IPv4 addressing

Taped inside the network cabinet door is a sheet of paper, written by whoever installed the network, that reads: 192.168.1.1 router, .2 switch, .3 and .4 access points, .10 storage, .21 and .22 tills, .31 and .32 card terminals, .41 roaster, .50 printer, everything else automatic. Jordan asks why every number starts with 192.168.1, why the router is .1, and what the 255.255.255.0 printed under it means. Answering those three questions is most of what you need to know about IPv4 addressing.

This lesson explains how IPv4 addresses are built from 32 bits, how a subnet mask or prefix length divides an address into a network part and a host part, how to find the network address, broadcast address and usable host range of any network, which address ranges are private, public or special, and how a host uses its own address, mask and default gateway to decide whether a destination is local. Python's standard ipaddress module appears throughout as a reliable calculator and checker.

Thirty-two bits in four octets

An IPv4 address is a 32-bit number. Because long binary strings are hard for people to read, it is written in dotted-decimal notation: the 32 bits are split into four 8-bit groups called octets, and each octet is written as a decimal number from 0 to 255, separated by dots. The address 192.168.1.21 is the binary number 11000000 10101000 00000001 00010101. A 32-bit field allows 2 to the power 32, about 4.3 billion, different addresses, which seemed plenty when IPv4 was designed in 1981 and has long since run out, as Lesson 6 explains.

Converting between decimal and binary is a core networking skill, used every day in subnetting. Each bit position in an octet has a value, from 128 for the leftmost bit down through 64, 32, 16, 8, 4 and 2 to 1 for the rightmost. To convert a decimal number to binary, take the largest place value that fits, write a 1, subtract it, and continue with the remainder; every place value that does not fit gets a 0. So 168 is 128 plus 32 plus 8: 10101000.

def to_binary(address):
    return '.'.join(format(int(octet), '08b') for octet in address.split('.'))

def to_int(address):
    value = 0
    for octet in address.split('.'):
        value = value * 256 + int(octet)
    return value

for a in ('192.168.1.21', '255.255.255.0', '10.20.40.1'):
    print(a.ljust(15), to_binary(a), to_int(a))

192.168.1.21    11000000.10101000.00000001.00010101 3232235797
255.255.255.0   11111111.11111111.11111111.00000000 4294967040
10.20.40.1      00001010.00010100.00101000.00000001 169093121

Treating the address as one integer, as to_int does, is how computers actually handle it, and it makes comparisons and ranges easy: an address is inside a range when its integer lies between the first and last integers of the range. Sorting a list of addresses as text gives nonsense, because 192.168.1.100 sorts before 192.168.1.21; sorting by integer gives the right order.

def to_bits(address):
    return '.'.join(bin(int(o)) for o in address.split('.'))

def from_bits(bits):
    return bits

print(to_bits('192.168.1.21'))

Network part and host part

Every IPv4 address is divided into two parts. The leftmost bits identify the network, and every device on the same network shares them. The remaining bits identify the host within that network. The dividing line is set by the subnet mask, a 32-bit value with 1s for every network bit followed by 0s for every host bit. The mask 255.255.255.0 is 24 ones followed by 8 zeros, so in 192.168.1.21 with that mask, the first three octets, 192.168.1, are the network part and the last octet, 21, is the host part.

Because a mask is always a block of 1s followed by 0s, it can be written more compactly as a prefix length: the number of 1 bits, written after a slash. 255.255.255.0 is /24, 255.255.0.0 is /16 and 255.255.255.192 is /26. This slash notation, called CIDR notation after Classless Inter-Domain Routing, is how networks are written in most configurations and documents today: 192.168.1.0/24 means the network whose first 24 bits are those of 192.168.1.0.

A host finds its network address by a bitwise AND of its address and its mask: wherever the mask has a 1 the address bit is kept, and wherever the mask has a 0 the result is 0. Two addresses are on the same network if they give the same result with the same mask. This one operation is how every computer decides whether a destination is local, a decision explored at the end of the lesson.

Network, broadcast and host addresses

Within every IPv4 network two addresses are reserved. The address with all host bits 0 is the network address, which names the network itself and is used in routing tables; it is not given to a device. The address with all host bits 1 is the broadcast address, used to send one packet to every host on the network. Everything in between is available for hosts. For 192.168.1.0/24, the network address is 192.168.1.0, the broadcast address is 192.168.1.255 and the usable hosts are 192.168.1.1 to 192.168.1.254, which is 254 addresses.

In general a network with h host bits contains 2 to the power h addresses, of which 2 to the power h minus 2 are usable. A /24 has 8 host bits, so 256 addresses and 254 hosts. A /26 has 6 host bits: 64 addresses, 62 hosts. A /30 has 2 host bits: 4 addresses, 2 hosts, the traditional size for a point-to-point link between two routers. The tiny exceptions are /31, which RFC 3021 allows for point-to-point links with no network or broadcast address, and /32, which names a single host.

import ipaddress

for text in ('192.168.1.0/24', '10.20.20.0/26', '172.16.5.4/30', '10.20.99.0/28'):
    net = ipaddress.ip_network(text, strict=False)
    hosts = list(net.hosts())
    print(str(net).ljust(16), 'mask', str(net.netmask).ljust(16),
          'broadcast', str(net.broadcast_address).ljust(14),
          'hosts', hosts[0], '-', hosts[-1], '(' + str(len(hosts)) + ')')

192.168.1.0/24   mask 255.255.255.0    broadcast 192.168.1.255  hosts 192.168.1.1 - 192.168.1.254 (254)
10.20.20.0/26    mask 255.255.255.192  broadcast 10.20.20.63    hosts 10.20.20.1 - 10.20.20.62 (62)
172.16.5.4/30    mask 255.255.255.252  broadcast 172.16.5.7     hosts 172.16.5.5 - 172.16.5.6 (2)
10.20.99.0/28    mask 255.255.255.240  broadcast 10.20.99.15    hosts 10.20.99.1 - 10.20.99.14 (14)

The strict=False argument lets ip_network accept an address with host bits set, such as 172.16.5.4/30, and quietly round it down to the network 172.16.5.4/30 contains. Without it, Python raises a ValueError, which is often what you want when checking configuration files, because a network written with host bits set is usually a typing mistake.

def network_info(address, prefix):
    return address, address, 2 ** (32 - prefix)

print(network_info('192.168.1.21', 24))

Address classes and private ranges

Before CIDR, IPv4 addresses were divided into fixed classes by their first bits. Class A networks, with a first octet from 1 to 126, used a /8 mask; class B, 128 to 191, used /16; class C, 192 to 223, used /24. Class D, 224 to 239, is multicast, and class E, 240 to 255, is reserved. Classful addressing wasted enormous numbers of addresses, because an organization needing 500 addresses had to take a class B with 65,534, and it was replaced by CIDR in 1993. The class names survive in exam questions and in phrases such as a class C sized network, meaning a /24.

RFC 1918 sets aside three ranges as private addresses that anyone may use inside their own networks and that are never routed on the public internet: 10.0.0.0/8, 172.16.0.0/12 (172.16.0.0 to 172.31.255.255) and 192.168.0.0/16. Ridgeline, like almost every home and business, numbers its LAN from a private range and uses network address translation at its firewall-router to share one public address, 203.0.113.42, assigned by the provider. Private addresses can be reused by every organization because they never leave the private network without being translated.

An address beginning 169.254 is a useful clue. When a host is set to get its address automatically but no DHCP server answers, it picks a random link-local address in 169.254.0.0/16, a feature Windows calls Automatic Private IP Addressing. The host can then talk only to other link-local hosts on the same cable. Seeing 169.254 on a till therefore means DHCP failed, not that the till is broken.

import ipaddress

def classify(address):
    if address.startswith('192.168'):
        return 'private'
    return 'public'

print(classify('172.20.1.5'))

Unicast, broadcast and multicast

IPv4 packets are delivered in three ways. Unicast sends a packet to one host, which is almost all traffic. Broadcast sends a packet to every host on a network: the directed broadcast address of a network, such as 192.168.1.255, or the limited broadcast 255.255.255.255, which means every host on this local network and is never forwarded by routers. DHCP relies on the limited broadcast, because a new device does not yet know any addresses. Multicast sends a packet to a group of hosts that have chosen to listen, using addresses from 224.0.0.0 to 239.255.255.255; it is used for streaming to many receivers, by routing protocols and by discovery services such as the one that lets phones find a printer. IPv6, in Lesson 6, drops broadcast altogether and uses multicast instead.

Is the destination local? The default gateway

Every host with an IPv4 address also needs a default gateway, the address of the router on its own network that forwards traffic to everywhere else. At Ridgeline that is 192.168.1.1, the firewall-router. When a host has a packet to send, it compares the destination with its own network. If the destination is in the same network, the host delivers the packet directly, finding the destination's MAC address with ARP, the Address Resolution Protocol, which broadcasts a question such as who has 192.168.1.50 and gets a reply from the printer. If the destination is on any other network, the host sends the frame to the default gateway's MAC address instead, and the router takes it from there.

A wrong mask or gateway produces confusing symptoms. A till with the right address but a /16 mask believes that 192.168.50.20, a guest device, is local and tries to reach it directly, which fails because the guest network is a different VLAN. A till with no gateway can print to the office printer but reach nothing on the internet. These are layer 3 problems, and the quick check is always the same: look at the host's address, mask and gateway together.

import ipaddress

def next_hop(host_ip, prefix, gateway, destination):
    my_net = ipaddress.ip_network(host_ip + '/' + str(prefix), strict=False)
    if ipaddress.ip_address(destination) in my_net:
        return 'deliver directly to ' + destination
    return 'send to gateway ' + gateway

till = ('192.168.1.21', 24, '192.168.1.1')
for dest in ('192.168.1.50', '192.168.50.20', '8.8.8.8', '203.0.113.80'):
    print(dest.ljust(15), '->', next_hop(*till, dest))

192.168.1.50    -> deliver directly to 192.168.1.50
192.168.50.20   -> send to gateway 192.168.1.1
8.8.8.8         -> send to gateway 192.168.1.1
203.0.113.80    -> send to gateway 192.168.1.1

def same_network(a, b, prefix):
    return a.split('.')[:3] == b.split('.')[:3]

print(same_network('10.20.20.10', '10.20.20.100', 26))