1. IPv4 Structure
An IPv4 address serves two purposes: it identifies the host (computer) and the network it belongs to. It is a 32-bit number, usually represented in "Dotted Decimal" notation for human readability.
Structure Breakdown
Format: x.x.x.x (Four Octets)
Range per Octet: 0 to 255
Example: 192.168.1.50
2. Binary Logic
Computers do not see 192. They see 11000000. To understand subnetting, you must be comfortable with the "Power of 2".
Each octet has 8 bits. The values of these bits, from left to right, are:
Conversion Example: 192
Does 128 fit into 192? Yes (Remainder 64). Bit = 1.
Does 64 fit into 64? Yes (Remainder 0). Bit = 1.
Remaining bits are 0.
Result: 11000000
3. Network vs Host Portion
Every IP address is split into two parts. The Subnet Mask determines where the line is drawn.
Devices can only talk directly to other devices if their Network ID matches perfectly. If the Network ID is different, they must send traffic to a Gateway (Router).
4. Subnet Masks & CIDR
The Subnet Mask tells the computer which bits belong to the network. CIDR (Classless Inter-Domain Routing) is the shorthand notation (e.g., /24).
| CIDR | Subnet Mask | Hosts (Total) | Usable Hosts |
|---|---|---|---|
| /8 | 255.0.0.0 | 16,777,216 | 16M+ |
| /16 | 255.255.0.0 | 65,536 | 65,534 |
| /24 | 255.255.255.0 | 256 | 254 |
| /25 | 255.255.255.128 | 128 | 126 |
| /26 | 255.255.255.192 | 64 | 62 |
| /27 | 255.255.255.224 | 32 | 30 |
| /30 | 255.255.255.252 | 4 | 2 |
*Usable Hosts = Total - 2 (One for Network ID, one for Broadcast).
5. Subnetting Math: A Walkthrough
Let's calculate the range for a specific network. This is a critical skill for configuring networks and setting scan ranges.
Example: 192.168.10.0/26
Step 1: Identify the Block Size
A /26 means 26 bits are on. The last octet has 2 bits on (11000000).
Decimal value of mask: 128 + 64 = 192.
Block Size Formula: 256 - Mask = Block Size.
256 - 192 = 64.
Step 2: List the Subnets (Increments of 64)
1. 192.168.10.0
2. 192.168.10.64
3. 192.168.10.128
4. 192.168.10.192
Step 3: Analyze the First Subnet (.0)
Network ID: 192.168.10.0
First Usable: 192.168.10.1
Last Usable: 192.168.10.62
Broadcast: 192.168.10.63
⚡ Interactive Simulator
Want to visualize the bits changing in real-time? Use our calculator to experiment with different CIDR notations.
Launch Subnet Trainer6. Public vs. Private IPs
Not all IPs are routable on the internet. RFC 1918 defines "Private" ranges used inside LANs (Local Area Networks).
| Type | Range | Description |
|---|---|---|
| Class A Private | 10.0.0.0/8 | Large Enterprise / Data Centers |
| Class B Private | 172.16.0.0/12 | AWS VPCs, Universities, Docker |
| Class C Private | 192.168.0.0/16 | Home routers, Small Business |
| Loopback | 127.0.0.0/8 | Refers to "This Machine" (localhost) |
| APIPA | 169.254.x.x | DHCP Failed (Self-assigned) |
7. Troubleshooting Network Issues
When connectivity fails, follow this checklist to isolate the problem.
- Check IP & Mask: Is the device in the correct subnet? Does the mask match the router?
- Check Gateway: Is the Default Gateway address in the same subnet as the device? (It must be).
- Check APIPA: If you see
169.254.x.x, the DHCP server is unreachable. - Ping Loopback:
ping 127.0.0.1verifies the TCP/IP stack is working on the OS. - Ping Gateway: Verifies connection to the local router.
8. 🛡️ Security Context
How Hackers Use Subnetting
1. Target Mapping: When performing a scan with Nmap, hacking tools assume a /24 by default. If a company uses a /23 (510 hosts), a lazy hacker scanning 192.168.1.0/24 will miss half the targets (the 192.168.0.x range).
2. Pivot Points: Compromising a machine with two network interfaces (Dual Homed) allows an attacker to route traffic from one subnet to another, bypassing firewalls. This is called "Pivoting".
3. Firewall Evasion: Understanding subnet boundaries helps in crafting packets that might slip through ACLs (Access Control Lists) that are poorly defined (e.g., allowing "Any" instead of a specific range).
🧪 Subnet Practice Lab
Test your knowledge. Try to solve these without a calculator first.
A1: 192.168.1.127 (Range is 0-127)
A2: 2 Usable Hosts (Total 4 minus NetID and Broadcast)
A3: Private (It falls within 172.16.0.0 - 172.31.255.255)
A4: No. They are in different networks (1.x vs 2.x). They need a router.
A5: DHCP Failure (APIPA address).
📌 Module Recap
- IP Address: Logical ID (Network + Host).
- Subnet Mask: Defines the boundary between Network and Host bits.
- CIDR: Shorthand for masks (e.g., /24). Higher number = smaller network.
- Network ID: First IP (Unusable). Broadcast: Last IP (Unusable).
- Private IPs: (10.x, 172.16-31.x, 192.168.x) are not routable on the open internet.