Networking

IP — Internet Protocol

The layer responsible for addressing and best-effort delivery of packets between hosts, potentially across many intermediate networks. IP itself makes no promise of delivery, order, or integrity beyond a basic header checksum — those guarantees are TCP's job, not IP's.

Quick reference

What it is: The layer that addresses hosts and routes packets between networks, with no delivery guarantee of its own.
Mental model: The postal system: it addresses and routes the envelope, but doesn't promise it arrives, arrives in order, or arrives at all.
Key numbers: 32-bit addresses (IPv4) or 128-bit (IPv6); common subnet sizes /24 (254 hosts), /16 (65,534 hosts).
Reach for it when: You don't choose it directly — every IP-based protocol (TCP, UDP, and everything built on them) sits on top of this layer.

Addressing

An IPv4 address is 32 bits, usually written as four dotted decimal octets (e.g. 192.168.1.10). It's split into a network portion and a host portion by a subnet mask (or CIDR prefix, e.g. /24).

CIDR	Mask	Usable hosts
/24	255.255.255.0	254
/16	255.255.0.0	65,534
/30	255.255.255.252	2 (common for point-to-point links)

Two hosts can talk directly only if they're on the same network (same network portion of their address). Otherwise, a packet is handed to a gateway/router, which forwards it based on its routing table — repeating hop by hop until it reaches a router directly attached to the destination's network.

Same shape as a mailing address: a shared "neighborhood" prefix, then a number unique to one device in it.

Ports and sockets — finding the program, not just the machine

An IP address gets a packet to the right machine, but a machine runs many programs at once. A port — a number from 0 to 65535 — says which one of those programs a packet is actually for. If the IP address is the building's street address, a port number is the apartment door inside it: the network only needs the street address to reach the building, and the OS routes the rest internally once it arrives, using a table of "which program is listening on which port."

Ports 0–1023 are "well-known" and reserved by convention for standard services (80/443 for web, 53 for DNS, 22 for SSH). A program has to explicitly bind to a port before anything addressed to it arrives — data sent to a port nobody is listening on is simply dropped.

Put an IP address and a port together and you get a socket — the actual address both ends of a conversation use. A server binds a fixed, well-known port and listens on it forever; a client doesn't need a fixed port at all, so its OS grabs any free number above 1024 (an ephemeral port) just for that one conversation and discards it afterward.

The server's port is fixed and known in advance; the client's port is picked fresh by its own OS, for this one exchange only.

Key fields worth knowing by name: TTL (Time To Live — decremented each hop, packet dropped at zero, preventing infinite routing loops), Protocol (which transport protocol follows — 6 for TCP, 17 for UDP), Source/Destination address, and Fragmentation fields (used when a packet exceeds the outgoing link's MTU).

TTL and hop-by-hop routing

Every router a packet passes through decrements TTL by one before forwarding it. This isn't optional bookkeeping — it's the only thing standing between a routing-table misconfiguration and a packet looping between two routers forever, silently eating bandwidth. If TTL hits zero, the router drops the packet and sends back an ICMP "Time Exceeded" message to the original sender — which is exactly the mechanism traceroute deliberately exploits: it sends packets with TTL 1, then 2, then 3, and reconstructs the path to a destination one dropped packet at a time.

TTL is a hop-count safety valve, not a timer despite the name — it protects the whole network from one bad route entry, not any single packet's latency.

Why IP has no reliability built in

This is a deliberate design tradeoff, not an oversight. Every router on the internet has to forward packets from an enormous number of unrelated connections as fast as possible — if IP itself tracked per-connection state, acknowledgments, and retransmissions, every router in every path would need to carry that state too, which does not scale to internet size. By keeping IP stateless and pushing reliability up to the endpoints (TCP, or the application itself on UDP), the network core stays simple, fast, and able to route around failures without needing to know or care what any given packet's delivery guarantees are supposed to be. The cost of that simplicity is pushed to whichever layer actually needs the guarantee — which is also why an application that doesn't need reliability (UDP-based telemetry, for instance) never has to pay for TCP's overhead just because it exists.

IP does provide one honesty signal when something goes wrong: ICMP (Internet Control Message Protocol) — the "Time Exceeded" message above, "Destination Unreachable", and the echo request/reply pair that ping uses. ICMP is not a delivery guarantee either; it's diagnostic signaling, and routers are free to rate-limit or drop it under load.

Private address ranges (RFC 1918)

10.0.0.0/8
172.16.0.0/12
192.168.0.0/16

Not routable on the public internet directly — devices behind a NAT gateway typically get an address from one of these ranges.

IPv4 vs. IPv6

IPv4's 32-bit address space allows roughly 4.3 billion unique addresses. That sounded limitless in the 1980s; it doesn't in a world with billions of phones, laptops, servers, and IoT devices all needing one. IANA formally handed out the last free blocks of IPv4 address space in 2011 — since then, the internet has run almost entirely on NAT to make one public IPv4 address serve an entire household or company's worth of devices. IPv6 exists specifically to make that workaround unnecessary again, by making the address space so large that giving every device its own globally unique address stops being a scarce resource.

128 bits isn't "IPv4 but a bit bigger" — each additional bit doubles the space, so 96 more bits is a change of roughly 29 orders of magnitude.

IPv6 also simplifies the packet itself, not just the address:

	IPv4	IPv6
Address length	32 bits	128 bits
Address format	Dotted decimal — `192.168.1.10`	Colon-separated hex groups — `2001:db8::1` (`::` compresses a run of zeros)
Header size	Variable, 20–60 bytes (options field)	Fixed 40 bytes — simpler and faster for routers to process
Fragmentation	Routers may fragment packets in flight	Only the sending host fragments; routers never do — pushes the cost to the endpoint that can best absorb it
Header checksum	Present — recomputed at every hop	Removed — left to the link and transport layers, since re-checksumming at every router added cost for little real benefit
Broadcast	Supported (e.g. `255.255.255.255`)	Removed entirely — replaced by more targeted multicast
Address configuration	Manual or DHCP	DHCPv6, or built-in stateless autoconfiguration (SLAAC) — a device can generate its own address without asking anyone
NAT	Effectively required at internet scale	Not needed for address scarcity — though still sometimes used for other reasons (privacy, topology hiding)

The two are not backward compatible — an IPv4-only device cannot talk directly to an IPv6-only one; something has to translate or tunnel between them. In practice, most networks run dual-stack (both protocols active side by side, picking whichever the other end supports) during what has turned into a multi-decade transition, with techniques like NAT64 and 6to4 bridging the two where dual-stack isn't available. IP's core job — best-effort packet delivery — is identical in both; only the addressing and header details change.

Real-world applications

Every networked embedded device — a Wi-Fi/Ethernet-connected MCU gets an IP address before it can speak TCP, UDP, or anything built on them.
Home and office routers — NAT translates private RFC 1918 addresses to a single public address, the reason most home devices share one internet-facing IP.
IoT device provisioning — DHCP (built on UDP, but assigning IP configuration) is how a new device on a network gets an address without manual configuration.
VPNs and tunneling — encapsulating one IP packet inside another is the basic trick behind most VPN implementations.

Gotchas

Field notes

A too-low default TTL isn't usually a problem on a LAN, but a misconfigured VPN or tunnel adding extra hops can make a destination that's normally reachable start silently failing once the path grows past the sender's default TTL.
Fragmentation (splitting a packet larger than a link's MTU) is expensive and increasingly disabled/avoided in practice — Path MTU Discovery exists specifically so senders can avoid it by finding the smallest MTU on the path up front.
NAT rewrites source addresses/ports in flight, which is why two devices behind the same home router can't be told apart by IP address alone from the internet's point of view — only the combination of translated IP and port identifies a specific internal device.
"No delivery guarantee" is a design choice, not a limitation to work around at the IP layer — it's precisely what keeps IP simple and fast enough to run on every router in a path. Reliability, when needed, is deliberately pushed up to TCP.