IP Addressing, Subnetting and IPv6

Introduction and Context

An IP address identifies an interface participating in an Internet Protocol network. Addressing enables hosts to communicate locally, while routing enables packets to move between networks. In professional network design, addressing is not merely the assignment of numbers: it is a structured process involving hierarchy, summarisation, security, availability, troubleshooting, and future growth.

IPv4 remains widely deployed, but its 32-bit address space is limited. IPv6 provides a 128-bit address space and introduces design features intended to support large-scale networks. Network professionals must therefore understand IPv4 subnetting, Classless Inter-Domain Routing (CIDR), Variable-Length Subnet Masking (VLSM), DHCP, NAT, IPv6 addressing, and dual-stack migration.

Learning Objectives

By the end of this chapter, you should be able to:

• Explain IPv4 address structure, masks, CIDR and address-allocation mechanisms.
• Calculate network, broadcast, host ranges and usable capacity.
• Design fixed-length and variable-length subnetted networks.
• Plan hierarchical addresses that support summarisation and growth.
• Explain DHCP, private addressing, NAT and their limitations.
• Describe IPv6 address types, notation, prefixes, SLAAC and DHCPv6.
• Configure and troubleshoot IPv4 and IPv6 addressing in a scalable network.
• Evaluate operational, security and governance implications of addressing decisions.

1. Addressing as a Network Design Function

An IP address has two logical parts: a network prefix and an interface identifier. The prefix identifies the routed network; the remaining bits identify an interface within that prefix. Routers use the prefix to select a next hop. They do not normally need to know every individual host address.

A well-designed address plan should be:

• Hierarchical: addresses reflect sites, buildings, departments or services.
• Summarisable: several contiguous networks can be represented by one route.
• Scalable: sufficient space exists for growth and new services.
• Unambiguous: overlapping ranges are avoided, especially between connected organisations.
• Documented: assignments, reservations and ownership are recorded.
• Policy-aligned: address boundaries support security zones, quality of service and administration.

The address plan should be designed before device configuration. Poor planning produces overlapping subnets, inefficient routing tables, difficult migrations and avoidable outages.

2. IPv4 Addressing Fundamentals

IPv4 addresses contain 32 bits, conventionally written as four decimal octets. Each octet represents 8 bits and ranges from 0 to 255. For example, 192.0.2.37 is the decimal representation of a 32-bit address. The range 192.0.2.0/24 is reserved for documentation and examples.

A subnet mask indicates which bits belong to the network prefix. A prefix length, written with slash notation, gives the number of network bits. Thus, /24 means that 24 bits identify the network and 8 bits remain for host addresses.

2.1 Network, host and broadcast addresses

For a conventional IPv4 subnet, the network address has all host bits set to zero, and the directed broadcast address has all host bits set to one. The addresses between them are normally assignable to interfaces.

For a prefix length p, the total number of addresses is:

where N is the total number of addresses and p is the prefix length, with 0 ≤ p ≤ 32. For ordinary subnets with at least two host bits, the traditional usable-host count is:

The subtraction excludes the network and broadcast addresses. This rule is not universal: /31 point-to-point links may use both addresses under specific standards and vendor support, and /32 identifies a single host or route rather than a conventional LAN.

Worked example. For 198.51.100.64/26, the host-bit count is 32 − 26 = 6. Therefore, the total size is 2⁶ = 64 addresses and the conventional usable capacity is 64 − 2 = 62 hosts. The network address is 198.51.100.64 and the broadcast is 198.51.100.127; usable addresses are .65 through .126.

2.2 Binary masks and block size

A /26 mask is 255.255.255.192. In the final octet, the subnet increments are 256 − 192 = 64. The resulting networks are .0, .64, .128 and .192. This block-size method is useful for rapid operational calculations, although binary reasoning is safer when prefixes cross octet boundaries.

Common examples are shown below.

3. CIDR and Route Summarisation

Classful addressing divided IPv4 into Classes A, B and C. This approach allocated blocks too coarsely and encouraged waste. CIDR replaced classful assumptions with an explicit prefix length. A /20 can be used regardless of its first octet, and routers forward according to the longest matching prefix.

CIDR improves allocation efficiency and enables route aggregation. For example, four contiguous /24 networks—203.0.113.0/24 through 203.0.116.0/24—can be summarised as 203.0.112.0/22 only if the aligned /22 range exactly contains the intended networks. Summarisation reduces routing-table size, but incorrect or overly broad summaries can black-hole traffic or conceal failures.

The longest-prefix-match rule selects the most specific matching route. If a router has both 10.10.0.0/16 and 10.10.20.0/24, traffic for 10.10.20.5 uses the /24 route because it contains more specific bits.

4. Subnetting and VLSM

Subnetting borrows host bits to create smaller networks. If s bits are borrowed, the number of equal-sized subnets is:

The remaining host bits determine capacity. Fixed-Length Subnet Masking (FLSM) gives every subnet the same size. It is simple, but inefficient when departments have different requirements. VLSM assigns different prefix lengths according to actual need.

4.1 VLSM design method

A reliable VLSM procedure is:

1. List required networks and host counts, including infrastructure addresses and growth.
2. Sort requirements from largest to smallest.
3. Select the smallest subnet that meets each requirement.
4. Allocate subnets on correct binary boundaries.
5. Check that no ranges overlap.
6. Reserve space for expansion and document gateways, DHCP ranges and exclusions.

The smallest conventional subnet supporting R hosts is found by selecting host bits h such that:

The prefix is then p = 32 − h. The inequality assumes a conventional subnet with network and broadcast addresses unavailable for hosts.

Worked VLSM example. An organisation receives 10.20.0.0/24 and needs networks for 100, 50, 25 and 10 hosts.

• 100 hosts requires 7 host bits because 2⁷ − 2 = 126; allocate /25: 10.20.0.0–10.20.0.127.
• 50 hosts requires 6 host bits because 2⁶ − 2 = 62; allocate /26: 10.20.0.128–10.20.0.191.
• 25 hosts requires 5 host bits because 2⁵ − 2 = 30; allocate /27: 10.20.0.192–10.20.0.223.
• 10 hosts requires 4 host bits because 2⁴ − 2 = 14; allocate /28: 10.20.0.224–10.20.0.239.

Addresses 10.20.0.240–10.20.0.255 remain available. The allocation is non-overlapping and leaves a small reserve, although a larger parent block would be preferable if rapid expansion is expected.

4.2 Address efficiency and design trade-offs

VLSM reduces waste, but very small subnets increase administrative complexity. Excessive fragmentation can make route summarisation difficult. A professional design balances utilisation against operational simplicity. It should also consider high-availability addresses, virtual IPs, network appliances, monitoring, printers, wireless devices and future cloud connectivity.

5. Private IPv4, DHCP and NAT

RFC 1918 private IPv4 ranges are:

Private addresses are not globally routed. They commonly reach the Internet through Network Address Translation. NAT changes address information, and Port Address Translation (PAT), often called many-to-one NAT, distinguishes simultaneous sessions using transport-layer port numbers.

NAT conserves public addresses and hides internal addressing, but it is not a complete security mechanism. It can complicate peer-to-peer applications, logging, troubleshooting, IPsec, VoIP and end-to-end communication. IPv6 reduces the architectural need for address conservation, although firewalls and application gateways remain essential.

DHCP dynamically supplies addresses and related parameters such as subnet mask, default gateway, DNS servers and lease duration. A typical IPv4 DHCP exchange is DORA: Discover, Offer, Request and Acknowledgement. Reservations bind a known client identifier or hardware address to a predictable address. DHCP relay agents forward client broadcasts across routed boundaries.

A resilient design uses authorised DHCP servers, redundant scopes, monitored utilisation, documented exclusions and protection against rogue DHCP servers. Static addresses remain appropriate for infrastructure, but they should be centrally recorded rather than assigned informally.

6. IPv6 Addressing

IPv6 uses 128-bit addresses, written as eight groups of four hexadecimal digits. For example: 2001:db8:1200:0000:0000:0000:0000:0042. Leading zeroes in a group may be omitted, and one longest consecutive sequence of all-zero groups may be replaced by “::”. The address therefore becomes 2001:db8:1200::42. The compression symbol must not be used twice in one address because the omitted length would be ambiguous.

IPv6 commonly uses a /64 subnet prefix for LANs. The remaining 64 bits form the interface identifier, although specialised designs may use other lengths. The large space supports hierarchical allocation, aggregation and globally unique addressing.

6.1 IPv6 address types

• Global unicast: globally routable addresses, commonly from 2000::/3.
• Link-local: fe80::/10; required on IPv6 interfaces and used for neighbour discovery and next-hop communication. Link-local addresses are valid only on their local link.
• Unique local: fc00::/7, with locally administered use commonly drawn from fd00::/8. These are intended for private internal communication and are not globally routed.
• Multicast: ff00::/8; IPv6 has no broadcast address. Multicast groups replace many broadcast functions.
• Loopback: ::1.
• Unspecified: ::, used when a node has no assigned address, such as during initial configuration.

Anycast uses the same unicast address on multiple interfaces. Routing delivers packets to the topologically nearest instance, making it useful for replicated services, but operational monitoring and service consistency are important.

6.2 IPv6 configuration mechanisms

SLAAC uses Router Advertisements to announce prefixes and configuration flags. A host can construct an address and perform Duplicate Address Detection (DAD). DHCPv6 can provide stateful address assignment or stateless information such as DNS parameters. These mechanisms can coexist; Router Advertisement flags determine whether hosts use DHCPv6 for addresses, other configuration, or neither.

IPv6 does not use ARP. Neighbour Discovery Protocol (NDP), carried through ICMPv6, performs neighbour resolution, router discovery, prefix discovery and reachability functions. Consequently, filtering ICMPv6 indiscriminately can break normal operation. Security controls should permit required ICMPv6 messages while limiting unwanted traffic.

6.3 IPv6 subnet planning

An organisation might receive 2001:db8:4500::/48 for documentation purposes. It can assign one /64 per VLAN: 2001:db8:4500:0010::/64 for users, 0011::/64 for voice and 0020::/64 for servers. The fourth hexadecimal field provides 16 bits of subnet identification, allowing 65,536 /64 subnets within the /48.

The common enterprise model is to reserve aggregate prefixes for regions or sites, allocate /56 or larger units to sites, and assign /64 prefixes to individual LANs. Point-to-point links may use /127 under suitable operational policy, while loopbacks are commonly represented by /128 addresses.

7. Routing, Address Scope and Security

Addressing and routing are inseparable. A route identifies a destination prefix, next hop and often an outgoing interface. Default routes provide reachability for destinations not otherwise known. Dynamic routing protocols exchange reachability, while static routes may be suitable for small or stable environments.

Address boundaries often define security zones: user, server, management, guest, industrial and public-service networks. However, an address range alone is not a security boundary. Firewalls, identity controls, segmentation, monitoring and least privilege must enforce policy.

IPv4 private addressing and NAT can create a false sense of protection. Conversely, globally routable IPv6 addresses are not inherently unsafe; a stateful firewall, ingress filtering, secure host configuration and careful exposure policy are still required. Source-address validation, anti-spoofing filters and route advertisements should be implemented at trust boundaries.

8. Applied Case: Illustrative Regional College Network

Background

A fictional regional college operates two campuses, each with staff, students, voice, servers, guest wireless and network-management services. Its original flat 192.168.1.0/24 network has exhausted addresses and makes troubleshooting and access control difficult.

Problem

The college needs separate security zones, approximately 900 IPv4-capable devices across both campuses, scalable wireless access, and IPv6 readiness. The campuses are connected by a routed WAN, and the existing Internet connection provides a limited public IPv4 allocation.

Analysis

A single /24 cannot support the required population. Extending the same subnet would preserve broadcast and security problems. The design team therefore chooses hierarchical private IPv4 addressing, VLSM for infrastructure links, DHCP for clients, NAT at the Internet edge, and a provider-assigned IPv6 /48. Each VLAN receives an IPv6 /64.

Approach and solution

The private plan reserves 10.60.0.0/16 for Campus A and 10.61.0.0/16 for Campus B. Within each campus, contiguous blocks are assigned to user, voice, server, guest and management VLANs. A /20 is reserved for student wireless growth, while /30 or /31 point-to-point ranges are used between routers according to platform support. Route summaries of 10.60.0.0/16 and 10.61.0.0/16 are advertised toward the core.

IPv4 DHCP scopes provide addresses and DNS information, with exclusions for gateways and infrastructure. PAT translates outbound private addresses. In IPv6, each VLAN receives a separate /64, hosts use SLAAC with managed DNS information, and firewalls apply explicit inbound and outbound policy. NDP inspection and DHCP protection are enabled on access switches where supported.

Outcome

The college gains address capacity, smaller fault domains, clearer firewall policies and summarised routing. IPv6 can be introduced without renumbering the IPv4 environment. Monitoring identifies unused and over-utilised pools, while documentation links each prefix to a site, VLAN, owner and security policy.

Learning points

The case demonstrates that address planning must precede implementation; VLSM should reflect real requirements; IPv6 should be designed per subnet rather than treated as an afterthought; and NAT, DHCP and firewalls solve different problems.

9. Configuration and Troubleshooting Practices

A systematic troubleshooting sequence is more effective than changing settings randomly:

1. Confirm the physical or wireless link.
2. Inspect address, prefix length, gateway and DNS configuration.
3. Test the local stack using loopback addresses.
4. Test the local gateway and neighbour resolution.
5. Test a remote address, then a name, separating routing from DNS problems.
6. Inspect routing tables, ARP/NDP state, DHCP leases, firewall logs and interface counters.
7. Compare the observed configuration with the address plan.

Typical IPv4 errors include an incorrect mask, duplicate address, wrong default gateway, exhausted DHCP scope and overlapping NAT rules. IPv6 errors include missing Router Advertisements, incorrect prefix lengths, failed DAD, blocked ICMPv6, incomplete DHCPv6 expectations and routes that exist only for IPv4.

Use authoritative documentation and tools such as ip addr, ip route, ip -6 route, ping, traceroute or their platform equivalents. Packet captures are especially valuable when determining whether a failure occurs at address assignment, neighbour discovery, routing, transport or application layers.

10. Contemporary Developments and Governance

Modern environments combine campus networks, cloud VPCs or VNets, software-defined networking, containers, VPNs and zero-trust access. Cloud providers typically require deliberate subnet planning because subnets influence routing, availability zones, security policies and service endpoints. Container platforms add virtual address spaces and service discovery, increasing the need to avoid overlap.

IP Address Management (IPAM) systems integrate allocations, DNS, DHCP, ownership and audit trails. Automation can provision addresses through APIs, but automated changes require validation, approval controls, rollback and testing. Artificial intelligence may assist anomaly detection or capacity forecasting, but it should not independently modify production routing without governance and human review.

Address records can reveal user, device and location information. Organisations should restrict access to IPAM data, retain logs according to legal and operational requirements, and avoid treating an address as definitive proof of a person’s identity. Privacy-enhancing techniques, data minimisation and documented retention policies are important, particularly in educational, healthcare and public-sector environments.

Best-Practice Checklist

• Use CIDR and hierarchical allocation rather than classful assumptions.
• Allocate the largest VLSM requirements first and verify binary boundaries.
• Reserve documented space for growth, infrastructure and migrations.
• Avoid overlapping private ranges across sites, partners and cloud networks.
• Use DHCP with redundancy, reservations and rogue-server protection.
• Treat NAT as a translation function, not as a complete security design.
• Assign IPv6 /64 prefixes to ordinary LANs and plan aggregation.
• Permit required ICMPv6 and secure NDP rather than blocking IPv6 blindly.
• Operate IPv4 and IPv6 with equivalent monitoring, policy and incident response.
• Maintain authoritative IPAM records and review utilisation regularly.

Chapter Summary

IPv4 and IPv6 addressing provide the structure on which routing, segmentation and network services depend. IPv4 subnetting uses masks and prefix lengths to divide address space; CIDR removes classful limitations and enables route summarisation. VLSM allocates different subnet sizes according to demand, provided that allocations are aligned and non-overlapping. DHCP automates IPv4 configuration, while private addresses and NAT extend the life of IPv4 but introduce operational limitations.

IPv6 expands the address space to 128 bits and uses global unicast, link-local, unique-local, multicast, anycast, loopback and unspecified addresses. SLAAC, DHCPv6 and NDP support automatic configuration and neighbour communication. A professional design is hierarchical, documented, secure, scalable and suitable for both campus and cloud environments. Effective implementation combines mathematics, routing knowledge, governance, monitoring and disciplined change control.

Key Terms

IPv4: A 32-bit Internet Protocol addressing system.

IPv6: A 128-bit Internet Protocol addressing system.

Prefix length: The number of leading bits identifying a network.

Subnet mask: A bit mask separating network and host portions of an IPv4 address.

CIDR: Classless Inter-Domain Routing using explicit prefix lengths.

VLSM: Variable-Length Subnet Masking using different subnet sizes in one address block.

FLSM: Fixed-Length Subnet Masking using equal-sized subnets.

Network address: The address with all host bits set to zero.

Broadcast address: The IPv4 address with all host bits set to one in a subnet.

Route summarisation: Representing several contiguous routes with one aggregate prefix.

DHCP: Dynamic Host Configuration Protocol.

NAT: Network Address Translation.

PAT: Port Address Translation, commonly many-to-one NAT.

SLAAC: Stateless Address Autoconfiguration for IPv6.

NDP: IPv6 Neighbor Discovery Protocol.

Link-local address: An IPv6 address valid only on the local link.

Anycast: One address assigned to multiple interfaces, reaching a topologically nearest instance.

IPAM: IP Address Management for organised allocation and tracking.

Review Questions

Short Answer Questions

1. What is the purpose of a subnet mask?
2. Why does CIDR improve on classful addressing?
3. State the conventional usable-host formula for an IPv4 subnet.
4. What is the role of DHCP relay?
5. Why does IPv6 use multicast instead of broadcast?

Long Answer Questions

1. Explain the process of designing a VLSM address plan, including ordering, alignment and growth.
2. Compare DHCP, SLAAC and DHCPv6 as address-configuration mechanisms.
3. Explain how NAT and PAT operate and discuss their operational limitations.
4. Describe IPv6 address types and give an appropriate use for each.
5. Discuss how hierarchical addressing supports route summarisation and security segmentation.

Analytical / Application Questions

1. Design a VLSM plan from 172.20.4.0/24 for networks requiring 110, 55, twenty-five and 12 conventional usable hosts. Show prefixes, ranges and unused capacity.
2. A company has overlapping 10.0.0.0/8 networks after a merger and must connect its sites and cloud environment. Analyse the risks and propose an address-renumbering or translation strategy.
3. An IPv6 host has a valid global address but cannot reach its default gateway. Develop a troubleshooting sequence using Router Advertisements, NDP, ICMPv6, interface state and routing information.

Multiple Choice Questions with Answers

Question 1

How many conventional usable host addresses are available in a 192.0.2.0/26 subnet?

A. 30

B. 62

C. 64

D. 126

Correct Answer: B. 62

Question 2

Which prefix provides 30 conventional usable IPv4 host addresses?

A. /26

B. /27

C. /28

D. /29

Correct Answer: B. /27

Question 3

Which technique assigns different subnet sizes according to departmental requirements?

A. PAT

B. SLAAC

C. VLSM

D. NDP

Correct Answer: C. VLSM

Question 4

What is the primary purpose of IPv4 NAT?

A. To convert IPv4 packets into IPv6 packets

B. To translate address information between addressing realms

C. To assign IPv6 link-local addresses

D. To replace routing tables

Correct Answer: B. To translate address information between addressing realms

Question 5

Which IPv6 address type is valid only on the local link?

A. Global unicast

B. Unique local

C. Link-local

D. Anycast

Correct Answer: C. Link-local

Question 6

What does the IPv6 address-compression rule allow?

A. Removing every zero from an address

B. Replacing one longest sequence of zero groups with ::

C. Using :: twice in every address

D. Converting hexadecimal groups to decimal octets

Correct Answer: B. Replacing one longest sequence of zero groups with ::

Question 7

Which protocol performs IPv6 neighbour discovery functions that ARP performs in IPv4?

A. ICMPv6 NDP

B. DHCPv4

C. PAT

D. FTP

Correct Answer: A. ICMPv6 NDP

Question 8

A network has both 10.10.0.0/16 and 10.10.20.0/24 routes. Which route is selected for 10.10.20.5?

A. 10.10.0.0/16 because it was learned first

B. 10.10.0.0/16 because it is shorter

C. 10.10.20.0/24 because it is the longest matching prefix

D. Neither route

Correct Answer: C. 10.10.20.0/24 because it is the longest matching prefix

Question 9

Which IPv4 range is private?

A. 8.8.8.0/24

B. 172.16.0.0/12

C. 192.0.2.0/24

D. 198.51.100.0/24

Correct Answer: B. 172.16.0.0/12

Question 10

What is the conventional total number of addresses in a /28 IPv4 subnet?

A. 8

B. 14

C. 16

D. 32

Correct Answer: C. 16