IP Addresses and Subnetting

Every packet traveling the internet carries two key pieces of information: where it came from and where it's going. Those locations are IP addresses. Understanding how addressing works — and how large address blocks are carved into smaller networks — is foundational knowledge for anyone building or operating networked systems.

IPv4

IPv4 is the original internet addressing scheme, introduced in the 1980s. An IPv4 address is a 32-bit number written as four decimal groups separated by dots: 192.168.1.42. Each group — called an octet — represents 8 bits and can hold a value from 0 to 255.

192   .   168   .   1   .   42
11000000  10101000  00000001  00101010   ← binary

32 bits gives you 2³² possible addresses — about 4.3 billion. That sounds like a lot, but the internet has more connected devices than that. We deal with the shortage through NAT and IPv6 (both covered below).

IPv6

IPv6 was designed to solve IPv4 exhaustion. It uses 128-bit addresses, written as eight groups of four hexadecimal digits:

2001:0db8:85a3:0000:0000:8a2e:0370:7334

Leading zeros in each group can be omitted, and consecutive all-zero groups can be collapsed to :::

2001:db8:85a3::8a2e:370:7334

128 bits gives you 2¹²⁸ addresses — 340 undecillion. Every device on earth could have billions of unique addresses and you'd barely make a dent. IPv6 adoption has been slow but is accelerating: as of 2024, around 40% of Google traffic is served over IPv6.

Public vs Private IP

Not all IP addresses are equal. There are two categories:

Public IPs are globally routable — every router on the internet knows how to forward packets to them. Your ISP assigns you one (or a small block) when you connect. Public IPs are allocated by regional registries (ARIN, RIPE, etc.) and are globally unique.

Private IPs are reserved for use inside networks and are not routable on the public internet. The three private ranges are:

Range	Addresses	Common use
10.0.0.0/8	16.7 million	Corporate networks, cloud VPCs
172.16.0.0/12	1 million	Medium-sized networks
192.168.0.0/16	65,536	Home and small office networks

When you look at your laptop's IP address at home, you'll typically see something like 192.168.1.105. That address means nothing outside your home network — your router is the device with a public IP.

NAT

NAT — Network Address Translation — is how a single public IP can serve an entire household or office of devices. Your router sits between your private network and the internet. It maintains a translation table that maps internal IP:port combinations to external port numbers on its single public IP.

When your laptop at 192.168.1.10 makes a request to a web server, your router:

1. Records: internal 192.168.1.10:54321 maps to external port 43210 on public IP 203.0.113.5
2. Rewrites the packet: source becomes 203.0.113.5:43210
3. Sends it to the internet

When the response comes back addressed to 203.0.113.5:43210, the router looks up its table and forwards it to 192.168.1.10:54321. The web server never knows your private IP existed.

NAT is why the internet hasn't collapsed under IPv4 exhaustion. A building with 500 employees can share a handful of public IPs. It's not elegant — NAT breaks end-to-end connectivity and complicates peer-to-peer applications — but it's kept IPv4 functional for decades longer than anyone expected.

Subnetting

Subnetting is dividing a network into smaller networks. You take a block of addresses and split it into logical groups, each acting as an independent network.

Why bother? A few reasons:

• Security isolation — traffic between subnets can be inspected and filtered by firewalls or security groups
• Broadcast containment — broadcasts only reach devices in the same subnet, not the whole network
• Organisation — separate subnets for web servers, databases, and internal services keeps things manageable
• Routing efficiency — routers can aggregate subnet routes, reducing table sizes

The key tool is the subnet mask, which defines which bits of an IP address represent the network and which represent individual hosts within that network.

CIDR Notation

CIDR (Classless Inter-Domain Routing) notation expresses a network as address/prefix-length. The prefix length is how many bits identify the network portion.

192.168.1.0/24
          ↑
          24 bits for network, 8 bits for hosts
          → 256 total addresses, 254 usable (.0 is network address, .255 is broadcast)

Common CIDR blocks and what they give you:

CIDR	Addresses	Usable hosts	Common use
/8	16.7M	16.7M	Large ISP or org allocation
/16	65,536	65,534	Corporate networks
/24	256	254	Typical office or VPC subnet
/28	16	14	Small subnet, firewall DMZ
/32	1	1 (itself)	Single host route

The math: a /n prefix means 2^(32-n) total addresses. A /24 has 2^8 = 256. A /28 has 2^4 = 16. Subtract 2 (network and broadcast addresses) for usable host count.

To check whether two IPs are in the same subnet: apply the subnet mask to both IPs using a bitwise AND. If the results match, they're on the same network.

192.168.1.42  AND  255.255.255.0  =  192.168.1.0  ← network address
192.168.1.99  AND  255.255.255.0  =  192.168.1.0  ← same network ✓
192.168.2.1   AND  255.255.255.0  =  192.168.2.0  ← different network ✗

Why Subnetting Matters for System Design

When you deploy infrastructure in a cloud environment, subnetting isn't optional — it's how you architect security and access control. Every cloud VPC (Virtual Private Cloud) is a network you define using CIDR blocks, then subdivided into subnets.

The standard pattern:

• Public subnet — has a route to the internet gateway. Put load balancers and NAT gateways here. Don't put databases here.
• Private subnet — no direct route to the internet. Put application servers and internal services here. They can initiate outbound connections via the NAT gateway in the public subnet.
• Isolated subnet — no internet access at all, even outbound. Put databases here.

Traffic between subnets is controlled by security groups (per-instance firewall rules) and network ACLs (subnet-level stateless rules). The subnet boundary is where you enforce "the database can only be reached by the application servers, not directly from the internet."

Consider a typical AWS setup. You create a VPC at 10.0.0.0/16 — 65,536 addresses. Then you carve it:

Subnet	CIDR	Purpose
public-1a	10.0.1.0/24	ALB, NAT gateway
public-1b	10.0.2.0/24	ALB (multi-AZ)
private-1a	10.0.10.0/24	EC2 app servers
private-1b	10.0.11.0/24	EC2 app servers (multi-AZ)
isolated-1a	10.0.20.0/24	RDS primary
isolated-1b	10.0.21.0/24	RDS replica

The ALB accepts internet traffic and forwards to app servers in the private subnet. App servers query the RDS instance in the isolated subnet. RDS can't reach the internet and can't be reached from it — the subnet boundary enforces this at the network level, separate from application-level security.

This pattern — public/private/isolated — shows up in almost every production cloud deployment. Understanding subnetting makes it obvious why the architecture is structured this way and what each boundary is protecting.

Key Takeaways

• IPv4 addresses are 32-bit numbers written as four octets (0–255 each), giving about 4.3 billion unique addresses
• IPv6 uses 128-bit addresses and provides effectively unlimited address space — but adoption has been gradual
• Private IP ranges (10.x, 172.16.x, 192.168.x) are non-routable and used inside local networks
• NAT lets many devices share one public IP by tracking port mappings at the router
• Subnetting divides a network into smaller segments for security isolation, traffic control, and organisation
• CIDR notation (/24, /16, etc.) expresses how many bits identify the network vs host portion
• Cloud VPC design always involves subnets — public for load balancers, private for servers, isolated for databases

Next up: how domain names get translated to IP addresses — DNS Deep Dive.