The Network Layer: Data Plane

The network layer carries datagrams between hosts across a path of routers. The sending host puts a transport segment inside a datagram. Each router reads the network-layer header and passes the datagram toward its destination. At the receiving host, the network layer hands the segment to TCP, UDP or another upper-layer protocol.

One local decision and one network-wide plan

Forwarding moves an arriving packet from an input link to an output link at one router. It can also discard a packet or send copies to several links. The decision happens for every packet, usually in hardware on a nanosecond timescale.

Routing determines paths across the network. Routing software exchanges information and computes routes, typically over much longer timescales, such as seconds. Planning a road trip resembles routing; taking the chosen exit at one interchange resembles forwarding. The router does not rerun its routing algorithm for each arriving packet.

Suppose a forwarding entry maps 10.20.0.0/16 to interface 2. When a datagram for 10.20.7.1 arrives, the lookup selects interface 2. The per-packet operation applies an existing decision. A link failure may later cause the routing process to replace the entry.

The two planes and their tables

The data plane performs these local packet operations. The control plane decides routes and supplies the tables. Traditional routers each run a routing component, exchange routing messages and compute their own tables. In software-defined networking, a logically centralized controller installs entries remotely; switches still handle packets locally.

The routing information base (RIB) stores routes learned by the control plane. The forwarding information base (FIB) is the lookup structure derived from those routes for the data plane. Commands sometimes call either structure a "routing table," so its role matters more than the informal name.

A router is one kind of packet switch, a device that moves packets according to header fields. A link-layer switch normally selects by a destination MAC address. A router normally selects by a destination IP address. Network-layer processing exists in both hosts and routers; application and transport communication is between the end hosts.

What IP promises

A network's service model states its delivery guarantees. Possible guarantees include delivery within a deadline, arrival in order, a minimum bandwidth or reliable delivery. Internet IP supplies best-effort service: none of those guarantees, and no built-in security guarantee. A datagram can be lost, delayed, duplicated or reordered. IP does not retransmit it.

IP is also connectionless. Each datagram carries the information used to forward it; the network layer does not first establish an end-to-end connection. Packets in one conversation can follow different paths.

Useful applications still work because other parts of the system provide what they need. TCP detects loss and restores byte order at the endpoints. Congestion control adjusts sending rates, operators add capacity, and nearby content servers shorten paths. A successful TCP transfer therefore does not mean that IP itself guaranteed delivery.

A router's data path has an input side, an internal connection and an output side. Its control software supplies the information those components apply.

The four parts

An input port receives bits, removes the incoming link-layer framing and looks up the output port. The switching fabric transfers the packet internally. An output port buffers packets, builds the outgoing frame and transmits it. The routing processor runs control-plane and management software, or communicates with an SDN controller. Input and output functions for one bidirectional link usually share a line card.

At 10 Gb/s, a 64-byte packet contains 512 bits and occupies 51.2 ns, giving about 19.5 million packet arrivals per second. At 100 Gb/s, the corresponding gap is 5.12 ns. These packet-only calculations explain the pressure for hardware lookups. A copy of the forwarding table on each line card lets ports work without consulting a central processor for every packet.

Longest prefix matching

An IP table groups destinations into prefixes. A destination can match several entries; longest prefix matching selects the matching entry with the greatest prefix length.

10.20.30.77 matches all four entries, so /24 selects interface 2. For 10.20.31.5, /16 wins and selects interface 1. For 10.99.1.1, /8 selects interface 0. Only the default /0 matches 172.16.0.1, giving interface 3. Table order does not decide the result.

Prefixes can end within an octet. 192.168.8.0/21 covers third-octet values 8–15; 192.168.12.0/22 covers 12–15. Thus 192.168.12.9 takes /22, while 192.168.9.200 takes /21. Compare prefix bits, not the number of matching dotted groups. Overlap allows a broad aggregated route alongside an exception with a more specific prefix.

A ternary content-addressable memory (TCAM) compares entries in parallel, including wildcard bits, and can return a match in about one clock cycle within its hardware capacity. Input processing also checks the IP version, IPv4 checksum and TTL, updates TTL and checksum, and records counters.

Three ways to move the packet

Memory switching copies a packet into shared memory and out again. Each packet consumes two memory transfers, so a memory system supporting B transfers per second has a ceiling of B/2 packets per second before other costs.

Bus switching sends the packet over one shared bus with an output label. One packet crosses at a time; bus bandwidth limits aggregate throughput.

An interconnection network, such as a crossbar, can move packets to different outputs simultaneously. A crossbar for N inputs and N outputs uses 2N buses. Two packets competing for the same output still need arbitration. Large routers combine stages, fixed-size cells and parallel fabric planes; a fabric rate of N times the line rate is the ideal aggregate capacity for N inputs.

A correct forwarding decision does not ensure immediate transmission. A packet may wait for the switching fabric or for its output link, and finite buffers can run out of space.

Where the queue forms

Input queuing occurs when the fabric cannot accept packets as quickly as inputs supply them. With one FIFO per input, head-of-the-line (HOL) blocking traps a packet behind an earlier packet waiting for a busy output, even when the later packet's output is free. For large switches with uniform random traffic, this arrangement has a throughput limit near 58.6% of line rate. Separate virtual output queues at each input remove this particular blockage.

Output queuing occurs when arrivals for one output exceed its line rate. If three equal packets reach one output during a packet time, one can depart and two wait. A fast fabric does not make the output link faster.

How much buffer?

The classic sizing rule is $B=\text{RTT}\times C$, with RTT in seconds and capacity C in bits per second. A 250 ms RTT and 10 Gb/s link give 2.5 Gb, or 312.5 MB. With N long-lived, unsynchronized TCP flows, the alternative rule $B=\frac{\text{RTT}\times C}{\sqrt{N}}$ gives 25 Mb, or 3.125 MB, for 10,000 flows. These are sizing rules with different traffic conditions, not interchangeable guarantees for every queue.

Large buffers can cause bufferbloat. Almost 1 MB queued ahead of an admitted packet on a 10 Mb/s link takes about 0.8 s to drain: convert the bytes to 8,000,000 bits, then divide by the rate. With tail drop, a new packet reaching a completely full buffer is discarded instead.

Dropping is different from scheduling

Buffer management decides which packets to discard or mark. Tail drop rejects new arrivals at a full buffer. Priority-based dropping removes lower-priority traffic first. Active queue management acts earlier: RED increases its drop or marking probability as average queue length rises. With ECN, a router can mark congestion in an eligible IP packet, allowing the endpoints to reduce load without that packet being lost.

Scheduling chooses the next packet to transmit:

• FIFO serves arrival order.
• Strict priority serves the highest-priority nonempty class, usually FIFO within each class. A non-preemptive scheduler finishes the packet already transmitting. If low-priority packet 1 is in progress when high 2, low 3 and high 4 arrive, departures are 1, 2, 4, 3.
• Round robin gives each nonempty class a packet turn and skips empty queues. For A holding a1, a2, a3 and B holding b1, departures are a1, b1, a2, a3. A work-conserving scheduler keeps transmitting whenever any packet waits.
• Weighted fair queueing (WFQ) accounts for packet lengths to approximate weighted bit-by-bit service. A continuously backlogged class receives approximately its weight divided by the active weight sum, times link rate. Weights 5:3:2 on 100 Mb/s give 50, 30 and 20 Mb/s when all are busy. If the third empties, the others receive 62.5 and 37.5 Mb/s. Weights provide shares, not fixed caps; counting packet turns alone gives different bandwidth shares when packet sizes differ.

These mechanisms let operators prioritize, slow or block traffic. Whether providers may treat lawful content or applications differently is the policy issue called network neutrality. Its legal rules depend on the country and date.

An IPv4 datagram consists of a header followed by a payload, usually a transport segment. The usual header is 20 bytes; options can extend it to 60. Total length is a 16-bit byte count, allowing up to 65,535 bytes. Ethernet commonly carries IP packets up to 1,500 bytes.

Read fields in their wire order

Options follow these fields when IHL exceeds 5. Since each IHL word is four bytes, IHL 5 means 20 bytes and IHL 15 means 60. Subtract this header size from Total length to find payload size.

DSCP supports traffic classification and ECN carries congestion information. Each router reduces TTL by at least 1. On expiry it discards the datagram and normally sends ICMP Time Exceeded. TTL commonly starts at 64, 128 or 255. Protocol identifies TCP (6), UDP (17), ICMP (1) or encapsulated IPv6 (41); it does not identify an application port.

Decode a complete header

Consider these hexadecimal bytes:

45 00 00 34 1C 46 40 00 40 06 32 2C C0 00 02 0A C6 33 64 14

45 gives version 4 and IHL 5. Total length 0034 is 52 bytes, leaving 32 payload bytes. Identification 1C46 is 7238. The flags/offset word 4000 sets DF, clears MF and gives offset 0. TTL 40 is 64, Protocol 06 means TCP, and the checksum is 322C. The source bytes decode to 192.0.2.10 and destination bytes to 198.51.100.20.

Compute the header checksum

Set the checksum field to zero and add the 16-bit words using one's-complement arithmetic. Fold each carry above bit 16 back into the low end, then invert the bits.

For this header the words are 4500 0034 1C46 4000 4006 0000 C000 020A C633 6414. Their ordinary sum is 0x2CDD1. Folding gives 0xCDD1 + 0x0002 = 0xCDD3; inversion gives 0x322C. Verification includes the stored checksum and produces 0xFFFF when no error is detected. Lowering TTL from 64 to 63 changes 4006 to 3F06, so the updated checksum is 0x332C.

The checksum protects only the IP header. TCP separately checks its segment and an IP-address pseudo-header end to end. UDP's checksum is optional over IPv4; zero means it was omitted. With 20-byte IP and TCP headers, a 1,500-byte datagram carries 1,460 application bytes, so combined header overhead is about 2.7%.

Normal forwarding preserves the source and destination IP addresses while replacing link-layer addressing at each link. NAT is an exception that rewrites IP addresses. IPv4 options, such as route recording, make the header variable and often require slower processing.

A link's maximum transmission unit (MTU) limits the IP datagram size it can carry. When an IPv4 packet is too large for the next link, a router can fragment it if DF is clear. Every fragment needs its own IP header, so the MTU is not all available for data.

Find the fragment sizes

For a datagram without options:

1. Subtract the header length from the original total length.
2. Subtract one header from the MTU to find space per fragment.
3. Round that space down to a multiple of 8 for every non-final fragment.
4. Split the payload, putting any remainder in the final fragment.
5. Divide the payload bytes preceding each piece by 8 to get its offset.
6. Add a header to each piece for its Total length; set MF on all but the final piece.

The fragments share an Identification value. Together with source, destination and protocol, it identifies their original datagram. MF means more fragments follow in payload order. Offset measures position within the original payload, never the original header.

A 4,000-byte datagram

With a 20-byte header and MTU 1,500, the payload is 3,980 bytes. Space for data is 1,480 bytes, already divisible by 8.

The second offset is 1,480 divided by 8. The third is 2,960 divided by 8. The payload still totals 3,980 bytes, but three headers make the transmitted total 4,040 bytes.

For a 2,400-byte datagram with a 20-byte header and MTU 1,000, the 980-byte space rounds down to 976. The data pieces are 976, 976 and 428 bytes. Total lengths are 996, 996 and 448; offsets are 0, 122 and 244; MF values are 1, 1 and 0. Filling every non-final fragment to 1,000 total bytes would violate the offset alignment rule.

Reassemble at the destination

Only the destination host reassembles the original datagram. Fragments can arrive out of order or be fragmented again on a smaller link. The destination places data by offset and learns the ending position from the fragment with MF 0. That final fragment arriving first does not mean reassembly is complete: every earlier byte must also be present. Missing fragments eventually cause reassembly to time out.

Fragmentation adds headers and makes loss more costly: one missing fragment prevents delivery of the whole transport segment. Port numbers occur in the first fragment, which complicates filtering and NAT for later fragments. Overlapping fragments can also create security problems.

Discover the path limit

With Don't Fragment (DF) set, an oversized IPv4 datagram is dropped. The router returns ICMP Destination Unreachable, type 3 code 4, reporting that fragmentation is needed and giving the next-link MTU. Path MTU discovery uses this feedback to reduce packet size. Blocking the feedback can create a black hole in which small packets work but large ones disappear.

For TCP over an MTU of 1,500 with 20-byte IP and TCP headers, the data MSS is 1,460 bytes. IPv6 routers never fragment: they return ICMPv6 Packet Too Big so the source can reduce its packet size or fragment at the source.

A host needs an IP address, a subnet mask or prefix length, a default gateway and DNS server addresses. Dynamic Host Configuration Protocol (DHCP) supplies these settings automatically. On a small network the router often acts as the server; a larger network can use a dedicated server for several subnets.

Discover, Offer, Request, ACK

DHCP uses UDP, with server port 67 and client port 68. A new client does not yet have an address or know a server, so the initial exchange uses broadcast delivery.

1. Discover: the client sends from 0.0.0.0:68 to 255.255.255.255:67. A transaction ID associates replies with this exchange, and the message carries the client's MAC address.
2. Offer: a server proposes an address, lease duration and settings. More than one server can reply.
3. Request: the client broadcasts its chosen address and server identifier. The other offering servers can see that they were not selected.
4. ACK: the selected server confirms the lease. The client can complete configuration and use the address.

For example, a laptop joins a network whose DHCP server is 192.168.1.1. The offer is 192.168.1.101 with mask 255.255.255.0, gateway 192.168.1.1, DNS server 192.168.1.1 and a lease of 86,400 s. After the laptop broadcasts its Request and receives the ACK, it has a 24-hour lease and the settings for local and remote traffic.

An Offer alone is not the completed assignment. A NAK rejects a request that is no longer valid, such as one associated with the wrong network, and the client must restart address acquisition.

Keep or give up the address

A lease allows reuse after a host leaves. With default timers, renewal starts at half the lease duration: the client unicasts a Request to the original server. If renewal fails, at 87.5% of the duration it broadcasts a Request so any suitable server can extend the lease. A 24-hour lease therefore has default renewal and rebinding times of 12 and 21 hours after acquisition.

If the lease expires without extension, the client must stop using that address. A client can send Release when leaving, while Decline reports that the offered address is already in use. The address assigned on a later visit may differ because DHCP manages a reusable pool, not permanent ownership.

Reach a server on another subnet

Routers do not forward the client's limited broadcast as ordinary traffic. A DHCP relay agent on the client's subnet passes the message to a configured remote server. Its gateway-address field identifies the client subnet, allowing the server to choose the correct pool. Replies return through the relay to the client.

The relay and the default gateway serve different jobs even when the same router provides both. Relaying gets the configuration exchange to a remote server; the default gateway carries the configured host's traffic toward other networks. Likewise, the DNS server resolves names and need not be the DHCP server.

A valid address with the wrong default gateway can still leave a host unable to reach off-link destinations. IPv6 has separate configuration mechanisms, including SLAAC from router advertisements and DHCPv6.

Private IPv4 addresses can be reused in independent networks. The private blocks are 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. They are not globally routed on the public internet. Network address translation (NAT) lets privately addressed devices communicate using a public address at the network's boundary.

Record the mapping before following the reply

Home routers commonly perform network address and port translation (NAPT). The router changes an outbound packet's source address and source transport port, and records the private/public pair. A returning packet's destination pair is translated back. One-to-one NAT also exists and maps addresses without changing ports.

A laptop at 192.168.1.101:50123 connects to 203.0.113.80:443. Its NAT router has public address 198.51.100.7 and allocates port 40001:

The table contains 198.51.100.7:40001 ↔ 192.168.1.101:50123. If a phone at 192.168.1.102 uses the same private port to contact that server, the router can allocate public port 40002. The public port distinguishes the return traffic; the private port alone would not.

Rewriting the IPv4 address changes the header checksum. TCP and checksummed UDP also cover IP addresses through their pseudo-headers, so their checksums must be adjusted. NAPT also rewrites a transport port. The server normally sees the translated public source, not the private one.

Mappings have lifetimes

Outbound traffic usually creates dynamic mappings. An unsolicited inbound packet with no matching mapping is dropped in this basic arrangement. To expose an internal service, a static port-forwarding entry can be installed, or a host can request a mapping through UPnP or Port Control Protocol. STUN helps a host discover its public mapping; TURN relays traffic when direct communication cannot be established.

Idle mappings expire. UDP behavioral requirements call for a timeout of at least two minutes, with five or more recommended. Keepalive traffic can preserve a mapping. The 16-bit port field provides 65,536 numerical values per protocol, but reserved ports and mapping behavior mean that number is not an exact guarantee of simultaneous connections.

What NAT solves and what it costs

Sharing a public address has prolonged IPv4 use. Providers can also use carrier-grade NAT, often assigning customers addresses from the shared block 100.64.0.0/10. A home connection may then pass through both the home NAT and a provider NAT.

Translation reduces direct end-to-end reachability and complicates protocols that carry addresses in their message bodies, such as SIP or active-mode FTP. NAT also reaches into transport fields. IPv6 addresses the underlying scarcity with a larger address space.

NAT's rejection of unmatched inbound traffic is not content inspection. A malicious program can open an outbound connection through the same mapping mechanism as a legitimate client. Firewall policy remains a separate security function.

IPv4 has 32-bit addresses, roughly 4.3 billion possible values. IANA distributed its final central-pool IPv4 blocks in February 2011. IPv6 expands addresses to 128 bits, about 3.4 × 10³⁸ values, and simplifies routine header processing. RFC 8200 specifies its basic packet format.

A fixed 40-byte header

The fields total 320 bits, or 40 bytes. Hop limit serves the role of IPv4 TTL: each forwarding router reduces it by 1 and discards the packet when it expires. Flow label can help routers and load balancers treat a flow consistently, for example by selecting a stable path. It does not promise bandwidth.

Payload length excludes the fixed header but includes extension headers. A 1,000-byte TCP segment with no extensions therefore gives Payload length 1,000 and total size 1,040 bytes. IPv4 Total length, in contrast, includes its header.

Follow the Next header chain

Next header identifies either an upper-layer protocol or an extension. Values include TCP 6, UDP 17 and ICMPv6 58; extension types include Hop-by-Hop Options 0, Routing 43, Fragment 44 and Destination Options 60. An extension's own Next header identifies what follows it.

For a source fragment carrying 600 bytes of a TCP segment, an 8-byte Fragment header makes Payload length 608. The fixed header says Next header 44; the Fragment header says Next header 6. The total fragment size is 648 bytes. Reading only the first Next header would mistake an extension for the transport protocol.

What IPv6 removes from routine forwarding

IPv6 has no fixed-header checksum, so changing Hop limit does not require a network-header checksum update. Link-layer and transport error checks still matter. UDP checksums are normally mandatory over IPv6, with a narrow exception for certain tunnels; they are optional over IPv4.

IPv6 routers never fragment. An oversized packet is discarded and triggers ICMPv6 Packet Too Big; the source then reduces size or uses a Fragment header. Every IPv6 link must support an IPv6 MTU of at least 1,280 bytes, with lower-layer adaptation where necessary. Fragmentation still exists at the source.

Options move to extension headers, keeping the basic header length fixed. The two addresses occupy 32 of the 40 bytes, or 80%. At a total size of 1,500 bytes, the 40-byte IPv6 header is about 2.7% overhead, compared with about 1.3% for the usual 20-byte IPv4 header.

Address notation and local operation

Write addresses as eight hexadecimal groups. Remove leading zeros in a group, and compress one run of zero groups using "::". Thus 2001:0db8:0000:0000:0000:0000:0000:0001 becomes 2001:db8::1; 2001:db8::/32 is reserved for documentation.

Hosts can use SLAAC with router advertisements or DHCPv6. IPv6 has multicast instead of broadcast. ICMPv6 carries Neighbor Discovery, which replaces ARP's local address-resolution role, as well as essential error feedback. The larger address space generally removes the need for address-sharing NAT.

An IPv4-only host cannot directly exchange IP packets with an IPv6-only host. Every forwarding device must understand the packet it handles, so replacing a network-layer protocol takes coordinated change across a huge installed network. IPv4 and IPv6 consequently coexist. The small ARPANET could switch to TCP/IP on January 1, 1983; the internet cannot repeat that kind of universal "flag day."

Run both with dual stack

A dual-stack host or router implements both IP versions and has addresses for both. DNS can return A records for IPv4 and AAAA records for IPv6. The client can then connect using a version supported by both endpoints.

Happy Eyeballs avoids a long delay when one path is broken by overlapping connection attempts across available addresses and families, usually starting with IPv6 and allowing IPv4 to follow shortly afterward. The connection that succeeds is used. Dual stack does not translate packets; a particular connection uses one IP version.

Carry IPv6 through an IPv4 stretch

A tunnel places a complete IPv6 datagram inside an IPv4 payload. The outer IPv4 header names the tunnel entrance and exit, and Protocol 41 identifies encapsulated IPv6. IPv4-only routers can carry the packet using that outer header without interpreting the inner one.

Suppose host A, 2001:db8:1::10, sends to host F, 2001:db8:2::20. Router B, 192.0.2.1, is the tunnel entrance; router E, 198.51.100.2, is the exit. Routers C and D between them handle only IPv4.

B forwards the IPv6 packet, reducing its Hop limit, and adds the outer header from B to E. C and D reduce the outer IPv4 TTL as they forward. E removes the outer header, reduces the inner Hop limit when forwarding toward F, and sends the IPv6 packet onward. A starting Hop limit of 64 reaches F as 62. The tunnel acts as one IPv6 link; its internal IPv4 routers do not each consume an IPv6 hop. The inner source and destination remain A and F.

The wrapper uses space. With a 20-byte outer IPv4 header and an underlying MTU of 1,500, at most 1,480 bytes remain for the entire inner IPv6 datagram. Tunneling is also used in VPNs and mobile networks.

Translate for incompatible endpoints

NAT64 converts between IPv6 and IPv4 headers while keeping translation state. DNS64 can synthesize an IPv6 destination from an IPv4 server address, often using 64:ff9b::/96. For 192.0.2.33, the final four bytes are hexadecimal C0 00 02 21, giving 64:ff9b::c000:221.

An IPv6-only client sends toward that synthesized address. NAT64 sends the corresponding IPv4 packet to the server, then translates the reply back. DNS64 provides the usable destination; NAT64 performs the packet conversion. Some IPv6-only mobile access networks use this arrangement.

Translation cannot preserve every feature: IPv4 has no direct counterpart for the IPv6 flow label or its extension-header structure. A tunnel preserves a packet inside a wrapper, while translation changes its protocol representation.

Deployment remains uneven across networks and countries. A host gaining IPv6 does not gain direct IPv4 compatibility; it still needs IPv4 support or a translation path to communicate with an IPv4-only service.

Generalized forwarding extends destination-based lookup into a broader match-plus-action model. A switch compares packet header fields with entries and performs the selected action. The same device can act as an IP router, Ethernet switch, firewall, translator or load balancer depending on the installed rules.

Read an entry

An entry specifies match fields, priority and actions. It also has counters, such as matched packets and bytes and elapsed time since installation. An idle timeout removes an entry after a period without matches; a hard timeout removes it after a fixed time since installation even if traffic continues.

OpenFlow 1.0 provides twelve match fields: ingress port; source MAC, destination MAC, EtherType, VLAN ID and VLAN priority; source IP, destination IP, IP protocol and IP type-of-service DSCP bits; and transport source and destination ports. These span several layers. TTL is not a supported match field in that version. Later versions support additional fields, including IPv6 fields.

A wildcard accepts any value in its field. For example, destination 10.2.. denotes 10.2.0.0/16. All fields wildcarded creates a match for every packet. A rule naming TCP port 22 also needs the appropriate IP/TCP protocol match so the transport-port field has the intended meaning.

Resolve overlapping matches

For overlapping wildcard rules, the greatest explicit priority wins. Specificity alone does not choose the winner. OpenFlow 1.0 has an additional rule: a completely exact entry, with no wildcard fields, precedes wildcard entries. A rule matching one exact IP address while leaving other fields wildcarded is still a wildcard entry.

Consider two entries, with all unspecified fields wildcarded:

A TCP packet for 10.2.0.5:22 matches both and is dropped. A TCP packet for 10.2.0.5:443 matches only the forwarding entry. This differs from longest prefix matching: the winner comes from the assigned priority, not the destination prefix length.

Take an action

Forwarding can select one output, several outputs for copying, or delivery to the controller. An empty action list drops the packet. Modify actions rewrite supported header fields, for example a destination IP address and transport port, before the packet is sent onward.

A table miss has no matching entry. In OpenFlow 1.0 the switch sends the packet to the controller; more general flow-table designs can configure a miss to drop or request controller help. The controller can install an entry so later packets stay on the fast local path.

Flow matching reads headers. Looking inside application payloads is deep packet inspection, a separate function that ordinary OpenFlow matching does not supply. Likewise, OpenFlow is a switch-control protocol, while SDN is the broader architecture that separates control from forwarding. Programmable data-plane languages such as P4 can define which headers a device parses, extending programmability beyond a fixed list of match fields.

A switch can apply a rule correctly while a packet still fails farther along the path. Software-defined networking (SDN) uses a controller and network applications to coordinate the forwarding behavior of several switches.

Separate the roles

SDN combines flow-based forwarding, separation of data and control planes, control functions outside the switches, and software interfaces for programming the network. A southbound interface, such as OpenFlow, carries instructions between controller and switches. A northbound interface lets network applications request behavior from the controller.

The controller is logically centralized: it presents one coordinated control system. Production systems can replicate that control across several physical servers for scale and reliability. A packet already covered by a flow entry is handled in the switch without a controller round trip.

Build a path one switch at a time

Traffic from 10.1.0.0/16 at s1 must reach 10.3.0.0/16 through s2 and s3. With other fields wildcarded, the relevant path entries are:

• On s1: ingress 1, source 10.1.0.0/16, destination 10.3.0.0/16 → output 4 toward s2.
• On s2: ingress 2, source 10.1.0.0/16, destination 10.3.0.0/16 → output 3 toward s3.
• On s3: destination 10.3.0.6 → output 1 toward that host.

Each output must lead to a link whose receiving switch has a compatible entry. A missing entry can produce a black hole; incompatible entries can send packets in a loop. Matching the source as well as the destination allows traffic from different source networks to take different paths to the same destination. Plain destination-only lookup cannot make that distinction.

Use the same mechanism for several jobs

A firewall can forward source 10.3.0.0/16 at priority 200 and drop all traffic at priority 100. Add an IPv4/TCP destination-port-22 drop at priority 300 to block SSH even from the allowed source network. These are wildcard rules, so their explicit priorities decide overlap. Reversing those priorities would allow the broader permit to defeat the intended SSH block.

An Ethernet forwarding entry can match destination MAC 22:A7:23:11:E1:02 and output port 3 regardless of IP addresses. A load-balancing pair can send traffic to 10.4.0.0/16 from source 10.1.0.0/16 on port 3, and from 10.2.0.0/16 on port 4, provided both paths reach that destination. Address and port rewriting before forwarding can implement NAT behavior.

Keep local and network-wide correctness separate

Inspecting one switch proves only that switch's match and action. To verify a path, follow the packet's actual header and ingress port through every switch, including any header changes. Also check the return direction when the application needs replies: installing an outward path does not automatically install its reverse.

SDN is used in data centers, networks between data centers such as Google's B4, and cellular core networks. Software control and commodity "white-box" switches let operators change behavior without depending on one vendor's dedicated appliance feature cycle. Computing the routes belongs to the control plane; matching the installed entries remains data-plane work.

A middlebox is a device on the communication path that does more than an ordinary IP router's standard forwarding job. RFC 3234 includes functions such as translation, filtering and traffic optimization. A single home gateway can combine routing, NAT and a firewall.

Why operators put functions on the path

NAT shares addresses. Security devices, including firewalls and intrusion detection systems, block or flag traffic based on headers or content. Performance devices include load balancers, caches, content-delivery servers and WAN optimizers. A packet can meet several such functions on one journey.

A load balancer presents one service address to clients and distributes connections across servers. For an ordinary stateful connection, packets need to reach the same backend. A hash of the 5-tuple—source address, destination address, source port, destination port and protocol—can make that selection consistent. Choosing a different backend for every packet would break a connection whose state exists only at the selected server.

These functions once commonly used closed appliances. They can now run on commodity switches, under SDN control, or as network functions virtualization (NFV): software implementations of functions such as NAT or firewalls on ordinary servers. NFV describes how the function is implemented; SDN describes how control is organized.

The IP hourglass

The internet has many applications and transport protocols above IP and many link and physical technologies below it. IP forms their common narrow waist. A new application does not need a different network layer for each link technology, and a new link does not need separate support for every application.

The architectural tradition described in RFC 1958 places connectivity at the center, uses IP as the common mechanism, and puts much intelligence at the endpoints. Middleboxes add functions inside that common path, thickening the waist and making communication depend on behavior beyond ordinary IP forwarding.

Apply the end-to-end argument

The end-to-end argument, first presented by Saltzer, Reed and Clark in 1981, asks where a function can be implemented completely and correctly. If that requires application knowledge available only at the endpoints, the endpoint implementation is still needed even when the network supplies a partial version.

For a reliable file transfer, error-free link delivery is insufficient. A router memory error, software bug or disk problem can still change the file. The receiving application must check the whole received file, for example with an agreed checksum, and request repair if the result differs. Local retransmission on a noisy Wi-Fi link can still improve performance by repairing common errors quickly. It does not replace the file-level check.

The cost of depending on today's protocols

Middleboxes can reduce address use, improve security policy enforcement and speed delivery. They can also restrict direct communication and cause ossification: devices assume a familiar protocol format and reject or alter unfamiliar behavior. A new transport can fail even when the endpoint software supports it.

QUIC uses UDP to pass through common deployed NAT and firewall behavior, and encrypts most transport information so intermediate devices have less opportunity to depend on its details. The design balances deployability with room to evolve. Today's internet includes programmable switches, content-delivery systems and large data centers; end-to-end design remains a guide for deciding what endpoint checks are essential within that more complex network.