IPv4: 32 Bits, Networks and Hosts

An IPv4 address is a 32-bit unsigned integer. 192.168.1.42 is the four bytes C0 A8 01 2A, each written in decimal and separated by dots — a notation chosen for humans in 1981 that has confused them ever since, because the dots have no structural meaning. The boundary between "network" and "host" is not at a dot; it is wherever the mask says.

The subnet mask is a second 32-bit number with ones on the left and zeros on the right: 255.255.255.0 is 24 ones then 8 zeros. AND the address with the mask and you get the network address (192.168.1.0); the remaining bits are the host part (.42). CIDR notation writes the mask as a count of ones: 192.168.1.42/24. Routers think entirely in prefixes: a routing table entry is a prefix and a length, and forwarding is "find the entry with the longest prefix that matches this destination". A /24 covers 256 addresses; a /16 covers 65,536; a /8 covers 16.7 million; /32 is one host; /0 is everything (the default route).

A host uses its own address and mask for exactly one routing decision: is the destination in my network? AND the destination with my mask; if it equals my network address, the destination is on-link — resolve its MAC directly and send. If not, send to the default gateway (the router on my network) and let it worry. 10.0.0.7 from 192.168.1.42/24 is off-link; 192.168.1.200 is on-link. Two hosts on the same cable with masks that disagree can each think the other is off-link and try to route through a gateway that sees no need — a classic misconfiguration.

The two addresses at the ends of every subnet are reserved. Host bits all zero is the network address, naming the subnet itself in routing tables. Host bits all one is the directed broadcast for that subnet (192.168.1.255); 255.255.255.255 is the limited broadcast that never leaves the segment, used by DHCP discovery before a host has any address. Hence the arithmetic every interviewer expects: a /24 has 256 addresses and 254 usable. See Subnetting: Splitting an Address Space.

Not all of the 2^32 space is routable on the internet. RFC 1918 private ranges — 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 — may be used by anyone inside their own network and are never routed publicly; every home network is 192.168.x.x or 10.x.x.x, and so is every corporate LAN and every cloud VPC. Because millions of networks reuse the same addresses, a packet with a private source cannot be replied to across the internet: something at the edge must rewrite it to a public address — that something is NAT, and private addressing is the reason it exists. Cloud VPCs are the same idea: 10.0.0.0/16 per VPC, NAT gateways at the edge, and peering that fails when two VPCs chose the same range.

127.0.0.0/8 is loopback: packets to 127.0.0.1 (or any 127.x) never reach a NIC; the kernel delivers them to itself. localhost resolves here. 169.254.0.0/16 is link-local: a host that asked DHCP and got no answer picks a random address in it, usable only on the local segment — seeing one is the diagnosis "DHCP failed". 100.64.0.0/10 is the shared address space for carrier-grade NAT, so ISPs can number customers without colliding with their home 10.x networks. 224.0.0.0/4 is multicast. 0.0.0.0 means "any address" when binding a socket and "no address yet" as a source. And three /24s — 192.0.2.0, 198.51.100.0, 203.0.113.0 — are reserved for documentation, which is why they appear throughout these lessons and never on the wire.

Four billion addresses sounded infinite in 1981. Early allocation was by class: class A gave 16 million addresses to one organisation, class B 65,536, class C 256, with nothing in between — so a university with 300 hosts took a class B and wasted 65,000. CIDR (1993) replaced classes with arbitrary prefix lengths and let routes aggregate, which bought twenty years. Private addressing plus NAT bought more, by letting a whole household or company sit behind one public address. IANA handed out its last /8 blocks in February 2011; the regional registries ran out one by one, RIPE (Europe) in November 2019. Today public IPv4 addresses are bought and leased on a market at tens of dollars each, cloud providers charge for every public IPv4 address, and most residential users are behind carrier-grade NAT.

The structural cost is not just scarcity. NAT breaks the end-to-end model: a host behind it cannot be connected to without help, which is why peer-to-peer, VoIP, gaming and WebRTC all carry NAT-traversal machinery, and why the "everyone is a server" internet did not happen on IPv4. The fix is a bigger address space with the end-to-end model restored — see IPv6: Not Just Bigger Addresses — and the reason it took so long is that NAT made IPv4 *work well enough* for the client–server web.