Net as a graph: Level 3 (IP)

3a. Nodes=IP interfaces, links=packets seen at both (no IP devices in between, TTL difference 1)

repeaters, hubs, switches included in links

3b. Nodes=IP devices (routers, firewalls, caches, NAT boxes); links=observed packets (no IP devices in between, TTL difference 1)