Tech Stuff - IPv4 Classes, Subnets, Netmasks, CIDR and NAT

<warning> To understand this stuff you need to be be comfortable with decimal, hexadecimal and binary notation. If you don't like this stuff stick to origami or try this memory jogger - Binary, Decimal and Hexadecimal</warning>

Most of this note is concerned with IP addresses used in version 4 of the IP protocol which uses a 32 bit IP address, such as, 192.168.0.15. This type of address is almost universally written as IPv4. See also IPv4 headers, TCP, UDP and IPv4 ICMP messages for the insatiably curious.

IPv4 is being progessively replaced with IPv6 (version 6 of the IP protocol) which uses a 128 bit address and greatly extends the address range of the Internet. While the immediate pressure for new IP addresses was hugely reduced in the mid-late 90s by CIDR, NAT and other initiatives, the increasingly dire warnings from the Regional Internet Registries (RIRs) of IPv4 address depletion are placing renewed emphasis on IPv6 deployment. Indeed, it is no exaggeration to say that a rising tide of panic is being fostered in an effort to increase the pace of IPv6 migration. Further, the adoption of IPv6 by the wireless world is probably the only way to supply the staggering number of mobile devices the world seems capable of consuming.

Contents

• Bit Numbering Conventions
• IPv4 Addresses
• IP Address Classes
• Netmask and Subnetmask
• IP Routing
• Bitwise ANDing
• Subnets (netmasks and subnetmasks)
• Multi-cast and Broadcast IPs
• Multicasting
• IP Address Usage
• Classless Inter-Domain routing (CIDR)
• IP Prefix (Slash) notation - 192.168.2/24
• Private IP Address Allocation
• Network Address Translation (NAT)
• Static and Dynamic IP Addresses
• IPv4 Calculator

Bit numbering

Once Upon a Time - IPv4

192.168.1.2:369

IP Address Classes

Netmask and Subnetmask

Routing of IPs

Bitwise AND

Subnets

Network and Broadcast Addresses

Multicasting Protocols

CIDR and NAT

CIDR

IP Prefixes - the slash format (17.16/16)

To simplify writing IP addresses used in routing or filtering systems it has now become common practice to define a list of IP addresses using a slash (more properly IP Prefix) notation. The IP address to the LEFT of the SLASH (/) is the Network (base) IP address and the number (1 to 32) to the RIGHT of the SLASH (/) is the number of contiguous 1 bits in the netmask. Thus, 192.168.2.0/24 will have an associated net/subnetmask containing 24 contiguous bits or 255.255.255.0 in dotted decimal format. The following table illustrates this notation:

Notes:

1. Experiment with IPv4/Prefix in the IPv4 Calculator.

2. In the above examples - if you are not asleep - you will see that we have extracted multiple Class C addresses from a Class C IP address (line 1) and subnetted sub-class C addresses from a Class B address (line 3) just to illustrate how flexible CIDR has allowed us to become.

3. Software, such as BIND (DNS), OpenLDAP (LDAP) and others, that interprets (or parses) IP addresses is very flexible in allowing specification of the number of dotted elements of the IPv4 address as shown in lines 1, 3 and 5. Essentially, only the minimum number of dotted elements necessary to unambigously define the IPv4 Network Base are required. All missing elements are replaced with zero before the IP Prefix/slash value (netmask) is applied to create the Network Base IP. In the case of line 4 in the above table, all 4 dotted elements must be present. If 172.28.127/28 was used the Network Base IP would be 172.28.127.0 - not the required result. In general, the rule is that if the slash value is a multiple of 8 you need only provide that number of dotted elements, if it is NOT a multiple of 8 you must supply one more. Thus, if the slash value is 16 (16/8 = 2 Remainder 0), then only two dotted elements are required. If the slash value is 25 (25/8 = 3 Remainder 1), then 4 dotted elements are required. Specifying more dotted elements than necessary is never a problem as long as the resulting range is understood as illustrated in lines 7 and 8.

4. The IP address used on the left-hand side can be any IP that will be within the final Network. The Network Base IP is computed by BITWISE ANDing the left-hand IP with the netmask derived fom the slash value.

5. Line 6 is a rare, but acceptable, format to show a single address - it is more commonly simply written as 10.0.2.2.

Private Network addresses

The IETF has defined a series of IP ranges (in RFC 1918) which may be freely used by any user/organization on their Private network. These addresses may not be used on the Public internet and all Public Internet gateways (routers) should silently discard the traffic (or, unusually, reject them with an ICMP message).

Clearly on large user networks Private IP addresses may well pass through routers while still inside a Private network.

The use of Private address means that the same IP addresses may be reused by many organisations (saving millions of IPv4 addresses) and only when the traffic is sent to the PUBLIC network must it be translated (via NAT) to a Public address.

Freely useable Private (not Public routable) Addresses

Which range you use is entirely up to you. Go on, spoil yourself (and be like Apple), have a whole class A address to yourself! In the case of home networks attached to a DSL or cable modem, it is normal to see a Class C range of 192.168.1/24 or 192.168.2/24. However, this is just a convention and any suitable range may be used. The full list of reserved and allocated IP address ranges are defined in RFC 1918 and RFC 3330 (you can get RFCs from the IETF).

Network Address Translation (NAT)

Network Address Translation (NAT) refers to the process by which a Private IP address (which may be freely used and routed in a user's Private network) may be mapped (or translated) to a Public IP addresses which can be routed across the Public Internet.

The NAT process is usually located in a Router or Proxy function at the edge of the network such as a DSL or cable modem. The original NAT RFC (RFC 1631) is a deceptively small specification which revolutionized the way IP addresses are used. NAT can map (or translate) an unlimited number of Private IP addresses to a single Public IP address if required, or a limited number of Public IPs can be used to map a large number of Private IP addresses.

A well written NAT system also acts as a 'poor mans' firewall since it has the additional advantage that Internal IP addresses are not visible from outside the organisation and even if they were Internet routers should discard packets addresses to Private IP addresses. NAT is generally a 'good thing'™ for the traditional client server style applications of the Internet such as web access, FTP and email.

Note: As the Internet moves more to peer-to-peer applications, such as IM and VoIP, which require permanent visibility of a directly addressable IP that is stable for a reasonable period of time, NAT is becoming increasingly contentious. It is fair to say there is serious gulf between those that see NAT as having saved the Internet by providing re-use of the limited IPv4 address space and those who see it as inherently evil because it hides the end user, forcing all kinds of gruesome kludges such as STUN.

The term PAT (Port Address Translation) is used in conjunction with NAT. It refers to the process by which a NAT service can map a port number to a specific Private IP address. This allows a single Public IP address to support a range of Public services (Web, email, FTP etc.) on internal (Private IP) hosts. Example:

Note: The External IP:Port shown above uses a Private address purely for illustration of the process involved and to avoid using an allocated Public IP address - the principle remains true.

Static and Dynamic IP Addresses

IP addresses may be either statically allocated or dynamically allocated by a service provider. A dynamic IP address has the following characteristics:

1. A single IP address is allocated when the user connects to the internet.

2. The service provider will normally change the IP address periodically - between every 12 and 24 hours is typical, significantly longer periods are increasingly common.

3. Dynamic IP addresses can be used for outgoing (client-server) activities such as Web browsing, collecting email and similar activities.

4. Dynamic IP addresses cannot be used (well there are 'kludges' that allow this) to host Web sites and email services that require a fixed IP defined in a DNS.

Static (Fixed) IP address(es) have the following characteristics:

1. One or more fixed IP address(es) are permanently assigned to a user (and will normally incur a cost).

2. Static IP addresses do not change (unless you change your service provider).

3. Static IP addresses can be used for outgoing (client-server) activities such as Web browsing, collecting email and similar activities.

4. Static IP addresses can be used to host Web sites and email services that require a fixed IP defined in a DNS.

5. A limited number of static address can be used in conjunction with NAT to map many PRIVATE to PUBLIC addresses.

There is a longer explanation here.

3.6 IPv4 Address Calculator

The tool has two parts that are invoked separately. The first part is essentially a simple IPv4 calculator and is invoked using the IPv4 Info button. The second part provides an IPv4 bitwise AND feature. This part is invoked with the Bitwise AND button.

IPv4 Calculator: Enter an IPv4 address with its /Prefix (or slash) notation in the IPv4/Prefix: box and click IPv4 Info. The calculator will populate No. of IPs (covered by the /Prefix or slash value), IPv4 Netmask in dotted decimal format (a dotted hex format is also shown enclosed in []) represented by the /Prefix, IPv4 Range lists the start and end IPv4 addresses covered by the /prefix (a dotted hex format is also shown enclosed in []). Finally, for those of you who need it (ignore it if not) the reverse map zone name of the IPv4 address is calculated based on the /Prefix value (IPv4 addresses below this name will be defined in the reverse zone file) and is shown in FQDN format in Reverse Zone.

Alternatively, enter a single IPv4 address (that lies anywhere in the desired range) without the /prefix in IPv4/Prefix and the number of desired IP addresses (if it is not a power of 2 it will be rounded up to the nearest power of 2) in No. of IPs then click IPv4 Info. The calculator will populate IPv4/Prefix (with the calculated /Prefix to cover the required or calculated number of IP addresses), No. of IPs will be updated if needed (due to any power of 2 rounding required) and IPv4 Netmask, IP Range and Reverse Zone will be populated normally.

The Clear button zaps ALL entries in IPv4 Calculator only.

Notes:

1. Validation and other errors are shown in the IPv4 Netmask box for no very good reason.

2. When entering a /prefix IPv4 address you only need to enter as many dotted elements as are required by the /prefix (more is not a problem), if you enter less than the required number the calculator silently pads with zeros to the right.

Bitwise AND: This calculator Bitwise ANDs any two IPv4 addresses. The bit patterns of the two IPv4 addresses and shown together with the bit pattern of the result together with its dotted decimal (and a dotted hex) value.

Enter the two IPv4 address (without any /Prefix notation) in the boxes labeled IPv4 1: and IPv4 2: (order is not important). If you omit IPv4 1: the value in IPv4/Prefix: will be used. If you omit IPv4 2: the calculated value in IPv4 Netmask: will be used. Click the Bitwise AND button to activate.

The calculator places the binary value (bit pattern) of IPv4 1: in Binary 1: and that of IPv4 2: in Binary 2:. Binary AND: contains the binary value of the result and IPv4 Result: shows the dotted decimal form (and a dotted hex form enclosed in []).

Clear will zap all entries in the Bitwise AND part only.

Notes:

1. Validation or other errors will appear in IPv4 Result: for no very good reason.

2. If less that 4 dotted decimal elements for any IPv4 address are entered the calculator will silently pad with zeros to the right.

Notes:

1. Javascript implementations may vary from browser to browser. This feature was tested with MSIE 10, Gecko (Firefox 25.0.1), Opera 11.10 and Chrome (31.0.1650.57 m) - so will likely work with any WebKit based browser, which obviously includes Safari (and now even Opera!)). If the tester does not work for you we are very, very sad - but yell at your browser supplier not us. However, if you do think you have found an error, or want to suggest improvements, please take the time to email using the link at the foot of this page.

Problems, comments, suggestions, corrections (including broken links) or something to add? Please take the time from a busy life to 'mail us' (at top of screen), the webmaster (below) or info-support at zytrax. You will have a warm inner glow for the rest of the day.