IP addresses, subnets and CIDR

Why this matters for security

Logs are full of IP addresses. The first questions an analyst asks are: is this address inside our network or outside? Is it private? Which office or cloud range does it belong to? Is it in the list of addresses we are allowed to test? All of these need subnet maths.

IPv4 addresses

An IPv4 address is 32 bits (ones and zeros), written as four numbers from 0 to 255 separated by dots, like 192.168.1.10. Each number is one octet (8 bits). There are about 4.3 billion IPv4 addresses, which is not enough for every device, so IPv6 was created: 128-bit addresses written in hexadecimal, like 2001:db8::1.

Private and public addresses

Some ranges are reserved for private networks inside homes and offices. They are not routed on the internet. Your router uses NAT (network address translation) to share one public address among all private devices.

Three small ranges are reserved for documentation and examples: 192.0.2.0/24, 198.51.100.0/24 and 203.0.113.0/24. This course uses them in example logs so we never point at a real company.

CIDR: describing a range

CIDR (Classless Inter-Domain Routing) notation writes a network as an address plus a slash and a number, the prefix length. The prefix length says how many of the 32 bits are fixed for the network. The rest are free for hosts (devices).

The number of addresses is 2 to the power of (32 minus the prefix). In a normal subnet two addresses are not used by hosts: the first is the network address and the last is the broadcast address. So a /24 has 256 addresses and 254 usable hosts.

Doing it in Python

import ipaddress

net = ipaddress.ip_network("192.168.10.0/26")
print(net.num_addresses)              # 64
print(net.network_address, net.broadcast_address)
print(ipaddress.ip_address("192.168.10.50") in net)   # True
print(ipaddress.ip_address("192.168.10.70") in net)   # False
print(ipaddress.ip_address("10.4.2.1").is_private)     # True

Seeing your own address

$ ip -brief address
lo        UNKNOWN  127.0.0.1/8 ::1/128
enp0s3    UP       192.168.1.23/24 fe80::a00:27ff:fe4e:66a1/64

PS> Get-NetIPAddress -AddressFamily IPv4 | Select-Object InterfaceAlias, IPAddress, PrefixLength

InterfaceAlias IPAddress     PrefixLength
-------------- ---------     ------------
Wi-Fi          192.168.1.42            24
Loopback...    127.0.0.1                8

Common mistakes

• Thinking a private IP in a log means "safe". An attacker already inside your network uses private addresses too.
• Thinking an IP address always equals one person. Many people share one public IP through NAT, mobile networks and VPNs.
• Writing a firewall rule for 10.0.0.0/8 when you meant one /24. A small typo in the prefix can open a huge range.