Skip to main content

Welcome to a Grasp lesson

Create a free account to keep studying and create your own study path.

Lesson 4

IP Addressing and Subnetting Fundamentals

Recommended resources

Hello! Welcome to the fourth lesson in our module on Networking Fundamentals.

In our last session, we explored the TCP three-way handshake, the process that establishes a reliable connection at the Transport Layer (Layer 4). We saw how SYN, SYN-ACK, and ACK packets are used to synchronize sequence numbers and open a communication channel.

Today, we move one layer down the OSI model to the Network Layer (Layer 3). Our focus will be on the core addressing scheme of the internet. This lesson fulfills the learning outcome: Explain the structure of an IP address and the function of a subnet mask.

For a penetration tester, this knowledge is as fundamental as knowing the alphabet. Every action you take—from scanning a network to exploiting a service—starts with an IP address. Understanding how these addresses are structured and how networks are defined is the first step in mapping your target's digital environment.

The Fundamental Question: Local or Remote?

Imagine your computer (PC1) wants to send data to another computer (PC2). How does it decide whether to send the data directly on the local network or to forward it to the router (the default gateway) to be sent out to a different network?

The Need for a Subnet Mask: Differentiating Local vs. Remote Networks
This diagram poses the central problem: without a subnet mask, a computer cannot determine if a destination IP address is on its local network or a remote one. This decision dictates whether traffic is sent directly or via the default gateway.

This is the core problem that the subnet mask solves. But before we get to the solution, let's start with the address itself.


The Structure of an IPv4 Address

An IP address is the unique identifier for a device on a network. While you are probably familiar with seeing them as four numbers separated by dots (e.g., 192.168.1.100), computers see them very differently.

To begin, let's watch a short segment of a video that introduces the basic components of an IP address and the role of the subnet mask.

Subnet Mask - Explained

The video 'Subnet Mask - Explained' by PowerCert Animated Videos provides a clear, animated introduction to IPv4 addresses and their components.

Please watch from the beginning to 01:35. Pay attention to the definitions of 'octet,' the 'network portion,' and the 'host portion' of an IP address.

As the video explained, an IPv4 address is a 32-bit number. We write it in "dotted-decimal notation" for human readability, where each of the four numbers, called an octet, is an 8-bit binary number.

But why can each octet only range from 0 to 255? The answer lies in binary mathematics. The following article provides an excellent, straightforward explanation of binary counting and why the 8-bit structure of an octet results in the 0-255 range.

A COMPLETE BEGINNER'S GUIDE TO SUBNETTING

This article, 'A COMPLETE BEGINNER'S GUIDE TO SUBNETTING,' starts with the fundamentals of binary that are essential for understanding all IP addressing concepts.

Please read the sections 'WHAT IS BINARY?' and 'LET’S LEARN TO COUNT IN BINARY!'. This will solidify why an 8-bit octet can represent numbers from 0 to 255.

To summarize the key idea from the reading: an 8-bit number has eight "slots," each with a value that is a power of two (128, 64, 32, 16, 8, 4, 2, 1).

  • A value of 0 is represented in binary as 00000000.
  • A value of 255 is represented as 11111111 (128+64+32+16+8+4+2+1).
  • Any number in between is a unique combination of these bits being turned "on" (1) or "off" (0).

The Subnet Mask: Dividing Network from Host

Now, let's return to the core function of the subnet mask: distinguishing the network portion from the host portion of an IP address. The network portion is common to all devices on the same network, while the host portion is unique to each device.

The subnet mask achieves this using a simple binary rule:

  • 1s in the subnet mask correspond to the network portion of the IP address.
  • 0s in the subnet mask correspond to the host portion of the IP address.

Let's continue with the PowerCert video, which demonstrates this process clearly.

Subnet Mask - Explained

This next segment of the video shows exactly how to convert an IP address and subnet mask into binary and use them to identify the network and host parts.

Please watch from 01:35 to 05:50. This section will walk you through the binary conversion and then show how lining up the IP and mask reveals the network and host bits.

The key insight is that the subnet mask acts like a filter. By performing a logical AND operation between the IP address and the subnet mask (both in binary), a device can determine its network address. All devices with the same network address are on the same local network.

The image below provides a static summary of this concept.

Binary Notation of IP Address and Subnet
This diagram shows the IP address 192.168.100.10 and its subnet mask 255.255.255.0, both in decimal and binary. The ones in the subnet mask align with the network portion of the IP, and the zeros align with the host portion.

One important rule about subnet masks is that the binary 1s must be contiguous, followed by the contiguous 0s. You will never see a valid mask like 11111111.11111111.11101111.00000000.


Notation and Context: CIDR

In the early days of the internet, networks were allocated in rigid blocks called "classes" (Class A, B, C). A Class C network always used a 255.255.255.0 subnet mask, giving it 254 usable host addresses. This system was incredibly wasteful. For example, if an organization needed 500 addresses, it had to be allocated a Class B block, which contained over 65,000 addresses.

To solve this, Classless Inter-Domain Routing (CIDR) was introduced. CIDR allows for flexible network sizes by letting us place the boundary between network and host bits almost anywhere.

CIDR also introduced a more concise way to represent a subnet mask, known as slash notation or prefix length. You simply write a / followed by the number of network bits (the number of 1s in the mask).

  • 255.255.255.0 in binary is 24 ones followed by 8 zeros, so it is written as /24.
  • 255.255.0.0 is 16 ones followed by 16 zeros, written as /16.
  • 255.0.0.0 is 8 ones followed by 24 zeros, written as /8.

This video segment quickly explains these default classes and introduces CIDR notation.

Subnet Mask - Explained

Let's watch one last clip that covers the historical context of address classes and introduces the modern CIDR notation.

Watch from 14:56 to 17:25. Focus on how CIDR (slash notation) provides a shorthand for writing subnet masks.


Why Do We Divide Networks?

Finally, let's address the "why." What is the purpose of breaking large networks into smaller ones (subnets)? The primary reason is to improve network performance and manageability by controlling broadcast traffic.

When a device needs to communicate with another device on the same local network (e.g., to find its MAC address via ARP, which we'll cover later), it sends a broadcast message to every device on that network. In a small network, this is fine. In a massive network with thousands of devices, constant broadcasting would create a "broadcast storm," grinding the network to a halt.

Routers do not forward broadcast traffic between networks. By dividing a large network into smaller subnets separated by routers, we contain broadcasts within each subnet, ensuring traffic stays local and the network remains efficient.


Conclusion

In this lesson, we dissected the fundamental components of network addressing at Layer 3. You now have the theoretical foundation to understand how every device on a TCP/IP network is identified and located relative to others.

Key Takeaways:

  • An IPv4 address is a 32-bit number, displayed as four 8-bit octets (0-255) in dotted-decimal notation.
  • Every IP address has a network portion (identifying the network) and a host portion (identifying the device on that network).
  • The subnet mask is a 32-bit number that uses a contiguous block of binary 1s to "mask" the network portion of an IP address. The remaining 0s indicate the host portion.
  • CIDR (Classless Inter-Domain Routing) and its slash notation (e.g., /24) provide a flexible and concise way to define the network boundary.
  • This separation into networks is crucial for managing broadcast traffic and improving network performance.

We've established what a subnet mask is and why it's used. In our next lesson, we will build directly on this knowledge to address the learning outcome: Describe the purpose and process of subnetting a network. You will learn how network administrators take a block of IP addresses and "carve it up" into smaller, more efficient subnets.