IPv4 addressing, subnets, and why the mask matters more than the address

Why this matters

Addressing is where candidates lose the most marks in domain 2, and almost always for the same reason: they learn the address and treat the mask as decoration. The mask is the part that does something. It is what a host consults, on every single packet, to decide whether to deliver directly or hand the packet to a router.

Core 1 does not ask you to subnet a network into thirteen pieces. It asks whether two given hosts can communicate, whether a stated configuration is workable, and what a machine will do with a particular address and mask. Those are answerable with one skill: turning an address and a mask into a range.

This lesson is also the foundation for lesson 40, where a machine has an address, a gateway and no connectivity, and the mask turns out to be the reason.

The lesson

Address and mask as one statement: what the machine decides with them

An IPv4 address is 32 bits, written as four decimal octets. On its own it is incomplete. The mask splits it into a network part and a host part, and that split is the whole point.

When a host has traffic for a destination, it does exactly one calculation:

1. Apply my mask to my own address to get my network.
2. Apply my mask to the destination address to get its network.
3. If they match, the destination is local: resolve its hardware address and send directly.
4. If they do not, send to the default gateway.

Everything else about local networking follows from those four lines. A host with a wrong mask will decide wrongly, and which way it decides wrongly predicts the symptom:

• Mask too narrow (more network bits than it should have): the host thinks local machines are remote and sends their traffic to the gateway. If the gateway routes it back onto the same segment, it may even work, slowly and oddly. If not, local machines are unreachable while the internet is fine.
• Mask too wide: the host thinks remote machines are local and tries to resolve their hardware address directly. Nothing answers. The internet fails while the local network works.

That second pattern is worth memorising. "Local resources fine, internet broken, gateway is configured" is a mask question before it is anything else.

Private ranges, public addresses and where network address translation sits

Three ranges are reserved for private use and are never routed on the internet:

• 10.0.0.0 to 10.255.255.255 — a /8, one very large network.
• 172.16.0.0 to 172.31.255.255 — sixteen contiguous /16 networks. Note the range ends at 172.31, not 172.32; that boundary is examinable.
• 192.168.0.0 to 192.168.255.255 — 256 /24 networks, the home and small office default.

Also worth recognising: 127.0.0.0/8 is loopback, where 127.0.0.1 is the host itself; 169.254.0.0/16 is link-local, the APIPA range covered in lesson 13; and addresses beginning 224 and above are multicast and reserved.

Private addresses reach the internet through network address translation, performed by the router. The router rewrites the source address of outgoing packets to its own public address, records the mapping, and reverses it on the way back. Nearly every small network uses the port-based form, where many internal hosts share one public address and are distinguished by port.

Two consequences the exam asks about. Outbound works automatically; inbound does not, because there is no mapping until a host inside starts a conversation. That is why reaching a service inside the network from outside requires an explicit port forward — covered in lesson 14.

Reading a mask in both notations, and converting between them without a calculator

Masks appear as dotted decimal (255.255.255.0) and as prefix length (/24), and you need to move between them quickly.

The only octet values a mask can contain, in order, are:

0, 128, 192, 224, 240, 248, 252, 254, 255

Each corresponds to a number of bits set: 0, 1, 2, 3, 4, 5, 6, 7, 8. So the prefix length is the sum across the four octets.

• 255.255.255.0 = 8 + 8 + 8 + 0 = /24
• 255.255.0.0 = /16
• 255.0.0.0 = /8
• 255.255.255.128 = 8 + 8 + 8 + 1 = /25
• 255.255.255.192 = /26
• 255.255.255.240 = /28
• 255.255.252.0 = 8 + 8 + 6 + 0 = /22

The host count follows from the bits left over: 2 to the power of the host bits, minus two for the network address and the broadcast address. A /24 has 8 host bits, so 254 usable addresses. A /26 has 6, so 62. A /30 has 2, so 2 — which is exactly right for a point-to-point link.

A mask with a value not in that list, such as 255.255.255.100, is invalid. Mask bits must be contiguous from the left.

Deciding whether two addresses can talk directly, which is the whole examinable skill

Given two addresses and a mask, the question is always: same network or not?

The reliable method for the octet where the mask is not 0 or 255:

1. Find the block size: 256 minus the mask value in that octet.
2. The networks start at multiples of that block size.
3. Find which block each address falls into.

Worked examples:

• 192.168.1.10/24 and 192.168.1.200/24. Mask is 255.255.255.0, so the first three octets must match. They do. Same network.
• 192.168.1.10/24 and 192.168.2.10/24. Third octet differs. Different networks — they need a router, and a user who has plugged them into the same switch and expects them to talk is describing this fault.
• 10.1.1.100/25 and 10.1.1.200/25. Mask 255.255.255.128, block size 128. Blocks are 0-127 and 128-255. The first is in 0-127, the second in 128-255. Different networks, despite the first three octets matching — which is exactly the trap the exam sets.
• 172.16.5.20/22 and 172.16.6.30/22. Mask 255.255.252.0, block size 4 in the third octet. Blocks are 0-3, 4-7, 8-11. Both are in 4-7. Same network.

Practise that last shape until it is automatic. It is the single most commonly examined calculation in this domain.

Default gateways: what a machine does with traffic it cannot deliver itself

The default gateway is the router the host sends anything non-local to. Three facts about it are examinable:

• It must be on the host's own subnet. A gateway outside the local range is unreachable by definition, because the host would need the gateway to reach the gateway. This misconfiguration produces total loss of remote connectivity with perfect local connectivity.
• A host with no gateway is not broken. It works perfectly within its own subnet. Only remote traffic fails, and the user reports "the internet is down" while the local printer works — which is the diagnostic signature.
• The gateway is not the DNS server, although on a home router they are usually the same device. Confusing them is why "I set the gateway, why does nothing resolve" happens.

The confirming test is a three-step ping, and the order matters because each step rules out a layer:

1. Ping the loopback address: proves the host's own stack works.
2. Ping the host's own address, then another host on the same subnet: proves the interface and the local segment.
3. Ping the default gateway: proves the router is reachable.
4. Ping a known external address, then a known external name: separates routing from name resolution.

Lesson 40 turns this into a full method. The point here is that each step is chosen to eliminate exactly one possibility, which is what makes it a diagnostic sequence rather than a list of commands.