The network layer is the part of a communications stack that routes packets across interconnected networks using logical addresses. It handles path selection, forwarding and fragmentation across routers, and sits below transport protocols such as TCP and UDP, which makes it the layer that gets traffic from one host network to another.
How the network layer works
The network layer moves traffic between separate networks by assigning logical addressing and selecting routes across routers. It is the layer that makes internetwork delivery possible, rather than merely moving frames within a single local segment.
Because it sits below transport protocols such as TCP and UDP, the network layer provides the path for end-to-end delivery while remaining largely unaware of application semantics. Its job is to forward packets toward the next hop, not to interpret the data they carry.
Core functions of routing and forwarding
The network layer performs three closely related jobs: route selection, packet forwarding and fragmentation when a packet must fit a smaller downstream link. Those functions let heterogeneous networks interoperate without every segment needing the same physical characteristics.
Routing is a control-plane decision about where traffic should go. Forwarding is the data-plane action of sending each packet to the next hop. Fragmentation is a compatibility mechanism, but it can also increase overhead and make delivery less efficient when paths impose different size limits.
Network layer protocols and addressing
This layer is commonly associated with IP and with the addressing model that lets hosts be found across multiple networks. Logical addresses identify where a system sits in the internetwork topology, which is different from link-layer identifiers that only matter on the local segment.
The practical importance of the layer is that it creates a scalable abstraction for communication. Devices can move traffic across many network boundaries without every sender needing direct knowledge of the full path, the intermediate routers, or the physical network makeup behind each hop. OSI and TCP/IP Models Guide is a useful companion for understanding where the network layer sits in the broader stack.
Why the network layer matters in security design
Security controls often depend on how the network layer routes traffic, because segmentation, filtering, inspection and path control all assume that packets can be steered or blocked at this layer. When routing is wrong, unstable or overly permissive, exposure can spread beyond the intended trust boundary.
Network-layer design also affects observability. If teams cannot see where traffic is entering, exiting or being rerouted, they can miss asymmetric paths, unauthorized transit, or traffic that avoids expected inspection points. The layer therefore influences both reachability and the defender’s ability to reason about it.
Risk and Threat Considerations
The network layer is a common place for exposure when routing, address handling or fragmentation is misconfigured. Weak path control can expose internal systems to unintended reachability, bypass security zones, or make traffic inspection less reliable.
Failure mechanism: Attackers or misconfigurations can abuse routing asymmetry, spoofed paths, or fragment handling to hide traffic, evade filtering, or reach services that were meant to stay isolated.
Impact: The result can be lateral movement, blind spots in monitoring, failed segmentation, or inconsistent delivery of security controls across different network paths.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, NIST Zero Trust (SP 800-207) and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | SC-7 — Boundary Protection | Network-layer routing and segmentation directly shape boundary enforcement. |
| AC-4 — Information Flow Enforcement | The network layer controls which flows can traverse between networks. | |
| Recommendation — Enforce boundary protections where network-layer paths cross trust zones. Apply flow-enforcement rules to constrain packet movement between networks. | ||
| NIST Zero Trust (SP 800-207) | Zero Trust Architecture | Zero trust depends on controlling network reachability and verifying paths between resources. |
| Recommendation — Design network paths so access is explicitly verified rather than implicitly trusted. | ||
| CIS Controls v8 | CIS-13 — Network Monitoring and Defense | Network-layer traffic needs continuous monitoring, filtering and defensive visibility. |
| Recommendation — Monitor routing and transit traffic to detect anomalies and blocked-path failures. | ||
Practitioner Guidance
What to watch for: Treat the network layer as a policy boundary, not just a transport convenience. Review route control, address scope, fragmentation behaviour and segmentation assumptions together, because a weakness in any one of them can change where traffic is actually allowed to go.
Practitioner note: If a control depends on packets taking a predictable path, validate that assumption against real routing behaviour, not just the intended design.
Related resources from NHI Mgmt Group
- What breaks when privileged access is controlled only at the network layer?
- What breaks when healthcare zero trust is applied only at the network layer?
- Why do logs, endpoints, and network tools fail to fully detect application-layer attacks?
- Who should own network-layer identity controls in an enterprise?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 29, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org