Layer 3 (Network): IP, routing & ping

Acutis · plain-English network help · updated June 2026

Layer 3 is where your traffic gets an address and a route. Once the physical link (Layer 1) and the local switch fabric (Layer 2) are healthy, Layer 3 — the Network layer — decides where a packet goes and how it gets there. It handles IP addresses, subnets, the default gateway, routing between networks, and the ICMP messages behind ping and traceroute. If a device can talk to its neighbors but can't reach the wider internet, Layer 3 is almost always where the fault lives.

IP addresses, subnets and masks

Every device on an IP network has an address, such as 192.168.1.42. On its own, that address isn't enough — the device also needs a subnet mask (for example 255.255.255.0, written as /24). The mask defines which part of the address identifies the local network and which part identifies the individual host. Two devices can only talk directly when they share the same network portion. If your mask is wrong, your computer may think a device three feet away is on a different network and try to route to it the long way — or fail entirely.

This is the single most common Layer 3 mistake: a device with the right IP but the wrong mask. It "works" for some destinations and silently breaks others, which makes it maddening to diagnose by feel. A subnet calculator takes the guesswork out — feed it an address and a mask and it shows you the network range, the usable host range, and the broadcast address so you can confirm a device is actually inside the subnet you expect.

The default gateway and routing

When a destination is outside your local subnet — anything on the internet, for example — your device hands the packet to its default gateway, which is normally your router. The gateway then forwards the packet toward its destination, hop by hop, with each router along the way consulting its own routing table. If your gateway address is missing, wrong, or unreachable, you'll be able to reach devices on your own subnet but nothing beyond it. That "local works, internet doesn't" pattern is the classic gateway symptom.

Want the longer explanation of what the gateway is and how to find yours? See what is a default gateway. For how masks and ranges work in depth, see what is a subnet.

ICMP, ping and traceroute

Layer 3 also carries ICMP, the protocol behind two tools you'll use constantly. ping sends a small ICMP echo request and waits for a reply, measuring round-trip time and revealing whether a host is reachable at all. traceroute (or tracert on Windows) maps the chain of routers between you and a destination, showing where delay or loss begins. Together they tell you whether the problem is your own device, your router, or somewhere out on the internet path.

Common Layer 3 symptoms

• Wrong IP address. A device pulled an address from the wrong range (or stuck on a self-assigned 169.254.x.x address because DHCP failed) can't reach anything useful.
• Wrong subnet mask. Reaches some hosts, fails on others, with no obvious pattern — the tell-tale sign of a mask mismatch.
• Wrong or missing gateway. Local devices ping fine, but the internet is unreachable and traceroute dies at the first hop.
• Can't reach another subnet. Two networks that should route to each other don't, usually a missing route or a firewall between them.
• Ping fails entirely. Either the host is down, the address is wrong, or ICMP is being filtered along the way.

How to diagnose Layer 3

Work outward from your own machine, one hop at a time:

1. Check your own settings. Run ipconfig (Windows) or ip addr / ip route (Linux/macOS) and confirm your IP, mask, and default gateway look sane. A 169.254.x.x address means DHCP failed — that's your first lead.
2. Ping your own gateway. ping 192.168.1.1 (use your real gateway). If this fails, the problem is local — Layer 1/2 or a bad gateway setting.
3. Ping a known public IP. Try ping 1.1.1.1. If the gateway answers but a public IP doesn't, the break is upstream, between your router and the internet.
4. Trace the path. tracert 1.1.1.1 (Windows) or traceroute 1.1.1.1 shows exactly which hop stops responding, separating a home problem from a provider problem.
5. Verify the subnet math. If reachability is patchy, plug your address and mask into a subnet calculator to confirm the host is really inside the range you think it is.

🔧 Inspect it with our free tools

Three browser tools confirm a Layer 3 fault without installing anything:

1. Open the Subnet Calculator and enter your IP and subnet mask (e.g. 192.168.1.42/24). Confirm your default gateway falls inside the usable host range it shows — if the gateway is outside your subnet, that's your bug.
2. Run the Ping Test and watch the latency and packet loss to the major clouds. Loss or huge latency points to an L3 or path problem, not your machine.
3. Paste an external IP into IP Lookup to see which network, ASN and ISP own it — handy when a traceroute hop or unknown address needs identifying.