Networking
Intermediate 16 min read Networking

IP Addressing & Subnetting

IPv4 addresses, CIDR and subnet masks decide how networks are carved and routed. Learn the math for subnetting by hand and how private ranges, NAT and IPv6 fit together.

IPv4IPv6CIDRsubnet maskprivate IPNATbroadcast
Prerequisites: Networking Fundamentals
Introduction

What is this?

An IPv4 address is a 32-bit number written as four octets (e.g. 192.168.1.20). CIDR notation (RFC 4632) pairs an address with a prefix length, such as 192.168.1.0/24, describing how many leading bits are the network part. The rest of the bits identify hosts inside that network.

Motivation

Why do you need it?

  • Subnetting is how you split a VPC or data-center block into app, db and public tiers.
  • Every DHCP range, security group and routing table references a CIDR block.
  • Understanding why 10.0.1.5 cannot talk directly to 10.0.2.5 saves hours of debugging.
  • Private ranges (RFC 1918) plus NAT are why most internal infrastructure uses 10.x, 172.16-31.x or 192.168.x.
Think about it

Mental model

Imagine

A street address with a zip code

Think of

IP address + subnet mask

The zip code (network part) routes mail to the right town; the street number (host part) finds the house. The subnet mask tells you which digits are the zip and which are the street.

Mechanics

How it works

  • A /N prefix means the first N bits of the address are the network identifier; the remaining 32-N bits address hosts.
  • The subnet mask writes those N bits as ones, e.g. /24 = 255.255.255.0.
  • The first address in a subnet is the network address and the last is the broadcast address; both are unusable for hosts.
  • Usable hosts in a /N network = 2^(32-N) - 2.
  • A router connects subnets: hosts route everything outside their own prefix to the gateway, which forwards between subnets.

Anatomy of the CIDR block 10.0.1.0/24.

10.0.1
.1
.2 – .254
.255
255.255.255.0
Reference

Key commands

ip addr show

Show your own IP, prefix and subnet mask.

ipcalc 192.168.1.0/24

Print network, usable hosts and broadcast for a CIDR block.

ip route

See which subnets are reachable directly and via which gateway.

ping 192.168.1.1

Verify a specific host in your subnet responds.

hostname -I

Print all local IP addresses without the interface listing.

Hands-on

Examples

Break down a subnet with ipcalc

Break down a subnet with ipcalc
$ ipcalc 10.0.0.0/21
Address:   10.0.0.0              00001010.00000000.00000000.00000000
Netmask:   255.255.248.0 = 21     11111111.11111111.11111000.00000000
Network:   10.0.0.0/21            00001010.00000000.00000000.00000000
HostMin:   10.0.0.1               00001010.00000000.00000000.00000001
HostMax:   10.0.7.254             00001010.00000000.00000111.11111110
Broadcast: 10.0.7.255             00001010.00000000.00000111.11111111
Hosts/Net: 2046                    Class A, Private Internet

A /21 keeps 11 host bits, giving 2^11 = 2048 addresses minus network and broadcast = 2046 usable. The range spans 10.0.0.0 through 10.0.7.255 — note the fourth octet and part of the third together hold the host bits.

Real world

In production

  • Cloud VPCs are carved with CIDR blocks; each subnet maps to an availability zone.
  • Route tables (main and subnet-specific) choose whether traffic crosses NAT gateways, VPC peers or VPNs.
  • Cluster networking (e.g. Kubernetes Pod CIDRs) assigns a whole range per node and per service.
  • Reserved ranges — the first four and last IP in every AWS VPC subnet — force careful planning of host counts.
Guidelines

Best practices

  • Always reserve larger CIDR blocks in the cloud than you think you need; growing a VPC later is painful.
  • Use RFC 1918 private ranges internally and NAT for anything that must reach the internet.
  • Keep subnet boundaries aligned to /N boundaries so they stay contiguous and routable.
  • Document which subnet hosts which tier (public, app, db, management).
Watch out

Common mistakes

  • Treating the network or broadcast address as usable host addresses.
  • Overlapping CIDR blocks between VPCs that later need to be peered.
  • Using 255.255.255.255 masks or host bits inside the network part when planning.
  • Forgetting IPv6: even dual-stack VPCs still need IPv4 address planning for DNS and legacy clients.
Root cause analysis

Common issues

Error
Can reach the gateway but not another host in the same subnet
Root cause

Different subnet masks, or the target host has a firewall.

Fix

Compare ip addr show on both; ensure both use the same prefix, e.g. /24.

Error
Address already in use when setting a static IP
Root cause

DHCP gave the address to another device.

Fix

Use a reservation outside the DHCP pool or check the DHCP server's leases.

Error
Packets route but connections never establish
Root cause

Subnets configured correctly but a stateful firewall drops the return path.

Fix

Verify symmetric routing and that conntrack/security groups allow return traffic.

When things break

Debugging tips

  • ip addr show tells you the prefix — compute whether two hosts share it before blaming routing.
  • If hosts in the same /24 cannot talk, check the subnet mask, not the gateway.
  • Overlapping subnets cause asymmetric routes; compare ip route on both hosts.
  • Use ipcalc on any borrowed CIDR to avoid planning mistakes.
Interviews

Interview checkpoint

Practice

Hands-on lab

Subnet a Private Network by Hand
25 min · intermediate
In progress
Objectives
  • Compute network, broadcast and usable host ranges from a CIDR block
  • Verify calculations with ipcalc
  • Split a /24 into two /25 subnets
  • Read your own subnet from ip addr output

Subnet a Private Network by Hand

25 min · intermediate

0/5 steps
0%
sandbox · Linux sandbox
$
Try these commands
Test yourself

Quick quiz

0/3
1

How many usable host addresses are in a /24 network?

2

Which of these is a valid private IPv4 address (RFC 1918)?

3

127.0.0.1 is reserved as the IPv4 loopback address.

Quick reference

Cheat sheet

Subnet math
/8 → 255.0.0.016,777,216 addresses (10.x private range)
/16 → 255.255.0.065,536 addresses, 65,534 usable
/21 → 255.255.248.02,048 addresses, 2,046 usable
/24 → 255.255.255.0256 addresses, 254 usable
/26 → 255.255.255.19264 addresses, 62 usable
/28 → 255.255.255.24016 addresses, 14 usable
RFC 1918 private ranges
10.0.0.0/810.0.0.0 – 10.255.255.255 (one huge block)
172.16.0.0/12172.16.0.0 – 172.31.255.255
192.168.0.0/16192.168.0.0 – 192.168.255.255
Go deeper

Official documentation

Address Allocation for Private Internets — RFC 1918
rfc
Classless Inter-Domain Routing (CIDR) — RFC 4632
rfc
IPv6 Addressing Architecture — RFC 4291
rfc
Internet Protocol (IPv4) — RFC 791
rfc