IP Addressing and Subnetting

The OSI model lesson left a packet sitting at layer 3 with a header wrapped around it. That header holds two numbers, a source and a destination. Every routing decision on the internet gets made by reading those two numbers and nothing else. So they are worth reading properly.

An address is 32 bits in a costume

An IPv4 address is a 32-bit number. Nothing more. The dots are a convenience for humans, splitting those 32 bits into four groups of 8, each written in decimal. That is why every group stops at 255: eight bits count from 0 to 255 and then run out.

So 10.0.5.130 is really this:

   10  .    0   .    5   .   130
00001010 00000000 00000101 10000010

Anyone who reads the decimal and skips the binary will be guessing at subnetting forever. Every rule below is a rule about bits.

There is a newer version, IPv6, which uses 128 bits and writes them as hex groups like 2001:db8::1. It exists because 32 bits only allow about 4.3 billion addresses and the world wanted more. The splitting rule is identical, just with more bits. IPv4 is what shows up on almost every internal network, so it drives the rest of this lesson.

The split: which part names the street, which names the house

Those 32 bits are not one label. They are two, glued together.

The leading bits name a subnet, a slice of a larger network whose machines all share those same leading bits. The trailing bits number one machine inside that slice. Two hosts with matching network bits can reach each other directly. Two hosts with different network bits cannot, and need a router in between.

Nothing in the address itself says where the split falls. 10.0.5.130 on its own is ambiguous. The split has to be told separately, and CIDR notation is how it gets told: 10.0.5.130/26 means the first 26 bits are network, the last 6 are host.

The same information also gets written as a subnet mask, which is just the prefix drawn as an address: 26 ones followed by 6 zeros is 11111111.11111111.11111111.11000000, which reads back as 255.255.255.192. Same fact, older costume. /24 is 255.255.255.0.

Working one out

Take a host at 10.0.5.130/26. The prefix is 26, so the first three octets (24 bits) are entirely network, plus the top 2 bits of the last octet. Only the final 6 bits are free.

address    10.0.5.130   ->  ........ ........ ........ 10 000010
prefix /26                  |<---- network ----->|<--->| host |
network    10.0.5.128   ->  ........ ........ ........ 10 000000
broadcast  10.0.5.191   ->  ........ ........ ........ 10 111111

Set all host bits to 0 and the result is the network address, 10.0.5.128. It names the subnet itself and never belongs to a machine. Set all host bits to 1 and the result is the broadcast address, 10.0.5.191, which reaches every host in the subnet at once. Also not a machine.

Everything between them is usable: 10.0.5.129 through 10.0.5.190. That is 62 addresses, which matches the formula 2^(32 - prefix) - 2, or 2^6 - 2.

The shortcut worth memorizing is block size. A /26 has 64 addresses, so the subnets start at .0, .64, .128, .192. Find which block contains the address and both ends fall out immediately. 130 lands in the .128 block. Done, no binary needed once the habit sticks.

Why any of this decides anything

Here is the part that makes subnetting worth the arithmetic rather than a trivia exercise.

When a host has a packet to send, it does one calculation first. It applies its own mask to its own address, applies the same mask to the destination address, and compares. Match means the destination is a neighbor on the same local network. No match means it is somewhere else.

Those two answers lead to completely different behavior:

• Same subnet. The sender needs the destination's hardware address, since a switch forwards on MAC addresses and knows nothing about IP. So the host broadcasts an ARP request, which shouts to the whole local network asking who owns that IP. The owner answers with its MAC address, and the frame goes straight there.
• Different subnet. ARP would be pointless, because the destination is not on this network to answer. Instead the host addresses the frame to the MAC of its default gateway and hands the packet over. The gateway is a router, and routing it onward is now the router's problem.

The destination IP never changes in either case. What changes is which MAC address goes on the frame. That is the whole reason both a layer 2 address and a layer 3 address exist at once, and it is what encapsulation from the previous lesson was building toward.

A wrong mask breaks this quietly. A host configured /24 that should be /16 will decide half its real neighbors are remote and ship their traffic to the gateway. If the gateway routes it back, everything works but slowly. If it does not, some hosts are simply unreachable, and nothing logs an error.

Reading it off a real machine

On a Linux host, ip addr prints every interface with its address and prefix.

$ip addr

Four things in that output are worth naming.

inet 10.0.5.130/26 is the address and its prefix, the exact pair the whole lesson has been working with. brd 10.0.5.191 is the broadcast address the kernel already computed, and it agrees with the arithmetic above.

The lo interface holds 127.0.0.1/8, the loopback address. It always means this same machine, and traffic to it never touches a wire. A service bound only to loopback is unreachable from every other host on earth, no matter what the firewall says.

The word dynamic with a valid_lft countdown means the address was leased, not typed in. DHCP handed it over when the machine joined the network, along with the gateway and DNS server. That lease expires, which is why an address seen on a network today may belong to a different machine next week. Timestamps matter when reading logs.

Private addresses and the router that lies

Three IPv4 ranges are reserved for private networks and are never routed on the public internet: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. Seeing one of those means the address is internal to somebody's network.

Millions of networks reuse those same ranges at once, which works only because of NAT. A router sitting at the edge rewrites the source address on outbound packets to its own single public address, remembers the swap, and reverses it on the replies. Everything inside shares one public identity.

The consequence is asymmetry, and it is the reason NAT matters to security work. Connections started from inside get out fine. Connections started from outside have no entry in the router's table, so the router has no idea which internal machine they belong to and drops them. A home machine is unreachable from the internet by default, and that is a side effect of address conservation rather than a security feature anyone designed.

Where this goes wrong

The /24 reflex is the most common failure. Not every subnet is a /24, and assuming one turns 10.10.14.23/26 into a sweep of 254 addresses when only 62 exist, or worse, misses the 190 hosts that a /23 actually holds.

Two prefixes break the minus-two rule and confuse people. A /32 is a single address with no network or broadcast, used to mean exactly one host. A /31 holds two addresses and zero waste, because RFC 3021 allows point-to-point links between routers to skip the network and broadcast entirely.

Try it live

Dragging the prefix below moves the split. Each step of the prefix halves or doubles the usable host count, and the network and broadcast addresses slide to match.

An address and a prefix get a packet to the right machine. They say nothing about what happens once it lands, and a single host may run a web server, an SSH daemon, and a database at the same time. The next lesson, TCP, UDP, and Ports, covers the number that picks which one of them the packet was meant for.