An IP address is a 32-bit number in disguise
In guide one we met the Internet Protocol and saw that every IP datagram carries a destination address so a router knows where to send it next. Now let's open up that address itself. An IPv4 address looks like 192.168.1.10, but that friendly four-piece form is a costume. Underneath, it is simply a single 32-bit binary number — 32 ones and zeros in a row. We chop those 32 bits into four groups of 8 (each group is called an octet), write each group as a plain decimal number from 0 to 255, and glue them with dots. That is the whole trick of dotted-decimal notation: it makes a 32-bit number readable to humans.
Because each octet is 8 bits, it can hold 2^8 = 256 different values, which is exactly why you never see 192.168.1.256 — there is no room for a 256 in 8 bits. With 32 bits total, the entire address space holds 2^32 addresses, roughly 4.3 billion. That sounded enormous in the 1980s and laughably small once every phone, fridge, and doorbell wanted one. Running out of these is the whole motivation for the next two guides on NAT and IPv6, so keep that 4.3-billion ceiling in the back of your mind.
Two addresses in one: the network part and the host part
Here is the single most important idea in this whole guide: an IP address is really two addresses welded together. The left chunk of bits names a network — a neighbourhood, a street — and the right chunk names one specific host on that network — the house number on that street. This split is exactly like a postal address, where the city and street get you to the right area and the house number picks the one door. A router out in the core does not care about your specific house; it only steers toward the right street, which is why grouping addresses by their network part is what makes routing scale.
But where does the network part end and the host part begin? Nothing in the four numbers tells you on its own. That boundary is carried separately, by a companion value called the subnet mask. The mask is another 32-bit pattern, but a tidy one: a run of 1s followed by a run of 0s. Every bit position that is a 1 in the mask is a network bit; every 0 is a host bit. Line the address up against its mask and the dividing line jumps out. To peel off the network part, a router does a bitwise AND of the address with the mask — wherever the mask is 0, the result is forced to 0, erasing the host bits and leaving just the network.
Address 192.168.1.10 = 11000000 10101000 00000001 00001010
Mask 255.255.255.0 = 11111111 11111111 11111111 00000000
\------ network (24 bits) ----/ \host/
Address AND Mask -> network number:
11000000 10101000 00000001 00000000
= 192.168.1.0 (the network this host lives on)
Host part (the rightmost 8 bits) = .10 (this specific host)From rigid classes to the slash: CIDR
Early on, the boundary wasn't free to fall anywhere — the Internet used classful addressing, which forced the network/host split to land at one of three fixed spots. A class A block fixed the split after 8 bits (about 16 million hosts), class B after 16 bits (about 65 thousand hosts), and class C after 24 bits (just 254 hosts). The catch was the brutal lack of middle sizes. An organization needing 2000 addresses was too big for a class C and got handed a class B of 65 thousand, wasting over 60 thousand addresses. Multiply that waste across the world and the 4.3-billion pool drains shockingly fast.
The fix, introduced in 1993, is Classless Inter-Domain Routing, universally called CIDR (say "cider"). CIDR throws away the three rigid classes and lets the boundary fall after any number of bits. We write it with the slash notation you have seen everywhere: a prefix like 10.0.0.0/8 means "the first 8 bits are the network, the rest are host." The number after the slash is just the count of network bits — the length of that run of 1s in the mask. So /24 is the mask 255.255.255.0 from the example above, /16 is 255.255.0.0, and /8 is 255.0.0.0. The slash and the dotted mask say the very same thing, two ways.
Reading a prefix is now a quick mental sum. With a /n prefix, the network bits are fixed and the remaining 32 - n bits are free for hosts, so the block holds 2^(32-n) addresses. A /24 has 2^8 = 256 addresses, a /26 has 2^6 = 64, a /16 has 2^16 = 65536. The smaller the slash number, the fewer network bits, the bigger the block. In real life, two of every block's addresses are reserved — the all-zeros host (the network itself) and the all-ones host (the broadcast for that network) — so a /24 gives 254 usable hosts, not 256. Worth remembering, easy to forget.
Subnetting: borrowing host bits to carve up a block
Now turn the idea around. CIDR lets you make blocks any size, and subnetting is the act of slicing one block you already own into several smaller ones. You do it by borrowing bits from the host part and promoting them to network bits — sliding the boundary rightward. Say your company holds 192.168.1.0/24, one flat network of 256 addresses, and you want four separate networks, one each for engineering, sales, guests, and printers. Borrow 2 bits from the host side (because 2^2 = 4 gives you four pieces) and the mask grows from /24 to /26.
- Engineering gets 192.168.1.0/26 — network id .0, usable hosts .1 through .62, broadcast .63.
- Sales gets 192.168.1.64/26 — network id .64, usable hosts .65 through .126, broadcast .127.
- Guests get 192.168.1.128/26 — network id .128, usable hosts .129 through .190, broadcast .191.
- Printers get 192.168.1.192/26 — network id .192, usable hosts .193 through .254, broadcast .255. Each subnet holds 2^(32-26) = 64 addresses, of which 62 are usable hosts.
Why bother splitting one tidy network into four? Because a subnet is a boundary that the link layer cannot cross on its own. Recall from the link-layer rung that a plain switch never breaks up a broadcast domain — flood a broadcast and it reaches everyone on that flat network. Cutting the block into separate subnets puts a router between the groups, so guests' broadcast chatter never floods engineering, and you can apply different rules at the boundary. Subnetting is how one organisation imposes structure and isolation on the addresses it was handed, without asking anyone for more.
Why routers love CIDR: one line for a million addresses
Subnetting splits blocks apart; CIDR's other superpower is gluing them together. Suppose an ISP owns 256 adjacent /24 networks that all begin with the same first 16 bits. Instead of advertising 256 separate routes to the rest of the Internet, it advertises one summary route: a single /16. Anyone elsewhere just needs to know "to reach anything starting with those 16 bits, send it toward this ISP." That collapsing of many specific prefixes into one shorter prefix is called aggregation, and it is the reason the Internet's core routers can hold the whole world in a forwarding table of manageable size rather than billions of entries.
Aggregation creates a delicious problem: a forwarding table can hold several prefixes that all match the same destination at once. The big aggregate /16 might say "go to ISP-A," while a more specific /24 inside it says "go to ISP-B" (perhaps a customer who switched providers but kept its addresses). Which line wins? The rule is longest-prefix match: among all matching entries, the router obeys the one with the most network bits — the longest slash, the most specific street. Specific beats general, every time. We trace that lookup in detail in guide five of this rung; for now just hold that picking the most specific match is the heart of the router data plane.
And then there's IPv6 (a teaser)
Everything above is IPv4, with its hard 4.3-billion ceiling. Its successor, IPv6, keeps every idea you just learned — a network part, a host part, a prefix length after a slash, longest-prefix match — and simply makes the address far longer: 128 bits instead of 32. That is 2^128 addresses, a number so vast it is hard to feel. The good news for you here is that CIDR thinking transfers wholesale: an IPv6 prefix like 2001:db8::/32 reads exactly the same way — the first 32 bits are the network. The next two guides tackle the address-exhaustion story head-on, first the NAT stopgap, then the real fix in IPv6.
One honest caveat before you go: it is tempting to think a longer address simply means "more devices," full stop. The deeper payoff is that with 128 bits, addresses are so abundant that every device can hold a globally unique, routable address again — restoring the original end-to-end design that IPv4 scarcity quietly broke. Whether the world actually uses them that way is a policy and deployment question, not a property of the bits. We'll be careful to separate what the protocol makes possible from what operators choose to do.