📘 IP Addressing and Routing

This page covers layer 3: how hosts get addresses, how a network is carved into subnets, and how packets find their way across the Internet. Subnet math is the part interviewers test by hand, so the worked examples are spelled out step by step. Every subnet in the examples was checked with Python's ipaddress module.

Table of Contents

1. IPv4 Addresses
2. CIDR and Subnetting
3. Special and Private Ranges
4. NAT
5. IPv6
6. ARP, NDP, and DHCP
7. ICMP
8. How Routing Works
9. Routing Protocols
10. Unicast, Broadcast, Multicast, Anycast
11. Cloud Networking
12. Questions

1. IPv4 Addresses

An IPv4 address is 32 bits written as four decimal octets: 192.168.1.10. Each address has a network part and a host part, and the split is set by the prefix length (the /24 in 192.168.1.0/24).

192.168.1.10/24
11000000.10101000.00000001.00001010
|<------- network 24 ------>|<host>|
mask 255.255.255.0 = 11111111.11111111.11111111.00000000

The network address is IP AND mask. Two hosts are on the same subnet if their network addresses match; otherwise traffic goes to the default gateway.

Old classful addressing (class A /8, B /16, C /24) was replaced by CIDR in 1993 because fixed class sizes wasted addresses. Interviewers still ask about classes, so know the first-octet ranges: A 1 to 126, B 128 to 191, C 192 to 223, D (multicast) 224 to 239, E (reserved) 240 to 255.

2. CIDR and Subnetting

For a prefix /n:

• Addresses in the block = 2^(32 - n).
• Usable hosts = 2^(32 - n) - 2, because the first is the network address and the last is the broadcast address.
• Exceptions: /31 has 2 usable addresses for point-to-point links (RFC 3021) and /32 is a single host.
• Cloud providers reserve more: AWS reserves 5 addresses per subnet, Azure 5, GCP 4.

Mask octet values to memorize: 128, 192, 224, 240, 248, 252, 254, 255. The block size in the interesting octet is 256 minus the mask value.

Worked example 1: which subnet is this host in?

Host 172.16.45.200/20.

1. /20 means the interesting octet is the third (bits 17 to 24), mask value 240, block size 256 - 240 = 16.
2. The third octet is 45, and the nearest multiples of 16 around it are 32 and 48, so the block starts at 32.
3. Network: 172.16.32.0/20. Next network: 172.16.48.0.
4. Broadcast: 172.16.47.255. Usable: 172.16.32.1 to 172.16.47.254, 4,094 hosts.

Worked example 2: split a network

Split 10.0.0.0/24 into 4 equal subnets.

4 = 2^2, so borrow 2 bits: /26, 64 addresses each.

Worked example 3: VLSM

You have 192.168.10.0/24 and need subnets for 100, 50, 20, and 2 hosts. Allocate largest first so blocks stay aligned.

192.168.10.228 onwards stays free for later.

Supernetting (route aggregation)

192.168.0.0/24 through 192.168.3.0/24 share their first 22 bits, so they can be advertised as one route 192.168.0.0/22. Aggregation keeps Internet routing tables small, which is why providers hand out aligned blocks.

Check your work in any shell with Python:

import ipaddress
n = ipaddress.ip_network("172.16.45.200/20", strict=False)
print(n, n.broadcast_address, n.num_addresses - 2)
# 172.16.32.0/20 172.16.47.255 4094
print(list(ipaddress.ip_network("10.0.0.0/24").subnets(new_prefix=26)))

3. Special and Private Ranges

Private addresses are not routed on the public Internet, so they need NAT to reach it.

The cloud metadata address 169.254.169.254 matters for security: an SSRF bug that lets an attacker make the server fetch that URL can leak cloud credentials, which is why AWS IMDSv2 requires a session token.

4. NAT

Network Address Translation rewrites addresses as packets cross a router. IPv4 ran out of addresses (IANA's free pool was exhausted in 2011), and NAT is what kept it alive.

Costs of NAT:

• Breaks the end-to-end model: unsolicited inbound connections have no mapping, so peer-to-peer needs NAT traversal (STUN, TURN, ICE, used by WebRTC).
• Keeps state, so mappings expire; long-lived idle connections need keepalives.
• Port exhaustion: one public IP has about 64K ports per destination, and cloud NAT gateways hit this under heavy outbound traffic to one endpoint.
• Logging and abuse attribution get harder with CGNAT.

NAT is not a firewall, although it has a similar side effect of blocking unsolicited inbound traffic.

5. IPv6

IPv6 addresses are 128 bits written as eight groups of four hex digits.

2001:0db8:0000:0000:0000:ff00:0042:8329
2001:db8::ff00:42:8329        (drop leading zeros, compress one run of zero groups with ::)

Transition mechanisms: dual stack (run both, the norm), NAT64/DNS64 (IPv6-only clients reach IPv4 servers), and tunnels. Happy Eyeballs (RFC 8305) makes clients race IPv6 and IPv4 connections so a broken IPv6 path does not stall the user. Global IPv6 adoption, measured by Google, has hovered around 45 to 50 percent of users.

6. ARP, NDP, and DHCP

ARP: IP to MAC on the local link

To send to 192.168.1.1 on the same LAN, a host needs its MAC address.

1. Check the ARP cache (ip neigh).
2. On a miss, broadcast "Who has 192.168.1.1? Tell 192.168.1.20".
3. The owner replies by unicast with its MAC.
4. Cache the answer for a while.

If the destination is on another subnet, the host ARPs for the default gateway's MAC instead, never the remote host's.

ARP spoofing: any host can send a fake reply and become a man in the middle. Defenses are dynamic ARP inspection on switches and, above all, encryption (TLS) so interception gains nothing.

IPv6 replaces ARP with Neighbor Discovery Protocol (NDP), using ICMPv6 neighbor solicitation and advertisement messages to multicast groups instead of broadcast.

DHCP: getting an address automatically

DORA, over UDP ports 67 (server) and 68 (client):

The lease gives the IP, subnet mask, default gateway, DNS servers, and lease time. Clients renew at 50 percent of the lease. A DHCP relay forwards broadcasts to a server on another subnet. A rogue DHCP server can hand out a malicious gateway, so switches offer DHCP snooping.

7. ICMP

ICMP carries control and error messages for IP. It has no ports.

Blocking all ICMP is a common mistake. "Fragmentation needed" messages power path MTU discovery; drop them and connections that send large packets hang (a PMTUD black hole). Allow at least types 3 and 11, and ICMPv6 must be allowed broadly because NDP depends on it.

8. How Routing Works

Every host and router has a routing table: destination prefix, next hop, interface, and metric.

$ ip route
default via 192.168.1.1 dev wlan0
10.8.0.0/16 via 10.8.0.1 dev tun0
192.168.1.0/24 dev wlan0 proto kernel scope link src 192.168.1.20

For each packet, a router:

1. Checks and decrements the TTL (IPv6 hop limit); at 0 it drops the packet and sends ICMP time exceeded, which prevents loops from circulating forever.
2. Finds the matching route with the longest prefix match.
3. Rewrites the layer 2 header for the next hop and forwards.

Longest prefix match

Destination 10.1.2.7 matches all four, and the most specific wins: Router C. Destination 10.1.9.9 goes to Router B. Destination 8.8.8.8 only matches the default route. Routers implement this with tries or TCAM hardware so lookups take nanoseconds.

The full IPv4 Internet table (the "DFZ") is roughly one million prefixes, and IPv6 is over 200,000.

9. Routing Protocols

Interior gateway protocols (IGP) route inside one organization. Exterior gateway protocols route between organizations.

An autonomous system (AS) is a network under one administrative policy with an AS number: an ISP, a cloud, a large company. BGP is how they tell each other "I can reach these prefixes".

BGP trusts what neighbors announce, which enables route hijacks and route leaks. Famous outages: Pakistan Telecom hijacking YouTube (2008) and Facebook withdrawing its own routes (October 2021), which took its DNS servers off the Internet. RPKI (cryptographically signed route origins) is the main mitigation, and most large networks now drop RPKI-invalid routes.

10. Unicast, Broadcast, Multicast, Anycast

Anycast works by announcing the same prefix via BGP from many locations; routing naturally delivers each client to the closest one. It gives low latency and absorbs DDoS traffic across many sites. It suits UDP (DNS) and short TCP connections, because a route change mid-connection can move a flow to a different site.

11. Cloud Networking

Cloud VPCs apply the same ideas as software.

Plan CIDRs up front: overlapping ranges (two VPCs both on 10.0.0.0/16) cannot be peered without NAT, and renumbering later is painful.

Kubernetes adds another layer: every pod gets an IP (often from an overlay or the VPC itself via the CNI plugin), Services get virtual IPs handled by kube-proxy (iptables or IPVS) or eBPF (Cilium), and the cluster needs non-overlapping pod and service CIDRs.

12. Questions

Next: TCP, UDP, and QUIC.