Skip to content
Book a call
Menu

Networking8 min read

IPv4

32-bit addressing, subnetting, and the protocol that built the internet

IPv4 Address Notation

An IPv4 address is a 32-bit number, written as four octets in dotted-decimal notation. Each octet is 8 bits (0-255).

Binary ↔ Decimal Conversion

Dotted Decimal Binary (each octet) Full 32-bit Binary
192.168.1.10 11000000 . 10101000 . 00000001 . 00001010 11000000101010000000000100001010
10.0.0.1 00001010 . 00000000 . 00000000 . 00000001 00001010000000000000000000000001
255.255.255.0 11111111 . 11111111 . 11111111 . 00000000 11111111111111111111111100000000

Octet-to-Binary Quick Reference

Each bit position has a power-of-2 value. Sum the "on" bits to get the decimal value:

Bit position 76543210
Value 1286432168421
Example: 192 11000000
Example: 168 10101000

192 = 128 + 64  |  168 = 128 + 32 + 8

Network/Host Split: Subnet Masks & CIDR

Every IPv4 address has two parts: network portion (identifies the subnet) and host portion (identifies the device within the subnet). The subnet mask defines where the split happens.

Subnet Mask Notation

Dotted decimal: 255.255.255.0

All network bits = 1, all host bits = 0

bash
11111111.11111111.11111111.00000000
|-------- network --------|-host--|
CIDR Notation

Prefix length: /24

The number after the slash = count of network bits

bash
192.168.1.0/24
= 24 bits for network, 8 bits for hosts
= 2^8 - 2 = 254 usable hosts

Common Subnet Masks

CIDR Subnet Mask Network Bits Host Bits Total Addresses Usable Hosts
/8 255.0.0.0 8 24 16,777,216 16,777,214
/16 255.255.0.0 16 16 65,536 65,534
/24 255.255.255.0 24 8 256 254
/25 255.255.255.128 25 7 128 126
/26 255.255.255.192 26 6 64 62
/27 255.255.255.224 27 5 32 30
/28 255.255.255.240 28 4 16 14
/30 255.255.255.252 30 2 4 2
/32 255.255.255.255 32 0 1 1 (host route)

Note

Why "-2" for usable hosts? Every subnet reserves the first address (all host bits = 0) as the network address and the last address (all host bits = 1) as the broadcast address. Neither can be assigned to a host.

Subnetting by Hand

Task: Split 192.168.1.0/24 into four /26 subnets.

Step 1 — Determine the new prefix length

We need 4 subnets. 2n >= 4, so n = 2. Borrow 2 bits from the host portion:

bash
Original:  /24 = 24 network bits + 8 host bits
New:       /26 = 24 + 2 network bits + 6 host bits

Each /26 subnet: 2^6 = 64 addresses, 62 usable hosts

Step 2 — Calculate subnet boundaries

Block size = 2host bits = 26 = 64. Subnets start at multiples of 64 in the last octet:

Subnet # Network Address First Usable Last Usable Broadcast
1 192.168.1.0/26 192.168.1.1 192.168.1.62 192.168.1.63
2 192.168.1.64/26 192.168.1.65 192.168.1.126 192.168.1.127
3 192.168.1.128/26 192.168.1.129 192.168.1.190 192.168.1.191
4 192.168.1.192/26 192.168.1.193 192.168.1.254 192.168.1.255

Step 3 — Verify in binary

bash
192.168.1.0   = 11000000.10101000.00000001.00|000000  (subnet bits = 00)
192.168.1.64  = 11000000.10101000.00000001.01|000000  (subnet bits = 01)
192.168.1.128 = 11000000.10101000.00000001.10|000000  (subnet bits = 10)
192.168.1.192 = 11000000.10101000.00000001.11|000000  (subnet bits = 11)
                                            ^^
                         2 borrowed bits → 4 subnets

Supernetting / CIDR Aggregation

The reverse of subnetting: combine contiguous smaller networks into a larger summary route. Essential for reducing routing table size.

Example: Aggregate four /24s into one /22

bash
10.1.0.0/24   = 00001010.00000001.00000000.00000000
10.1.1.0/24   = 00001010.00000001.00000001.00000000
10.1.2.0/24   = 00001010.00000001.00000010.00000000
10.1.3.0/24   = 00001010.00000001.00000011.00000000
                                  ^^^^^^
                 First 22 bits are identical → 10.1.0.0/22

One /22 summary route replaces four /24 routing entries.

Note

Aggregation requirement: The networks must be contiguous and aligned to a power-of-2 boundary. You cannot aggregate 10.1.1.0/24 + 10.1.2.0/24 + 10.1.3.0/24 + 10.1.4.0/24 into a single /22 because they don't share the same first 22 bits.

Private Address Ranges (RFC 1918)

These ranges are not routable on the public internet. Reserved for internal networks. NAT translates them to public addresses at the network edge.

Range CIDR Total Addresses Typical Use
10.0.0.0 — 10.255.255.255 10.0.0.0/8 16,777,216 Large enterprises, cloud VPCs (AWS default VPC uses 172.31.0.0/16, but custom VPCs often use 10.x)
172.16.0.0 — 172.31.255.255 172.16.0.0/12 1,048,576 Docker default bridge (172.17.0.0/16), K8s pod CIDRs
192.168.0.0 — 192.168.255.255 192.168.0.0/16 65,536 Home routers, small labs, kind clusters

Tip

K8s note: In a typical cluster, pod CIDR (e.g., 10.244.0.0/16 for Flannel) and service CIDR (e.g., 10.96.0.0/12) are carved from RFC 1918 space. Calico, Cilium, and other CNIs let you customize these.

Special Addresses

Address / Range Purpose Details
127.0.0.0/8 Loopback Traffic never leaves the host. 127.0.0.1 is "localhost". The entire /8 is reserved, but only .1 is typically used. Packets sent here are routed internally by the kernel's loopback interface (lo).
169.254.0.0/16 Link-local (APIPA) Auto-assigned when DHCP fails. Not routable. Also used by AWS for instance metadata (169.254.169.254) and by K8s node-local DNS cache.
0.0.0.0 Unspecified / default route As a source: "I don't have an address yet" (DHCP discover). As a route destination: the default route (0.0.0.0/0). As a listen address: bind to all interfaces.
255.255.255.255 Limited broadcast Broadcast to all hosts on the local network segment. Not forwarded by routers. Used by DHCP.
100.64.0.0/10 Carrier-grade NAT (CGN) RFC 6598. Shared address space for ISP-level NAT. Also used by some overlay networks (Tailscale uses 100.x.y.z).

IPv4 Header Format

The IPv4 header is 20 bytes minimum (without options). Every field matters for routing, fragmentation, and protocol demuxing.

Version 4 bits
IHL 4 bits
DSCP 6 bits
ECN 2 bits
Total Length 16 bits
Identification 16 bits
Flags 3 bits
Fragment Offset 13 bits
TTL 8 bits
Protocol 8 bits
Header Checksum 16 bits
Source IP Address 32 bits
Destination IP Address 32 bits
Options (if IHL > 5) Variable, 0-40 bytes

Key Header Fields Explained

Field Purpose
Version Always 4 for IPv4. Tells the router which header format to parse.
IHL (Internet Header Length) Header length in 32-bit words. Minimum = 5 (20 bytes). If options present, can be up to 15 (60 bytes).
DSCP (Differentiated Services) QoS marking. Used by routers to prioritize traffic (e.g., EF for VoIP, AF for streaming).
Total Length Entire packet size (header + payload) in bytes. Max = 65,535 bytes.
Identification + Flags + Fragment Offset Used for IP fragmentation and reassembly (see below).
TTL (Time to Live) Hop counter. Decremented by each router. Packet discarded when TTL = 0. Prevents routing loops.
Protocol Identifies the encapsulated upper-layer protocol. Tells the OS which handler to invoke.
Header Checksum Verifies header integrity. Recomputed at every hop (because TTL changes). Removed in IPv6.

TTL: Loop Prevention & Traceroute

TTL (Time to Live) is set by the sender (typically 64 or 128) and decremented by 1 at each router hop. If TTL reaches 0, the router drops the packet and sends an ICMP Time Exceeded (Type 11) message back to the source.

  1. Sender sets TTL=64

    Packet leaves the host

  2. Router A: TTL=63

    Decrements, forwards

  3. Router B: TTL=62

    Decrements, forwards

  4. Destination

    Receives packet (TTL=62)

How traceroute works

traceroute exploits TTL to discover the path to a destination:

  1. Send a packet with TTL=1. The first router drops it and returns ICMP Time Exceeded, revealing its IP.
  2. Send a packet with TTL=2. The second router drops it and returns ICMP Time Exceeded.
  3. Repeat, incrementing TTL by 1 each time, until the packet reaches the destination (which replies with ICMP Port Unreachable for UDP-based traceroute, or Echo Reply for ICMP-based).
console
# Linux uses UDP by default, macOS also uses UDP
$ traceroute 8.8.8.8
 1  192.168.1.1    1.2 ms   1.1 ms   1.0 ms   # Your gateway
 2  10.0.0.1       5.4 ms   5.2 ms   5.3 ms   # ISP router
 3  72.14.236.1   10.1 ms  10.0 ms  10.2 ms   # Google edge
 4  8.8.8.8       10.5 ms  10.3 ms  10.4 ms   # Destination

# Use -I for ICMP-based (some firewalls block UDP)
$ traceroute -I 8.8.8.8

Tip

DevOps tip: mtr (My Traceroute) combines traceroute + ping into a continuous diagnostic. It shows per-hop packet loss and jitter — invaluable for diagnosing network issues. mtr -z shows ASN numbers too.

Fragmentation

When a packet is larger than the MTU (Maximum Transmission Unit) of the next link (typically 1500 bytes for Ethernet), the router must either fragment it or drop it.

Fragmentation Fields

Field Role
Identification (16 bits) All fragments of the same original packet share the same ID
Flags (3 bits) Bit 0: Reserved. Bit 1: DF (Don't Fragment). Bit 2: MF (More Fragments)
Fragment Offset (13 bits) Position of this fragment's data in the original packet (in 8-byte units)
Why Fragmentation Is Bad
  • If any fragment is lost, the entire packet must be retransmitted
  • Reassembly is CPU-intensive and consumes memory buffers
  • Increases latency and jitter
  • Some firewalls/NATs drop fragments (security risk: overlapping fragment attacks)
  • Fragments bypass stateful firewall port inspection
Path MTU Discovery (PMTUD)
  • Set the DF (Don't Fragment) bit on all packets
  • If a router can't forward (packet > link MTU), it drops the packet and sends ICMP Fragmentation Needed (Type 3, Code 4) back
  • The sender reduces packet size and retransmits
  • Discovers the smallest MTU across the entire path
  • All modern OSes use PMTUD by default

Warning

ICMP black hole: If a firewall blocks ICMP (including "Fragmentation Needed"), PMTUD breaks. Packets get silently dropped. This is a common cause of mysterious connectivity issues, especially with VPNs/tunnels that reduce the effective MTU. Always allow ICMP Type 3 Code 4 in your firewall rules.

Tip

K8s/tunnel note: Overlay networks (VXLAN, Geneve, WireGuard) add encapsulation headers, reducing the effective MTU. For example, VXLAN adds 50 bytes of overhead, so the inner MTU is 1450 instead of 1500. Calico VXLAN mode and Cilium both handle this — but mismatched MTU settings across nodes cause exactly the PMTUD black hole described above.

Protocol Field Values

The Protocol field in the IPv4 header tells the receiving host which transport-layer (or other) protocol is encapsulated in the payload.

Value Protocol Description
1 ICMP Internet Control Message Protocol — ping, traceroute, error messages. Not a transport protocol; operates alongside IP.
2 IGMP Internet Group Management Protocol — multicast group membership.
6 TCP Transmission Control Protocol — reliable, ordered, connection-oriented. HTTP, SSH, databases.
17 UDP User Datagram Protocol — unreliable, connectionless. DNS, DHCP, QUIC, media streaming.
41 IPv6 encapsulation IPv6 packet encapsulated inside IPv4 (6in4 tunneling).
47 GRE Generic Routing Encapsulation — tunnel protocol. Used by some VPNs and overlay networks.
50 ESP Encapsulating Security Payload — IPsec encryption.
51 AH Authentication Header — IPsec integrity/authentication (rarely used without ESP).
132 SCTP Stream Control Transmission Protocol — multi-stream, message-oriented. Used in telecom (SS7 over IP).

Note

Full list: IANA maintains the authoritative registry of IP protocol numbers at iana.org/assignments/protocol-numbers.

Solidnines — solidnines.com