT modifies both IP headers (Layer 3) and TCP/UDP headers (Layer 4 port numbers).

Longest Prefix Matching: the router selects the routing entry with the longest (most specific) prefix that matches the destination IP. Check 192.168.1.200 against each prefix: Prefix 1 (192.168.1.0/24): network = 192.168.1.0, range = .0-.255 → 200 is in range ✓ (24-bit match). Prefix 2 (192.168.1.128/25): network = 192.168.1.128, range = .128-.255 → 200 is in range ✓ (25-bit match). Prefix 3 (0.0.0.0/0): matches everything (0-bit match). Longest matching prefix = /25 (Prefix 2, 25 bits) → forward to Interface B.

ARP (Address Resolution Protocol) resolves (maps) a known IP address to its corresponding MAC address within a local network by broadcasting an ARP request and waiting for the reply.

ECMP (Equal-Cost Multi-Path): when multiple paths to a destination have identical routing metric (equal cost), ECMP distributes traffic across all these paths rather than selecting just one. Load balancing methods: per-flow hashing (same flow always takes same path, preserving packet order), per-packet round-robin (may reorder packets), per-destination. Supported by: OSPF (install multiple equal-cost next-hops for same destination), IS-IS, EIGRP, BGP (with specific configuration). Benefits: increased effective bandwidth (uses multiple links), redundancy (path failure just removes one path). ECMP is not limited by physical link speed - it works with any equal-cost paths. Data centers use ECMP extensively with fat-tree and Clos topologies.