IP Addressing, CIDR and NAT

1IPv4 and dotted decimal

Meera's phone has an IPv4 address: 192.168.1.42. An IPv4 address is 32 bits — thirty-two ones and zeros that name one interface on the Internet. Humans write those 32 bits as four decimal octets separated by dots. An octet is 8 bits, so each group is a number from 0 through 255. 192, 168, 1, and 42 are four such groups. The dots are only for reading; the address is still one 32-bit number.

Every later subnetting question asks how those 32 bits split: some bits name the network (the group of machines that share a prefix), and the rest name the host (this phone inside that group). 192.168.1.256 is not an address — 256 does not fit in 8 bits.

Figure. Four equal octets make one 32-bit address. Subnet masks decide how many leading bits belong to the network.

How to read an address

1. Four octetsRead left to right: each group is one byte (8 bits).
2. Range checkEach octet must be 0–255; 256 or more is invalid dotted decimal.
3. Think in bitsSubnetting works on the full 32-bit pattern, not on the decimal groups alone.

2Classful defaults and CIDR

The shop's address is written 203.0.113.10/28. The /28 is CIDR — Classless Inter-Domain Routing. It means the first 28 of the 32 bits are the network prefix, the shared part, and the remaining 4 bits name hosts inside that block. A prefix is just 'the first n bits stay fixed.'

Older classful defaults still appear as shortcuts: Class A meant /8, Class B /16, Class C /24. They are default prefix lengths, not a second addressing system. The /n is what the phone and the shop actually use. The shop's /28 is smaller than a Class C /24 — 4 host bits, not 8.

Figure. Classful /8 /16 /24 sizes are special cases; CIDR lets the prefix length be any integer mask.

From class letter to prefix length

1. Spot the class habitA starts 0…, B starts 10…, C starts 110… — each implied a default /8, /16, /24.
2. Read CIDR/n counts network bits from the left; everything after is host space.
3. Prefer prefixWhen a question gives /26, ignore the old class default and subnet on 26.

3Subnet mask and host bits

A /n mask has n leading 1-bits and 32-n trailing 0-bits. Those trailing zeros are the host bits: the bits that can change from one machine to the next inside the block. For the shop's /28, host bits h = 32-28 = 4. The block then holds 2^h = 16 addresses. Two of them are reserved: the all-zeros host part is the network address (203.0.113.0), and the all-ones host part is the broadcast address (203.0.113.15). A /28 does not give 16 usable IPs — usable hosts are 14.

A /24 mask is 255.255.255.0. A /26 mask is 255.255.255.192 because the last octet begins 11000000. Subtract the two reserved endpoints unless the question names a /31 point-to-point link. Meera's home /24 has 8 host bits: 256 addresses, 254 usable.

Figure. The /26 line splits 32 bits into a fixed prefix and a 6-bit host field — 64 addresses, 62 assignable. Box widths match the 26:6 bit split.

Mask to counts

1. Host bitsHost bits h = 32 - n from the CIDR prefix /n.
2. Total addressesBlock size = 2^h addresses in the subnet.
3. Usable hostsDefault: usable = 2^h - 2 (network + broadcast reserved).

Coding lab. Usable hosts on the shop /28 runs in the app, with checks on your output.

4Block size and network address

To find which subnet a host belongs to, locate the interesting octet — the one where the mask is neither 0 nor 255 — and jump in steps of the block size. Block size = 256 minus the mask value in that octet. The network address has host bits all zero in that block; broadcast is all ones. Never guess from the decimal pattern alone — align to the block boundary.

Meera's phone 192.168.1.42/24 is easy: the last octet's mask is 0, so the whole last octet is host, and the network is 192.168.1.0. A neighbour on a /25 at 192.168.1.130 sits in the upper 128-wide block starting at 192.168.1.128. The shop 203.0.113.10/28 has block size 16 in the last octet, so its network is 203.0.113.0.

Figure. A /25 splits the last octet into two 128-wide blocks. Host .130 lands in the upper block starting at .128.

Which subnet is this host in?

1. Interesting octetFind the octet where the subnet mask is between 0 and 255.
2. Block sizeBlock = 256 - mask byte (e.g. /25 → mask 128 → block 128).
3. Align downThe network address is the largest multiple of the block size not exceeding the host octet.

5Private IPv4 ranges

Meera's 192.168.1.42 is a private address. RFC 1918 names three ranges that routers on the public Internet will not forward: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. Hosts with these addresses reach the wider Internet only through NAT or a proxy. The shop's 203.0.113.10 is a documentation public address in this lesson — it is not in those three ranges.

The three prefixes are the fact to keep, not individual host numbers. 8.8.8.8 is public. 172.16.5.1 is private. 192.168.1.42 is private because it sits inside 192.168.0.0/16.

Figure. To scale on the second octet: the private slice of 172.x is only the 16-value band 172.16 – 172.31 (/12) — the boundary trap. 10.x.x.x is private end to end and 192.168.x.x is private across its whole third octet; only 172 splits mid-range.

Spot a private address

1. 10/8Any 10.x.x.x is private.
2. 172.16/12172.16.0.0 through 172.31.255.255 — not all 172.x.
3. 192.168/16192.168.x.x is private; 192.x otherwise is usually public.

6ARP, DHCP and DNS

Three helpers get the tea-page packet onto the first hop. DHCP, Dynamic Host Configuration Protocol, is how the phone got 192.168.1.42 and learned that 192.168.1.1 is the gateway — the router that leaves the home network. ARP, Address Resolution Protocol, maps an IP on this LAN to a MAC address, the hardware number on the Wi-Fi card. The phone ARPs for 192.168.1.1 before it can send the first frame.

DNS, Domain Name System, maps the human name shop.rao.example to 203.0.113.10. That lookup is an application job and is taught in full in the DNS lesson. Here the only point is the split: DHCP hands the phone an address, ARP finds the next-hop MAC, DNS finds the shop's IP.

Figure. DHCP leases L3 config, ARP resolves next-hop MAC, DNS maps names — three different questions, three protocols.

Which protocol when?

1. Need a MACSame subnet delivery → ARP broadcast: who has this IP?
2. Need an addressHost boots without config → DHCP discover/offer/request/ack.
3. Need a nameBrowser has a hostname → DNS query returns A/AAAA records.

7NAT address translation

The shop cannot send a reply to 192.168.1.42. That address is private — it is not unique on the Internet, and public routers will not deliver to it. NAT, Network Address Translation, on Meera's home router rewrites the packet. Going out, source 192.168.1.42 plus the phone's local TCP port become the router's public address 198.51.100.80 plus a public port. Coming back, the router rewrites the destination to 192.168.1.42.

Many private hosts can share one public IP because the router remembers the address-and-port pair. NAT conserves IPv4 addresses. It does not encrypt, and it is not DHCP.

Figure. Several hosts on a private LAN share one routable public address through the NAT router's translation table.

Outbound through NAT

1. Private sourceHost 192.168.1.50:5000 sends to a public server.
2. RewriteNAT router replaces source with public IP:ephemeral port and logs the mapping.
3. ReturnReply hits the public IP; NAT table restores 192.168.1.50:5000.