Layer 3 has one job: get a packet from a source that may be many networks away to the right destination. It does that with routing — and it uses ICMP to report problems and let tools like ping and traceroute work at all.
A router doesn't know the full path to every destination — it only knows, for each packet, which neighboring router to hand it to next: the next hop. It decides using a routing table, matching the packet's destination IP against every entry and picking the longest prefix match — the most specific route that still matches.
| Destination | Next hop | Interface | Prefix length |
|---|
Every IP packet carries a TTL that every router decrements by 1. If TTL hits 0, the router drops the packet and sends back an ICMP Time Exceeded message identifying itself. Traceroute abuses this on purpose: it sends packets with TTL=1, then 2, then 3, deliberately "killing" the packet at each successive hop to map the whole path one router at a time.
NAT exists because there aren't enough IPv4 addresses for every device to have a public one. A home router gives every device a private address, then rewrites outbound packets to use its single public address — tracking the substitution in a table so replies can be translated back.
| Internal address | Translated (public) address | Destination |
|---|---|---|
| 10.0.0.5:51000 | 203.0.113.9:40001 | 93.184.216.34:443 |
When the reply arrives addressed to 203.0.113.9:40001, the router looks up this exact table entry, rewrites the destination back to 10.0.0.5:51000, and forwards it — the private host never sees the public address at all.
If a packet is larger than a link's MTU, a router has to split it into smaller fragments before forwarding. Each fragment gets its own IP header, a copy of the identification field so the destination knows which fragments belong together, and an offset (in 8-byte units) so they can be reassembled in the right order.
| Fragment | Offset (bytes) | Offset field value (8-byte units) | Payload size | More fragments? |
|---|
| Type | Name | Used for |
|---|---|---|
| 8 | Echo Request | What ping sends. |
| 0 | Echo Reply | What ping is waiting for. |
| 11 | Time Exceeded | TTL hit 0 — exactly what traceroute exploits. |
| 3 | Destination Unreachable | Host, network, or port couldn't be reached. |
| 5 | Redirect | A router telling a host a better next hop exists for this destination. |
* * * for some hops even though the path is working fine — silence doesn't mean the network is broken.