IP addresses, subnets and CIDR explained simply

Every device that talks over a network needs an IP address, like a postal address for data. Understanding addresses and subnets is the base of networking, cloud setup (VPCs) and firewall rules.

IPv4 and IPv6

• IPv4 addresses are 32 bits, written as four numbers from 0 to 255, such as 192.168.1.10. There are about 4.3 billion, which ran short.
• IPv6 addresses are 128 bits, written in hexadecimal such as 2001:db8::1, with a vast space. IPv6 is widely deployed but IPv4 is still everywhere.

Public and private addresses

Some IPv4 ranges are private, meant for use inside homes, offices and cloud networks. They are not routed on the public internet:

• 10.0.0.0/8
• 172.16.0.0/12
• 192.168.0.0/16

Others are public. Also useful: 127.0.0.1 is localhost (this machine), and 169.254.x.x is a self-assigned link-local address.

Network part and host part

An address has two parts: which network it belongs to, and which host inside that network. A subnet mask says where the split is.

255.255.255.0 means the first 24 bits are the network and the last 8 bits are for hosts.

CIDR notation

CIDR writes the mask as a slash and the number of network bits:

• 192.168.1.0/24 is the same as mask 255.255.255.0.
• /16 is 255.255.0.0, and /8 is 255.0.0.0.
• A bigger number after the slash means a smaller network.

Counting addresses

A block with h host bits has 2^h addresses. In normal IPv4 subnets, two are reserved: the network address (first) and the broadcast address (last). Cloud providers often reserve a few more.

CIDR	Host bits	Addresses	Usable (classic)
/24	8	256	254
/25	7	128	126
/26	6	64	62
/27	5	32	30
/28	4	16	14
/30	2	4	2

Example: 10.0.1.0/24 covers 10.0.1.0 to 10.0.1.255. Hosts can use 10.0.1.1 to 10.0.1.254.

Splitting 10.0.0.0/16 into /24 subnets gives 256 subnets such as 10.0.0.0/24, 10.0.1.0/24 and so on.

Talking to other networks

• A device sends traffic for its own subnet directly.
• For anything else it sends the traffic to the default gateway, a router that forwards it onward.
• NAT lets many devices with private addresses share one public address. The router rewrites addresses and keeps a table, which is why you cannot reach a device behind NAT from outside unless a port is forwarded.
• DHCP hands out addresses automatically. Servers usually get static addresses or reservations.

Why this matters in practice

• Cloud VPC design: pick a private range, split it into subnets (public, private, database) and avoid ranges that overlap with your office VPN or other VPCs, or you cannot connect them later.
• Firewall rules: you allow or block by CIDR, such as 203.0.113.0/24. A single host is /32. Everything is 0.0.0.0/0, so be careful using it.
• Debugging: if two machines cannot reach each other, check the subnet, gateway and routes first.

Handy commands

ip addr           # your addresses (Linux)
ip route          # routing table and default gateway
ping 10.0.1.5     # reachability
traceroute host   # the path packets take

Takeaway: an address has a network and a host part, CIDR shows the split, 2^host-bits gives the size, private ranges stay inside your network, and good subnet planning saves painful changes later.

---

Networking & Cloud series, Part 1 (how the internet works): 1 of 5.