Địa chỉ IP & SubnettingIP Addressing & Subnetting

Part of the Network Engineer Roadmap knowledge base.

Overview

Every device that speaks the Internet Protocol needs a unique IP address so that packets can be delivered to it, the same way a house needs a postal address. IP addressing and subnetting are the arithmetic that decides which addresses exist, how they are grouped into networks, and how routers decide whether a destination is “local” (on the same subnet) or “remote” (reachable only through a router).

Getting this right is the single most important foundational skill for a network engineer. Almost everything else — routing (./07-routing.md), switching (./08-switching.md), firewalls and ACLs (./11-network-security.md), DHCP/DNS (./06-core-protocols.md) — depends on a correct, well-planned addressing scheme.

This note covers:

• The structure of an IPv4 address (32-bit, dotted decimal, network vs host portion), the historical classes, and modern classless (CIDR) addressing.
• MAC addresses and ARP: how a Layer-3 IP address gets mapped to a Layer-2 hardware address so a frame can actually be delivered on the wire — see also ./03-network-models-and-layers.md.
• Public vs private addressing (RFC 1918), link-local, CGNAT, and loopback ranges.
• Subnet masks / CIDR, with a full /8–/32 reference table.
• Subnetting, VLSM, and supernetting / route summarization — worked out in binary.
• IPv4 vs IPv6: why we ran out, 128-bit addressing, notation, /64 subnets, SLAAC, and dual-stack.
• NAT vs PAT, ports and sockets, and the role of the default gateway.

Fundamentals

The IPv4 address: 32 bits in dotted decimal

An IPv4 address is a 32-bit number. To make it human-readable we split it into four 8-bit octets and write each octet as a decimal number (0–255) separated by dots — “dotted decimal notation.”

  192   .   168   .    1   .   10
11000000 . 10101000 . 00000001 . 00001010

Each octet is one byte (8 bits), so the total address space is 2^32 = 4,294,967,296 addresses (~4.3 billion).

Converting one octet to binary is just place values:

Example — convert 168:

128 + 32 + 8 = 168
 1    0    1    0    1    0    0    0   -> 10101000
(128) (64) (32) (16) (8)  (4)  (2)  (1)

Memorize the eight place values (128 64 32 16 8 4 2 1) — subnetting is nothing more than fast mental binary using these numbers.

Network portion vs host portion

An IP address is not one flat number; it is split into two parts:

• Network portion (the high-order / left bits) — identifies which network the host belongs to. All hosts on the same subnet share the same network portion.
• Host portion (the low-order / right bits) — identifies which specific host on that network.

The subnet mask is what draws the line between the two. Where the mask has 1 bits, that position is “network”; where the mask has 0 bits, that position is “host.”

IP     192.168.1.10   = 11000000.10101000.00000001.00001010
Mask   255.255.255.0  = 11111111.11111111.11111111.00000000
                        \_______ network _______/\__ host __/
Network = 192.168.1.0    Host part = .10

Classful addressing (historical)

Before 1993, the network/host split was fixed by the leading bits of the first octet. This “classful” system is obsolete for allocation but you still hear the vocabulary (a “/24” is casually called “a class C”).

Note: 127.0.0.0/8 (inside the class A range) is reserved for loopback, and 0.0.0.0/8 is reserved, which is why class A usable range is stated as 1–126.

Why classful failed: it was too coarse. If you needed 300 hosts, a class C (254) was too small, so you got a class B (65,534) and wasted ~65,000 addresses. This inefficiency accelerated IPv4 exhaustion and drove the move to classless addressing.

Classless addressing (CIDR)

CIDR (Classless Inter-Domain Routing, RFC 4632) removes the fixed class boundaries. The mask length can be any value from /0 to /32, written as a prefix length after the address:

192.168.1.0/24    -> first 24 bits are network, last 8 are host
10.0.0.0/8        -> first 8 bits network
172.16.5.0/26     -> first 26 bits network, last 6 host

CIDR lets you size a network to fit the number of hosts you actually need, and lets routers aggregate many small networks into one summary route (see Supernetting).

Key Concepts

Subnet masks, CIDR, and the host-count formula

The prefix length /n means n network bits and (32 − n) host bits. From the host bits you compute address counts:

• Total addresses in the block = 2^(32−n)
• Usable hosts = 2^(32−n) − 2 (subtract the network address and the broadcast address)

The “minus 2” applies to ordinary subnets. Two exceptions:

• /31 (RFC 3021) — 2 addresses, both usable, used for point-to-point links (no broadcast needed).
• /32 — a single host address (a “host route”), e.g. a loopback interface or a specific ACL entry.

Full prefix ↔ mask ↔ hosts reference table

The wildcard mask (the inverse of the subnet mask) is used by Cisco ACLs and OSPF network statements — it marks which bits to ignore.

The eight “interesting” mask octet values you will see over and over: 128, 192, 224, 240, 248, 252, 254, 255 (each adds one more 1 bit).

MAC addresses, ARP, and how IP + MAC work together

An IP address lives at Layer 3 (network) and is used for end-to-end delivery across networks. But the actual wire (Ethernet, Wi-Fi) delivers frames using Layer 2 hardware addresses. To move a packet even one hop, the sender must know the destination’s Layer-2 address.

MAC address (48-bit hardware address)

A MAC address (Media Access Control) is a 48-bit address burned into (or assigned to) a network interface, written as six hex bytes: 00:1A:2B:3C:4D:5E.

• The first 24 bits are the OUI (Organizationally Unique Identifier), assigned by the IEEE to a vendor (e.g. 00:1A:2B = a specific manufacturer).
• The last 24 bits are assigned by the vendor to make each NIC unique.
• Bit 1 of the first byte (the least-significant bit of the first octet) = I/G bit: 0 = unicast, 1 = multicast/broadcast (broadcast MAC = FF:FF:FF:FF:FF:FF).
• Bit 2 of the first byte = U/L bit: 0 = globally unique (from OUI), 1 = locally administered (e.g. MAC randomization on phones).

MAC addresses are flat (no hierarchy, not routable) and are only meaningful within a single Layer-2 broadcast domain.

IP vs MAC vs ARP — comparison

ARP (Address Resolution Protocol, RFC 826) is the mechanism that maps a known IP to an unknown MAC on the local link. Results are cached in the ARP table for a few minutes.

ARP request/reply walkthrough

Host A (192.168.1.10, MAC AA:AA:...) wants to send to Host B (192.168.1.20, MAC BB:BB:...) on the same subnet.

1. A checks its ARP cache for 192.168.1.20. Not found.
2. A broadcasts an ARP request as an Ethernet frame with destination MAC FF:FF:FF:FF:FF:FF:

   “Who has 192.168.1.20? Tell 192.168.1.10 (AA:AA:...)” Every device in the broadcast domain receives it.

3. Only B recognizes its own IP. B unicasts an ARP reply back to A:

   “192.168.1.20 is at BB:BB:BB:BB:BB:BB”

4. A caches 192.168.1.20 → BB:BB:... and now builds the real frame: src MAC AA:AA, dst MAC BB:BB, carrying the IP packet.

The key routing decision happens before ARP: A compares B’s IP against its own subnet mask. If B is on the same subnet, A ARPs for B directly. If B is on a different subnet, A does not ARP for B’s IP — it ARPs for the default gateway’s IP, and sends the frame to the gateway’s MAC (while the IP packet still carries B’s IP as the ultimate destination). See Default gateway.

Inspect the ARP cache on Linux:

ip neigh          # modern
arp -n            # legacy
# 192.168.1.20 dev eth0 lladdr bb:bb:bb:bb:bb:bb REACHABLE

Public vs private, and other special ranges

Not all addresses are routable on the public Internet. RFC 1918 carves out three private ranges that anyone can use internally; they must be translated by NAT before reaching the Internet.

Everything else is public address space, globally routable and centrally allocated by IANA → the five RIRs (ARIN, RIPE, APNIC, LACNIC, AFRINIC).

• 169.254.x.x (link-local / APIPA): if you see this on an interface, DHCP almost certainly failed — a classic troubleshooting signal.
• 100.64.0.0/10 (CGNAT): ISPs use this between the customer’s router and the ISP’s NAT so they don’t burn public IPv4; it looks private but is technically “shared address space.”

Subnetting: a full worked example

Goal: split 192.168.10.0/24 into 4 equal subnets.

We need 4 subnets. 2^2 = 4, so we borrow 2 bits from the host portion. New prefix = /24 + 2 = /26.

New mask /26 = 255.255.255.192. Binary of the 4th octet:

/24 host bits:  hhhhhhhh   (8 host bits, 256 addresses)
/26 borrow 2:   ssHHHHHH   (2 subnet bits 's', 6 host bits 'H')
Mask 4th octet: 11000000 = 192

Each subnet has 2^6 = 64 addresses → 64 − 2 = 62 usable hosts. The block size (increment) = 256 − 192 = 64. So subnets start at multiples of 64:

How to find these four values for any subnet — take 192.168.10.130/26:

1. Network address = IP AND mask (bitwise AND). 4th octet only:

   IP   130 = 10000010
   Mask 192 = 11000000
   AND      = 10000000 = 128   ->  network = 192.168.10.128

2. Broadcast = network with all host bits set to 1:

   Network 4th octet 10000000, set 6 host bits to 1:
   10111111 = 191   ->  broadcast = 192.168.10.191

3. First usable = network + 1 = .129. Last usable = broadcast − 1 = .190.

So 192.168.10.130 is a host in subnet 192.168.10.128/26.

Verify with ipcalc:

$ ipcalc 192.168.10.130/26
Address:   192.168.10.130       11000000.10101000.00001010.10 000010
Netmask:   255.255.255.192 = 26 11111111.11111111.11111111.11 000000
Network:   192.168.10.128/26    11000000.10101000.00001010.10 000000
HostMin:   192.168.10.129       11000000.10101000.00001010.10 000001
HostMax:   192.168.10.190       11000000.10101000.00001010.10 111110
Broadcast: 192.168.10.191       11000000.10101000.00001010.10 111111
Hosts/Net: 62

VLSM (Variable Length Subnet Masking)

Real networks are not made of equal-sized subnets. VLSM means using different prefix lengths for different subnets carved from the same block, sizing each to its need. Rule: allocate largest first, and always pick a prefix whose usable-host count ≥ requirement.

Goal: from 192.168.1.0/24, allocate:

Allocate sequentially from .0, largest first:

Remaining 192.168.1.228 – .255 stays free for growth. Had we allocated the /30 first, we would have fragmented the block and been unable to fit the /25 contiguously — hence largest first.

Supernetting / route summarization

Supernetting is the reverse of subnetting: combining several contiguous smaller networks into one larger summary route (an “aggregate”). This shrinks routing tables and hides internal instability — a core benefit of CIDR.

Example: summarize these four /24s into one route.

192.168.0.0/24
192.168.1.0/24
192.168.2.0/24
192.168.3.0/24

Look at the third octet in binary and find the common leading bits:

0 = 000000 00
1 = 000000 01
2 = 000000 10
3 = 000000 11
    \____/  the first 6 bits are identical; last 2 vary

The first two octets (16 bits) are identical, plus the first 6 bits of the third octet = 22 common bits. So the summary is:

192.168.0.0/22   ->  covers 192.168.0.0 – 192.168.3.255 (1,024 addresses)

Instead of advertising four routes, a router advertises one 192.168.0.0/22. For summarization to be clean the blocks must be contiguous and the summary must start on a proper boundary (here .0 is divisible by the block size of 4).

IPv4 vs IPv6

IPv4’s ~4.3 billion addresses were exhausted (IANA’s free pool ran out in 2011). NAT postponed the crisis; IPv6 (RFC 4291) solves it with 128-bit addresses — 2^128 ≈ 340 undecillion.

An IPv6 address is eight groups of four hex digits (16 bits each), separated by colons:

2001:0db8:0000:0000:0000:ff00:0042:8329

Compression rules:

1. Drop leading zeros in each group: 0db8 → db8, 0000 → 0, 0042 → 42.
2. Replace one run of consecutive all-zero groups with :: (only once).

2001:0db8:0000:0000:0000:ff00:0042:8329
  -> 2001:db8::ff00:42:8329
Loopback ::1  (= 0:0:0:0:0:0:0:1)
Unspecified ::  (all zeros)

The standard subnet size is /64: the first 64 bits are the network prefix, the last 64 are the interface identifier (host). A site typically gets a /48 and subnets into many /64s.

IPv4 vs IPv6 comparison

SLAAC (Stateless Address Autoconfiguration): a host learns the /64 prefix from Router Advertisements and generates its own interface ID (from the MAC via EUI-64, or a random/privacy address), no DHCP server required.

Dual-stack is the standard migration path: run IPv4 and IPv6 simultaneously on the same interfaces; applications prefer IPv6 (via DNS AAAA records) and fall back to IPv4.

NAT vs PAT (overload)

NAT (Network Address Translation, RFC 3022) rewrites IP addresses in packet headers as they cross a boundary (typically the edge router/firewall). It exists mainly to let many private RFC 1918 hosts share scarce public IPv4 addresses, and secondarily to hide internal topology.

PAT (Port Address Translation), also called NAT overload or “masquerade,” is what almost everyone actually uses. It multiplexes many internal hosts behind a single public IP by also translating the source port and tracking each flow in a translation table.

Example — two internal hosts browse the web through public IP 203.0.113.5:

Both inside hosts happened to use source port 51000, but PAT gives each a unique translated port (40001, 40002), so return traffic is de-multiplexed back to the correct host. Linux example:

# Masquerade all traffic leaving eth0 (typical home-router / gateway rule)
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

Trade-off: NAT/PAT breaks true end-to-end connectivity (inbound connections need port forwarding), which is one reason IPv6 aims to eliminate it.

Ports and sockets

An IP address gets a packet to the right host; a port gets it to the right application/process on that host. A port is a 16-bit number (0–65535). TCP and UDP each have their own independent port space.

A socket is the combination IP address + port (+ protocol). A TCP connection is uniquely identified by a 4-tuple / 5-tuple:

(protocol, source IP, source port, destination IP, destination port)
e.g. (TCP, 192.168.1.10, 51000, 93.184.216.34, 443)

That is why one server on port 443 can handle thousands of simultaneous clients — each connection differs by client IP/port even though the server side is identical.

Common ports

See ./06-core-protocols.md for how these protocols behave.

Default gateway

The default gateway is the router IP a host sends packets to when the destination is not on its own subnet. It is the host’s exit door to the rest of the world.

The decision, on every outbound packet:

1. Host computes destination IP AND subnet mask.
2. Compares the result to its own network address.
3. Same subnet → deliver directly (ARP for the destination’s MAC, send frame straight to it).
4. Different subnet → send to the default gateway (ARP for the gateway’s MAC; the IP packet keeps the real destination IP, but the L2 frame is addressed to the gateway). The gateway then routes it onward — see ./07-routing.md.

The default gateway must be an IP on the same subnet as the host, otherwise the host cannot reach it. In routing tables it appears as the route for 0.0.0.0/0 (the “default route” — matches everything).

ip route            # show routing table
# default via 192.168.1.1 dev eth0    <- the default gateway
# 192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.10

Useful Linux CLI

ip addr show                       # show all interfaces + IP/mask (CIDR)
ip -br addr                        # brief one-line-per-interface view
ip addr add 192.168.1.10/24 dev eth0   # assign an address
ip route                           # routing table (find the default gateway)
ip neigh                           # ARP/NDP neighbor cache (IP <-> MAC)

ipcalc 192.168.10.130/26           # subnet math: network, broadcast, hosts
ipcalc 10.0.0.0/8 --split 24       # split a block into subnets

# Quick host-count / boundary check
sipcalc 172.16.0.0/20              # (alt tool) detailed subnet info

Best Practices

• Plan the address space top-down. Start from a single large private block (e.g. 10.0.0.0/8) and delegate hierarchical chunks per region → site → VLAN. Hierarchy enables clean summarization and keeps routing tables small.
• Use VLSM — size subnets to need, allocate largest first. Don’t hand every LAN a /24 out of habit; a point-to-point link needs a /30 (or /31), not 254 addresses.
• Leave room to grow. Reserve gaps between allocations so a subnet can be widened later without renumbering.
• Keep a documented IPAM record (even a spreadsheet, ideally an IPAM tool). Track every subnet, its purpose, VLAN, and gateway. Unmanaged addressing is the root cause of countless outages.
• Standardize conventions: e.g. gateway always .1, DHCP pool .100–.200, static servers .10–.50. Predictability speeds troubleshooting.
• Never overlap subnets — overlapping ranges break routing and especially break VPNs/site-to-site links and cloud VPC peering. Coordinate RFC 1918 usage across all sites.
• Use /31 for point-to-point links (RFC 3021) where supported, to save addresses.
• Adopt IPv6 (dual-stack) now. Assign /64 per subnet, use ULA for internal-only, and let SLAAC handle host config where appropriate.
• Don’t rely on NAT as security. NAT hides addresses but is not a firewall; enforce policy explicitly (./11-network-security.md).
• Verify with tooling, not mental math alone. Confirm subnet boundaries with ipcalc/sipcalc before deploying ACLs, DHCP scopes, or routing statements.
• Watch for 169.254.x.x on interfaces — it signals DHCP failure and should never appear as a “working” address.

References

• RFC 1918 — Address Allocation for Private Internets
• RFC 4632 — Classless Inter-Domain Routing (CIDR)
• RFC 4291 — IP Version 6 Addressing Architecture
• RFC 826 — An Ethernet Address Resolution Protocol (ARP)
• RFC 3022 — Traditional IP Network Address Translator (NAT)
• RFC 6598 — IANA-Reserved IPv4 Prefix for Shared Address Space (CGNAT)
• Cloudflare Learning — What is subnetting?
• Cloudflare Learning — IPv4 vs IPv6