IP addresses and subnets

Why it matters

Every device on an IP network needs an address, and every address belongs to a subnet. Cloud engineers carve virtual networks into subnets, security engineers write firewall rules for address ranges, and database administrators decide which networks may connect to a database. If you cannot read 10.0.4.0/22, you cannot do any of these safely.

An IPv4 address is 32 bits

192.168.1.10 is four octets (8 bits each) written in decimal, separated by dots. Each octet ranges from 0 to 255. Underneath, it is one 32-bit number:

192      .168      .1        .10
11000000 .10101000 .00000001 .00001010

An address has two parts: the network part (which network the device is on) and the host part (which device on that network).

The subnet mask and CIDR prefix

The subnet mask says where the network part ends. Its 1-bits cover the network part:

255.255.255.0  =  11111111.11111111.11111111.00000000

That mask has 24 one-bits, so it is written as the CIDR prefix /24. 192.168.1.10/24 means "the first 24 bits are the network".

Each extra prefix bit halves the subnet.

Network, broadcast and usable addresses

In each subnet, the first address (host bits all 0) is the network address and the last (host bits all 1) is the broadcast address. Neither is given to a device, so usable hosts = 2^(32 - prefix) - 2. (Cloud providers often reserve a few more; AWS reserves five per subnet.)

Worked example 1: a /24

192.168.1.10/24: the network is 192.168.1.0, the broadcast is 192.168.1.255, and hosts run from 192.168.1.1 to 192.168.1.254. A device at 192.168.2.5 is on a different network, so traffic to it must go through a router (your default gateway).

Worked example 2: a /26

192.168.1.130/26. A /26 mask is 255.255.255.192, so the last octet's block size is 256 - 192 = 64. The subnets start at .0, .64, .128 and .192. 130 falls in the block starting at 128, so:

• network: 192.168.1.128
• broadcast: 192.168.1.191 (the next block starts at .192)
• usable: 192.168.1.129 to 192.168.1.190, 62 hosts

The same answer comes from a bitwise AND of the address and the mask, which is what computers do and what you will code in the activity:

130 = 10000010
192 = 11000000
AND = 10000000 = 128

Worked example 3: same subnet or not?

A server is at 10.0.4.20/22 and a database at 10.0.7.200. Are they on the same subnet? A /22 has 22 network bits, so the third octet's block size is 256 - 252 = 4: blocks start at 4, 8, 12 and so on. 4 and 7 both fall in the block 4 to 7, so the subnet is 10.0.4.0 to 10.0.7.255 and they can talk directly without a router. A host at 10.0.8.1 would be in the next block and would need the gateway.

Private and special ranges

RFC 1918 reserves three ranges for private networks. They are not routed on the public internet:

• 10.0.0.0/8
• 172.16.0.0/12 (172.16.0.0 to 172.31.255.255)
• 192.168.0.0/16

Also worth knowing: 127.0.0.1 is loopback (this computer), and 169.254.x.x is a self-assigned address that usually means DHCP failed.

IPv6 in one paragraph

IPv4 has only about 4.3 billion addresses, so IPv6 uses 128 bits, written in hexadecimal groups such as 2001:db8::1 (:: replaces a run of zero groups). Subnets are usually /64. The same network/host idea applies.

Common mistakes

• Giving a device the network or broadcast address.
• Overlapping subnets. 10.0.0.0/16 already contains 10.0.5.0/24; using both in one design causes routing confusion. This matters when you connect two cloud networks.
• Thinking /24 always means the last octet. A /22 such as 10.0.4.0/22 spans 10.0.4.0 to 10.0.7.255.
• Mixing up mask and prefix. 255.255.255.192 is /26, not /192.

Quick recap

• IPv4 = 32 bits, four octets; the prefix says how many bits are network.
• Network address = address AND mask; usable hosts = 2^(32 - prefix) - 2.
• Know the RFC 1918 private ranges, loopback and 169.254.

Try it

Open the Do tab and finish a small JavaScript subnet calculator.