Understanding IP Addressing and Subnetting

Imagine, for a second, a planet with no postal codes at all — just billions of buildings, no street names, no way to say "the third house past the bakery" to anyone who isn't already standing next to you. Every letter would have to be delivered by someone who already personally knew where it was going. That is, roughly, what a network without addresses would be: a pile of machines with plenty to say to each other and absolutely no way to say who they were saying it to. An IP address is the fix. It is a device's home address on a network, precise enough that a reply sent from the other side of the planet knows exactly which door to knock on when it comes back.

This chapter asks you to slow down more than any other chapter so far, because the mechanics here reward being walked through by hand, the way you would talk a curious friend through a math trick rather than hand them a formula and walk away. By the end of it, you should be able to look at an address and a mask together and know, without a calculator, exactly which devices can talk to each other directly and which ones cannot — a skill that will still be useful to you twenty years from now, long after specific protocol version numbers have changed.

What an Address Actually Has to Do

Every packet that ever crosses a network carries two addresses on it, always, without exception: where it came from, and where it is going — the same way every envelope that has ever reliably reached anyone carried both a return address and a delivery address. Drop either one and the system breaks in an obvious way: no destination address, and nobody knows where to deliver the letter; no return address, and nobody can send a reply back. An IP address is simply the digital version of that same, ancient postal requirement, applied to every single device that ever wants to hold a conversation over a network.

There are two versions of this addressing scheme in active use today, and they exist side by side for a very concrete historical reason.

IPv4 is the original, and it is built from 32 bits, conventionally split into four groups of eight bits each (each group called an "octet") and written as four numbers from 0 to 255 separated by dots — 192.168.1.1, for instance. Thirty-two bits sounds small until you do the arithmetic: two to the thirty-second power is a little over 4.3 billion possible addresses. In 1981, when this scheme was standardized, 4.3 billion looked functionally infinite — there were perhaps a few thousand computers on Earth capable of joining a network at all. Nobody involved was being careless; they were solving the problem in front of them, at the scale that problem actually existed at the time.

That scale changed almost unrecognizably. Smartphones, laptops, smart thermostats, doorbell cameras, and eventually light bulbs all wanted their own address, and 4.3 billion turned out to be a hard ceiling the world hit within a few decades — a genuine crisis, not an exaggerated one, that reshaped how the internet is actually built today, in ways this chapter will walk through directly.

IPv6 is the fix, engineered specifically to never run out again in any foreseeable future: 128 bits instead of 32, written as eight groups of hexadecimal digits separated by colons — 2001:0db8:85a3:0000:0000:8a2e:0370:7334. The jump from 32 bits to 128 bits does not just double the address space; because each additional bit doubles the number of possible addresses, the total comes out to roughly 340 undecillion — a number with 36 zeroes after it, so vast that giving every grain of sand on every beach on Earth its own IPv6 address, many times over, would barely make a dent in it.

IPv4: 192.168.1.1
IPv6: 2001:0db8:85a3:0000:0000:8a2e:0370:7334

Public Addresses, Private Addresses, and the Address on Your Own Apartment

Not every address plays by the same rules, and the distinction matters the moment you try to picture how a packet actually finds its way to you. A public address works like a street address for an entire building — unique across the whole internet, assigned by your internet provider or a cloud company, and directly reachable from literally anywhere else on the planet that is allowed to reach it. A private address works like an apartment number inside that building — perfectly meaningful to anyone else living in the same building, and utterly meaningless to a stranger standing outside on the street who has no idea which building you even live in.

Three specific ranges are permanently set aside, worldwide, for exactly this private, apartment-number role: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. No internet provider on Earth will ever hand one of these out as your public address, precisely so that every home, office, and coffee shop on the planet can reuse the same private ranges internally, over and over, without ever colliding with anyone else's private network — because none of those addresses are ever routed on the open internet in the first place. Your home router almost certainly handed your laptop something starting with 192.168. for exactly this reason: it is drawing from the specific range set aside for precisely this job.

Addresses also differ in how long they last. A static address never changes, the way a business keeps the same storefront address for decades — the natural fit for a server that needs to be found reliably at the same location, day after day. A dynamic address is handed out as needed, typically by a service called DHCP, the way a hotel assigns you a room number for the length of your stay and gives that same number to someone else the moment you check out — the natural fit for a laptop or a phone that wanders on and off different networks constantly.

The Idea of Subnetting: One Address Block, Many Neighborhoods

Here is the problem subnetting exists to solve. Suppose an organization is handed one enormous block of addresses — say, every address starting with 10. — and simply lets every device on Earth it owns, from the CEO's laptop to a security camera in a parking garage, sit on that same flat, undivided block together. Every one of those devices would be able to shout at every other one directly, all sharing the exact same broadcast traffic, all sitting in the exact same trust zone. A single infected laptop in that arrangement is one hop away from a payroll database. A guest's phone in the lobby is one hop away from the CFO's desktop. That is not a network; that is a building with no interior walls at all, just one enormous open floor.

Subnetting is the act of building those interior walls: taking one large block of addresses and deliberately splitting it into smaller, purpose-built pieces — one piece for engineering, a separate piece for guest Wi-Fi, a separate piece again for security cameras — each isolated from the others even though every single one of them was carved out of the same original block. It is the exact same instinct that makes a city planner draw district boundaries instead of leaving every street, house, and factory scattered at random: it keeps traffic contained, keeps strangers out of places they should not be, and lets each neighborhood be reasoned about, secured, and managed on its own.

The payoff is threefold, and every part of it maps directly onto a real, everyday failure that subnetting prevents. It reduces congestion, because broadcast traffic — a message meant for every device on a segment at once, the networking equivalent of shouting down a single street rather than addressing one specific house — stays contained inside its own subnet instead of flooding an entire organization every time one device on the other side of the building needs to announce itself. It improves security, because a compromised device sitting in the guest-Wi-Fi subnet can be blocked, entirely, from ever reaching the finance department's subnet, regardless of how badly it wants to. And it makes a large network genuinely easier to reason about, because each subnet becomes a small, self-contained, human-sized chunk instead of one incomprehensibly large flat space.

How a Subnet Mask Actually Works, By Hand

This is the part worth slowing all the way down for, because once it clicks, it never stops clicking.

Every IPv4 address, remember, is 32 bits — 32 individual on/off switches, grouped into four octets of eight bits each. A subnet mask is a second 32-bit number, laid directly alongside the address, bit for bit, whose only job is to answer one question for every single one of those 32 positions: is this bit part of the "neighborhood" (the network) or part of the "house number" (the specific host)? Wherever the mask has a 1, that position belongs to the network portion of the address. Wherever the mask has a 0, that position belongs to the host portion — the part that actually varies from device to device inside the same neighborhood.

Picture the address 192.168.1.10 laid directly above the mask 255.255.255.0, bit for bit:

Address:      11000000.10101000.00000001.00001010
Mask:         11111111.11111111.11111111.00000000
              -----------------------------------
Network part: 11000000.10101000.00000001 (192.168.1)
Host part:                                00001010 (10)

Read straight down that stack: everywhere the mask shows a 1, we keep the address bit exactly as it is — that is the neighborhood's name, fixed for every device that belongs to it. Everywhere the mask shows a 0, that bit is free to vary — that is the individual house number, the part that actually distinguishes one device on the subnet from another. In this example, the first three octets (192.168.1) are entirely masked as network, and the last octet (the final 10) is entirely free as host — which is exactly why every device sharing this mask on this network will show the same first three numbers and differ only in the last one.

CIDR notation is nothing more than a fast way to say the same thing without writing out the whole mask: the number after the slash in something like 192.168.1.0/24 is simply a count of how many leading bits of the mask are 1s. A /24 means the first 24 bits — three full octets — are network, leaving the final 8 bits free for hosts. That is precisely the 255.255.255.0 mask worked through above, just spoken in shorthand instead of spelled out in full.

Inside that leftover host space, two specific addresses are permanently off-limits to any actual device, and it is worth knowing exactly why. Set every host bit to 0 and you get the network address — 192.168.1.0 in this example — which names the subnet itself rather than any device sitting inside it, the same way a building's address refers to the building, not to any one tenant. Set every host bit to 1 instead and you get the broadcast address — 192.168.1.255 here — a special address that means "every device on this subnet at once," reserved specifically so a device can announce something to its entire neighborhood in a single message rather than addressing everyone individually. Neither address is ever assigned to a real device, which is exactly why a /24 subnet, with 256 total address values available, only ever offers 254 usable addresses for actual machines.

IP Address:   192.168.1.10
Subnet Mask:  255.255.255.0   (i.e. /24: 24 network bits, 8 host bits)
Network:      192.168.1.0
Broadcast:    192.168.1.255
Usable hosts: 192.168.1.1 - 192.168.1.254
CIDR:         192.168.1.0/24

The Trick That Trips Up Almost Everyone: Smaller Number, Bigger Network

There is one piece of CIDR notation that reliably confuses newcomers the first time they meet it, and it is worth naming directly rather than letting you stumble into it on your own: a smaller number after the slash means a bigger network, and a larger number means a smaller one. It feels backwards until you remember what that number is actually counting — not the size of the network, but the number of bits reserved for identifying it, which leaves fewer bits free for hosts as it grows, not more.

Walk the extremes to feel it properly. A /8 reserves only 8 bits for the network portion, which leaves a full 24 bits — over 16 million possible addresses — free for hosts. That is not a home network; that is the size of allocation historically handed to an entire large internet provider, or in the earliest days of IPv4, to a single enormous organization. A /30, at the opposite extreme, reserves 30 of the 32 bits for the network, leaving only 2 bits free for hosts — a mere 4 total address values, of which only 2 are ever usable once the network and broadcast addresses are set aside. That is not a neighborhood at all; it is barely a network in the everyday sense — just enough room for exactly two routers to sit on either end of a single dedicated link between them, with nothing left over for anyone else to join.

Notice the pattern running down that table: every step from one row to the next roughly multiplies the address count by 256, because each step is trading one entire octet — eight bits — from network back to host. Subnetting, in other words, does not carve networks into arbitrary sizes; it slices them the way you would slice a pizza along strict fold lines — always into a half, a quarter, an eighth, a sixteenth of the whole, because every available cut point is a power of two, never an arbitrary in-between number.

Watching Your Own Home Network Do This Quietly

You do not need a data center to see subnetting at work — it is already running, right now, inside whichever router is sitting in your home. Your router receives one public address from your internet provider, the way an entire apartment building receives one street address. It then hands out private addresses to your laptop, your phone, your smart TV, and anything else that joins your Wi-Fi, almost always drawing from the 192.168.0.0/16 or 192.168.1.0/24 range by factory default — the equivalent of assigning apartment numbers inside that one building. Even at this small, single-subnet scale, the router leans on exactly the same network-versus-broadcast-versus-host math worked through above to know, for every single packet it sees, whether it belongs on your LAN or needs to be forwarded out to the wider internet.

[Internet]
   |
[Public IP: 203.0.113.5]
   |
[Router]
   |
[Private IPs: 192.168.1.2, 192.168.1.3, ...]

Carrying This Forward

Everything in this chapter reduces to one small, sturdy idea: an address only means something once you know how much of it is a neighborhood name and how much of it is a house number, and a subnet mask is nothing more than the tool that draws that line, bit by bit, as precisely as you like. Once that distinction is genuinely comfortable — once you can glance at an address and a /prefix together and know, without reaching for a calculator, roughly how many neighbors share that address's network and which ones do not — you have learned the single piece of networking mechanics that shows up more often than almost any other, in router configurations, in cloud provider dashboards, in firewall rules, and in the CIDR blocks you will type into real Go programs the moment this book hands you your first ones in the Go Fundamentals part just ahead.

Frequently Asked Questions

Why does a smaller number after the slash mean a bigger network? It feels completely backwards. It feels backwards until you remember what that number is actually counting: not the size of the network, but the number of bits reserved for identifying it, which leaves fewer bits free for hosts as it grows rather than more. A /8 spends only 8 bits naming the neighborhood and leaves 24 bits free for houses, over 16 million of them, while a /30 spends 30 bits on the neighborhood and leaves only 2, barely enough for two routers on either end of one dedicated link.

If my laptop shows an address like 192.168.1.10, can someone on the other side of the world reach me there directly? No, and this trips up nearly everyone the first time they think about it. Private addresses like the 192.168.0.0/16 range are never routed on the open internet at all — the internet's backbone routers are configured to simply drop any packet addressed to one of the reserved private ranges, on the assumption it has wandered somewhere it does not belong. Only your own router, and whatever NAT translation it performs on your behalf, actually connects you to the wider internet.

Why do two completely unrelated devices on opposite sides of the planet get to use the exact same private address without ever conflicting? Because a private address is only ever meaningful inside its own network, the same way an apartment number only means something to people already inside that specific building. NAT is what makes this workable at internet scale — your router rewrites the address on every outgoing packet and remembers, for each conversation, exactly which internal device the reply belongs to, so 192.168.1.10 behind your router and 192.168.1.10 behind a router on another continent never need to know the other one exists.

Why can't a /24 subnet actually use all 256 of its addresses for devices? Because two of those 256 values are permanently reserved for bookkeeping rather than for any device: the network address, with every host bit set to zero, names the subnet itself the way a building's address refers to the building and not any tenant, and the broadcast address, with every host bit set to one, is reserved for messages meant for every device on the subnet at once. That is exactly why a /24, with 256 total values, only ever offers 254 usable host addresses.

Now that IPv6 has 340 undecillion addresses, does that mean NAT and subnetting stop mattering? Subnetting keeps mattering regardless of address supply, because its real job was never scarcity in the first place — it is about containing broadcast traffic, walling off a compromised guest device from the finance department, and keeping a large network small and human-sized enough to reason about. IPv6's enormous address space does remove the scarcity problem NAT was invented to patch around, but the interior-walls reasoning behind subnetting is just as necessary on an IPv6 network as it ever was on IPv4.

Fun Facts and Notes

• The address 0.0.0.0 is reserved for special use — commonly meaning "any address" or "not yet assigned" — and is never handed out to a real device on a real network.
• If you tried to individually visit every single IPv6 address at any conceivable scanning rate, using every computer on Earth working together, it would take vastly longer than the current age of the universe to get through them all.
• The IPv4 address shortage was so widely anticipated, and yet so slow to actually bite, that engineers spent over a decade patching around it with NAT before the pressure to fully adopt IPv6 became unavoidable — a rare case of a predicted crisis arriving exactly on schedule and still catching much of the industry only half-prepared.