IP Addressing, Subnets & CIDR

What an IP address is

An IP address is the network-layer identity of a host — the "where" that routing uses to move a packet across networks. Two versions coexist:

• IPv4 — 32 bits, written as four octets (192.168.0.1). ~4.3 billion addresses, long since exhausted, which is why NAT and private ranges are everywhere.
• IPv6 — 128 bits (2001:db8::1). An effectively unlimited space that removes the need for NAT, though IPv4 persists for compatibility.

Public vs private addresses

Certain IPv4 ranges are reserved as private — routable only inside a local network, never on the public internet. A NAT gateway translates many private hosts behind one public address. Knowing these ranges on sight is genuinely useful when reading any cloud VPC config:

One category note: the three RFC 1918 ranges are what "private" formally means; loopback is a separate reserved block (RFC 1122's special-use space) that never leaves the host at all.

CIDR — how address blocks are sized

CIDR (Classless Inter-Domain Routing) notation appends a prefix length: 10.0.1.0/24. The number is how many leading bits are fixed (the network part); the remaining bits are host addresses. The rule of thumb:

Each step down in prefix length doubles the block. A /24 holds 2^(32−24) = 256 addresses; a /16 holds 65,536.

This is the math behind sizing a cloud subnet, writing a firewall/security-group rule, or reading a routing table. When you allocate 10.0.0.0/16 to a VPC and carve /24s out of it for each availability zone, you are just spending host bits.

Takeaways

• IP = network-layer host identity; IPv4 (32-bit, scarce) vs IPv6 (128-bit, abundant).
• Private ranges (10/8, 172.16/12, 192.168/16) stay off the public internet; NAT bridges them.
• CIDR /N fixes N network bits; addresses = 2^(32−N). Smaller N = bigger block.

NAT is not infinite

A NAT gateway keeps a connection table keyed by the 4-tuple the far side sees: (source IP, source port, destination IP, destination port). With one public IP, all hosts behind it share the same ~64,512 ephemeral source ports per destination — because the destination is part of the key, the same translated source port can be reused toward a different (dst-ip, dst-port) pair. If 2,000 pods all call the same downstream API without connection reuse, the port table for that one destination fills and new connections are refused even though bandwidth is plentiful. The exhaustion math:

One nuance: this assumes the NAT allocates ports per destination pair — Linux netfilter SNAT and cloud NAT gateways behave this way for TCP (AWS documents its NAT Gateway as supporting up to ~55,000 simultaneous connections to each unique destination per IPv4 address). An endpoint-independent NAT that reserves one global mapping per internal socket instead has a single shared ~64K budget across all destinations — know which one you are behind before doing capacity math.

If 10,000 containers each keep 10 idle connections to the same database, that is 100,000 entries against the 64K-per-destination limit. NAT exhaustion produces confusing errors: new outbound connections time out while inbound traffic and established flows keep working. The fix is connection pooling, shorter idle timeouts, or assigning more public IPs. NAT also hides the original source IP from servers, complicates logging/rate-limiting, and breaks protocols that embed IP addresses (some IPsec modes, FTP active mode).

Trade-offs: private addresses and NAT

• Great for stretching scarce IPv4 space and keeping internal hosts off the public internet.
• Hurt when you need peer-to-peer connectivity, clean audit logs of original clients, or easy merging of two networks that were both allocated the same default range (e.g., two companies both used 10.0.0.0/16).
• IPv6 changes the game by giving every host a globally routable address, removing the need for NAT in internal networks — at the cost of running dual-stack until IPv4 finally disappears.

Worked split: a VPC into availability zones

Allocate 10.0.0.0/16 to a VPC. That spans 10.0.0.0–10.0.255.255 (65,536 addresses). Subnet count is pure bit math: a /16 has 16 host bits; each /24 consumes 8 of them, so you can carve 2^(24−16) = 256 distinct /24 subnets — not 254. (The classic −2 is for usable hosts inside one subnet, never for how many subnets fit in a prefix.)

After carving three /24s you still have 256 − 3 = 253 free /24 slots in the VPC. Inside each AWS /24, usable hosts are 256 − 5 = 251 (network, broadcast, and three AWS-reserved addresses) — that host reservation does not shrink the subnet count. The third octet increments by one for each /24, which is the usual convention.

CIDR aggregation example

Suppose a router sees four adjacent subnets:

• 10.0.0.0/24
• 10.0.1.0/24
• 10.0.2.0/24
• 10.0.3.0/24

These four blocks share the first 22 bits (10.0.0.x through 10.0.3.x), so they can be summarized as one route: 10.0.0.0/22. Aggregation reduces routing-table size and keeps upstream routers from tracking every small subnet. The rule: the aggregate must cover exactly the contiguous blocks you intend. For instance, 10.0.0.0/24 and 10.0.2.0/24 do not sit together on a power-of-two boundary, so the smallest single prefix covering both is 10.0.0.0/22 — which also pulls in 10.0.1.0/24 and 10.0.3.0/24, blocks that may belong to someone else. (A /23 like 10.0.0.0/23 spans only 10.0.0.0/24 and 10.0.1.0/24, so it cannot summarize 10.0.2.0/24 at all.) When several routes overlap, a router forwards using longest-prefix match — the most specific route (the largest prefix length) covering the destination wins, so a /24 entry always takes precedence over a /22 that happens to contain it.

Drills — do the math before an interviewer makes you

CIDR is one of the few system-design topics you may be asked to compute live. Work each one before opening the answer.

1. You hold 10.0.0.0/16 and need 6 subnets of at least 8,000 hosts each — what prefix, and how many fit?
   Show answer

   8,000 usable hosts needs 13 host bits: 2¹³ = 8,192 total, and 8,192 − 5 = 8,187 ≥ 8,000 even after AWS's five reserved addresses. 13 host bits means a /19. A /16 holds 2^(19−16) = 8 distinct /19s, so all 6 fit — with 2 spare.

2. What is the smallest single prefix covering both 10.0.4.0/24 and 10.0.7.0/24?
   Show answer

   Compare the third octets in binary: 4 = 00000100, 7 = 00000111. They agree on the octet's first six bits and first differ at its seventh bit — i.e. the addresses share their first 22 bits, a /22 boundary. The answer is 10.0.4.0/22 (third octets 4–7) — which also pulls in 10.0.5.0/24 and 10.0.6.0/24, so make sure those belong to you before advertising the aggregate.

3. A router holds both 10.0.4.0/22 and 10.0.5.0/24. A packet arrives for 10.0.5.9 — which route wins, and why?
   Show answer

   The /24 wins by longest-prefix match: when several routes cover the same destination, the router forwards using the most specific one (the largest prefix length). The forwarding rule in one line: match all candidate routes, pick the longest prefix, forward there.

Private vs public address table

Re-authored for this guide, with concepts and diagrams adapted from Karan Pratap Singh’s System Design (course, MIT licence) and the System Design Primer (CC BY 4.0). Diagrams © their respective authors.