4.9.4.3–4.9.4.6 - IP addresses, subnets and IPv6

Network and host identifiers

An IP address contains a network identifier and a host identifier, and the boundary depends on the network prefix.

The network identifier identifies the network or subnet to which an interface belongs. The host identifier distinguishes an interface within that network. Routing can use the network prefix rather than keeping a separate Internet-wide route for every host. An address is assigned to a network interface; a computer with several interfaces can have several addresses.

An IPv4 address has 32 bits, commonly written as four decimal octets. Each octet represents eight bits and ranges from 0 to 255. In 192.168.12.37/24, the /24 says that the first 24 bits are the network prefix. Here the network is 192.168.12.0/24, and the final eight bits provide the host identifier. Another interface 192.168.12.90/24 has the same network identifier but a different host identifier.

The dotted decimal punctuation does not always mark the network/host boundary. With /26, the first 26 bits identify the subnet: two bits from the final octet join the first three octets. Do not infer the boundary merely by saying “the last number is the host”. The prefix/mask must be known.

Administrators can put departments in separate subnets. This makes their address organisation and routing manageable; controlling access between them also requires suitable router/firewall rules. Subnetting alone does not encrypt traffic.

Finding a subnet with a mask

A subnet mask identifies the network bits by placing a 1 in each network position and a 0 in each host position.

IPv4 masks use contiguous 1 bits followed by 0 bits. The mask 255.255.255.0 is /24; 255.255.255.192 is /26, because 192 is binary 11000000. Applying bitwise AND to the address and mask keeps each network bit and clears each host bit.

Consider 192.168.12.77 with mask 255.255.255.192. The first three octets remain unchanged because AND with eight 1 bits preserves them. Work on the last octet:

The network address is therefore 192.168.12.64/26. Six host bits remain, so the subnet spans final-octet values 64–127. In a conventional IPv4 subnet, 64 is the network address and 127 is its broadcast address; ordinary host addresses are 65–126. This illustration has 62 usable host addresses. The customary network/broadcast exclusion is not a universal rule for every specialised prefix, so use the conditions supplied in a task.

To decide whether another address is in the same subnet, apply the same mask to it and compare the network results. 192.168.12.100/26 also gives .64, whereas 192.168.12.140/26 gives .128. A local host uses its mask to decide whether to deliver on the local network or send towards a router/default gateway. Two different network identifiers require routing between the subnets.

IPv4 and IPv6 address space

IPv6 was introduced chiefly because growth in connected devices put pressure on the limited IPv4 address space.

IPv4 uses 32-bit addresses, giving $2^{32}$ possible bit patterns, approximately 4.3 billion. Not all are available as public host addresses: some are reserved for private networks or special purposes. Rapid Internet growth meant there were too few publicly usable addresses for every interface to receive its own unique IPv4 address. Sharing addresses through NAT helps extend IPv4 use, but does not enlarge its address space.

IPv6 uses 128-bit addresses, giving $2^{128}$ patterns, a vastly larger address space. An IPv6 address is normally written in eight groups of hexadecimal digits separated by colons, for example 2001:db8:12:0:0:0:0:5. Leading zeros in a group may be omitted and a single consecutive run of all-zero groups may be compressed using ::, giving 2001:db8:12::5 here. These are two textual forms of the same address. 2001:db8::/32 is reserved for documentation, so this is an example rather than a live public destination.

IPv6 also has network prefixes and host/interface-identifying bits. A much larger address space permits many more globally unique addresses and reduces the address-conservation reason for NAT. It does not mean every IPv6 address is globally routable, that every IPv4 device automatically understands IPv6, or that firewalls and authentication become unnecessary. Both standards coexist during transition.

Routable and non-routable addresses

An address can be valid inside a local network without being a destination that public Internet routers will forward to.

For this distinction, a routable public address is a globally allocated address intended for routing on the public Internet. It identifies its destination without relying on a private organisation's address choices. Actual access still depends on routes, connectivity and security rules: “publicly routable” does not mean “every service is accessible”.

Private IPv4 addresses are intended for internal networks and are not routed as destinations across the public Internet. The standard private blocks are:

Different organisations may reuse these ranges. Two schools can each have a host 192.168.1.20; that address alone cannot identify which school's host an Internet packet should reach. Private addresses can be routed between internal subnets by an organisation's routers, so “non-routable” here means non-routable on the public Internet, not incapable of any routing.

NAT can translate a private host's traffic to use a public address at a gateway; the private address does not thereby become publicly allocated. Other special addresses, including loopback and link-local addresses, also have restricted scope. Do not classify every address outside the three private blocks as a usable public destination.