IPv4 addressing¶

Exercise ipv4-addressing-annex.pdf · PDF

Look at these two: 10.3.0.11 and 10.3.0.300. One of them can never be an address. Which one, and why?

You have typed 10.G.0.11 all week. Your phone has an address like it right now, and so does every device in your home. In this unit you will plan the addresses of a whole company network, and a single wrong number means "no Internet". This page teaches you to read an address like a technician: which part is the street, which part is the house.

An address is 32 bits¶

An IPv4 address is a number of 32 bits, written as four octets (bytes) in decimal with dots between them. That way of writing it is called dotted decimal.

   10   .    3    .    0    .    11
00001010 . 00000011 . 00000000 . 00001011        4 × 8 = 32 bits

Each octet is 8 bits, and from Binary you know that 8 bits hold 2⁸ = 256 values, from 0 to 255. So 10.3.0.300 is impossible: 300 does not fit in 8 bits.

To convert, keep the powers of two in front of you: 128 64 32 16 8 4 2 1. For 200: 128 + 64 + 8 = 200, so 11001000.

2³² = 4,294,967,296 addresses. That looked endless when IPv4 was written down in RFC 791 (September 1981). It was not: today there are almost twice as many people as that.

Street and house number¶

A postal address has a part that is the same for all your neighbours (the street) and a part that is only yours (the house number). An IP address too:

• The network part: the first bits, the same for every machine in the network. It answers "which network?" Routers only look at this part.
• The host part: the rest, different for each machine. It answers "which machine inside it?" A host is any device with an IP address.

Look at your own address on the Ubuntu host with ip -br addr and compare it with a neighbour's. The numbers that are the same are the network part; the ones that differ are the host part. You also see 127.0.0.1/8 on lo: more on that below.

The mask: where the street ends¶

A subnet mask is another 32-bit number: ones over the network part, zeros over the host part. Always all the ones first, then all the zeros.

address   10.3.0.37      00001010.00000011.00000000 . 00100101
mask      255.255.255.0  11111111.11111111.11111111 . 00000000
                         |------- network --------|   | host |

Count the ones: 24. That number is the prefix. Writing 10.3.0.37/24 says exactly the same as "address 10.3.0.37, mask 255.255.255.0". This short way is CIDR notation (Classless Inter-Domain Routing, RFC 1519, September 1993; today RFC 4632).

Three special numbers in every network¶

The computer finds the network address with a bitwise AND between address and mask: 1 AND 1 = 1, anything else = 0. Where the mask has ones, the address bit survives; where it has zeros, it becomes 0.

37      00100101
AND 0   00000000
=       00000000   → 0, so the network is 10.3.0.0

The three easy masks¶

Today, only the masks that cut exactly at a dot:

With /24 you do not even need binary: the first three numbers are the network, the last one is the host. On the next page the border moves inside the last number, and then binary is the only way.

Practise: network, broadcast, range¶

Work them out with a pencil first. Answers shown for group 1:

Then check your answers with Python, in one line (change the address between the quotes):

python3 -c "import ipaddress; n = ipaddress.ip_interface('10.1.0.37/24').network; print(n, n.netmask, n.broadcast_address, n.num_addresses - 2)"

10.1.0.0/24 255.255.255.0 10.1.0.255 254

It prints the network, the mask, the broadcast and the number of hosts.

Typical mistakes: writing your own address as the network (the network is the street: host part to zero); 172.16.5.0 for the /16 (the border is after the second number); forgetting the −2.

Private and special addresses¶

On 3 February 2011 the IANA, the organisation that hands out addresses to the world, gave away its last free blocks. The RIPE NCC, which serves Europe, ran out on 25 November 2019. The Internet survived thanks to two ideas: private addresses, reused in every home and office behind one public address (NAT, later in the unit), and IPv6.

A private address is one that anybody may use inside their own network, and that is never routed on the Internet.

RFC 1918 (February 1996) reserves three blocks:

Two more to recognise:

• 127.0.0.0/8 is loopback: "myself". 127.0.0.1 is the machine talking to itself.
• 169.254.0.0/16 is link-local: the address a machine gives itself when nobody gave it one. Seeing 169.254.x.x means "automatic configuration failed".

The plan of your group¶

For the rest of the unit each group G (1 to 8) uses this plan. Copy yours and keep it:

The convention: the router takes the first host address of each network. So group 3's LAN is 10.3.0.0/24, router 10.3.0.1, broadcast 10.3.0.255, hosts 10.3.0.1 to 10.3.0.254.

Lab: same network or not?¶

Start the lan lab and open pc1 and pc2, as on the earlier pages. First ask pc1 which networks it knows:

G=3 containerlab deploy -t lan.clab.yml       # host, in ~/labs, with your G
docker exec -it clab-lan-pc1 bash             # terminal 1
docker exec -it clab-lan-pc2 bash             # terminal 2
ip route                                      # on pc1

root@pc1:/# ip route
10.1.0.0/24 dev eth1 proto kernel scope link src 10.1.0.11
root@pc1:/# ip route get 10.1.0.13
10.1.0.13 dev eth1 src 10.1.0.11 uid 0
root@pc1:/# ip route get 10.1.1.12
RTNETLINK answers: Network is unreachable

pc1 knows exactly one network, its own /24. ip route get asks "how would you reach this address?". (You also see a line 172.20.20.0/24 dev eth0: containerlab's management network. Ignore it.)

Predict first, then ping each destination from pc1 with ping -c 1 -W 1 ADDRESS:

Two different silences. "100% packet loss" means: I looked for you in my street and nobody opened. "Network is unreachable" means: that is not my street, and I do not know any post office.

Same cable, different network¶

Now move pc2 to another network, on the same switch:

ip addr flush dev eth1                        # on pc2: remove its address
ip addr add 10.G.1.12/24 dev eth1             # on pc2: a new one (do not forget /24)
ping -c 1 10.G.1.12                           # on pc1
ping -c 1 10.G.0.11                           # on pc2

Both pings fail with Network is unreachable, in both directions. The two machines share a cable and a switch, but not a network part. To talk, they would need a router.

Put pc2 back (ip addr flush dev eth1, then ip addr add 10.G.0.12/24 dev eth1) and ping again from pc1: it answers. Then clean up with containerlab destroy -t lan.clab.yml --cleanup.

Key takeaways¶

• An IPv4 address is 32 bits, written as four octets in dotted decimal, each from 0 to 255.
• The mask (or prefix, in CIDR notation /24) splits it into a network part (the street) and a host part (the house).
• Host bits all 0 = network address; all 1 = broadcast address; hosts = 2^{host bits} − 2. A /24 has 254 hosts.
• Private blocks (RFC 1918): 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16. Loopback 127.0.0.0/8; link-local 169.254.0.0/16 means "nobody gave me an address".
• Two machines talk directly only if they share the network part. Otherwise they need a router, even on the same switch.
• Your group's LAN is 10.G.0.0/24, with the router at 10.G.0.1.

Quick check¶

Next: Tramuntana Apps has one /24 and departments that must not see each other. Time to cut it into pieces, in Subnetting.