IP Addressing and Subnetting

• Read an IPv4 address with CIDR notation and derive its subnet
• Compute usable host ranges and broadcast addresses
• Use subnet logic to interpret captures, logs and firewall rules

• Every firewall rule and every log line contains addresses; you can't judge them without subnet math.
• Scanning or triage requires knowing which IPs are in scope and in-network.
• Segmentation (separating zones) is literally subnet design — the security control is a CIDR choice.
• Troubleshooting 'why won't these two hosts talk?' is usually answered by whether their subnets/routes agree.

192.168.1.10/24 is like 'Apt 10, 1st Street in 192.168.1-town'. The /24 says the town boundary; anything outside town is reached by going through a gate — the router.

• The CIDR suffix counts the fixed network bits: /24 means the first 24 bits are network, the last 8 identify the host.
• The network address sets all host bits to 0 — it names the subnet, not a device.
• The broadcast address sets all host bits to 1 — it addresses everyone in the subnet.
• The usable range is everything between network and broadcast addresses.
• A router holds routes that say 'to reach this network, send next hop X'; hosts send off-subnet traffic to their default gateway.

• A penetration tester authorized for '192.168.10.0/24 only' uses the mask to keep scans strictly inside that subnet — scope is expressed in CIDR.
• A firewall allows prompt hosts '10.0.20.0/24 → 10.0.30.0/24:443' because the two tiers are separate subnets.
• A SOC analyst reads a malicious IP and closes the subnet range in the SIEM, catching the attacker's other hosts in one query.

• Always write addresses with their CIDR suffix; a bare IP is ambiguous.
• Reserve a small range (e.g. .0-.9) for network devices and gateways so host inventory stays readable.
• Keep segmentation in CIDR sizes you can reason about — one /24 per zone beats a handful of odd-sized ranges.

• Confusing the network address (host bits 0) with a usable host — logging it as a 'device IP' is a classic.
• Forgetting the broadcast address is not assignable, inflating usable-count guesses by two.
• Assuming two hosts on the same /16 can talk when a firewall only permits their /24s.

• When two hosts can't talk, first compare their network parts and gateways — a mismatch means 'wrong neighborhood'.
• Use `ipcalc` or `python3 -c 'from ipaddress import *'` to check your subnet math instantly.
• In a capture, filter `ip.src` within a subnet with Wireshark's `ip.addr == 10.0.20.0/24` to see a whole zone at once.

• Overlapping subnets let traffic bypass zone boundaries; audit your VPC/subnet overlaps periodically.
• IPv4 exhaustion drove NAT and RFC1918 reuse — your private ranges are not globally unique, so a firewall must never treat them as externally trustworthy.