Loading content
Network Layer
Below the name is the backbone: independent networks announcing what they can reach, and trusting each other by default.
What it is
Once a name resolves to an address, the address has to be reached across thousands of independent networks that were never centrally designed. The backbone is a mesh of Autonomous Systems announcing which blocks of addresses they can carry, and choosing paths between them.
This layer is where the truest ownership signal on the web lives — the network behind an IP — and where the internet’s deepest structural weakness lives: it routes on trust.
Going deeper
BGP does not choose the fastest route — it chooses by policy. Each router prefers routes by a ladder of rules: highest local preference (a business decision), then shortest AS-path, then a few tie-breakers. This is why traffic sometimes takes a geographically absurd path: money and policy outrank distance.
Networks stratify: tier-1 networks reach the entire internet purely by settlement-free peering and pay no one; tier-2 networks peer where they can but buy transit to fill the gaps; tier-3 networks are access providers that mostly buy transit. The tier map is the commercial skeleton of the whole system.
A more-specific prefix always wins in routing, and BGP authenticates nothing by default, so announcing a /24 inside someone’s /16 quietly pulls that traffic to you. RPKI fixes the origin half of the problem by cryptographically signing which AS may announce a prefix — but it only works where both the origin signs and the receiving networks check, and that coverage is still incomplete.
Addresses (v4/v6) allocated in blocks called prefixes.
Every reachable machine has an IP address; addresses are handed out in blocks (prefixes, in CIDR notation) by the regional registries. A prefix, not a single address, is the unit networks actually route and own.
A network under one administrative control.
An Autonomous System is a set of prefixes run as one network under a single policy, identified by an AS number. The ASN behind an IP is the most reliable owner signal on the backbone — far truer than a privacy-masked WHOIS.
The routing protocol that stitches the internet together.
The Border Gateway Protocol is how ASes tell each other which prefixes they can reach; each picks the best AS-path from what it hears. It believes announcements by default — the single fact that makes hijacks and leaks possible.
Physical points where networks peer.
An IXP is a physical facility where many networks interconnect directly to exchange traffic, cheaply and locally, instead of paying transit. The big exchanges (DE-CIX, AMS-IX, LINX) are chokepoints of physical concentration.
The commercial map — who pays whom to carry traffic.
Networks either peer (exchange traffic for mutual benefit, often free) or buy transit (pay a larger network to reach the rest of the internet). Tier-1 networks peer settlement-free with each other; everyone else buys transit somewhere. This is the money map of the backbone.
One address announced from many places at once.
Anycast announces the same IP prefix from many locations, so users reach the nearest instance — the technique behind DNS root servers and CDNs. It makes one "address" a globally distributed system.
Cryptographic validation of who may announce a prefix.
Resource Public Key Infrastructure cryptographically signs which AS is authorised to originate a prefix, letting networks reject bogus announcements. It is the partial fix to BGP’s trust problem — real, but only as strong as its (still incomplete) adoption.
Read it honestly
The network layer is where machine truth is strongest: routing and allocation data are generated by infrastructure, not claimed by people. Its limit is abstraction — an ASN tells you the operating network, not always the ultimate corporate owner, which is where this layer hands off to the ownership graph.
Take Network Layer from reference to the live system.