IP Addresses Demystified: Subnet Masks, CIDR, and the Network/Host Divide

In the previous article, we answered "why MAC addresses aren't enough" — because they are flat, non-hierarchical, and switches can't make forwarding decisions at Internet scale. The conclusion: the Internet needs a hierarchical, logical addressing system that lets intermediate devices decide direction based on address prefixes, without needing to memorize the location of every device on the planet.

That system is the IP address. But what does "hierarchical" actually mean? How does an IP address split into a network portion and a host portion? How does your computer determine whether a target IP is "one of us" or "send to the gateway"?

This chapter unpacks the internal structure of IP addresses, so you can truly see how a router "knows which way to forward."

• Understand the 32-bit binary structure of IPv4 addresses and their decimal representation
• Master the bitwise logic of subnet masks — explain the network/host split in plain language
• Understand CIDR notation and leave behind the outdated Class A/B/C mindset
• Clearly grasp the relationship between public IPs, private IPs, and NAT
• Understand why IPv4 ran out and how IPv6 fundamentally solves the problem

• Understand why the Internet needs hierarchical addressing

• Basic familiarity with binary-to-decimal conversion

• Understand how ARP works

Open your terminal and check your IP configuration:

You see three numbers: 192.168.1.10, 0xffffff00, 192.168.1.255. The first two are familiar — your IP address and subnet mask. But do you really understand the relationship between them?

More specifically, recall a key operation from the ARP article: when your computer pings github.com (whose IP is, say, 151.101.2.133), it does NOT ARP-query that IP directly. Instead, it turns to the gateway 192.168.1.1. What makes your computer decide "151.101.2.133 is not in my neighborhood"?

The answer lies in the bitwise logic of IP addresses and subnet masks.

We normally see IP addresses in forms like 192.168.1.10 — this is called dotted decimal notation. But computers don't understand this — they only understand binary. Every IPv4 address is fundamentally 32 binary bits, divided into 4 groups of 8 bits (one byte each). The decimal value of each byte is joined by dots for human readability.

So 192.168.1.10 is, to a computer, a 32-bit binary number:

Understanding this binary face is critical — because the division between network and host portions, and the entire subnet mask mechanism, operate entirely at the binary level. The decimal form is just a skin for human eyes.

The "hierarchical structure" of an IP address is this: every IP address is naturally divided into two parts — the Network ID and the Host ID.

A postal address analogy:

All addresses within "Haidian District" share the same "Beijing, Haidian District" prefix. The post office only needs to see "Beijing, Haidian District" to know which direction to send a letter. Once the letter arrives in Haidian District, the specific mailbox is located using "1 Zhongguancun Street."

IP addresses work the same way: all IPs sharing the same Network ID belong to the same network (the same broadcast domain). Routers only need to look at the Network ID to decide forwarding direction. Delivery to the specific device within the network is the job of switches and MAC addresses.

This perfectly answers the question left from the previous article: why can a single routing rule cover thousands or millions of devices? Because routers only remember Network IDs, not Host IDs.

Now the question: in 192.168.1.10's 32 bits, how many leading bits are the Network ID, and how many trailing bits are the Host ID? The IP address alone tells you nothing.

The answer comes from its partner: the subnet mask.

3.1 The Format of a Subnet Mask

A subnet mask is also a 32-bit binary number, but it has a very distinctive shape: a continuous block of 1s followed by a continuous block of 0s. No interleaving — just a clean boundary.

In the subnet mask, the portion covered by 1s is the Network ID; the portion covered by 0s is the Host ID. In this example, the first 24 bits are the network portion, the last 8 bits are the host portion.

3.2 IP & Mask = Network Address

The computer extracts the Network ID using a simple bitwise AND operation:

The rule is straightforward: 1 AND 1 = 1, 1 AND 0 = 0, 0 AND 0 = 0. The mask's 1s let the corresponding IP bits "pass through"; the mask's 0s "zero out" the corresponding IP bits. The result is the network address of the network your IP belongs to.

3.3 The Subnet Mask Determines How Many Hosts a Network Can Hold

The number of bits covered by 0s in the subnet mask is the number of host bits, which also determines the maximum number of devices in the network:

This is the fundamental meaning behind "your home network can support up to 254 devices" — the 8-bit host portion allocated by the subnet mask defines your IP address pool size.

Constantly writing 192.168.1.0 / 255.255.255.0 is verbose. Network engineering has a cleaner notation: CIDR (Classless Inter-Domain Routing).

CIDR simply writes the count of 1s in the subnet mask after the IP, separated by a slash:

/24 means "the first 24 bits are the Network ID," /8 means "the first 8 bits are the Network ID." It's concise, precise, and completely frees us from the outdated Class A/B/C classification.

Common CIDR prefixes and their corresponding subnet masks:

Why don't we talk about Class A/B/C anymore? Because that classification system (Class A = /8, Class B = /16, Class C = /24) was superseded by CIDR 30 years ago. Under CIDR, the boundary between network and host portions can be at any position — like /26, a division that never existed in the classful world. Clinging to the "Class A/B/C" mindset only confuses beginners.

Back to our original question: how does your computer know 151.101.2.133 is not on the local network?

The answer is now clear — it performs a bitwise AND between the target IP and its own subnet mask, then compares the result to its own network address.

Conversely, if the target is 192.168.1.20:

Every operating system performs this check before sending any data packet. Now you can use this knowledge to explain a wide range of networking phenomena: why two computers with mismatched subnet masks might not communicate, why ping 127.0.0.1 never touches your network card, why a VPN connection adds extra entries to your routing table — they all boil down to subnet checks happening behind the scenes.

By now, you understand how IP addresses split into network and host portions. But here's another question: your home's 192.168.1.10 and your neighbor's 192.168.1.10 — won't they conflict?

The answer is: no, because these two IPs live in their respective LANs and can never see each other. This is the concept of private IPs.

6.1 Private IPs: Internal Numbers for LANs

The IETF reserved three IP address ranges in RFC 1918, specifically for LAN-internal use:

These three ranges share a common trait: routers on the Internet will never forward packets destined for private IP addresses. Private IPs only work within a LAN; once past the router, no one recognizes them.

Think of it like internal employee IDs — "I'm employee #3" has meaning inside the company, but outside the building, the statement means nothing to anyone.

6.2 Public IPs: Your Real Address on the Internet

In contrast, a public IP is globally unique and routable across the Internet. Your router's WAN port holds a public IP (e.g. 100.64.0.2), and it acts as the "spokesperson" for your entire home network on the Internet.

6.3 NAT: Sharing One Public IP Among the Whole Household

Now a problem arises: three devices at home each have private IPs (192.168.1.10, 192.168.1.20, 192.168.1.30), but the router has only one public IP. How do they all access the Internet simultaneously?

The answer is NAT (Network Address Translation). When forwarding a packet, the router replaces the private source IP with its own public IP and remembers "this port number originally corresponds to which device inside." When the reply comes back, it reverse-maps the port number back to the correct internal device.

NAT has been the "life support" of the IPv4 era — it allows billions of devices to access the Internet through just a few hundred million public IPs, dramatically slowing IPv4 address exhaustion. But it also introduces a side effect: external hosts cannot directly reach internal devices (unless you set up port forwarding), a common pain point for P2P connections, remote desktop, and similar scenarios.

7.1 The 32-Bit Ceiling

IPv4 has only 32 bits, which means the theoretical maximum number of addresses is:

4.3 billion sounds like a lot — but the world population exceeds 8 billion, and each person has more than one connected device on average. Phones, laptops, tablets, smartwatches, TVs, game consoles, IoT sensors... plus servers, routers, and switches that also need IPs.

In reality, IPv4 addresses were fully allocated by 2011. For over a decade since, we've relied on survival tactics like NAT and address reclamation — but these are bandaids, not cures.

7.2 IPv6: A 128-Bit Address Space of Cosmic Scale

IPv6 expands the address from 32 bits to 128 bits:

How big is this number? Every square meter of the Earth's surface could be assigned approximately 667 sextillion IPv6 addresses. It's not just one address per device — every atom could have an address.

IPv6 addresses use hexadecimal notation, with groups of 4 hex digits separated by colons:

A typical residential IPv6 prefix is /64, meaning every household gets 2⁶⁴ addresses. NAT becomes unnecessary in IPv6 — every device can have its own globally unique public address.

7.3 Scope of This Series

IPv6 is a massive topic: extension headers, SLAAC (stateless auto-configuration), NDP (Neighbor Discovery Protocol replacing ARP), multicast replacing broadcast... all deserve deep discussion. For this article, you only need to understand:

• IPv4's 32-bit space has been exhausted; NAT is a temporary workaround
• IPv6 solves the address space problem permanently with 128 bits
• We'll cover IPv6 and NDP in a dedicated follow-up article

For now, continue using IPv4 as the primary vehicle for learning network layer concepts — almost all networking principles are common between IPv4 and IPv6.

1. Check your IP configuration and subnet mask

   bash

   # macOS / Linux ifconfig en0 | grep inet # Windows ipconfig

   Find your IP address and subnet mask. Write your network address in CIDR notation (e.g. 192.168.1.0/24). What's the maximum number of devices your home network can support?

2. Manually determine if a target is on the same subnet

   Suppose your IP is 10.0.0.45 and your subnet mask is 255.255.255.0. Which of the following IPs are on the same subnet as you?

   • 10.0.0.100
   • 10.0.1.45
   • 192.168.1.1

   Show your working (IP & mask → compare network addresses).

3. Check your router's public IP

   Visit https://ifconfig.me in your browser or run curl ifconfig.me. Is the IP you see the same as what ifconfig shows? If not, why?

1. Verify subnet check behavior on a real network

   On a LAN with subnet mask 255.255.255.0, configure two machines as 192.168.1.10 and 192.168.2.10. Use Wireshark to observe what happens when they ping each other. Was an ARP request ever sent? If not, at what step was it blocked?

2. Calculate address ranges for a /26 network

   A /26 prefix means the subnet mask is 255.255.255.192. For IP 192.168.1.100/26, compute:

   • Network address
   • Broadcast address
   • Usable IP range
   • Number of usable hosts

• An IPv4 address is a 32-bit binary number. Dotted decimal is just a display format for humans.
• Every IP address is split into a Network ID and a Host ID. The Network ID identifies "which network"; the Host ID identifies "which device within that network." This is the foundation of IP's hierarchical structure.
• The subnet mask defines the boundary between Network ID and Host ID. The leading N bits set to 1 represent the network portion. A bitwise AND between IP and mask yields the network address.
• CIDR notation (e.g. 192.168.1.0/24) is a more precise and modern notation than the Class A/B/C system.
• The subnet check is what every OS performs before sending a packet — target IP & subnet mask → compare to own network address → same subnet = deliver directly; different subnet = send to gateway.
• Private IPs (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) only work within a LAN and cannot cross routers. Public IPs are globally unique.
• NAT allows multiple private-IP devices to share a single public IP for Internet access — the life-support system of the IPv4 era.
• IPv4's 32 bits (4.3 billion addresses) have been exhausted. IPv6 uses 128 bits, providing a virtually unlimited address space.

You now understand the static structure of IP addresses: what they look like, how Network and Host portions are divided, how subnet masks work, and the difference between public and private IPs. But a critical question remains unanswered:

Once you hand a packet to the gateway, what does the gateway (router) do next? How does it know where the "next hop" should go?

The next article formally enters the world of routing — the structure of routing tables, static vs. dynamic routing protocols (RIP, OSPF, BGP), the meaning of the default route, and the complete journey of a data packet traversing multiple networks.