IPv4 Addresses and Subnet Masks

IPv4 Addresses and Subnet Masks

What you'll learn

• Explain the two-part structure of an IPv4 address: network part and host part
• Apply the subnet mask as a filter to reveal any address's network number
• Predict whether two hosts can talk directly or need a router, from addresses and masks alone
• Recognize three special ranges on sight — loopback, APIPA and multicast — and diagnose the classic "169.254" symptom
• Tell the story of classful addressing: why classes existed, why CIDR replaced them in 1993, and where their ghost still appears

This lesson builds on Chapter 6 of Dr. Tahseen Al-Doori's Network Essentials — its IPv4 fundamentals, its subnet-mask teaching (the strongest single idea in the book's addressing chapters), and its tour of the special ranges. One book topic, classful addressing, is retold here as history rather than technique; the section near the end explains exactly why.

One address, two jobs

An IPv4 address is 32 bits — four octets, written in dotted decimal. But it is not one number with one meaning. Every IPv4 address divides into two parts with two different jobs:

• The network part (the left-hand bits) names which network the device sits on. Every device on the same network shares this part exactly, the way every house on a street shares the street name.
• The host part (the right-hand bits) names which device on that network, the way a house number picks out one building on the street.

This split is what makes routing possible: routers read the network part to steer a packet toward the right street, and only the final delivery cares about the house number. (Contrast this with a MAC address, which carries no location information at all — the next lesson builds on exactly that difference.)

There is one catch, and it is the reason this lesson exists: the dividing line between the two parts is not fixed. Some networks use 8 bits of network and 24 of host; others 24 and 8; others split mid-octet. Nothing in the address itself tells you where the line falls. Something else has to — and that something is the subnet mask.

The mask is a filter

Alongside its address, every IPv4 interface carries a second 32-bit value: the subnet mask. The book teaches it under a name that explains it better than the official one ever did — Dr. Al-Doori prefers to call it a filter, and this course keeps that model front and center.

Here is the filter model. The mask is a row of 32 bits with a strict shape: 1s on the left, 0s on the right, no mixing. Lay it under an address, bit for bit:

• Where the mask bit is 1, the address bit shines through — it is a network bit.
• Where the mask bit is 0, the address bit is blocked out — it is a host bit.

Apply the filter — keep every bit under a 1, zero every bit under a 0 — and what remains is the network number: the address with its host part blanked to zeros. That number is the network's name, the "street name" all its devices share.

The strict shape explains yesterday's mysterious table. Because a mask's 1s always fill from the left with no gaps, each of its octets must be one of exactly nine values: 255 (all ones), 0 (all zeros), or one of the seven left-filled octets between them — 128, 192, 224, 240, 248, 252, 254. A "mask" like 255.255.201.0 is impossible: 201 is 11001001, and those scattered 1s violate the no-mixing rule.

Worked example 1 — the easy case. Address 10.44.7.9, mask 255.0.0.0. The first mask octet is all 1s, so the entire first octet of the address passes through: 10. The other three mask octets are all 0s, so those address octets are blanked. Network number: 10.0.0.0. Host part: 44.7.9 — device 44.7.9 on network 10. When the mask breaks on octet boundaries like this, you can read the split without touching binary.

Worked example 2 — the line falls mid-octet. Address 172.19.200.77, mask 255.255.224.0. The first two octets pass whole (172.19) and the last is blanked — but the third octet needs the bits:

address octet 3:   200  =  1 1 0 0 1 0 0 0
mask octet 3:      224  =  1 1 1 0 0 0 0 0
                          ----------------
passes the filter:         1 1 0 0 0 0 0 0   =  192

Only the top three bits shine through, and they read 110 — worth 128+64 = 192. Network number: 172.19.192.0. Notice what just happened: two devices at 172.19.200.77 and 172.19.201.4 look like neighbors in decimal, but whether they truly share a network depends entirely on bits you can only see by filtering. This is the mechanic's moment from the last lesson — decimal is the paint job; the mask works on the engine.

(For the curious: the filtering operation is what logic calls a bitwise AND — a 1 survives only where address and mask both have a 1. Your networking stack performs it on every single packet it sends.)

Why the split matters: the direct-or-gateway decision

Every time your machine sends a packet, it makes one decision before anything else: is the destination on my own network, or not? The test is pure filtering. The machine applies its mask to its own address, applies the same mask to the destination, and compares the two network numbers:

• Same network number → deliver directly: the destination is on my street, I can address it locally.
• Different network number → I cannot reach it myself; hand the packet to the default gateway, the router that leads out of this network.

That is the entire decision — two filters and a comparison. It is why the encapsulation lesson in Module 2 told you outbound frames usually carry the gateway's MAC address. And it is why a wrong mask is one of networking's sneakiest faults: give a machine the wrong mask and it will misjudge who is local, confidently delivering some packets nowhere while its address looks perfectly fine. Lesson 6 of this module dissects the gateway decision in full; for now, hold on to the principle: addresses plus masks decide who talks directly to whom.

Try one: can 192.168.4.20 and 192.168.5.20, both masked 255.255.255.0, talk directly? Filter both: networks 192.168.4.0 and 192.168.5.0. Different streets — a router must stand between them, or they cannot exchange a single packet, even if they're plugged into the same switch.

The slash shorthand

Writing masks as four octets gets tedious, so the industry mostly writes them as a count. Since a mask is fully described by how many 1s it has (they're always on the left), 255.255.255.0 — twenty-four 1s — is written /24, spoken "slash twenty-four." 255.0.0.0 is /8; 255.255.224.0 from the worked example is 8+8+3 = /19. An address and mask together become compact: 172.19.200.77/19.

You will see this prefix notation everywhere: Linux tools print it by default (your lab shows it in a minute), router configs and documentation prefer it, and the subnetting lesson runs on it. For now, just convert confidently in both directions — count the 1s, or deal them out octet by octet.

Addresses that follow special rules

Three address ranges behave unlike ordinary addresses, and network technicians learn to recognize them on sight. Chapter 6 covers all three; here they are with their 2026 street value.

Loopback — 127.0.0.1. The entire 127.0.0.0/8 block is reserved, and its famous representative is 127.0.0.1, the loopback address. It does not belong to any network card — it lives purely inside your machine's TCP/IP software. A packet sent to 127.0.0.1 makes a U-turn inside the stack without ever touching hardware. That makes it a diagnostic scalpel: ping 127.0.0.1 succeeding proves your TCP/IP software is installed and functioning — while proving nothing about your cable, your Wi-Fi, or your network. It is the bottom rung of Module 2's troubleshooting ladder: the "does the engine even start?" test.

APIPA — 169.254.0.0/16. Most machines don't carry hand-typed addresses; they ask a DHCP server for one at boot (Module 5 devotes a lesson to DHCP). But what if the machine asks and nobody answers? Rather than sit addressless, the machine assigns itself a random address from the reserved range 169.254.0.0/16 — a mechanism called APIPA (Automatic Private IP Addressing), also known generically as IPv4 link-local addressing. In practice the draw is narrower than the whole block: RFC 3927 holds back the first and last 256 addresses, so a self-assigned address always falls between 169.254.1.0 and 169.254.254.255. (A 169.254 address outside that window did not come from standard self-assignment.) The address works only on the local network: it has no gateway, so it reaches nothing beyond the street.

Here is the symptom story you will meet in real life, over and over. A user reports "the internet is down." You run ipconfig and see Autoconfiguration IPv4 Address: 169.254.87.140. That single line tells you a complete story: the machine is set to obtain an address automatically; it broadcast a request for a DHCP server; it waited; no answer came; it fell back to self-assignment. The problem is therefore not the browser, not the web, not DNS — it is that this machine could not reach a DHCP server: the service is down, or the link to it is broken, or the machine is plugged into the wrong network. A 169.254 address is not really an address so much as a distress flare — learn its shape now and it will hand you free diagnoses for the rest of your career.

Multicast — 224.0.0.0 through 239.255.255.255. Module 2 gave you unicast (one recipient) and broadcast (everyone on the local network). The first octets 224–239 mark the third delivery mode: multicast, one-to-many delivery to exactly the devices that subscribed to a group — the mechanism behind live video streams to many viewers at once, and behind quieter machinery like routing protocols that address "all routers on this link" without disturbing anyone else. You won't configure multicast in this course, but you must recognize the range: an address starting 224–239 is never a normal device address.

One more family deserves a nod because you have been staring at it all along: addresses beginning 192.168., 10., or 172.16. through 172.31. are private addresses — reserved by RFC 1918 for use inside local networks (the blocks are 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16). Your home network almost certainly uses them; how they coexist with the public Internet — NAT — is a great story with its own lesson later in this module.

From the textbook to 2026: the rise and fall of address classes

Chapter 6, like every networking text of its era, teaches classful addressing: the rule that an address's first octet determined its network/host split. The design dates to the Internet's youth (early 1980s), when it seemed sensible to pre-cut the address space into fixed sizes:

(127 is missing from the table on purpose — that block became loopback.)

The elegance was that the address implied its own mask: see a first octet of 172, know the split is /16, no mask needed. The fatal flaw was the sizing: three sizes fit nobody. An organization with 300 devices was too big for a Class C (254 hosts) and comically too small for a Class B (65,534) — so it took the Class B and wasted sixty-five thousand addresses. Multiply that waste across the world and add the growth of the 1990s Internet, and the address space began visibly running out while router tables ballooned.

The fix arrived in 1993 and was refreshingly blunt: abolish the classes. CIDR — Classless Inter-Domain Routing — decreed that the mask alone defines the split, at any bit boundary, and that every address must travel with its mask (or its /n prefix) because nothing about the address implies it anymore. That is the world you have been learning all lesson, and it has been the only operative system for over three decades: the mask is the sole authority, /19 is as legitimate as /16, and "what class is this address?" stopped being a configuration question in 1993.

So why teach the table at all? Because the ghost of classful addressing still walks, and you will meet it:

• Your OS remembers. Type a static address of 10.x.x.x into Windows' network settings and it helpfully auto-fills the mask 255.0.0.0; type 192.168.x.x and it offers 255.255.255.0. Those suggestions are pure class-table nostalgia. Treat them as a first guess to verify, never an answer — your network's real mask is whatever your network design says, and accepting an echo of 1985 on a /19 network creates exactly the wrong-mask fault described earlier.
• The vocabulary lingers. Veterans and vendor docs still say "a Class C" for any /24, decades on. Understand it; don't imitate it.
• The multicast range is the class that survived. "First octet 224–239" is old Class D, still doing its original job.
• Old material lives forever. Certification archives, legacy configs and, yes, our own textbook reason in classes. Now you can read them fluently — as history.

The book presents classes as operative technique — the standard of its day and beyond, since certification curricula kept classes alive in classrooms long after 1993. This course follows current standard practice (RFC 4632): all arithmetic is mask-first and classless, and classes appear only the way Latin appears in medicine.

Lab: Read your own address

Time to move from paper to your actual machine. Every device you will ever troubleshoot has the three values this lesson taught — address, mask, gateway — and reading them is the first move of nearly every diagnosis.

Objective. Find your machine's real IPv4 address, subnet mask and default gateway; compute your network number with the filter; verify the gateway passes the direct-or-gateway test.

Setup. Any Windows or Linux computer connected to a working network (home Wi-Fi is perfect). No installs, no changes — this lab only reads. Have paper ready for one filter computation.

Steps.

1. Open a terminal (Windows: search cmd; Linux: any terminal).
2. Windows: run ipconfig /all. Find the adapter that carries your connection (Wi-Fi or Ethernet — the one with a Default Gateway listed) and record: IPv4 Address, Subnet Mask, Default Gateway, and whether DHCP Enabled says Yes. If yes, also note Lease Obtained and Lease Expires — proof your address is borrowed, not owned.
3. Linux: run ip addr. Find your active interface (typically wlan0, eth0 or enp… — the one marked state UP with an inet line that is not 127.0.0.1) and record the inet value. Notice it comes as address-slash-prefix, e.g. 192.168.1.23/24 — prefix notation in the wild, exactly as promised. Then run ip route show default and record the gateway address after the word via.
4. Convert between mask forms: Windows users, turn your dotted mask into /n by counting 1s; Linux users, expand your /n into dotted decimal. (For the overwhelmingly common home case: /24 ↔ 255.255.255.0.)
5. On paper, apply the filter: mask against your own address, octet by octet, to produce your network number.
6. Apply the same filter to your gateway's address. Compare network numbers.
7. Note your Physical Address (Windows) or link/ether line (Linux) for the next lesson — that hex string is your MAC address, about to become important.

Expected result. A typical home network yields something like: address 192.168.1.23, mask 255.255.255.0 (/24), gateway 192.168.1.1, network number 192.168.1.0 — with the gateway's network number matching yours.

Verify. Three checks: your address's first octets place it in a private range (192.168.x.x, 10.x.x.x, or 172.16–31.x.x — expected on any home or office network); your computed network number matches your address with the host part zeroed; your gateway shares your network number exactly. That last one is not a coincidence — a gateway must live on your network, or you couldn't reach it to hand packets over (a point the gateway lesson builds on).

Questions.

1. Which part of your address is the host part, and how many bits long is it?
2. If DHCP Enabled says Yes: who chose your address — you, your machine, or another device? What happens when the lease expires?
3. Could your machine talk directly to 8.8.8.8 (a public DNS server)? Run the two-filter test and answer from network numbers.

(Answers: 1 — the bits under the mask's 0s; on a /24, the final octet, 8 bits. 2 — a DHCP server chose it; at expiry the machine renews the lease, usually keeping the same address, or requests a fresh one — Module 5 covers the mechanics. 3 — no: 8.8.8.8 filters to a different network number than yours, so packets for it go to your default gateway.)

If it goes wrong.

• Several adapters, which one? VPNs and virtual machines add phantom adapters. The physical one is the adapter with a Default Gateway entry (Windows) or the interface named in ip route show default (Linux).
• Your address starts 169.254. You've caught the APIPA flare in the wild: your machine got no DHCP answer. Reconnect to the network or restart your router, then repeat the lab — and congratulations on your first live diagnosis.
• Linux shows only lo with 127.0.0.1. Only loopback is up — your interface is down or disconnected. Reconnect (Wi-Fi menu or cable) and rerun ip addr.
• The mask isn't 255.255.255.0. Not a problem — a gift. Do step 5 in binary like worked example 2, and enjoy being ahead of the curve for the subnetting lesson.

Reset/cleanup. Nothing to clean up — the lab read values and changed nothing.

Check yourself

1. Dissect 172.19.200.77 with mask 255.255.240.0: network number, and the number of host bits. (Careful — the mask differs from the lesson's worked example.)
2. A user reports nothing loads; ipconfig shows IPv4 Address 169.254.203.5. Name the mechanism that produced this address, state what failed, and give the first place you'd investigate — is it the user's browser, the web server, or something else?
3. ping 127.0.0.1 succeeds on a laptop that cannot reach any website. List one thing this proves and two things it does not prove.
4. Hosts A (10.1.130.7, mask 255.255.128.0) and B (10.1.200.9, same mask) — same network or different? Show the third-octet filtering that decides it.
5. A colleague configures a server with address 225.10.10.5 and cannot understand why everything misbehaves. What did they miss?
6. While setting a static address 172.20.9.14, Windows auto-fills the mask 255.255.0.0. The network plan says the subnet is a /24. Which do you enter, and where did Windows' suggestion come from?

Answers

1. Mask third octet 240 = 11110000. Address third octet 200 = 11001000; top four bits pass: 1100 0000 = 192. Network number 172.19.192.0 — and host bits are the mask's 0s: 4+8 = 12 bits. (Same network number as the /19 example, via a different mask — the mask, not the address, decides.)
2. APIPA (automatic link-local self-assignment). The machine requested an address via DHCP broadcast and no DHCP server answered, so it self-assigned from 169.254.0.0/16 — an address with no gateway. Investigate the path between this machine and the DHCP service: wrong network/VLAN, dead cable or Wi-Fi association, or the DHCP server (usually the home router) itself — not the browser and not the web.
3. It proves the machine's TCP/IP software is installed and functioning. It does not prove the network card delivers to the network (loopback never touches hardware), and it does not prove the gateway, DHCP, DNS, or anything beyond the machine works — the loopback U-turn happens entirely inside the stack.
4. Mask third octet 128 = 10000000 — only the top bit passes. A: 130 = 10000010 → passes 1 → 128. B: 200 = 11001000 → passes 1 → 128. Networks: 10.1.128.0 for both — same network, direct delivery, no router needed. (Decimal instinct says "130 vs 200 — different"; one filtered bit says otherwise. This is why we compute.)
5. 225.x.x.x sits in the multicast range (first octet 224–239). Those addresses name delivery groups, never individual devices — a server can't use one as its own unicast address. Pick an ordinary address from the network's plan.
6. Enter the plan's mask: 255.255.255.0. Windows' suggestion is a classful echo — 172.20 falls in the historical Class B range, so it offers /16, a rule that stopped governing real networks in 1993. The design document outranks the ghost.

Key terms

• Network part / host part — the two jobs inside every IPv4 address: which network, then which device on it.
• Subnet mask — the 32-bit filter (1s left, 0s right, never mixed) that defines where network ends and host begins.
• Network number — an address with its host bits zeroed; the shared name of a network, revealed by the filter.
• Default gateway — the router a host hands packets to when the destination's network number differs from its own.
• Prefix notation (/n) — writing a mask as its count of 1-bits: /24 = 255.255.255.0.
• Loopback (127.0.0.1) — the software-only self-address; a successful ping proves the stack, nothing more.
• DHCP — the service that leases addresses to machines automatically (full lesson in Module 5).
• APIPA / link-local (169.254.0.0/16) — the self-assigned fallback range when DHCP goes unanswered; a diagnostic flare.
• Multicast range (224–239) — first octets marking one-to-many group delivery, never a device's own address.
• Private addresses (RFC 1918) — 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16; local-use ranges detailed in the NAT lesson.
• Classful addressing (obsolete) — the pre-1993 system where the first octet implied the mask; history and vocabulary only.
• CIDR — Classless Inter-Domain Routing (1993): the mask alone, at any bit boundary, defines the split.

Summary

• An IPv4 address is 32 bits doing two jobs: network part (the street) and host part (the house number) — and the boundary between them is set by the mask, not the address.
• The subnet mask is best understood the way the book teaches it: a filter — 1s let network bits shine through, 0s blank the host bits, and what remains is the network number.
• Mask octets can only be the nine left-filled values; anything else is not a mask.
• Every send starts with the direct-or-gateway decision: filter my address, filter the destination, compare — same network number means direct delivery, different means hand it to the gateway.
• /n prefix notation counts the mask's 1-bits; Linux speaks it natively and the subnetting lessons run on it.
• Special ranges to know on sight: 127.0.0.1 loopback (stack test), 169.254.x.x APIPA ("DHCP didn't answer" flare), 224–239 multicast (group delivery), plus the RFC 1918 private blocks.
• Classes A–E governed addressing until CIDR abolished them in 1993; they persist only as OS auto-fill suggestions, slang, and the multicast range — read them as history, never configure by them.

Next lesson

Your machine now has two addresses to its name — the IP address you just read, and the MAC address you noted in step 7. Next lesson: why one delivery needs both, and the protocol that introduces them to each other.

Sources and further study

• Al-Doori, T., Network Essentials, Chapter 6 — IPv4 structure, the mask-as-filter teaching, special ranges, and the classful system taught here as history.
• RFC 791, "Internet Protocol" — https://www.rfc-editor.org/rfc/rfc791.html — the IPv4 address in its original habitat.
• RFC 4632, "Classless Inter-Domain Routing (CIDR)" — https://www.rfc-editor.org/rfc/rfc4632 — the current standard (BCP 122) for the classless world.
• RFC 1918, "Address Allocation for Private Internets" — https://www.rfc-editor.org/info/rfc1918/ — the private ranges previewed above.
• Microsoft Learn, "ipconfig" — https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/ipconfig — reference for the lab's Windows command.
• Download: OSI and TCP/IP Model Reference (the layer card from Module 2 — addressing lives at the internet layer you mapped there).