Core CS · Computer Networks
Four numbers, thirty-two bits, one line drawn through them
Every subnetting question you will ever be set is this one skill: turn four decimals into 32 bits, find the line the mask draws through them, and read off the network, the broadcast and the host count. Classful addressing is where that line used to be decided by the leading bits of the first octet.
Type any address and watch it come apart, bit by bit →01 The idea
Thirty-two bits, and the line that cuts them in two
A MAC address names a card. It is flat, it has no parts, and nothing can route on it, which is why the previous lesson had to shout on a single link to find one. An IPv4 address is the opposite kind of number. It is 32 bits, and those bits are split into two fields: a network part on the left saying which network the machine is on, and a host part on the right saying which machine on that network. A router at the far end of a corporate backbone handling a packet for 172.16.94.221 reads only the network part, matches it against its table, and sends the packet onward without knowing or caring that .94.221 exists. That is the entire reason the internet scales: one row in a routing table covers millions of machines.
You never see those 32 bits. You see 172.16.94.221, and the dots are punctuation added for people. The bits are cut into four groups of eight called octets, each printed as a decimal from 0 to 255, because eight bits hold 28 = 256 distinct values and 0 to 255 is how you write them. On the wire the IPv4 header carries the source and destination as 32 bare bits each with nothing between them. So the first thing to learn is the conversion in both directions, and to learn it as a mechanical habit rather than a calculation, because every number later in this module comes out of it.
Now the awkward part. The split between network and host is not visible in the address. 172.16.94.221 could be one machine on a network of 65,534, or one machine on a network of 62, and the digits are identical in both cases. What decides is a second 32-bit number carried alongside, the subnet mask: a 1 bit wherever the address bit belongs to the network, a 0 bit wherever it belongs to the host. The 1s are always contiguous and always start at the left, so a mask is completely described by how many of them there are. 255.255.0.0 and /16 are the same mask written two ways, and you will meet both in the same afternoon.
In 1981, when RFC 791 defined IPv4, carrying a mask around felt wasteful, so the designers made the address imply it. Look at the leading bits of the very first octet. A leading 0 means class A and the mask is /8. A leading 10 means class B and the mask is /16. A leading 110 means class C and the mask is /24. Nothing else about the address is consulted, and no mask needs to be sent anywhere: any machine holding the address can work out where the line falls. That is classful addressing, and it is the reason the first octet ranges are worth memorising.
It is also why classful addressing collapsed. Three sizes is three sizes. Class C gives you 254 usable addresses and class B gives you 65,534, with nothing at all in between, so an organisation with 400 machines had to be handed a class B and leave 65,134 addresses unused. Half the total address space sits in class A, which was carved into only 126 networks. By 1993 the arithmetic had become unsurvivable and classless addressing replaced it, which is the next lesson. Classful is dead on every router on the planet, and it is still asked in interviews and written exams every year, so you need both halves of that sentence.
02 Worked example
One address, taken apart bit by bit
One address carries this lesson, the console in section 04 and half the cheat sheet: 172.16.94.221. Nothing here is recalled. Each number below is produced by an operation on bits you can check on paper, and the console reproduces every one of them digit for digit.
Start with the conversion, because everything after it is bit arithmetic. Write the eight place values 128 64 32 16 8 4 2 1 above a row and fill left to right, subtracting when the value fits. Take the last octet, 221: 221 is at least 128, so write 1 and 93 is left; 93 is at least 64, so 1 and 29 left; 29 is under 32, so 0; 29 is at least 16, so 1 and 13 left; then 8 fits leaving 5, then 4 fits leaving 1, then 2 does not, then 1 does. That is 11011101. Going back the other way is addition and nothing else: 128 + 64 + 16 + 8 + 4 + 1 = 221. Do the same for the other three and the whole address is 10101100.00010000.01011110.11011101.
The highlighted node is the one to slow down on, because it is the only step in the chain that classful addressing performs for free and classless addressing refuses to. Everything to its left is arithmetic on the address itself and is true forever. Everything to its right depends entirely on where the line was placed. Move that line and every remaining number changes: the same 172.16.94.221 on a /26 has a network address of 172.16.94.192, a broadcast of 172.16.94.255 and 62 usable hosts, and not one digit of the address changed.
Now the two operations, written out so there is nothing to take on trust. The mask is /16, so the first sixteen mask bits are 1 and the last sixteen are 0. AND gives 1 only where both inputs are 1, so every network bit survives unchanged and every host bit is forced to 0:
10101100.00010000.01011110.11011101 the address
11111111.11111111.00000000.00000000 the mask
10101100.00010000.00000000.00000000 = 172.16.0.0, the network address
The broadcast is the mirror image. Invert the mask so its host positions are 1, then OR, which gives 1 wherever either input is 1. Network bits pass through untouched because they are ORed with 0, and every host bit is forced to 1:
10101100.00010000.01011110.11011101 the address
00000000.00000000.11111111.11111111 the inverted mask
10101100.00010000.11111111.11111111 = 172.16.255.255, the directed broadcast
Those two results are the endpoints of the block, and neither of them can be typed into a machine. Add one to the first and subtract one from the second and you get the usable range: 172.16.0.1 through 172.16.255.254, since 00000001 is 1 and 11111110 is 254. Counting them is where 2h − 2 comes from, and it is worth deriving once rather than memorising. There are 16 host bits, so the host field can take 216 = 65,536 different patterns. Exactly two of those patterns are spoken for: all zeros names the network itself, all ones is the broadcast for it. Take those two away and 65,534 patterns are left for actual machines. Nothing about the number 2 is magic; it is one address at each end of the block.
Hold on to the shape of that, because the rest of the module is this same procedure with the line in a different place. Convert, find the boundary, AND for the network, OR for the broadcast, subtract two for the count. Classful addressing is the special case where the boundary is always at bit 8, 16 or 24 and the address tells you which.
03 Mechanics
Five classes, and the addresses that are not hosts
Two tables carry this section. The first is the class scheme itself, with every count derived rather than quoted. The second is the set of addresses that look like ordinary hosts and are not, which is where most marks are actually lost.
| Class | Leading bits | First octet | Default mask | Net / host bits | Networks in the class | Usable hosts each |
|---|---|---|---|---|---|---|
| A | 0 |
1 to 126 |
/8 = 255.0.0.0 |
8 / 24 |
126 — 27 = 128, minus 0 and 127 |
16,777,214 = 224 − 2 |
| B | 10 |
128 to 191 |
/16 = 255.255.0.0 |
16 / 16 |
16,384 = 214 |
65,534 = 216 − 2 |
| C | 110 |
192 to 223 |
/24 = 255.255.255.0 |
24 / 8 |
2,097,152 = 221 |
254 = 28 − 2 |
| D | 1110 |
224 to 239 |
none |
none |
Multicast, the block 224.0.0.0/4. 228 group addresses, not networks. | not applicable |
| E | 1111 |
240 to 255 |
none |
none |
Reserved by RFC 1112 for future use, the block 240.0.0.0/4. Never allocated. | not applicable |
Where those network counts come from, since guessing them is the classic slip. Class A has eight network bits, but the leading one is pinned at 0 by the definition of the class, so only seven are free: 2⁷ = 128 possible network numbers. Two are then removed. 0.0.0.0/8 is reserved to mean “this network” and 127.0.0.0/8 is the loopback block, so 128 − 2 = 126 and the usable first octets run 1 to 126 rather than 0 to 127. Class B pins two bits, leaving fourteen free: 2¹⁴ = 16,384, with nothing carved out. Class C pins three, leaving twenty-one: 2²¹ = 2,097,152. Answering “128 class A networks” is the standard mistake and it is one subtraction away from correct.
How the address space was actually divided, which is the whole argument of the next lesson. Class A is every address whose top bit is 0, so it is 2³¹ = 2,147,483,648 addresses out of a total of 2³² = 4,294,967,296. That is exactly half the internet, split among 126 organisations. Class B takes 230, a quarter. Class C takes 229, an eighth. Class D and class E take 228 each, 6.25% apiece. Those shares sum to 50 + 25 + 12.5 + 6.25 + 6.25 = 100, which is a useful check that you have the leading-bit patterns right. Now put a real organisation into that scheme. A company with 400 machines cannot use class C, because 254 usable addresses is not 400. So it is given a class B and uses 400 of 65,534, wasting 65,134 addresses that no one else can ever touch. There was no size in between, and no way to say “give me 512”, because the leading bits of the first octet were the only thing allowed to decide.
The second table is the one that actually costs marks. Every row is an address that parses like a host address and is not one.
| Address | What it means | Assignable to an interface? | Where you meet it |
|---|---|---|---|
| Host bits all zero 172.16.0.0 |
Names the network itself, not any machine on it. | no |
Routing tables. “Route to 172.16.0.0/16” means the whole block. |
| Host bits all one 172.16.255.255 |
The directed broadcast for that one network. Every host on it receives the packet. | no |
The second of the two addresses that the − 2 removes. |
| 0.0.0.0 | “This host on this network” as a source. “Any address” as a bind target. “Everything” as a route. | no |
Source address of a DHCP DISCOVER; the wildcard a server binds to; the default route 0.0.0.0/0. |
| 127.0.0.1 | Loopback. The whole of 127.0.0.0/8 is reserved by RFC 1122 and looped back inside the host. | already bound |
ping 127.0.0.1, the name localhost, and every service you test before deploying it. |
| 255.255.255.255 | Limited broadcast. Every host on this link and no further. A router never forwards it. | no |
Destination of a DHCP DISCOVER, sent from UDP port 68 to port 67 before the client has any address at all. |
| 169.254.0.0/16 | Link-local, defined by RFC 3927. A host picks one for itself when DHCP does not answer. | self-assigned |
Windows calls it APIPA. Seeing 169.254.x.x means DHCP failed, every time. |
| RFC 1918 private 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 |
Usable addresses that no router on the public internet will carry. | yes |
Every home and office LAN on earth, behind NAT. |
The private ranges, written out exactly, because two of the three get misquoted. 10.0.0.0/8 runs from 10.0.0.0 to 10.255.255.255: one whole class A network, 224 = 16,777,216 addresses. 192.168.0.0/16 runs from 192.168.0.0 to 192.168.255.255: 256 consecutive class C networks, 216 = 65,536 addresses. The one people get wrong is 172.16.0.0/12. The prefix is /12, not /16, so the mask covers the first octet and the top four bits of the second. Write them out: 172 is 10101100, and the second octet ranges over 0001 followed by any four bits, which is 00010000 = 16 up to 00011111 = 31. So the block runs 172.16.0.0 to 172.31.255.255, sixteen consecutive class B networks, 220 = 1,048,576 addresses. It does not stop at 172.16.255.255 and it does not reach 172.32.anything, and both of those are common enough to be worth writing on your hand.
Two broadcasts, and the difference the exam wants. A directed broadcast is the all-ones host part of a specific network, like 172.16.255.255. It names a real network, so a router elsewhere on the internet can in principle forward it as ordinary unicast and have the last router turn it into a link broadcast. That is exactly how the smurf amplification attack worked, so RFC 2644 changed the default in 1999 and routers have shipped with directed-broadcast forwarding disabled ever since. A limited broadcast, 255.255.255.255, names no network at all; it is scoped to the link by definition and the first router drops it. That is why a DHCP client, which has no address and no idea what network it is on, has to use the limited one.
Where the textbook and the deployed network part company. Teach yourself the classful rules, then hold two corrections next to them. First, 2ᵘ − 2 assumes both the all-zeros and all-ones patterns are unusable, which stops being sensible on a two-address point-to-point link where it leaves zero: RFC 3021 allows a /31 with both addresses usable, and router-to-router links are configured that way routinely. Second, no router has inferred a mask from the leading bits since CIDR arrived in 1993; a modern box is told the prefix length explicitly and would happily run 10.0.0.0/23 even though 10 is “a class A”. Class identification survives because it is a fast, cheap way to test whether you can convert to binary and reason about a boundary, and because the vocabulary stuck: people still say “a class C” when they mean a /24. Know it, and know that it decides nothing.
05 Cheat sheet
Thirteen answers to have ready
Every row is something you can be asked to state or compute in under ten seconds. The right-hand column is the specific wrong answer that gets given, not a general caution.
| What they ask | The answer | The trap |
|---|---|---|
| Size of an IPv4 address | 32 bits = 4 bytes = 4 octets | saying 48 bits — that is a MAC address, from the previous lesson |
| Leading bits, by class | 0 = A, 10 = B, 110 = C, 1110 = D, 1111 = E | Memorising the decimal ranges only. The bits generate the ranges, so the bits are the cheaper thing to hold. |
| First-octet ranges | A 1–126, B 128–191, C 192–223, D 224–239, E 240–255 | saying class A is 1–127 — 127 is the loopback block, not a usable network |
| Default masks | A /8, B /16, C /24 | Offering a mask for class D or E. Neither has a network/host split, so neither has a mask. |
| Networks per class | A 126, B 16,384, C 2,097,152 | saying 128 for class A — the leading bit is pinned, then 0 and 127 are removed |
| Usable hosts per network | A 16,777,214, B 65,534, C 254 | quoting 2ᵘ and forgetting the − 2 |
| Where − 2 comes from | all-zeros host = network address; all-ones host = directed broadcast | Saying “one is for the router”. A gateway holds an ordinary host address like everything else. |
| Two ways to write a mask | /16 and 255.255.0.0 are the same number | Treating the prefix length as a count of octets. It counts bits, so /24 is three octets of ones. |
| 0.0.0.0 | this host as a source; any address as a bind; everything as a route | calling it a broadcast |
| 127.0.0.1 | loopback; the whole 127.0.0.0/8 is reserved | Calling it a usable class A network. It costs 16,777,216 addresses and carries one function. |
| 255.255.255.255 | limited broadcast, this link only, never forwarded | confusing it with the directed broadcast, which names a specific network and can be routed |
| Private ranges, RFC 1918 | 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 | writing 172.16.0.0/16 — the block is /12 and ends at 172.31.255.255 |
| An address starting 169.254 | link-local, RFC 3927: DHCP did not answer | Trying to route it. It is valid on the local link only, and it is a symptom, not a configuration. |
06 Where & why
Where these numbers show up on a real machine
None of this is a teaching abstraction. Every number below is printed by a command you can run, or documented by a provider you will deploy on, and each one shows a place where the real system agrees with the textbook or deliberately does not.
ip addr show prints an interface as inet 172.16.94.221/16, address and mask in one token, because they are useless apart. ip route prints default via 172.16.0.1 alongside a line for 172.16.0.0/16, and the kernel derived that second line by ANDing the address with the mask exactly as you did on paper. The default route is stored as 0.0.0.0/0: a zero-length prefix, so no bits have to match and every destination hits it. That is why it is always the last resort in a longest-prefix match.
You create a VPC by choosing an RFC 1918 block, typically something like 10.0.0.0/16, and cut /24 subnets out of it. AWS then reserves five addresses in every subnet rather than two: the network address, the VPC router, the DNS resolver, one held for future use, and the broadcast address, which AWS reserves even though it does not support broadcast at all. So a /24 that the textbook says holds 254 usable addresses holds 251 in a VPC. The − 2 is the protocol floor; a provider may take more, never fewer.
Run ipconfig /all on a machine with no internet and you will sometimes see an IPv4 address of 169.254.x.y with mask 255.255.0.0 and no default gateway. Nobody configured that. The host broadcast a DHCP DISCOVER from 0.0.0.0 to 255.255.255.255, got no reply, and fell back to picking a link-local address for itself under RFC 3927. The missing gateway is the giveaway: the machine can reach its own link and nothing beyond it.
Read the first octet: 8 is 00001000, leading bit 0, so classful rules call it class A with a /8 mask. And 8.0.0.0/8 genuinely was handed out as a single class A allocation, sixteen million addresses to one holder, which is the waste from section 03 in one line. Today the internet does not treat it as one network at all: 8.8.8.0/24 is announced separately by Google. The class still tells you how to read the bits. It has told you nothing about the routing since 1993.
07 Interview questions
What they ask, and what they follow up with
This topic is asked early because it is cheap to mark and impossible to bluff. Expect an address on a whiteboard, a request for the class, and then a follow-up that changes the mask to see whether you were reading bits or reciting ranges.
What is an IPv4 address, physically? How many bits, and why is it written the way it is?
An IPv4 address has two parts. What are they, and what decides where the boundary is?
Give me the five classes with their leading bits and first-octet ranges.
Why does class A have 126 networks and not 128?
Where does 2ᵘ − 2 come from? Derive it rather than quoting it.
Tell me what 0.0.0.0, 127.0.0.1 and 255.255.255.255 each mean.
What are the private address ranges, exactly?
A router receives a packet addressed to 172.16.255.255. What happens to it?
Same address, two different masks. Does anything actually change?
Classful addressing is obsolete. Why are you still being asked about it?
How does an IPv6 address differ from this, structurally?
08 Practice problems
Six to work out on paper
Write the place values 128 64 32 16 8 4 2 1 at the top of the page and keep them there. For every problem, convert before you reason, and never let a decimal answer influence a binary one. Two of these turn entirely on doing the AND column by column instead of guessing at the dotted decimal.