Internet Protocol Addressing and Subnetting

Introduction

Internet Protocol (IP) addressing provides the logical identification required for devices to communicate across interconnected networks. A physical network interface may have a hardware address, but routers forward packets primarily by examining logical IP addresses and prefixes. Effective network administration therefore requires more than memorising address formats: an administrator must select suitable address ranges, divide networks into efficient subnets, configure hosts and routers, diagnose address-resolution problems, and apply mechanisms such as DHCP, NAT and ICMP appropriately.

This chapter focuses on IPv4 and IPv6 addressing, subnet masks, Classless Inter-Domain Routing (CIDR), Variable Length Subnet Masking (VLSM), address resolution, ICMP, DHCP, NAT and systematic subnet planning.

Learning Objectives

After studying this chapter, a learner should be able to:

• distinguish IPv4 and IPv6 address structures and address types;
• convert between prefix lengths, subnet masks and address counts;
• calculate network, broadcast, host and usable ranges in IPv4;
• apply CIDR and VLSM to practical network designs;
• explain ARP, Neighbor Discovery, ICMP, DHCP and NAT;
• design an address plan that is scalable, documented and operationally safe;
• identify common addressing and subnetting faults.

1. IP Addressing Fundamentals

An IP address identifies a logical interface in an internetwork. It is associated with an interface rather than permanently with a physical computer; one device can have several interfaces and an interface can sometimes have several addresses.

An address has two conceptual parts:

1. Network prefix: identifies the network or subnet.
2. Interface or host identifier: identifies an interface within that subnet.

The boundary is specified by a prefix length. In CIDR notation, a slash followed by a number indicates how many leading bits belong to the prefix. For example, /24 means that 24 of the 32 IPv4 bits form the network prefix.

A prefix is not the same as a device count. The number of addresses in an IPv4 prefix is determined by the number of remaining host bits, h:

Here, h = 32 − prefix length. In a conventional IPv4 subnet, the all-zero host address identifies the network and the all-one host address is the directed broadcast address. Thus, for ordinary subnets with at least two host bits:

The subtraction excludes the network and broadcast addresses. This rule does not apply identically to point-to-point designs, IPv6, or special-purpose prefixes, so the addressing context must always be stated.

IPv4 notation

IPv4 contains 32 bits, normally written as four decimal octets, for example 192.168.10.25. Each octet has eight bits and ranges from 0 to 255. The binary value of an octet is obtained from the place values 128, 64, 32, 16, 8, 4, 2 and 1.

The address 192.168.10.25 with prefix /24 has:

• network address: 192.168.10.0;
• subnet mask: 255.255.255.0;
• host identifier: 25;
• directed broadcast: 192.168.10.255;
• conventional usable range: 192.168.10.1–192.168.10.254.

The old classful categories A, B and C are historically important but are not the basis of modern routing. CIDR permits prefixes such as /19, /27 and /30, independent of the old classes.

IPv4 address categories

Private addresses require translation or another controlled gateway mechanism before reaching the public Internet. They are not intrinsically secure.

2. IPv6 Addressing

IPv6 uses 128-bit addresses, written as eight groups of four hexadecimal digits separated by colons, for example:

2001:0db8:0001:0000:0000:0000:0000:0025

Leading zeroes within a group may be omitted. One contiguous sequence of zero groups may be replaced by ::, but this abbreviation may be used only once in an address. The previous address can therefore be written as 2001:db8:1::25.

IPv6 commonly uses /64 for a LAN subnet: the first 64 bits identify the subnet prefix and the last 64 bits identify an interface. Unlike conventional IPv4, IPv6 has no broadcast address. Multicast and Neighbor Discovery perform functions that previously depended on broadcast. IPv6 addresses may be:

• Global unicast: routable across the public Internet;
• Unique local: intended for private internetworks, commonly within fc00::/7, with locally assigned structures;
• Link-local: fe80::/10, required for communication on the local link and for Neighbor Discovery;
• Multicast: ff00::/8, identifying groups of receivers;
• Loopback: ::1;
• Unspecified: ::, used when a host has no usable source address.

IPv6 supports Stateless Address Autoconfiguration (SLAAC), DHCPv6 and manually configured addresses. An IPv6 interface commonly has more than one address, especially a link-local and a global or unique-local address.

3. Subnet Masks and CIDR

A subnet mask is a 32-bit IPv4 value with contiguous one-bits for the network portion and zero-bits for the host portion. The network address is calculated by a bitwise AND between the IP address and the mask:

The operation is applied bit by bit: 1 AND 1 equals 1; all other combinations equal 0.

A /26 prefix has 26 network bits and 6 host bits. Its mask is 255.255.255.192 because the final octet is 11000000 in binary. It contains:

and, under the conventional IPv4 rule, 62 usable host addresses.

Worked example: identifying a /26 subnet

Given 192.168.50.141/26:

1. /26 means blocks of 64 addresses in the final octet.
2. The subnet boundaries are 0, 64, 128 and 192.
3. 141 lies in the 128–191 block.

Therefore:

• network address: 192.168.50.128;
• first usable address: 192.168.50.129;
• last usable address: 192.168.50.190;
• broadcast address: 192.168.50.191.

The address is valid for a host because it is neither the network nor broadcast address.

Prefix aggregation

CIDR also supports route aggregation. Several contiguous networks can be represented by one shorter prefix if they are aligned on the required binary boundary and the routing policy permits aggregation. Aggregation reduces routing-table size, but incorrect aggregation can black-hole traffic or send it to the wrong organisation. Address allocation and routing design must therefore be coordinated.

4. Subnetting and VLSM

Subnetting divides one network into smaller logical networks. It improves broadcast containment, supports security boundaries, separates administrative groups and uses address space more efficiently. Borrowing b bits from the host portion creates:

This assumes the borrowed bits can be used freely and that the addressing plan does not impose additional restrictions.

Worked example: equal-size subnetting

An organisation owns 192.168.40.0/24 and needs at least six subnets, each supporting at least 25 hosts.

The host requirement is tested first. Five host bits provide 2^5 − 2 = 30 usable addresses. Therefore the new prefix is 32 − 5 = /27. A /27 creates 2^(27−24) = 8 equal-size subnets, satisfying the requirement.

The subnet boundaries increase by 32:

Two subnets remain available for growth or special purposes.

VLSM

Variable Length Subnet Masking assigns different prefix lengths to different requirements. It prevents a small point-to-point link from consuming the same address space as a large user LAN.

A reliable VLSM procedure is:

1. list every subnet requirement, including growth;
2. sort requirements from largest to smallest;
3. select the smallest prefix that satisfies each requirement;
4. allocate on valid binary boundaries;
5. record network, usable range and broadcast;
6. verify that no ranges overlap and that summarisation remains possible.

For example, from 10.20.0.0/24, requirements of 100, 50, 20 and 10 hosts can be allocated as /25, /26, /27 and /28 respectively. Their conventional usable capacities are 126, 62, 30 and 14. Starting at the lowest address and allocating largest first gives 10.20.0.0/25, 10.20.0.128/26, 10.20.0.192/27 and 10.20.0.224/28. The remaining 10.20.0.240/28 is available for expansion. This example illustrates why largest-first allocation prevents fragmentation.

5. Address Resolution and Control Protocols

ARP

Address Resolution Protocol (ARP) maps an IPv4 address to a link-layer address on the local network. A host first checks its ARP cache. If no entry exists, it broadcasts an ARP request asking which interface owns the target IPv4 address. The owner normally replies with its hardware address, and the sender caches the result temporarily.

ARP operates only on the local link. For a remote destination, a host resolves the MAC address of its default gateway, not the final remote host. ARP has no built-in authentication, so forged replies can support man-in-the-middle attacks. Dynamic ARP inspection, static bindings in special cases and switch security controls can reduce this risk.

IPv6 does not use ARP. Neighbor Discovery Protocol (NDP), carried by ICMPv6, performs address resolution, router discovery, prefix discovery, duplicate-address detection and neighbor reachability detection. NDP uses multicast rather than IPv4 broadcast.

ICMP and ICMPv6

Internet Control Message Protocol reports errors and provides diagnostic functions. Examples include destination unreachable, time exceeded and echo request/reply. The ping utility commonly uses echo messages, while traceroute or tracert relies on responses generated when packet lifetime limits expire.

ICMP is part of normal IP operation, not merely a testing tool. Firewalls should filter dangerous or unnecessary messages carefully rather than blocking all ICMP. Excessive filtering can break path maximum-transmission-unit discovery, diagnostics and IPv6 operation.

6. DHCP and Address Configuration

Dynamic Host Configuration Protocol automatically supplies configuration such as an IPv4 address, subnet mask, default gateway, DNS server and lease duration. The familiar IPv4 exchange is often described as DORA:

1. Discover: the client broadcasts a request for a DHCP server;
2. Offer: a server proposes configuration;
3. Request: the client requests one offer;
4. Acknowledgement: the server confirms the lease.

DHCP uses UDP, with server port 67 and client port 68 in IPv4. A router cannot normally forward a broadcast between subnets, so a DHCP relay agent forwards client requests to a central server. The relay inserts information that identifies the receiving subnet, allowing the server to select the correct address pool.

DHCP improves consistency but introduces dependence on server availability and configuration quality. Rogue DHCP servers can redirect traffic, while exhausted or incorrectly scoped pools can prevent clients from joining the network. Authorised-server controls, monitoring, suitable lease times and documented reservations are important operational safeguards.

IPv6 may use SLAAC, DHCPv6 or both. Router Advertisements tell hosts about prefixes and default routers. DHCPv6 can provide additional configuration, although default-router information is normally learned through Router Advertisements.

7. NAT and Private-to-Public Connectivity

Network Address Translation changes address information as packets cross a gateway. The most common form, Port Address Translation (PAT), allows many private hosts to share one public IPv4 address by distinguishing flows using transport-layer port numbers and a translation table.

A translation table typically records the internal address and port, translated public address and port, remote endpoint and protocol. Return traffic is matched to this state and translated back. NAT conserves IPv4 addresses and hides internal addressing conventions, but address hiding is not equivalent to a complete security control.

NAT can complicate peer-to-peer applications, VoIP, gaming, logging, IPsec and protocols that embed addresses in payloads. Port forwarding creates a controlled inbound mapping but increases exposure and must be protected by firewall rules, authentication, patching and monitoring. IPv6 reduces the address shortage that motivated NAT, although organisations may still use firewalls and, in limited designs, translation mechanisms.

8. Systematic Subnet Planning

A professional address plan should begin with requirements rather than arbitrary subnet masks. Gather:

• number and type of sites;
• current hosts and realistic growth;
• VLANs, server networks, voice, wireless, management and guest networks;
• point-to-point links and infrastructure addresses;
• security and routing boundaries;
• summarisation opportunities;
• public, private or provider-assigned address constraints;
• high-availability and reserved-address needs.

A practical design workflow is:

1. obtain an authorised address block and document ownership;
2. divide it hierarchically by region, site, function or security zone;
3. reserve space for growth and avoid overlapping independent networks;
4. allocate largest VLSM requirements first;
5. choose gateway and infrastructure conventions consistently;
6. configure DHCP scopes with exclusions and reservations;
7. document VLAN, prefix, gateway, DNS, DHCP and routing information;
8. test reachability, address uniqueness, failover and security controls;
9. monitor utilisation and update the plan through change management.

A useful address-management record includes prefix, location, VLAN or purpose, gateway, DHCP range, reserved addresses, owner, allocation date and status. IP Address Management (IPAM) systems reduce duplicate assignments and make auditing easier.

Applied Case: Illustrative Campus Network

Background

A fictional technical college has a /16 private allocation, 10.60.0.0/16. Its main campus requires a 300-host student LAN, a 120-host administration LAN, a 50-host laboratory LAN, a 25-host security-camera LAN and several small infrastructure networks.

Problem

The original flat network produces excessive broadcasts, makes access-control policies difficult and has no documented growth strategy.

Analysis and solution

The network team separates functions into VLANs and applies VLSM. The student LAN receives /23, providing 510 conventional usable addresses; administration receives /25, providing 126; laboratories receive /26, providing 62; and cameras receive /27, providing 30. A /30 or /31 may be considered for point-to-point links depending on device support and design policy. Each VLAN receives a distinct gateway, DHCP scope and security policy. Inter-VLAN routing occurs on a Layer 3 switch or router, while a firewall controls traffic between student, administration, camera and server zones.

DHCP relay forwards requests to redundant servers. DNS and DHCP records are integrated with the institution's IPAM process. IPv6 is introduced using a provider-assigned prefix, with /64 prefixes per VLAN, Router Advertisements and firewall policies equivalent in intent to IPv4 controls. NAT is used only for IPv4 Internet access, while the firewall logs translations and denied traffic.

Outcome

Broadcast domains become smaller, address allocation is documented, and the college can add buildings without redesigning existing VLANs. Monitoring detects pool exhaustion and duplicate addresses. The design does not assume that subnetting alone provides security: routing and firewall policy enforce the actual boundaries.

Learning points

The case demonstrates that subnetting is simultaneously an addressing, routing, operational and security-design activity. Capacity calculations, hierarchy, documentation and control-plane protection are all necessary.

Challenges, Limitations and Best Practices

Common errors include confusing a host address with a network address, using an incorrect mask, overlapping VLSM ranges, allocating too little growth capacity, treating private addresses as secure, blocking essential ICMP, and assuming DHCP prevents every duplicate address. Another frequent error is configuring IPv4 carefully while leaving IPv6 unmanaged, creating an unintended security gap.

Best practice is to use CIDR notation consistently, calculate from binary boundaries, allocate largest requirements first, reserve infrastructure addresses, maintain authoritative IPAM records, use DHCP snooping and related switch protections where appropriate, secure router advertisements, monitor ARP and NDP anomalies, and test both IPv4 and IPv6. Address plans should be reviewed after organisational, cloud, wireless or regulatory changes.

Privacy and governance also matter. DHCP logs, IPAM records and firewall translations can be associated with users and devices. Retention, access control, lawful disclosure and data-minimisation policies should be defined. Administrators should not use address records for unauthorised surveillance, and changes to public addressing or filtering should follow documented approval procedures.

Chapter Summary

IP addressing supplies the logical structure required for internetwork communication. IPv4 uses 32-bit addresses and conventional subnets reserve network and broadcast addresses, while IPv6 uses 128-bit addresses, multicast and Neighbor Discovery rather than broadcast. CIDR expresses the prefix boundary and supports both precise subnetting and route aggregation. Subnet calculations depend on host-bit counts, and VLSM allocates different prefix lengths to different requirements.

ARP resolves local IPv4 addresses to link-layer addresses; NDP performs related IPv6 functions through ICMPv6. ICMP supports error reporting and diagnostics. DHCP automates configuration through leases and relay agents. NAT and PAT conserve IPv4 space but introduce operational and security complications. A sound address plan is hierarchical, documented, growth-aware, tested and managed alongside routing, firewalling, monitoring and governance.

Key Terms

Address resolution: Mapping a network-layer address to a link-layer address.

ARP: IPv4 protocol used to discover a local interface’s link-layer address.

CIDR: Classless representation of an address and prefix length.

DHCP: Protocol that leases host configuration parameters.

Directed broadcast: IPv4 address identifying all hosts on a specified subnet.

ICMP: Protocol for IP control, error reporting and diagnostics.

IPv4: 32-bit Internet Protocol version.

IPv6: 128-bit Internet Protocol version.

IPAM: Systems and processes for managing address allocations.

Link-local address: Address valid only on the local network link.

Multicast: One-to-many delivery to a subscribed group.

NAT: Translation between address realms at a gateway.

Neighbor Discovery: IPv6 mechanism for discovering routers and neighbors.

Network prefix: Leading bits identifying a network or subnet.

PAT: NAT form that uses port numbers to multiplex flows.

Prefix length: Number of leading bits belonging to the network prefix.

SLAAC: IPv6 method of configuring addresses from router advertisements.

Subnet mask: IPv4 bit mask separating network and host portions.

Unicast: One-to-one packet delivery.

VLSM: Use of different subnet masks within one address allocation.

Review Questions

Short Answer Questions

1. What is the purpose of a network prefix?
2. Why does IPv6 not require an IPv4-style broadcast address?
3. What information does DHCP commonly provide to a client?
4. What is the difference between ARP and IPv6 Neighbor Discovery?
5. Why is NAT not equivalent to a firewall?

Long Answer Questions

1. Explain CIDR and show how prefix length affects IPv4 address capacity.
2. Describe the DORA process and explain why DHCP relay agents are needed.
3. Compare IPv4 and IPv6 address types and configuration approaches.
4. Explain the operational benefits and limitations of NAT and PAT.
5. Describe a professional workflow for designing and documenting a VLSM address plan.

Analytical / Application Questions

1. An organisation has 192.168.100.0/24 and needs four subnets supporting 50 hosts each. Determine a suitable prefix, mask, address capacity and subnet boundaries.
2. Design a VLSM allocation from 172.20.0.0/24 for departments requiring 90, 40, 20 and 10 usable host addresses. Show the prefix selected for each and verify that ranges do not overlap.
3. A campus reports that IPv4 clients receive addresses but cannot reach the Internet, while IPv6 clients can communicate locally but not externally. Propose a systematic diagnostic sequence involving DHCP, default gateways, NAT, routing, ICMP and IPv6 Router Advertisements.

Multiple Choice Questions with Answers

Question 1

How many conventional usable host addresses are available in an IPv4 /27 subnet?

A. 14

B. 30

C. 32

D. 62

Correct Answer: B. 30

Question 2

What is the network address of 192.168.50.141/26?

A. 192.168.50.0

B. 192.168.50.64

C. 192.168.50.128

D. 192.168.50.192

Correct Answer: C. 192.168.50.128

Question 3

Which protocol resolves an IPv4 address to a local link-layer address?

A. ARP

B. DHCP

C. ICMP

D. DNS

Correct Answer: A. ARP

Question 4

Which IPv6 mechanism replaces the functions commonly provided by ARP?

A. PAT

B. NDP

C. RARP

D. FTP

Correct Answer: B. NDP

Question 5

What is the correct order of the main DHCP IPv4 exchange?

A. Offer, Discover, Acknowledge, Request

B. Discover, Request, Offer, Acknowledge

C. Discover, Offer, Request, Acknowledge

D. Request, Discover, Acknowledge, Offer

Correct Answer: C. Discover, Offer, Request, Acknowledge

Question 6

Which IPv4 range is private?

A. 8.8.8.0/24

B. 172.16.0.0/12

C. 224.0.0.0/4

D. 169.254.0.0/16

Correct Answer: B. 172.16.0.0/12

Question 7

A /24 network is divided using a /27 prefix. How many equal-size subnets are created?

A. 2

B. 4

C. 8

D. 16

Correct Answer: C. 8

Question 8

Which statement about IPv6 is correct?

A. It uses 32-bit addresses

B. It requires broadcast for router discovery

C. It commonly assigns /64 prefixes to LANs

D. It cannot use multicast

Correct Answer: C. It commonly assigns /64 prefixes to LANs

Question 9

What is the primary purpose of PAT?

A. To map many private flows through one public IPv4 address using ports

B. To replace DNS with ARP

C. To allocate IPv6 prefixes automatically

D. To calculate a subnet mask

Correct Answer: A. To map many private flows through one public IPv4 address using ports

Question 10

Which VLSM allocation practice is generally recommended?

A. Allocate the smallest requirements first

B. Allocate largest requirements first

C. Use the same prefix for every link

D. Ignore future growth

Correct Answer: B. Allocate largest requirements first