IP Addressing, Subnets, CIDR

The Internet is one big graph of routers forwarding IP packets. The address tells routers where to send a packet; the subnet mask tells them which addresses are “near” each other and which need to be routed elsewhere.

IPv4 vs IPv6

You’ll write IPv4 daily. IPv6 shows up in cloud (AWS dual-stack) and mobile networks. Both work the same conceptually.

Private (RFC 1918) ranges

These never appear on the public Internet. NAT translates them at the edge.

Plus 127.0.0.0/8 (loopback — 127.0.0.1) and 169.254.0.0/16 (link-local; AWS metadata at 169.254.169.254).

CIDR notation

10.0.0.0/24 = “the first 24 bits are the network, the rest is hosts.”

Smaller suffix number = bigger network. /24 has 256 addresses (254 usable — first is network, last is broadcast). /16 has 65,536 (65,534 usable).

Quick math:

• Hosts in /n = 2^(32-n) - 2.
• Each step down (e.g. /24 → /23) doubles the size.

Public vs private — what crosses the Internet?

A packet leaving your laptop to 8.8.8.8:

1. Source IP starts as your private 192.168.1.42.
2. Hits your home router. NAT rewrites the source to your public IP 203.0.113.5. See 04_nat.md.
3. Travels through ISP routers based on BGP tables.
4. Arrives at Google’s edge.
5. Response comes back, NAT translates 203.0.113.5 back to 192.0.0.1.42 based on the mapping table.

Routers on the Internet drop packets with private source IPs.

Subnetting in practice (cloud VPC)

Typical AWS VPC layout:

VPC 10.0.0.0/16
├── public subnet  10.0.1.0/24   (us-east-1a)  — load balancers, NAT gateways
├── public subnet  10.0.2.0/24   (us-east-1b)
├── private subnet 10.0.10.0/24  (us-east-1a)  — app servers
├── private subnet 10.0.11.0/24  (us-east-1b)
├── db subnet      10.0.20.0/24  (us-east-1a)  — RDS, Elasticache
└── db subnet      10.0.21.0/24  (us-east-1b)

Three tiers (public / app / db), two AZs each, 6 subnets total. See 09_vpc_cloud_networking.md.

Reserved addresses inside a subnet

10.0.1.0/24 has 256 addresses but 254 usable:

• 10.0.1.0 — network address (the subnet itself).
• 10.0.1.255 — broadcast address.
• AWS reserves three more: .1 (router), .2 (DNS), .3 (future use). So usable is actually 251.

This matters for tiny subnets — a /29 (8 addresses) in AWS gives you only 3 usable. Plan for at least /28.

Special-purpose ranges

In a security group rule, 0.0.0.0/0 ingress = “the whole Internet” — used for public web servers, dangerous for SSH.

Common Python uses

import ipaddress

net = ipaddress.ip_network("10.0.0.0/24")
print(net.num_addresses)         # 256
print(net.network_address)       # 10.0.0.0
print(net.broadcast_address)     # 10.0.0.255
print(ipaddress.ip_address("10.0.0.42") in net)  # True

# CIDR overlap check
a = ipaddress.ip_network("10.0.0.0/16")
b = ipaddress.ip_network("10.0.5.0/24")
print(b.subnet_of(a))            # True

ipaddress is stdlib. Use it for VPC planning scripts and firewall rule validators.

Common interview confusions

• “/24 is bigger than /16.” No — bigger CIDR number = smaller network. /24 is 256 addresses, /16 is 65,536.
• “192.168.1.0/24 and 192.168.2.0/24 overlap.” No — different network bits. They’re adjacent but disjoint.
• “Two VPCs both using 10.0.0.0/16 can be peered.” No — overlapping CIDRs can’t peer; routes are ambiguous. Plan unique ranges from day 1.
• “0.0.0.0 means localhost.” No — 127.0.0.1 is localhost. 0.0.0.0 means “any interface” (binding) or “default route” (routing).

Interview angle

• “What’s the difference between /24 and /16?” — /24 covers 256 addresses (254 hosts), /16 covers 65,536 (65,534 hosts). Smaller suffix = bigger network. Each /n has 2^(32-n) addresses.
• “Why are 10.x.x.x, 172.16-31.x.x, 192.168.x.x special?” — RFC 1918 private ranges, never routed on the public Internet. NAT translates them at the edge.
• “How do you plan a VPC?” — pick a unique private range (avoid overlap with peers and on-prem), divide into subnets per AZ × tier (public/app/db), leave headroom (don’t allocate /24 if you might need more IPs).
• “What’s 0.0.0.0/0 in a route table or firewall rule?” — “all addresses.” In a route table it’s the default route (catch-all). In an ingress rule it’s “open to the whole Internet.”
• “Why can’t two VPCs with 10.0.0.0/16 be peered?” — overlapping CIDR makes routing ambiguous; the router can’t decide which side a packet to 10.0.5.5 belongs to.