CYBER SECURITY • NETWORKING AND INTERNET SECURITY

IP Addressing & Routing — Explain IP addressing, subnets, and routing at a conceptual level

How hierarchical addressing and routing protocols enable billions of devices to communicate across interconnected networks.

Historical Context & Motivation

The modern Internet emerged from a need to interconnect heterogeneous computer networks, and the central challenge was deceptively simple: how does a packet of data find its way from one machine to another across a web of independently operated networks? In the late 1960s, the ARPANET demonstrated that packet-switching could work within a single network, but linking separate networks together — what Vint Cerf and Bob Kahn called internetworking — required a universal addressing scheme and a forwarding mechanism that no single authority controlled. The result was the Internet Protocol (IP), which introduced a globally unique address space and a hop-by-hop routing paradigm that remains the architectural backbone of today's Internet.

1969
ARPANET Goes Live
The first four nodes of ARPANET exchange packets using the Network Control Protocol (NCP). Addressing is limited to host numbers within a single network — there is no concept of inter-network routing.
1974
TCP/IP Proposal
Cerf and Kahn publish "A Protocol for Packet Network Intercommunication," introducing the split between TCP (reliable transport) and IP (addressing and forwarding), along with a 32-bit address format.
1981
RFC 791 — IPv4 Specified
The formal specification of IPv4 defines the datagram header, 32-bit addressing, and the concept of classful network IDs (Class A/B/C). This standard underpins the vast majority of Internet traffic for over four decades.
1993
CIDR Replaces Classful Addressing
Classless Inter-Domain Routing (CIDR) eliminates rigid class boundaries and introduces variable-length subnet masks, dramatically slowing IPv4 address exhaustion and enabling hierarchical route aggregation.
1998
IPv6 Standardized (RFC 2460)
With IPv4 exhaustion on the horizon, IPv6 expands the address space to 128 bits (≈ 3.4 × 10³⁸ addresses), simplifies the header, and mandates IPsec support — directly tying addressing evolution to security.

The fundamental question that IP addressing and routing answers is this: given a destination identified only by a numerical address, how can a packet traverse an arbitrary topology of interconnected networks — each operated by different organizations — and arrive at the correct host? Understanding this question is essential for network security, because every firewall rule, every access-control list, and every intrusion-detection signature ultimately operates on the fields defined by the IP header.

Core Principles & Definitions

IP addressing and routing rest on a small number of foundational ideas that, taken together, enable scalable global communication. An IP address is a numerical identifier assigned to every interface on a network; in IPv4 it is 32 bits long, conventionally written in dotted-decimal notation (e.g., 192.168.1.10). Each address is logically split into a network prefix and a host identifier. A subnet mask (or prefix length) defines where that boundary falls, while routing is the process by which each intermediate device — a router — examines the destination address, consults a routing table, and forwards the packet toward the next hop.

1

Hierarchical Addressing

IP addresses encode both the network a host belongs to and its identity within that network, much like a postal code identifies a city while a street number identifies a house. This hierarchy allows routers to aggregate routes rather than tracking every individual host.
2

Subnet Masking

A subnet mask is a 32-bit bitmask (e.g., 255.255.255.0 or /24) that, when ANDed with an IP address, extracts the network prefix. Subnetting lets administrators partition a single address block into smaller logical segments, each acting as an independent broadcast domain.
3

Longest-Prefix Match

When a router has multiple routing table entries that match a destination address, it selects the entry with the longest (most specific) prefix. This rule enables fine-grained traffic engineering while allowing a short default route to catch everything else.
4

Hop-by-Hop Forwarding

No single device knows the full path to a destination. Each router independently decides the next hop for a given packet based on its own routing table. The end-to-end path emerges from the composition of many local forwarding decisions — a design that tolerates partial failures gracefully.
5

Routing Protocols

Dynamic routing protocols (OSPF, BGP, RIP) allow routers to exchange reachability information and compute optimal paths automatically. Interior gateway protocols handle intra-organization routing, while BGP governs inter-domain routing across the global Internet.
KEY TAKEAWAY
Think of IP addressing like the international postal system. The network prefix is the country and city — it tells the postal service (router) which regional hub to forward the letter to. The host ID is the street address — meaningful only once the letter reaches the correct local post office. Just as no single postal worker needs to know every address on Earth, no single router needs a complete map of the Internet; it only needs to know the next office to pass the letter to.

Visual Explanation — IPv4 Address Structure

The diagram shows how a /24 subnet mask is applied to the address 192.168.10.25. The purple region marks the 24-bit network prefix, while the cyan region marks the 8-bit host identifier. The bitwise AND of the address and mask produces the network address 192.168.10.0, which routers use to determine the destination subnet.

The diagram above illustrates the most fundamental operation in IP networking: separating the network prefix from the host identifier using a subnet mask. When a host wants to send a packet to 192.168.10.25, the local network stack performs a bitwise AND between the destination address and the configured subnet mask. If the resulting network address matches the sender's own network prefix, the packet is delivered locally (via ARP or NDP); otherwise, it is forwarded to the default gateway — typically the nearest router — which repeats the process at each subsequent hop. Notice that in a /24 subnet, only 8 bits remain for host addressing, yielding 2⁸ − 2 = 254 usable host addresses after reserving the all-zeros (network) and all-ones (broadcast) addresses.

Mathematical Framework — Subnetting Arithmetic

Subnetting relies on a concise set of binary arithmetic operations. Although the concepts are simple individually, combining them fluently is essential for network design, firewall configuration, and security auditing. The following equations formalize the key relationships between prefix lengths, address counts, and subnet boundaries.

USABLE HOSTS PER SUBNET
H = 2^(32 − n) − 2
where n is the CIDR prefix length (number of network bits), and the subtraction of 2 accounts for the reserved network address (all host bits = 0) and broadcast address (all host bits = 1).
NUMBER OF SUBNETS FROM A PARENT BLOCK
S = 2^(n_sub − n_parent)
where n_sub is the new (longer) prefix length and n_parent is the original prefix length. For example, splitting a /16 into /24 subnets gives 2⁸ = 256 subnets.
NETWORK ADDRESS EXTRACTION (BITWISE AND)
Network Address = IP Address AND Subnet Mask
The bitwise AND of any host address with its subnet mask zeroes out the host bits, producing the network address. This is the operation every router performs to look up the destination in its routing table.
BROADCAST ADDRESS
Broadcast = Network Address OR (NOT Subnet Mask)
The bitwise OR of the network address with the inverted mask (also called the wildcard mask) sets all host bits to 1, yielding the directed broadcast address for that subnet. Packets sent to this address are delivered to all hosts on the subnet.
🔒 Security Implication
Understanding subnet boundaries is not merely an administrative exercise. Misconfigured subnet masks are a common source of security vulnerabilities: a mask that is too broad can expose hosts to traffic from unauthorized segments, while a mask that is too narrow can cause routing black holes. Firewall ACLs are typically written in terms of network/prefix pairs (e.g., 10.0.0.0/8), making fluency with CIDR notation essential for writing correct security rules.

Routing Mechanisms — How Packets Find Their Way

Once a host determines that a destination IP address lies outside its local subnet, it forwards the packet to a default gateway, which is the first router on the path. That router inspects the destination address, performs a longest-prefix-match lookup in its routing table, and selects the best matching entry. The entry specifies a next-hop address and an egress interface. This process repeats at every intermediate router until the packet reaches the destination's local subnet, where it is delivered directly to the target host. The beauty of this design is that each router makes a purely local decision; no single device needs end-to-end path knowledge.

Top: Host A (10.1.1.25) sends a packet to Host B (172.16.5.42). The packet traverses two routers, each performing a longest-prefix-match lookup. Router R1's routing table is shown, with the matching entry highlighted. Bottom: the three categories of routing — interior gateway protocols (IGPs), exterior gateway protocols (EGPs), and static routes.
Common routing protocols and their characteristics
ProtocolTypeAlgorithmScope
OSPFIGP — Link-stateDijkstra's SPFSingle AS; builds full topology map
RIPIGP — Distance-vectorBellman–FordSmall networks; max 15 hops
BGPEGP — Path-vectorPolicy-based path selectionInter-AS; the 'glue' of the global Internet

Worked Example — Subnetting a /24 Network

Suppose you are a network administrator tasked with splitting the address block 192.168.50.0/24 into four equal subnets for four departments. Determine the subnet addresses, usable host ranges, and broadcast addresses for each subnet.

Subnetting 192.168.50.0/24 into 4 Subnets
1
Step 1 — Determine the New Prefix LengthWe need 4 subnets from a /24 block. Since 2k ≥ 4 requires k = 2 additional network bits, the new prefix length is 24 + 2 = /26. The corresponding subnet mask is 255.255.255.192 (binary: 11111111.11111111.11111111.11000000).
New prefix: /26 → Mask: 255.255.255.192
2
Step 2 — Calculate Hosts per SubnetWith a /26 prefix, the host portion is 32 − 26 = 6 bits. The number of usable hosts per subnet is 2⁶ − 2 = 64 − 2 = 62 hosts.
62 usable hosts per subnet
3
Step 3 — Determine Subnet Block SizeThe block size (also called the increment) is 2⁶ = 64. Each successive subnet's network address increments by 64 in the last octet: .0, .64, .128, .192.
Block size: 64
4
Step 4 — Enumerate All Four SubnetsSubnet 1: Network 192.168.50.0/26, Hosts .1–.62, Broadcast .63. Subnet 2: Network 192.168.50.64/26, Hosts .65–.126, Broadcast .127. Subnet 3: Network 192.168.50.128/26, Hosts .129–.190, Broadcast .191. Subnet 4: Network 192.168.50.192/26, Hosts .193–.254, Broadcast .255.
Four /26 subnets: .0, .64, .128, .192
5
Step 5 — Verify and Discuss Security ImplicationsTotal addresses: 4 × 64 = 256 = 2⁸, which accounts for the entire /24. Each subnet is now an independent broadcast domain, so a compromised host in Subnet 1 cannot send broadcast traffic that reaches Subnet 3. Firewall rules can reference each /26 block individually, enabling microsegmentation — a key defense-in-depth strategy.
Verification: 4 × 64 = 256 = 28

IPv4 vs. IPv6 — Strengths, Limitations, and Security Considerations

IPv4 has served as the Internet's addressing workhorse for over four decades, but its 32-bit address space of roughly 4.3 billion addresses was exhausted by 2011 (IANA allocation) and 2019 (RIPE NCC, the last regional registry). The workaround — Network Address Translation (NAT) — allows many hosts to share a single public address but breaks the end-to-end principle and complicates peer-to-peer protocols, IPsec transport mode, and forensic attribution. IPv6 addresses these limitations with a 128-bit address space, a simplified fixed-length header, mandatory support for IPsec, and built-in stateless address autoconfiguration (SLAAC).

Comparison of IPv4 and IPv6 characteristics
FeatureIPv4IPv6
Address Length32 bits (≈ 4.3 × 10⁹ addresses)128 bits (≈ 3.4 × 10³⁸ addresses)
NotationDotted-decimal (192.168.1.1)Colon-hex (2001:0db8::1)
Header Size20–60 bytes (variable options)40 bytes fixed + extension headers
NAT RequirementUbiquitous due to address scarcityGenerally unnecessary; restores end-to-end model
IPsecOptionalMandatory in specification (implementation varies)
AutoconfigurationDHCP required for most configurationsSLAAC built-in; DHCPv6 available
Security ConcernsARP spoofing, DHCP attacks, IP spoofingNDP spoofing, SLAAC privacy, dual-stack bypass
KEY TAKEAWAY
Transitioning from IPv4 to IPv6 is analogous to migrating a city from a four-digit phone number system to a fifteen-digit one while keeping both systems operational simultaneously. The dual-stack period — where hosts run both protocols — introduces a unique attack surface: adversaries can exploit whichever protocol stack receives less monitoring. Security policies must explicitly cover both IPv4 and IPv6 traffic, or attackers will tunnel through the gap.

Connection to Advanced Theory — BGP Security and Software-Defined Networking

The conceptual foundations of IP addressing and routing extend directly into advanced topics that dominate modern network security research. The Border Gateway Protocol (BGP), which manages inter-domain routing across the global Internet, was designed in an era of implicit trust among network operators. It lacks built-in authentication of route announcements, making it vulnerable to BGP hijacking — where a malicious or misconfigured autonomous system advertises ownership of IP prefixes it does not control, redirecting or blackholing traffic. The Resource Public Key Infrastructure (RPKI) and BGPsec are cryptographic extensions designed to address this, but deployment remains incomplete.

From foundational to advanced networking concepts
ConceptFoundational (This Lesson)Advanced Extension
AddressingIPv4/IPv6 address structure, CIDR notationRPKI for prefix origin validation; IP anycast for distributed services
RoutingHop-by-hop forwarding, longest-prefix matchSegment routing (SR-MPLS, SRv6); source routing in IPv6 extension headers
Control PlaneOSPF/BGP build routing tables on each deviceSDN (OpenFlow) centralizes control-plane logic; programmable data planes (P4)
SecuritySubnet segmentation, ACLs based on IP rangesZero-trust architectures; micro-segmentation with identity-aware proxies

Software-Defined Networking (SDN) represents a paradigm shift that decouples the control plane (routing decisions) from the data plane (packet forwarding). A centralized SDN controller maintains a global view of the network topology and pushes forwarding rules to switches, enabling fine-grained, programmable security policies that would be cumbersome to implement with traditional per-device configurations. Understanding the classical IP addressing and routing model is prerequisite to appreciating what SDN changes — and what attack surfaces it introduces when the controller itself becomes a single point of compromise.

Practice Problems

PROBLEM 1CONCEPTUAL
Explain why IP addresses are structured hierarchically (network prefix + host ID) rather than being flat identifiers. What would happen to routing table sizes if every IP address were unique with no hierarchical structure?
PROBLEM 2BASIC CALCULATION
Given the address 172.20.45.130 with a subnet mask of 255.255.255.224 (/27), determine: (a) the network address, (b) the broadcast address, (c) the range of usable host addresses, and (d) the total number of usable hosts.
PROBLEM 3INTERMEDIATE
An organization has been allocated the block 10.50.0.0/16. They need to create subnets that each support at least 500 hosts. (a) What is the longest prefix length that satisfies this requirement? (b) How many such subnets can be created from the /16 block? (c) List the network addresses of the first three subnets.
PROBLEM 4APPLIED
A security analyst reviews a firewall rule that permits traffic from 192.168.0.0/22 to reach a server at 10.0.5.10. The analyst needs to verify which specific IP addresses are covered by the /22 source range, and whether the address 192.168.4.1 would be permitted. Show your work and explain the security implication of using /22 instead of /24.
PROBLEM 5CRITICAL THINKING
Consider a scenario where a malicious autonomous system (AS) announces the prefix 8.8.8.0/25 via BGP, while Google legitimately announces 8.8.8.0/24. Explain, using the longest-prefix-match rule, why this BGP hijack would succeed in diverting traffic. Then discuss what architectural or cryptographic mechanisms could prevent or mitigate such an attack.

Lesson Summary

IP addressing provides a hierarchical numerical identity to every network interface, with IPv4 using 32-bit addresses in dotted-decimal notation and IPv6 expanding to 128 bits. Every address is logically divided into a network prefix and a host identifier by a subnet mask, enabling administrators to partition address space into manageable segments and write precise firewall rules using CIDR notation. The number of usable hosts per subnet is 2^(32 − n) − 2, and subnetting decisions directly impact security posture through broadcast domain isolation and the principle of least privilege.

Routing is the hop-by-hop process by which routers consult their routing tables and apply the longest-prefix-match rule to select the best next hop for each packet. Interior gateway protocols like OSPF handle routing within an organization, while BGP manages inter-domain routing across the global Internet — and its lack of built-in authentication creates ongoing security challenges such as prefix hijacking. Mastering these foundational concepts — addressing, subnetting, and routing — is essential for designing secure network architectures, interpreting firewall policies, and understanding advanced topics like SDN and zero-trust networking.

Varsity Tutors • Cyber Security • IP Addressing & Routing