IP Addressing
The addressing system that routes billions of packets per second across the global internet. From the 32-bit IPv4 design of 1981 through exhaustion crises to the 128-bit IPv6 future — IP addressing is the foundation of all modern networking.
// CHAPTER 01
Why Every Device Needs an Address
Logical identity, location, and the hierarchy that makes the internet possible
// REAL-WORLD SCENARIO
Every device that participates in IP communication needs an IP address — a logical identifier that tells the network both who the device is and where it lives in the topology. This is the key distinction from MAC addresses. A MAC address is a flat, permanent hardware identifier — there is no structural information in a MAC that tells you which city, country, or network a device is on. An IP address is hierarchical by design.
The hierarchy is the critical insight. An IP address is divided into two parts: the network portion (which network is the device on?) and the host portion (which specific device on that network?). Routers use only the network portion to make forwarding decisions — they never need to know about individual hosts, only about reachable networks. This aggregation is what makes routing the entire internet feasible within the memory constraints of real hardware.
Layer 3 vs. Layer 2 Addressing
MAC addresses operate at Layer 2 (the data link layer, within a single broadcast domain). They are flat — every MAC is globally unique, but there is no geographic or topological information embedded. A router that needed to forward packets using MAC addresses would require an entry for every MAC address on Earth: ~15 billion devices as of 2024, and growing to hundreds of billions with IoT. This is computationally and economically impossible.
IP addresses operate at Layer 3 (the network layer, across routed boundaries). They are hierarchical — a router with a route for 10.10.10.0/24 covers 254 individual hosts with one table entry. A route for 10.0.0.0/8 covers 16.7 million hosts with one entry. This prefix aggregation is how the global internet routing table remains manageable.
🌐 The Internet Fits in ~900,000 Routes
The forwarding lookup happens in TCAM (Ternary Content-Addressable Memory) — specialized hardware that performs longest-prefix-match lookups across all routing table entries simultaneously in nanoseconds. This is how a core internet router can forward tens of millions of packets per second while consulting a ~900,000-entry routing table: the lookup is a parallel hardware operation, not a sequential software search.
// CHAPTER 02
IPv4: Structure, Notation, and the 32-Bit Address
From 32 binary bits to dotted-decimal and back
An IPv4 address is a 32-bit binary number. Humans don't work well with 32-bit binary strings, so the address is expressed in dotted-decimal notation: the 32 bits are divided into four groups of 8 bits (octets), and each octet is written as a decimal number from 0 to 255.
Converting a binary octet to decimal is straightforward positional math. Each bit has a positional weight (128, 64, 32, 16, 8, 4, 2, 1). Sum the weights of bits that are 1:
The reverse — decimal to binary — requires repeated halving or subtraction of powers of 2. For 192: 192 ≥ 128 → bit 7 = 1, remainder 64. 64 ≥ 64 → bit 6 = 1, remainder 0. All remaining bits = 0. Result: 11000000.
IPv4 ADDRESS ANALYZER
Enter an IPv4 address and prefix length to calculate all subnet parameters.
Classful Addressing (Historical Context)
The original IPv4 RFC 791 (1981) defined classful addressing — the address space was divided into fixed classes based on the leading bits of the first octet. This predates CIDR notation and was the only addressing model until 1993.
IPv4 ADDRESS CLASSES
Click a class to see range, default prefix, private ranges, and use cases.
Leading bits 110. Small networks. 192.168.x.x (65,536 addresses) is the most commonly recognized private range — home routers default to 192.168.1.x or 192.168.0.x.
Classful addressing was rigid and catastrophically wasteful. A company needing 300 hosts could not get a /23 — that didn't exist in classful. They had to take a Class B (/16, 65,534 hosts), leaving 65,234 addresses permanently wasted in their allocation but unavailable to anyone else. This waste, multiplied across thousands of organizations, consumed the IPv4 address space faster than growth alone would have. CIDR fixed this in 1993.
⚠ Class D and E have no subnet mask or host addresses
CIDR: Classless Inter-Domain Routing
CIDR (RFC 1519, 1993) eliminated fixed class boundaries. Instead of "Class A = /8, Class B = /16, Class C = /24," CIDR allows any prefix length from /0 to /32. A company needing 300 hosts gets a /23 (510 usable hosts) — not a wasteful /16.
CIDR notation appends the prefix length after a slash: 192.168.1.0/24. The prefix length specifies how many bits are the network portion. The remaining (32 − prefix) bits are the host portion. A /24 has 8 host bits = 256 addresses, 254 usable. A /22 has 10 host bits = 1,024 addresses, 1,022 usable.
CIDR also enables supernetting (route aggregation): multiple smaller contiguous prefixes can be summarized as a single larger prefix in routing advertisements. An ISP owning 192.168.0.0/24 through 192.168.3.0/24 can advertise one 192.168.0.0/22, saving routing table entries on the internet. This aggregation is why BGP tables have ~900K entries, not tens of millions.
// CHAPTER 03
Subnet Masks and Network/Host Decomposition
Bitwise AND, network addresses, broadcast, and host ranges
A subnet mask is a 32-bit value where all network bits are 1 and all host bits are 0. It serves as a bitmask that, when AND'd with an IP address, extracts the network address. The subnet mask is the operational counterpart to CIDR notation: /24 = subnet mask 255.255.255.0.
Calculating the Network Address: Bitwise AND
Apply bitwise AND between the IP address and subnet mask. For every bit position: the result is 1 only if both IP and mask have a 1; otherwise 0. All host bits become 0 in the result — this is the network address.
The Four Addresses Every Subnet Contains
Network address: All host bits = 0. Identifies the subnet itself. Cannot be assigned to any host. Used in routing table entries (e.g., "route 192.168.10.0/24 via 10.0.0.1").
Broadcast address: All host bits = 1. A packet sent to the broadcast address is delivered to every host in the subnet by Layer 2 (Ethernet broadcast). Cannot be assigned to a host. Routers do not forward directed broadcasts by default (CVE against Smurf amplification attacks).
First usable host: Network address + 1. Commonly assigned to the default gateway (router) by convention — though this is convention, not a requirement.
Last usable host: Broadcast address − 1. The formula: usable hosts = 2^(32−prefix) − 2.
Special Prefix Lengths: /31 and /32
/31 (RFC 3021): Contains exactly 2 addresses. Normally neither would be usable (network + broadcast). RFC 3021 explicitly allows /31s for point-to-point links where broadcast is never needed — both addresses are assignable to the two endpoints. This saves the 2 addresses that a /30 (4 total, 2 usable) wastes. Cisco, Juniper, and modern routers support /31 on P2P interfaces.
/32 (host route): A single specific IP address with no subnet context. Used for: loopback interfaces (routers assign 32-bit loopbacks for router IDs), policy-based routing for specific hosts, OSPF/BGP router IDs, and very specific routing entries that override broader routes via LPM.
Wildcard Masks
A wildcard mask is the bitwise inverse of the subnet mask. Where the subnet mask has 1s (network bits), the wildcard has 0s; where the subnet mask has 0s (host bits), the wildcard has 1s. Wildcards are used in Cisco ACLs and OSPF area statements to match ranges of addresses.
// CHAPTER 04
Special and Reserved IPv4 Address Ranges
RFC 1918, loopback, link-local, CGNAT, documentation, and multicast
Large portions of the 4.3 billion IPv4 address space are permanently reserved for specific purposes defined by IANA and various RFCs. Using a reserved range for production hosts causes silent, mysterious failures — packets to or from reserved ranges may be dropped by internet routers without notification.
SPECIAL IPv4 ADDRESS RANGES
Click any range to see RFC authority and detailed purpose.
RFC 1918 Private Address Space (The Foundation of NAT)
RFC 1918 (1996) defined the three private ranges that can be freely reused by any organization without IANA coordination: 10.0.0.0/8 (16.7M addresses), 172.16.0.0/12 (1.05M addresses across 172.16.x.x–172.31.x.x), and 192.168.0.0/16 (65,536 addresses).
The fundamental rule: private addresses are never routed on the public internet. All internet routers drop packets with private source or destination IPs. This means the same private address can simultaneously exist in millions of different private networks — your home 192.168.1.100 and a hospital's 192.168.1.100 are entirely separate devices. NAT translates private-to-public at the internet boundary.
🏠 The Entire World Shares Three Address Ranges
Loopback (127.0.0.0/8)
The entire /8 block 127.0.0.0–127.255.255.255 is reserved for loopback. Traffic sent to any address in this range is processed by the local TCP/IP stack and never transmitted on the wire. 127.0.0.1 is the conventional loopback address ("localhost"). Services that should only accept local connections bind to 127.0.0.1 explicitly — a database server bound to 127.0.0.1 is not accessible from the network.
On Linux, the lo interface handles loopback. Packets to 127.0.0.1 travel through the socket layer, are processed by the TCP/IP stack in kernel, and delivered to the destination socket — all without touching any network hardware. Round-trip latency is typically <0.1ms.
Link-Local / APIPA (169.254.0.0/16)
When a host using DHCP cannot reach a DHCP server after the standard retry period (4 seconds, then escalating backoff), Windows and macOS auto-assign an address from 169.254.0.0/16 — APIPA (Automatic Private IP Addressing). The host picks a random address in this range and uses ARP to verify no other host has claimed it. Link-local addresses are not routed beyond the local subnet (no gateway is configured, TTL stays local).
Diagnostically: seeing a 169.254.x.x address means DHCP failed. Common causes: DHCP server unreachable (wrong VLAN, server down), DHCP scope exhausted (no addresses available), DHCP relay agent not configured (server is on a different subnet with no ip helper-address), or VLAN misconfiguration (device is in the wrong VLAN).
Documentation Addresses (RFC 5737)
Three /24 blocks are reserved for documentation and examples in textbooks, RFCs, training materials, and tutorials: 192.0.2.0/24 (TEST-NET-1), 198.51.100.0/24 (TEST-NET-2), and 203.0.113.0/24 (TEST-NET-3). These addresses should appear only in documentation — never in production configurations. This module uses them for examples.
// CHAPTER 05
IPv4 Exhaustion, IANA, and the RIR System
How 4.3 billion addresses ran out — and what extended IPv4's lifetime
// REAL-WORLD SCENARIO
The IANA → RIR → ISP Hierarchy
IP address allocation follows a three-tier hierarchy. IANA (Internet Assigned Numbers Authority), managed by ICANN, maintains the master IP address registry. IANA allocates large blocks (/8s historically) to five Regional Internet Registries:
After IANA exhaustion, RIRs continue to operate waiting list policies for new allocations from returned or recovered space. Organizations also return unused blocks — a company that received a /8 in the 1980s might return it to IANA/RIR if their growth never required that many addresses.
IPv4 Address Markets
IPv4 addresses have become a tradable commodity. RIRs facilitate or permit transfers of address blocks between organizations. As of 2024 market prices: a /24 (256 addresses) trades for approximately $15,000–$25,000 USD; a /16 (65,536 addresses) is worth roughly $1–2 million. Large legacy holders (MIT held 18.0.0.0/8; Stanford held 36.0.0.0/8) have sold portions of these historic /8 allocations, injecting millions of addresses back into the pool.
Carrier-Grade NAT (CGNAT, RFC 6598)
To avoid assigning a public IP to every customer, ISPs deploy CGNAT (Carrier-Grade NAT). The ISP assigns each customer a private address from 100.64.0.0/10 (the RFC 6598 shared address space) and performs NAT at the ISP's border router. Multiple customers share one public IP.
CGNAT creates two layers of NAT: the customer's home router does NAT from 192.168.x.x to 100.64.x.x (ISP private), then the ISP's CGNAT device does NAT from 100.64.x.x to the public IP. This double-NAT breaks many applications:
// CHAPTER 06
IPv4 Packet Header Deep Dive
Every field, its purpose, and why some were eliminated in IPv6
Every IP packet begins with a minimum 20-byte header. Network engineers, security analysts, and performance tuners need to understand every field — not just source and destination IP. The header controls routing, fragmentation, QoS, and transport protocol selection.
Field-by-Field Analysis
Version (4 bits): Always 4 for IPv4, always 6 for IPv6. The first thing a network device checks. IPv4 and IPv6 packets can coexist on the same wire (dual-stack) — this field distinguishes them.
IHL — Internet Header Length (4 bits): Header length in 32-bit words. Minimum 5 (= 20 bytes, no options). Maximum 15 (= 60 bytes, with 40 bytes of options). If IHL > 5, the router must parse and potentially act on options — a performance cost. Most modern traffic has IHL = 5.
DSCP — Differentiated Services Code Point (6 bits): Previously the "Type of Service" (ToS) field. DSCP marks packets for QoS treatment — routers and switches use DSCP to classify traffic into priority queues. Critical DSCP values: EF (Expedited Forwarding, DSCP 46 / 0x2E) for voice/delay-sensitive traffic; AF41 (DSCP 34) for video conferencing; CS0 (DSCP 0) for best-effort/default. Reclassified at trust boundaries — only devices the administrator trusts (VoIP phones, internal servers) have their DSCP preserved.
ECN — Explicit Congestion Notification (2 bits): Allows routers to signal congestion to endpoints without dropping packets (RFC 3168). An ECN-capable transport (ECT) sets bits 01 or 10. A congested router sets bits 11 (CE — Congestion Experienced). The receiving endpoint signals the sender (via TCP ECE flag) to reduce its sending rate. ECN is TCP's congestion signal without the "slow down by dropping" pain — important for latency-sensitive applications and modern QoS systems (CoDel/FQ-CoDel use ECN marking).
Total Length (16 bits): Total IP packet size in bytes, including header and payload. Maximum: 65,535 bytes. Practical maximum over Ethernet: 1,500 bytes (MTU). Larger packets require fragmentation or jumbo frames.
Identification (16 bits): Unique ID for the original packet. All fragments of the same packet share the same Identification value — the reassembly engine uses this to group fragments back together. Each new packet gets a different Identification (typically a counter or random value).
Flags (3 bits): Bit 0 = reserved (always 0). Bit 1 = DF (Don't Fragment) — if set and the packet exceeds the next-hop MTU, the router drops the packet and sends ICMP "Fragmentation Needed" (type 3, code 4) back to the source. This is essential for PMTU Discovery (RFC 1191). Bit 2 = MF (More Fragments) — set on all fragments except the last.
Fragment Offset (13 bits): Position of this fragment's data within the original unfragmented packet, in 8-byte units. The first fragment has offset 0. Maximum offset: 8191 × 8 = 65,528 bytes.
TTL — Time to Live (8 bits): Hop counter. Each router decrements TTL by 1 before forwarding. When TTL reaches 0, the router drops the packet and sends ICMP Type 11 (Time Exceeded) to the source. Prevents routing loops from trapping packets forever. Default TTL values: Linux/macOS = 64, Windows = 128, Cisco routers = 255. traceroute exploits TTL by sending packets with TTL=1,2,3,… to map each hop — each TTL-expired router sends its IP in the ICMP response.
Protocol (8 bits): Identifies the Layer 4 (or direct IP) protocol in the payload. Key values: 1 = ICMP, 6 = TCP, 17 = UDP, 41 = IPv6-in-IPv4 (6in4 tunnels), 47 = GRE, 50 = ESP (IPsec), 51 = AH (IPsec), 89 = OSPF (sent directly over IP, not UDP/TCP), 112 = VRRP.
Header Checksum (16 bits): One's complement checksum of the IP header only (not payload). The checksum is recomputed at every hop because the TTL changes (and options might change). This per-hop recomputation was identified as unnecessary overhead — Layer 2 (Ethernet FCS) and Layer 4 (TCP/UDP checksums) already protect data integrity end-to-end. IPv6 eliminated the header checksum entirely.
IPv4 Fragmentation and PMTU Discovery
When a router receives a packet larger than the next-hop MTU and the DF bit is not set, it fragments the packet into smaller pieces. Each fragment gets the same Identification, different offsets, and MF bit set (except the last fragment). The destination host reassembles the fragments using Identification + offset.
Fragmentation is harmful to performance: it creates CPU overhead at the fragmenting router and the reassembling host, fragments can arrive out of order causing reassembly buffer pressure, and if any fragment is lost, the entire original packet must be retransmitted. Modern networks use PMTU Discovery (RFC 1191): hosts set DF=1 and rely on ICMP "Fragmentation Needed" responses from routers to learn the path's minimum MTU, then segment their data accordingly. TCP MSS negotiation handles this at the transport layer.
⚠ PMTU Discovery blackholes
// CHAPTER 07
Public vs. Private IP Addresses
Routable vs. RFC 1918, NAT, PAT, and the end-to-end principle
Public IP Addresses
A public IP address is globally unique and routable on the public internet. It is allocated by an RIR and registered in IANA's global database (WHOIS). Every internet router has a route to every public IP prefix — any packet with a public destination can theoretically be delivered anywhere on Earth.
NAT: Address Translation at the Network Boundary
NAT (Network Address Translation) translates IP addresses at the boundary between a private network and the public internet. When a host with private IP 192.168.1.50 sends a packet to the internet, the NAT device (home router, enterprise firewall) replaces the source IP with the public IP. When the reply arrives, NAT replaces the destination IP (public) with the original private IP and forwards it internally.
Simple NAT (one-to-one) maps one private IP to one public IP. Rare — wastes public addresses. More common: PAT (Port Address Translation), also called NAPT — the NAT device distinguishes multiple simultaneous sessions from different private hosts by also mapping unique source port numbers. One public IP can support ~65,000 simultaneous sessions (the port space) from potentially thousands of private hosts.
NAT Breaks the End-to-End Principle
The internet's original design principle (RFC 1958) was end-to-end: any host can communicate directly with any other host without intermediary state. NAT violates this: a host behind NAT cannot receive unsolicited inbound connections unless an explicit port forwarding rule exists on the NAT device. There is no NAT state entry to match an inbound packet from an unknown external host.
Applications requiring inbound connections (hosting a web server, running a game server, accepting peer-to-peer connections) require explicit port forwarding configuration on the NAT device. Modern applications use NAT traversal techniques to establish peer-to-peer connections despite NAT: STUN (Session Traversal Utilities for NAT) to discover the external IP/port; TURN (Traversal Using Relays around NAT) to relay traffic through a server when STUN fails; ICE (Interactive Connectivity Establishment) to try multiple traversal paths simultaneously. WebRTC (browser video/audio) uses ICE+STUN+TURN to establish peer connections through NAT.
Static NAT vs. Dynamic NAT vs. PAT
Static NAT: One private IP permanently maps to one public IP. All traffic to the public IP is forwarded to the private IP. Used for internal servers that must be reachable from the internet (web server, VPN gateway). Requires one public IP per server.
Dynamic NAT: A pool of public IPs is shared among private hosts. When a host initiates outbound traffic, it is assigned an available public IP from the pool. When the session ends, the public IP returns to the pool. Limited by pool size — if more concurrent sessions than pool IPs, new connections fail.
PAT (Port Address Translation): Overloads one public IP using port numbers to distinguish sessions. The standard mode for home routers and most enterprise NAT. Provides ~65,000 port slots per public IP — effectively unlimited for most practical use.
// CHAPTER 08
Unicast, Broadcast, Multicast, and Anycast
The four delivery modes of IPv4 — and when to use each
Unicast
Unicast identifies a single interface. A packet sent to a unicast address is delivered to exactly one destination. Every host-to-host TCP connection, every DNS query to a specific server, every HTTP request — all unicast. This is the default and most common addressing mode in IPv4.
Broadcast
IPv4 has two broadcast types. Limited broadcast (255.255.255.255) is sent to all hosts on the local subnet — routers never forward it. Used by DHCP Discover (client doesn't know the DHCP server's IP yet), and Wake-on-LAN. Directed broadcast targets all hosts on a specific remote subnet: the network address with all host bits set to 1 (e.g., the directed broadcast for 192.168.1.0/24 is 192.168.1.255). Routers by default do not forward directed broadcasts (RFC 2644) — they were exploited in the Smurf DDoS amplification attack of the late 1990s where a spoofed source IP could trigger thousands of hosts to send ICMP replies to the victim.
Multicast
Multicast (224.0.0.0/4, Class D) delivers one packet to a subscribed group of receivers simultaneously. This is far more efficient than unicast for one-to-many delivery: a 1 Gbps video stream multicast to 1,000 receivers uses 1 Gbps of network bandwidth regardless of group size. The same stream via unicast would require 1 Tbps.
IGMP (Internet Group Management Protocol) manages multicast group membership at the host level — hosts send IGMP Join/Leave messages to subscribe to or unsubscribe from multicast groups. Switches use IGMP snooping to avoid flooding multicast to all ports. PIM (Protocol Independent Multicast) handles multicast routing between routers — PIM-SM (Sparse Mode) for wide-area multicast, PIM-DM (Dense Mode) for local multicast.
Anycast
Anycast assigns the same IP address to multiple nodes in geographically distributed locations. Routers receive route advertisements for the same prefix from multiple locations. BGP's shortest-path selection naturally routes packets to the topologically nearest instance. If that instance fails, BGP reconverges and the next-nearest instance handles traffic.
Anycast is the technology behind global DNS infrastructure and CDNs. Cloudflare's 1.1.1.1 DNS resolver runs on servers in 300+ cities worldwide — all announcing the same IP via BGP. A DNS query from Tokyo reaches a Tokyo server; from London, a London server. Anycast is not explicitly "configured" in IPv4 — it emerges from BGP's normal behavior when multiple locations announce the same prefix.
🌍 DNS Root Servers Run on 13 Anycast Addresses
// CHAPTER 09
Static vs. Dynamic IP Assignment
Manual configuration, DHCP, DORA handshake, and DHCP reservations
Static IP Configuration
A statically assigned IP is manually configured and does not change unless an administrator changes it. Required parameters: IP address, subnet mask, default gateway, DNS server(s). Static IPs are used for: servers (DNS A records point to static IPs — a changing server IP breaks DNS), network infrastructure (routers, managed switches, APs have predictable management IPs), printers, IP phones, and any device that other systems need to reach at a consistent address.
Risk: IP address conflicts. If two devices are manually assigned the same IP, both will observe conflicting ARP replies and enter an error state. Linux prints kernel warning "ARPHRD: 2 conflict detected" and usually keeps the IP. Windows shows a notification and may disable the adapter. The original holder and the conflict both experience intermittent connectivity. Prevention: use IPAM tools to track all static assignments.
DHCP: The DORA Process
DHCP (Dynamic Host Configuration Protocol) automates IP assignment. The four-step negotiation is called DORA:
Why does the Request broadcast (step 3) go to all servers, not just the one that made the Offer? Multiple DHCP servers may have sent Offers. The broadcast informs all servers which one was chosen — servers that were not chosen release their tentative offer back to their available pool.
DHCP Lease Renewal
DHCP leases are time-limited. At T1 (50% of lease duration), the client sends a unicast DHCP Request to its original server, asking to renew. If no response, at T2 (87.5% of lease duration), the client broadcasts a DHCP Request to any available server. If the lease expires with no renewal, the IP is released and the client must restart the DORA process from scratch.
DHCP Options (Beyond Just an IP)
DHCP delivers much more than just an IP address. Option 3 = default gateway. Option 6 = DNS server IPs. Option 15 = domain name (appended to unqualified hostnames for resolution). Option 43 = vendor-specific information (used by VoIP phones to locate provisioning server). Option 66 = TFTP server (for PXE boot and network booting). Option 150 = TFTP server IP for Cisco IP phones. Option 121 (classless static routes) = additional routes beyond the default gateway. Enterprise DHCP servers deliver network-specific configurations to different client types using these options.
DHCP Reservations vs. Static Addresses
A DHCP reservation (static DHCP binding) assigns a specific IP to a device based on its MAC address. The device still uses DHCP — it sends DORA, but the server always offers the same reserved IP. Benefits: the device IP is predictable (for DNS records, firewall rules, IPAM tracking) without manually configuring the device itself. Best practice for printers, IP cameras, APs, VoIP phones, and any infrastructure device that needs a consistent address.
// CHAPTER 10
IP Address Planning and IPAM
Hierarchical allocation, subnet sizing, and managing thousands of addresses
// REAL-WORLD SCENARIO
Hierarchical Allocation Principles
Assign a large block at the organizational root and carve subnets downward. Example: start with 10.0.0.0/8 for the entire organization. Assign each geographic site a /16: Site-NY = 10.1.0.0/16, Site-LA = 10.2.0.0/16, Cloud = 10.10.0.0/16. Within each site, assign functional VLANs from the site's /16: servers = .1.0/24, workstations = .2.0/23, management = .3.0/28, VoIP = .4.0/24. This hierarchy enables route summarization at every level — Site-NY is summarized as 10.1.0.0/16 in the WAN routing table, hiding 256 potential /24s behind one route entry.
Subnet Sizing Guidelines
Size subnets for expected maximum population plus 30% growth headroom. Never create subnets that are already 80%+ utilized at deployment — DHCP scope exhaustion causes outages. Standard sizing by role:
IPAM: IP Address Management
Beyond ~50 subnets, managing IP allocations in a spreadsheet is a liability. IPAM (IP Address Management) tools provide: a visual tree of your address space showing allocations and free space; DHCP scope management integrated with physical DHCP servers (ISC DHCP, Windows DHCP, Infoblox); DNS record management integrated with IP assignments; conflict detection and automatic alerting; utilization trending (when will a subnet fill up?); change history and audit trail. Open-source: phpIPAM, Netbox (also manages rack diagrams, cabling, and device inventory). Enterprise: Infoblox, BlueCat, SolarWinds IPAM.
// CHAPTER 11
Longest Prefix Match and IP Routing
How routers use IP addresses to forward packets — the heart of the internet
IP addressing and routing are inseparable — the hierarchical structure of IP addresses exists specifically to make routing efficient. Every IPv4 forwarding decision is a lookup: given the destination IP, which routing table entry is the best match?
Longest Prefix Match (LPM)
When a router's routing table has multiple entries that all match a destination IP, it selects the entry with the longest (most specific) prefix. A /32 beats a /24 beats a /16 beats a /0. This is LPM (Longest Prefix Match).
The default route (0.0.0.0/0) is the "route of last resort" — it matches everything but is always the lowest-priority match because it has the shortest prefix. An explicit route always wins over the default.
TCAM: How LPM Happens in Hardware
Modern router ASICs perform LPM using TCAM (Ternary Content-Addressable Memory). Unlike regular RAM (read a specific address → get a value) or CAM (provide content → get address), TCAM allows each memory cell to store 0, 1, or X (don't care). A /24 route stored in TCAM has 24 specific bits followed by 8 don't-cares. A /0 default route is all don't-cares. Hardware queries all TCAM entries simultaneously by broadcasting the destination IP to every entry — a massively parallel comparison that produces the matching entry with the longest prefix in nanoseconds, regardless of table size.
Route Summarization and Address Planning
Route summarization reduces the routing table by advertising one aggregate prefix instead of many specific ones. If Site-NY has subnets 10.1.1.0/24 through 10.1.254.0/24, the WAN edge router can advertise just 10.1.0.0/16 to other sites and the internet — 254 internal routes become 1. Downstream routers never learn about internal topology.
Summarization breaks when address space is non-contiguous. If Site-NY also has 10.5.100.0/24 (outside the 10.1.0.0/16 block), that subnet cannot be summarized with the others and requires a separate routing entry. This is why disorganized addressing plans with random subnet assignments prevent effective aggregation — and bloat routing tables.
// CHAPTER 12
Troubleshooting IP Addressing Issues
Diagnostic tools, systematic approach, and common failure modes
Systematic Troubleshooting Flow
Start at Layer 3 and work outward. Check if the device has a valid IP (not 169.254.x.x). Verify the subnet mask is correct (wrong mask = wrong "local" determination). Verify the default gateway is configured and on the same subnet. Ping the gateway (LAN reachability). Ping a known internet IP (8.8.8.8) to test routing. Ping by hostname (google.com) to test DNS. Each step isolates a specific potential failure.
Common IP Addressing Failure Modes
IP address conflict: Two devices have the same IP. Symptoms: intermittent connectivity, ARP instability, "duplicate IP address" messages in OS logs. Diagnosis: arping -I eth0 192.168.x.x sends ARP probes — if you see two different MAC addresses respond, there is a conflict. Check both static assignments and DHCP scope for duplicate entries.
Wrong subnet mask: A device with 192.168.1.50 and mask /23 (255.255.254.0) considers both 192.168.0.x and 192.168.1.x as local. If the network uses /24, the device will ARP for hosts that aren't on the local segment, fail to route through the gateway for them, and experience failures. Diagnosis: compare the subnet mask with other devices on the same segment.
Wrong or missing default gateway: The device can reach hosts on its own subnet (Layer 2 via MAC) but fails to reach any other subnet or the internet. The "default gateway not configured" or wrong gateway error is immediately visible with ip route show — there should be a 0.0.0.0/0 route.
APIPA (169.254.x.x): DHCP acquisition failed. Escalation checklist: Is the DHCP server running? (systemctl status dhcpd or check Windows DHCP service.) Is the DHCP scope exhausted? (check DHCP server lease count vs. pool size.) Is the device in the correct VLAN? (wrong VLAN = wrong DHCP scope.) Is a DHCP relay agent configured? (devices on different subnets from the DHCP server need ip helper-address on the gateway router.) Is there a rogue DHCP server? (tcpdump -i eth0 port 67 or port 68 to observe DHCP traffic.)
Asymmetric routing: Packets take different paths inbound vs. outbound. A stateful firewall that sees only one direction drops the connection. Common in multihomed networks with multiple ISPs. Diagnosis: traceroute from each side to identify asymmetry; fix with policy routing or asymmetric routing exceptions on the firewall.
// CHAPTER 13
Common Misconceptions
IP addressing errors that cost engineers hours of troubleshooting
✗ Common Mistake — IP addresses are permanent like MAC addresses
✗ Common Mistake — NAT is a security mechanism
✗ Common Mistake — Private IPs cannot be routed at all
✗ Common Mistake — The broadcast address wastes two IP addresses unnecessarily
✗ Common Mistake — 127.0.0.1 and localhost are always identical
getaddrinfo("localhost") may return ::1 (IPv6 loopback) first. If a service binds only to 127.0.0.1 but your application resolves "localhost" to ::1, the connection fails even though the service is running. This causes mysterious connection-refused errors. Fix: bind services to both 127.0.0.1 and ::1, or use 0.0.0.0 (all IPv4 interfaces). In /etc/hosts, verify localhost resolves to both 127.0.0.1 and ::1.✗ Common Mistake — Classful address ranges still matter in modern networking
// CHAPTER 14
Interview Questions
Beginner through PhD — what to actually know for networking interviews
🎯 Key Takeaways
- ✓IPv4 addresses are 32 bits in dotted-decimal notation — the hierarchy of network + host portions enables routing aggregation, keeping the global routing table at ~900K entries instead of billions.
- ✓CIDR replaced classful addressing in 1993, allowing any prefix length /0–/32. A /24 has 8 host bits (254 usable hosts); bitwise AND with the subnet mask gives the network address.
- ✓RFC 1918 private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) are never routed on the public internet — NAT translates private-to-public at the boundary.
- ✓The IPv4 header carries TTL (decremented each hop, prevents loops), Protocol (1=ICMP, 6=TCP, 17=UDP, 89=OSPF), DSCP (QoS markings), and fragmentation fields.
- ✓NAT is address translation, not security — it enables private-address hosts to share public IPs but breaks end-to-end connectivity and requires STUN/TURN/ICE for peer-to-peer.
- ✓DHCP delivers IPs via the DORA process (Discover→Offer→Request→Acknowledge). DHCP reservations bind a specific IP to a MAC address for predictable addressing without manual config.
- ✓Longest Prefix Match (LPM): a router always uses the most specific matching route — a /32 host route overrides a /24 network route overrides the /0 default. Implemented in TCAM hardware.
- ✓Seeing 169.254.x.x (APIPA) means DHCP failed — check DHCP server availability, scope exhaustion, VLAN assignment, and relay agent configuration.
- ✓CGNAT (RFC 6598, 100.64.0.0/10) is the ISP-level NAT extending IPv4 lifetime — it breaks port forwarding, P2P applications, and inbound server hosting.
- ✓IANA exhausted IPv4 in February 2011; IPv6 (128-bit, 2^128 addresses) is the long-term solution — ~50% of Google traffic is IPv6 as of 2024, but full IPv4 sunset is decades away.
Discussion
0Have a better approach? Found something outdated? Share it — your knowledge helps everyone learning here.