5. Internet Protocol, Addressing and Network Services

Introduction and Context

The Internet is not a single network but an interconnection of independently managed networks. Its usefulness depends on common rules that allow hosts, routers, applications, and service providers to exchange data despite differences in hardware, operating systems, and local technologies. The Internet Protocol (IP) provides the principal addressing and forwarding mechanism for this internetwork. Supporting services such as ARP, ICMP, DHCP, DNS, NAT, and routing protocols make IP networks usable in practice.

At the network layer, data is treated as packets. A packet contains a source address, a destination address, control information, and a payload. Routers examine the destination IP address and select a next hop. They do not normally need to understand the application data carried inside the packet. This separation between forwarding and application meaning is one of the reasons the Internet has scaled so effectively.

For data-science professionals, knowledge of IP is relevant beyond network administration. Distributed data platforms, cloud services, APIs, container environments, observability systems, and security controls all depend on correct addressing and reliable network services. An incorrectly designed subnet can produce inefficient routing, security exposure, or failure of a large analytical workload.

Learning Objectives

After completing this chapter, the learner should be able to:

1. Explain the purpose and structure of IPv4 and IPv6.

2. Design IPv4 subnetting and CIDR schemes.

3. Distinguish public, private, unicast, multicast, broadcast, and anycast addressing.

4. Describe how ARP, ICMP, DHCP, DNS, and NAT operate together.

5. Explain packet forwarding, longest-prefix matching, default routes, and TTL or Hop Limit.

6. Design a practical IPv6 addressing plan.

7. Diagnose common addressing and network-service failures.

8. Evaluate operational, security, governance, and architectural implications of network design.

The Internet Protocol Model

IP is connectionless and best-effort. Connectionless means that IP does not establish a dedicated end-to-end circuit before transmitting a packet. Best-effort means that IP itself does not guarantee delivery, ordering, duplication protection, or timing. These responsibilities may be provided by higher-layer protocols, particularly TCP, or handled by applications using protocols such as UDP and application-level retries.

An IP packet may traverse many networks. Each router makes an independent forwarding decision based primarily on the destination address and its routing table. If a route changes, two successive packets from the same source may follow different paths. This design improves resilience but requires applications and operational tools to tolerate variation.

An address has two important interpretations. It identifies an interface or endpoint in a logical addressing system, and it provides information about network location. The network-prefix portion supports hierarchical routing; the host or interface portion identifies a device within that prefix. CIDR notation expresses the prefix length directly, such as `192.0.2.0/24` or `2001:db8:1200::/48`.

IPv4 Addressing and Subnetting

IPv4 uses 32-bit addresses, conventionally written as four decimal octets, for example `192.168.10.25`. The address space is divided into a prefix and a host portion. Modern networks use Classless Inter-Domain Routing (CIDR), rather than the historical class A, B, and C model. A `/24` prefix has 24 network bits and 8 host bits; a `/26` has 26 network bits and 6 host bits.

The number of addresses in a prefix is:

`2^(32 - prefix length)`

For ordinary IPv4 subnets, the all-zero host address identifies the network and the all-one host address is the directed broadcast address. Thus, a `/26` contains 64 addresses and normally supports 62 assignable host addresses. Point-to-point links, loopbacks, and special-purpose networks may use different conventions.

For example, consider `192.168.40.0/24` divided into four equal subnets. Borrowing two host bits creates a `/26`. The resulting ranges are:

• `192.168.40.0/26`, usable hosts `.1` to `.62`, broadcast `.63`
• `192.168.40.64/26`, usable hosts `.65` to `.126`, broadcast `.127`
• `192.168.40.128/26`, usable hosts `.129` to `.190`, broadcast `.191`
• `192.168.40.192/26`, usable hosts `.193` to `.254`, broadcast `.255`

Subnetting improves address organization, limits broadcast domains, and supports security and administrative boundaries. It also introduces planning obligations. A subnet that is too small creates operational pressure; one that is excessively large increases broadcast scope, complicates policy, and wastes address space.

Variable-Length Subnetting and CIDR Allocation

Variable-Length Subnet Masking (VLSM) allocates different prefix sizes according to actual requirements. Suppose an organization has `10.20.0.0/24` and needs networks for 100, 50, 25, and 10 hosts. A reasonable allocation, beginning with the largest requirement, is `/25` for 126 usable hosts, `/26` for 62, `/27` for 30, and `/28` for 14. The remaining addresses can be reserved for growth or additional services.

CIDR also supports route aggregation. If several contiguous networks share a common prefix, they can be advertised as a summary route. Aggregation reduces routing-table size and limits the propagation of topology details. However, summarization must not hide a required exception or create an invalid overlap.

Private IPv4 ranges are reserved for internal use: `10.0.0.0/8`, `172.16.0.0/12`, and `192.168.0.0/16`. They are not globally routed and commonly require NAT for Internet access. Documentation examples should use ranges reserved for documentation, such as `192.0.2.0/24`, rather than real public addresses.

Other important IPv4 categories include loopback (`127.0.0.0/8`), link-local addressing (`169.254.0.0/16`), multicast (`224.0.0.0/4`), and limited broadcast (`255.255.255.255`). These categories have distinct operational meanings and should not be treated as ordinary host addresses.

IPv6: Larger Addressing and Different Assumptions

IPv6 uses 128-bit addresses, written as hexadecimal groups separated by colons, for example `2001:db8:1200:10::25`. Leading zeroes within a group may be omitted, and one consecutive sequence of zero groups may be compressed with `::`. An IPv6 address should be expanded carefully when troubleshooting, because different textual forms may represent the same address.

IPv6 addressing is hierarchical. A common enterprise design gives a site a `/48`, assigns `/64` prefixes to LANs or VLANs, and reserves additional bits for sites, regions, environments, and functions. A `/64` is significant because many IPv6 mechanisms, including Stateless Address Autoconfiguration (SLAAC), are designed around that subnet size. Although smaller prefixes may exist for specialized links, arbitrary small subnetting of user LANs is usually poor practice.

IPv6 defines several address types. Global unicast addresses are routable on the public Internet. Unique local addresses, within `fc00::/7` and commonly using the `fd00::/8` portion, are intended for private internal communication. Link-local addresses (`fe80::/10`) are automatically present on interfaces and are essential for local-neighbor and routing operations. Multicast replaces the central role that broadcast has in IPv4. Anycast allows the same address to be assigned to multiple interfaces, with traffic delivered to the topologically nearest instance according to routing decisions.

IPv6 does not use ARP. Neighbor Discovery Protocol (NDP), carried through ICMPv6, performs address resolution, router discovery, duplicate-address detection, and neighbor reachability functions. IPv6 hosts may configure addresses using SLAAC, DHCPv6, or a combination. Router advertisements communicate prefix and default-router information; DHCPv6 can provide additional configuration such as DNS server addresses.

Packet Forwarding in Practice

When a host sends a packet, it first determines whether the destination belongs to a directly connected prefix. If it does, the host resolves the destination’s link-layer address. If it does not, the host sends the frame to its configured default gateway. The gateway then makes the next forwarding decision.

A router compares the destination address with all matching routing entries and applies longest-prefix matching: the route with the greatest number of matching prefix bits is preferred. For example, a packet matching both `10.0.0.0/8` and `10.10.0.0/16` uses the `/16` route. If no more specific route exists, a default route (`0.0.0.0/0` in IPv4 or `::/0` in IPv6) may be used.

At every hop, the data-link frame is removed and a new frame is created for the next link. The IP source and destination normally remain unchanged, except where NAT or another translation mechanism is applied. The IPv4 TTL and IPv6 Hop Limit are reduced by each router. When the value reaches zero, the packet is discarded, preventing persistent routing loops. ICMP commonly reports this event to the sender, enabling tools such as traceroute to infer path information.

Routing entries may be learned through connected routes, static configuration, or dynamic routing protocols. Interior Gateway Protocols such as OSPF and IS-IS support routing within an administrative domain, while BGP exchanges reachability information between autonomous systems. Route selection may consider administrative preference, metric, policy, and prefix length. The forwarding table is therefore both a technical and governance instrument: it expresses which destinations an organization is willing to reach through which paths.

The Network Services That Make IP Usable

ARP and Neighbor Resolution

IPv4 hosts communicate over local Ethernet or Wi-Fi using link-layer addresses, commonly MAC addresses. When a host knows an IPv4 destination but not its MAC address, it broadcasts an ARP request asking which device owns the address. The owner sends an ARP reply containing its MAC address. The result is stored temporarily in an ARP cache.

If the destination is remote, the host resolves the MAC address of the default gateway, not the remote host. ARP is local to a broadcast domain and is not routed. Gratuitous ARP can announce an address change or detect conflicts, but ARP is also vulnerable to spoofing. Dynamic ARP inspection, segmentation, and static bindings in carefully controlled environments can reduce risk.

IPv6 uses NDP rather than ARP. NDP uses ICMPv6 multicast messages and supports more functions, including router discovery and neighbor reachability detection. Filtering ICMPv6 indiscriminately can therefore break essential IPv6 operation.

ICMP and ICMPv6

Internet Control Message Protocol communicates errors, diagnostics, and control information. It does not transport application payloads in the same manner as TCP or UDP. Examples include destination unreachable, time exceeded, and echo request/reply. The `ping` utility uses echo messages, while `traceroute` commonly relies on time-exceeded responses generated as TTL or Hop Limit values expire.

ICMP messages are valuable for diagnosis but can be abused for scanning, reflection, or denial-of-service activity. A security policy should distinguish between unnecessary exposure and essential control traffic. Blocking all ICMP often produces opaque failures, especially for Path Maximum Transmission Unit Discovery and IPv6 NDP.

DHCP and Automatic Configuration

Dynamic Host Configuration Protocol assigns configuration parameters such as an IPv4 address, subnet mask, default gateway, lease duration, and DNS servers. The familiar IPv4 exchange is often described as DORA: Discover, Offer, Request, and Acknowledgment. Because the initial client has no address, DHCP discovery uses broadcast on the local network. A DHCP relay can forward requests between a client subnet and a centralized DHCP server.

DHCP is a lease-based service. A client normally renews its allocation before it expires. Reservations can associate a stable address with a device identifier, but they should not be confused with a permanent manual configuration. Rogue DHCP servers can direct users to malicious gateways or DNS services; authenticated infrastructure, switch protections, monitoring, and carefully controlled relay configuration are important safeguards.

IPv6 may use SLAAC, DHCPv6, or both. SLAAC provides an address from a router-advertised prefix, while DHCPv6 may provide additional parameters. IPv6 operational design should decide explicitly which mechanism supplies addresses, DNS information, and default-router information.

DNS and Name Resolution

The Domain Name System maps names to resource records. An A record maps a name to an IPv4 address, while an AAAA record maps it to an IPv6 address. Other records include CNAME for aliases, MX for mail routing, NS for delegation, and TXT for assorted policy or verification data. DNS is hierarchical: root servers direct queries toward top-level domains, which direct them toward authoritative servers.

Most clients use a recursive resolver. The resolver obtains an answer on the client’s behalf and caches it according to the record’s time to live. Caching improves performance and reduces query traffic, but it means that configuration changes are not always visible immediately. Split-horizon DNS may provide different answers for internal and external clients, although it must be managed carefully to avoid inconsistent security assumptions.

DNS does not itself guarantee that a reachable address represents a trustworthy service. Applications should validate certificates, authenticate peers, and apply authorization. DNS Security Extensions (DNSSEC) can provide authenticity of DNS data through digital signatures, but it does not encrypt ordinary DNS queries. Encrypted transports such as DNS over TLS or DNS over HTTPS address confidentiality between a client and resolver, with corresponding monitoring and governance trade-offs.

NAT and Address Translation

Network Address Translation changes address information as packets pass through a device. Port Address Translation, commonly called NAPT, allows many private hosts to share one public IPv4 address by distinguishing sessions using transport-layer ports. NAT conserves scarce IPv4 addresses and provides a boundary between internal and external addressing, but it is not a complete security architecture.

Translation complicates peer-to-peer communication, logging, troubleshooting, and protocols that embed addresses in payloads. Port forwarding allows an external destination and port to be mapped to an internal service, but every such rule increases exposure and should be documented. IPv6 generally aims for end-to-end addressing and does not require NAT for address conservation, although firewalls remain necessary.

An Integrated Example

Consider a university analytics laboratory with separate networks for student workstations, research servers, management devices, and guest access. The organization receives `10.50.0.0/22` for internal IPv4 use. It allocates a `/24` to research servers, two `/25` networks to student areas, a `/26` to management devices, and reserves the remaining space for growth. A routable IPv6 `/48` is divided into `/64` prefixes, one per VLAN.

A student workstation joining the network sends a DHCP discovery. The relay forwards it to the central DHCP service, which returns an IPv4 address, subnet mask, gateway, and DNS resolver. The workstation queries DNS for a data-platform service name and receives an A record and, where available, an AAAA record. If the selected destination is outside the student subnet, the workstation resolves the gateway’s MAC address using ARP and sends the packet to it.

The router applies its forwarding table and may send the packet through a firewall and NAT gateway. The research service replies to the translated public address and port. ICMP messages may report a failed route or an expired TTL. If the workstation uses IPv6, it obtains a prefix through router advertisements, resolves the local next hop using NDP, and follows an IPv6 route without NAT. This sequence demonstrates that addressing, naming, link-layer resolution, routing, and security policy are interdependent rather than isolated services.

Applied Case Study: Redesigning a Cloud-Connected Research Network

Background

The following is an illustrative case. A research institute operates a private data-processing cluster, cloud-based storage, administrative systems, and remote-access services. Its original network uses one large `10.0.0.0/8` address space, manually configured servers, inconsistent DNS records, and several overlapping VPN ranges.

Situation and Problem

Users report intermittent access failures. Some systems resolve names to obsolete addresses, VPN clients conflict with local home networks, and security teams cannot reliably determine whether traffic originated from a workstation, a container, or a translated gateway. Broadcast traffic is also larger than necessary, and a temporary cloud connection introduces overlapping address space.

Analysis

The main problem is not a single faulty device. It is the absence of an addressing and service architecture. A flat private range weakens segmentation; manual addressing increases configuration drift; overlapping prefixes make routing ambiguous; and NAT logs are insufficiently correlated with user and workload identity. DNS records, DHCP leases, firewall rules, and routing tables are maintained by separate teams without a common inventory.

Approach and Solution

The institute first creates an address-management inventory and reserves non-overlapping ranges for production, research, management, guest, VPN, and cloud environments. It uses VLSM for IPv4 and assigns a `/64` IPv6 prefix to each logical subnet. Research services, users, management systems, and guests are separated by VLANs and routed through policy-enforcing firewalls.

DHCP becomes authoritative for workstation configuration, with reservations only where operationally justified. Internal DNS zones are integrated with DHCP and address-management records, while external DNS exposes only approved services. Route summarization is applied at site boundaries, and the cloud connection is redesigned with unique prefixes rather than relying on extensive translation. NAT remains at the controlled Internet edge, with time-synchronized translation logs linked to device identity.

Monitoring is added for DHCP failures, duplicate addresses, DNS response errors, route changes, ARP anomalies, and IPv6 neighbor events. Security policies permit required ICMP and ICMPv6 traffic while restricting unsolicited inbound connections. A staged migration tests each subnet before old routes and records are retired.

Outcome

The redesigned environment has clearer ownership, smaller broadcast domains, predictable routing, better incident evidence, and a path toward dual-stack operation. The most important improvement is architectural consistency: addresses, names, routes, identities, and security rules now describe the same network reality.

Learning Points

1. Address planning should precede device deployment and cloud integration.

2. DNS, DHCP, routing, and inventory systems should be managed as related services.

3. NAT can support IPv4 transition but cannot replace segmentation or identity controls.

4. IPv6 requires deliberate design rather than simply enabling an additional protocol.

5. Observability and time-correlated logs are essential for diagnosing translated traffic.

Design Choices, Risks, and Common Errors

A sound addressing plan begins with requirements: number of sites, departments, devices, growth rate, security zones, routing boundaries, cloud connections, and operational ownership. It reserves space for expansion and avoids accidental overlap. Address management should be documented in an IP Address Management system or an equivalent controlled repository.

Frequent errors include assigning a network address to a host, using an incorrect subnet mask, creating overlapping prefixes, confusing a DNS failure with a routing failure, and assuming that a successful ping proves application availability. Other mistakes include blocking all ICMP, treating private addresses as globally reachable, deploying IPv6 without monitoring it, and using NAT as a substitute for a firewall.

Dual-stack environments introduce additional considerations. A host may receive both A and AAAA records and select a path according to operating-system behavior and reachability. If IPv6 is enabled but poorly routed, users may experience delays or failures even though IPv4 works. Testing must therefore include both protocols, DNS behavior, firewall policy, MTU handling, and failure scenarios.

Security and governance also matter. Address data can reveal organizational structure, device identity, and user activity. DHCP, DNS, router, firewall, and NAT logs may contain personal or sensitive information and should be retained according to institutional policy and applicable data-protection requirements. Administrative access to these systems should use least privilege, strong authentication, change control, and separation of duties. Network automation should validate proposed prefixes and routes before deployment; an automated error can propagate much faster than a manual one.

Automation and Contemporary Developments

Modern networks increasingly use software-defined networking, cloud controllers, infrastructure-as-code, and APIs. Address pools can be allocated automatically when a virtual network, container cluster, or tenant is created. Automation improves consistency, but it requires authoritative inventories, policy validation, rollback, and continuous drift detection.

Container platforms commonly create overlay networks and private service ranges. Operators must prevent overlap between container, host, campus, VPN, and cloud address spaces. Service discovery may use DNS-like mechanisms, while load balancers and anycast designs distribute requests across instances. In large environments, telemetry systems correlate flow records, DNS queries, route changes, and identity data to support performance analysis and security investigation.

IPv6 deployment is progressing through dual-stack, IPv6-only segments with translation mechanisms, and provider-managed architectures. The appropriate strategy depends on application compatibility, operational capability, address policy, and regulatory or contractual requirements. The enduring principle is that protocol transition should be tested as an architectural change, not treated as a checkbox.

Best-Practice Framework for Address and Service Design

A professional design should:

• establish an authoritative address and naming inventory;
• allocate hierarchical, non-overlapping prefixes with documented growth space;
• use VLSM and route summarization where they improve efficiency and control;
• separate users, servers, management, guests, and sensitive workloads;
• define DHCP, DNS, NDP, routing, NAT, and firewall responsibilities explicitly;
• monitor both IPv4 and IPv6, including control traffic and failure conditions;
• synchronize logs and protect them from unauthorized alteration;
• test failover, expiration, duplicate-address, DNS, MTU, and route-loop scenarios;
• apply least privilege and change management to network infrastructure; and
• review the design as organizational, cloud, and application requirements change.

Chapter Summary

IP provides a common logical addressing and forwarding system across interconnected networks. IPv4 uses 32-bit addresses and remains dependent on careful subnetting, CIDR allocation, and often NAT. IPv6 uses 128-bit addresses, hierarchical prefixes, multicast-based control mechanisms, and a substantially larger address space. Subnetting and VLSM organize hosts into manageable and secure network boundaries, while route aggregation improves scalability.

Packet forwarding depends on direct delivery, default gateways, longest-prefix matching, routing tables, and hop-lifetime controls. ARP and NDP connect logical addresses to local link-layer delivery. DHCP and SLAAC automate host configuration, DNS maps names to services, ICMP supports control and diagnosis, and NAT translates address and port information. These services interact closely; a failure in one can appear to be a failure in another.

Professional network design requires more than calculating subnet masks. It requires non-overlapping address plans, service ownership, security controls, monitoring, governance, reliable documentation, and consideration of cloud, automation, dual-stack, and emerging IPv6 architectures.

Key Terms

IPv4: A 32-bit Internet Protocol addressing system.

IPv6: A 128-bit Internet Protocol designed to provide a substantially larger address space.

CIDR: Classless notation that represents a network prefix and its length, such as `/24`.

Subnet: A logically divided IP network with its own prefix.

VLSM: Allocation of different subnet sizes according to network requirements.

Prefix: The network portion of an IP address used for routing.

Default gateway: A router used when a destination is outside the local subnet.

Longest-prefix matching: Selecting the routing entry with the most specific matching prefix.

ARP: IPv4 protocol for resolving an IP address to a local link-layer address.

NDP: IPv6 protocol suite for neighbor resolution, router discovery, and reachability.

ICMP: Internet control protocol used for errors, diagnostics, and network information.

DHCP: Lease-based service that supplies host configuration parameters.

DNS: Hierarchical system that maps domain names to resource records.

NAT: Translation of network addresses as traffic crosses a device or boundary.

PAT/NAPT: Translation that uses transport ports to share one address among multiple sessions.

SLAAC: IPv6 method by which hosts configure addresses from router advertisements.

TTL/Hop Limit: Packet field limiting the number of router hops a packet may traverse.

Route aggregation: Combining several contiguous routes into a shorter summary prefix.

Anycast: Addressing in which multiple interfaces share an address and traffic reaches a selected instance.

IPAM: Controlled management of address allocation, documentation, and utilization.

Review Questions

Short Answer Questions

1. Why is IP described as connectionless and best-effort?

2. What is the purpose of a default gateway?

3. How does ARP differ from IPv6 Neighbor Discovery?

4. What information does DHCP commonly provide to an IPv4 host?

5. Why is longest-prefix matching important in routing?

Long Answer Questions

1. Explain IPv4 subnetting and CIDR, including the calculation of usable addresses and a worked subnetting example.

2. Compare IPv4 and IPv6 addressing, including address types, configuration methods, broadcast behavior, and control protocols.

3. Describe how DHCP, DNS, ARP, routing, NAT, and ICMP interact when a workstation accesses an Internet service.

4. Discuss the benefits and limitations of NAT in enterprise networks.

5. Develop a professional framework for designing an address-management and network-service architecture.

Analytical / Application Questions

1. An organization has `192.168.100.0/24` and needs subnets supporting 110, 50, 25, and 12 hosts. Design a VLSM allocation and explain the order of allocation.

2. A client receives an IP address and can ping its gateway but cannot reach a named application. Analyze the possible DHCP, DNS, routing, firewall, NAT, and application causes in a logical troubleshooting sequence.

3. A cloud connection overlaps with an internal private prefix. Evaluate at least two redesign options and recommend one, considering routing, NAT, security, logging, and future growth.

22. Multiple Choice Questions with Answers

Question 1

An organization divides 192.168.40.0/24 into four equal IPv4 subnets. What prefix length results?

A. /25

B. /26

C. /27

D. /28

Correct Answer: B. /26

Question 2

A router has routes 10.0.0.0/8 and 10.10.0.0/16. Which route is selected for destination 10.10.5.4?

A. 10.0.0.0/8 because it was learned first

B. 10.10.0.0/16 because it is more specific

C. Both routes equally, using packet alternation

D. The default route only

Correct Answer: B. 10.10.0.0/16 because it is more specific

Question 3

When an IPv4 host sends traffic to a remote network, which local link-layer address does it normally resolve using ARP?

A. The remote host's MAC address

B. The DNS server's MAC address

C. The default gateway's MAC address

D. The source application's MAC address

Correct Answer: C. The default gateway's MAC address

Question 4

Which service normally supplies an IPv4 host with an address, subnet mask, gateway, and DNS information?

A. DHCP

B. ICMP

C. ARP

D. BGP

Correct Answer: A. DHCP

Question 5

Which statement best describes NAT or NAPT?

A. It encrypts every packet crossing a router

B. It translates addresses, and NAPT can distinguish sessions using ports

C. It replaces the need for routing tables

D. It provides authenticated DNS responses

Correct Answer: B. It translates addresses, and NAPT can distinguish sessions using ports

Question 6

What is the principal role of DNS in a client request?

A. To map names to resource records such as IPv4 or IPv6 addresses

B. To assign a MAC address to every router

C. To reduce a packet's TTL

D. To create an Ethernet broadcast domain

Correct Answer: A. To map names to resource records such as IPv4 or IPv6 addresses

Question 7

Why can blocking all ICMP traffic cause operational problems?

A. ICMP is required to encrypt TCP payloads

B. ICMP supports diagnostics and important functions such as path MTU discovery

C. ICMP allocates all IPv4 addresses

D. ICMP replaces DNS recursion

Correct Answer: B. ICMP supports diagnostics and important functions such as path MTU discovery

Question 8

Which IPv6 mechanism performs functions analogous to IPv4 ARP and also supports router discovery?

A. DHCP relay

B. NDP

C. PAT

D. BGP

Correct Answer: B. NDP

Question 9

A packet's IPv4 TTL reaches zero while crossing routers. What normally happens?

A. The packet is forwarded indefinitely

B. The packet is converted automatically to IPv6

C. The packet is discarded and an ICMP time-exceeded message may be returned

D. The packet is delivered to the DNS resolver

Correct Answer: C. The packet is discarded and an ICMP time-exceeded message may be returned

Question 10

Which design practice best reduces routing ambiguity in a cloud-connected enterprise?

A. Allow overlapping private prefixes and depend entirely on NAT

B. Use non-overlapping hierarchical prefixes and document them centrally

C. Place all workloads in one unrestricted /8 network

D. Disable IPv6 and ICMP without further analysis

Correct Answer: B. Use non-overlapping hierarchical prefixes and document them centrally