2.1 IPv4 and IPv6 Addressing, Subnetting & Header Architecture

2.1 IPv4 and IPv6 Addressing, Subnetting & Header Architecture

In penetration testing and security analysis, an exhaustive comprehension of Network Layer (OSI Layer 3) protocols is non-negotiable. The Internet Protocol (IP) provides logical addressing, routing across internetworks, and packet fragmentation. The CREST Practitioner Security Analyst (CPSA) examination expects candidates to rapidly analyze IP headers, calculate subnets, detect address anomalies, and identify misconfigurations that expose internal networks.

---

1. IPv4 Addressing & Historical Classful Architecture

An IPv4 address is a 32-bit numeric identifier represented in dotted-decimal notation, consisting of four 8-bit octets separated by periods (e.g., 192.0.2.1). Each octet ranges from 0 to 255 (binary 00000000 to 11111111), yielding a theoretical maximum address space of $2^{32} \approx 4.29 \times 10^9$ unique addresses.

Historical Classful Architecture (RFC 791)

Before the introduction of Classless Inter-Domain Routing (CIDR) in 1993, the IPv4 space was partitioned into five discrete classes determined by the leading high-order bits of the first octet:

CIDR and Subnet Masks (RFC 1519)

Classful addressing proved extraordinarily wasteful. Classless Inter-Domain Routing (CIDR) eliminated fixed class boundaries by pairing the 32-bit address with a subnet mask—a continuous string of binary 1s indicating the network portion followed by binary 0s indicating the host portion.

In CIDR notation, a forward slash followed by the prefix length denotes the number of network bits (e.g., /24 equates to 255.255.255.0).

Subnet Calculation Reference

Subnet Calculation Rule: For any given subnet with $h$ host bits ($32 - \text{prefix length}$):

1. Total IP addresses = $2^h$.
2. Usable host addresses = $2^h - 2$ (subtracting the all-zeros Network ID and the all-ones Directed Broadcast ID).
3. Block size (magic number) in the relevant octet = $256 - \text{mask octet value}$.

Worked Example: Given the IP address 192.168.10.138/27:

• Subnet mask: /27 has 27 ones $\rightarrow 255.255.255.224$.
• Host bits: $32 - 27 = 5$ bits $\rightarrow 2^5 = 32$ total addresses per block.
• Block size: $256 - 224 = 32$. Multiples of 32 in the 4th octet: 0, 32, 64, 96, 128, 160...
• Since 138 falls between 128 and 159:
  • Network ID: 192.168.10.128
  • First Usable Host: 192.168.10.129
  • Last Usable Host: 192.168.10.158
  • Directed Broadcast Address: 192.168.10.159
  • Usable Host Capacity: 30 hosts.

---

2. Special-Use & RFC 1918 Private Addressing Scopes

Certain address ranges are reserved by the Internet Assigned Numbers Authority (IANA) and documented in specific RFCs. Penetration testers must immediately recognize these scopes during reconnaissance.

RFC 1918 Private IP Ranges

To mitigate public IPv4 exhaustion, RFC 1918 reserved three private address blocks that are not routable on the public internet. Enterprise border routers drop packets with these source or destination addresses:

+-----------------------+-------------------+---------------------+---------------------+
| RFC 1918 Block        | CIDR Prefix       | Total IP Count      | Typical Use         |
+-----------------------+-------------------+---------------------+---------------------+
| 10.0.0.0 -            | 10.0.0.0/8        | 16,777,216          | Large corporate     |
| 10.255.255.255        | (Single Class A)  |                     | enterprise intranets|
+-----------------------+-------------------+---------------------+---------------------+
| 172.16.0.0 -          | 172.16.0.0/12     | 1,048,576           | Mid-sized networks, |
| 172.31.255.255        | (16 /16 blocks)   |                     | DMZs, data centers  |
+-----------------------+-------------------+---------------------+---------------------+
| 192.168.0.0 -         | 192.168.0.0/16    | 65,536              | Small office / home |
| 192.168.255.255       | (256 /24 blocks)  |                     | networks (SOHO)     |
+-----------------------+-------------------+---------------------+---------------------+

Other Special-Purpose IPv4 Ranges

• Loopback (127.0.0.0/8, RFC 1122): Used by the local host to direct traffic to itself without hitting the physical network interface. The standard address is 127.0.0.1 (localhost).
• APIPA / Link-Local (169.254.0.0/16, RFC 3927): Automatic Private IP Addressing. When a host is configured for DHCP but fails to receive a lease, it self-assigns an address from this range via ARP probing. In a penetration testing context, discovering an interface on 169.254.x.x indicates a broken DHCP service, VLAN trunking misconfiguration, or an isolated interface.
• Carrier-Grade NAT / Shared Space (100.64.0.0/10, RFC 6598): Used by ISPs for CGNAT deployments to avoid conflicts with customer RFC 1918 networks.
• Documentation Scopes (RFC 5737): 192.0.2.0/24 (TEST-NET-1), 198.51.100.0/24 (TEST-NET-2), and 203.0.113.0/24 (TEST-NET-3).

Network Address Translation (NAT) & Port Address Translation (PAT)

Because RFC 1918 addresses cannot traverse public backbones, edge firewalls and routers utilize Network Address Translation (NAT):

• Static NAT (1-to-1): Maps a single internal private IP address permanently to a single public IP address (typically used for publicly accessible DMZ servers).
• Dynamic NAT (Many-to-Many): Maps private IP addresses to an available pool of public IP addresses on a first-come, first-served basis.
• Port Address Translation (PAT / NAT Overload): Maps thousands of internal private IP sockets to a single public IP address by tracking unique source Layer 4 port numbers. The translation table binds (Private_IP:Private_Port) <-> (Public_IP:Mapped_Port).

Penetration Testing Significance: PAT obscures internal network topologies from external reconnaissance. However, internal IP addresses frequently leak in HTTP response headers (Location: http://10.1.2.5/), email headers (Received: and X-Originating-IP), or misconfigured internal DNS servers responding to external queries.

---

3. IPv4 Header Architecture & Bit-Level Fields

The IPv4 header is defined in RFC 791. It has a minimum size of 20 bytes (when no options are present) and can extend up to a maximum of 60 bytes.

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|Version|  IHL  |Type of Service|          Total Length         |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|         Identification        |Flags|      Fragment Offset    |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|  Time to Live |    Protocol   |        Header Checksum        |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                       Source Address                          |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                    Destination Address                        |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                    Options                    |    Padding    |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Detailed Field Breakdown

1. Version (4 bits): Identifies the IP protocol version. For IPv4, this binary value is 0100 (decimal 4).
2. Internet Header Length (IHL, 4 bits): Specifies the header length in 32-bit (4-byte) words. The minimum valid value is 5 ($5 \times 4 = 20$ bytes). The maximum value is 15 ($15 \times 4 = 60$ bytes). Any value greater than 5 indicates the presence of IP Options.
3. Type of Service (ToS) / DiffServ (8 bits): Originally defined for Quality of Service (QoS). Modern RFCs divide this into the 6-bit Differentiated Services Code Point (DSCP) for traffic prioritization and the 2-bit Explicit Congestion Notification (ECN) field.
4. Total Length (16 bits): Defines the entire datagram size in bytes, including header and data payload. The maximum theoretical IPv4 datagram size is $2^{16} - 1 = 65,535$ bytes.
5. Identification (16 bits): An integer identifier assigned by the sending host to uniquely identify fragments belonging to a single original IP datagram.
6. Flags (3 bits): Controls fragmentation behavior:
   • Bit 0 (Reserved): Must be 0. (Informally designated as the "Evil Bit" in RFC 3514 as an April Fools joke).
   • Bit 1 (DF - Don't Fragment): If set to 1, routers are prohibited from fragmenting the datagram. If the packet exceeds a link's MTU, the router drops it and generates an ICMP Type 3 Code 4 error. Essential for Path MTU Discovery (PMTUD).
   • Bit 2 (MF - More Fragments): If set to 1, it signals that subsequent fragments follow. If set to 0, this is the final fragment (or the only fragment).
7. Fragment Offset (13 bits): Indicates the position of the fragment's payload relative to the beginning of the original unfragmented datagram, measured in 8-byte (64-bit) units. The first fragment has an offset of 0.
8. Time to Live (TTL, 8 bits): Counter decremented by at least 1 by every routing hop. Prevents packets from circulating indefinitely in routing loops. When TTL reaches 0, the packet is discarded, and the router sends an ICMP Type 11 Code 0 (Time Exceeded) message to the sender.
   • OS Fingerprinting Baseline: Default TTL values differ across operating systems:
     • Linux / Android / Unix: Default TTL = 64
     • Microsoft Windows: Default TTL = 128
     • Cisco IOS / Network Devices: Default TTL = 255
9. Protocol (8 bits): Designates the encapsulated Layer 4 protocol. Key values tested on CPSA:
   • 1 = ICMP (Internet Control Message Protocol)
   • 2 = IGMP (Internet Group Management Protocol)
   • 6 = TCP (Transmission Control Protocol)
   • 17 = UDP (User Datagram Protocol)
   • 47 = GRE (Generic Routing Encapsulation)
   • 50 = ESP (Encapsulating Security Payload - IPsec)
   • 51 = AH (Authentication Header - IPsec)
   • 89 = OSPF (Open Shortest Path First)
10. Header Checksum (16 bits): Covers the IP header only (payload integrity is verified by Layer 4 checksums). Because TTL decrements at each hop, the checksum must be recalculated by every intermediate router.
11. Source & Destination IP Addresses (32 bits each): The originating and target IPv4 addresses.
12. Options & Padding (Variable, 0 to 40 bytes): Used for network testing, debugging, and routing controls (e.g., Strict/Loose Source Routing, Record Route). Rare in modern production networks; frequently dropped by perimeter firewalls due to security risks.

Packet Fragmentation Security Attacks

• Teardrop Attack: The attacker crafts fragments with overlapping offsets (e.g., Fragment 1 has offset 0-99; Fragment 2 has offset 50-149). Flawed TCP/IP stack reassembly routines crashed or panicked upon computing negative length allocations.
• Ping of Death: Maliciously fragmented packets whose reassembled Total Length exceeds the 65,535-byte maximum, causing integer buffer overflows in legacy kernels.
• Tiny Fragment Attack: The attacker forces the first fragment to be smaller than the transport header (e.g., 8 bytes), splitting the TCP flags and destination port into the second fragment. Stateless packet filters that inspect only Fragment 0 allow the packet through, permitting unauthorized ingress.

---

4. IPv6 Addressing Architecture & Header Mechanics

IPv6 (RFC 8200) was engineered to solve IPv4 address exhaustion, eliminate the necessity of NAT, and streamline router forwarding efficiency.

Address Representation & Scopes

An IPv6 address is 128 bits in length, structured as eight 16-bit blocks (hextets) separated by colons, expressed in hexadecimal notation: 2001:0db8:85a3:0000:0000:8a2e:0370:7334

Compression Rules (RFC 5952):

1. Leading Zeros Suppression: Leading zeros within any 16-bit hextet must be omitted (0db8 becomes db8; 0000 becomes 0).
2. Double Colon Compression (::): A single contiguous sequence of two or more all-zero hextets can be replaced by ::. This substitution can be performed only once per address to preserve mathematical uniqueness.
   • Full Address: fe80:0000:0000:0000:020c:29ff:fe4b:8a12
   • Compressed: fe80::20c:29ff:fe4b:8a12

IPv6 Address Scopes and Prefixes

+---------------------------+-----------------------+---------------------------------------+
| Address Type              | Prefix Range          | Description / Scope                   |
+---------------------------+-----------------------+---------------------------------------+
| Link-Local                | fe80::/10             | Mandatory on all IPv6 interfaces;     |
|                           | (fe80:: to febf::)    | valid only on local link; not routed. |
+---------------------------+-----------------------+---------------------------------------+
| Global Unicast (GUA)      | 2000::/3              | Globally routable public IPv6 space   |
|                           | (2000:: to 3fff::)    | assigned by RIRs.                     |
+---------------------------+-----------------------+---------------------------------------+
| Unique Local (ULA)        | fc00::/7              | Equivalent to RFC 1918 private space; |
|                           | (fc00:: to fdff::)    | widely implemented as fd00::/8.       |
+---------------------------+-----------------------+---------------------------------------+
| Multicast                 | ff00::/8              | Replaces all IPv4 broadcast functions.|
|                           |                       | ff02::1 = All nodes on link;          |
|                           |                       | ff02::2 = All routers on link.        |
+---------------------------+-----------------------+---------------------------------------+
| Loopback                  | ::1/128               | Equivalent to 127.0.0.1.              |
+---------------------------+-----------------------+---------------------------------------+
| Unspecified               | ::/128                | Equivalent to 0.0.0.0.                |
+---------------------------+-----------------------+---------------------------------------+

Exam Distinction: IPv6 has no broadcast addressing. All broadcast operations are superseded by specifically targeted multicast groups (e.g., Solicited-Node Multicast ff02::1:ff00:0/104).

Autoconfiguration: SLAAC vs DHCPv6

• Stateless Address Autoconfiguration (SLAAC, RFC 4862): A host generates its own address without a stateful server. The host sends an ICMPv6 Router Solicitation (RS); the local router replies with an ICMPv6 Router Advertisement (RA) containing the network prefix (typically /64).
  • The host creates a 64-bit Interface Identifier (IID) using Modified EUI-64 (derived from the 48-bit MAC address by inserting 0xFFFE in the middle and inverting the 7th bit, the Universal/Local bit) or via RFC 4941 Privacy Extensions (randomly generated IIDs to prevent physical tracking across networks).
• DHCPv6 (RFC 8415): Can operate in Stateful mode (allocating IP addresses and DNS configuration) or Stateless mode (router provides prefix via SLAAC; DHCPv6 provides supplemental parameters like DNS resolvers and NTP servers).

IPv6 Base Header & Extension Headers

Unlike IPv4's variable-length header, IPv6 features a streamlined, fixed 40-byte base header:

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|Version| Traffic Class |           Flow Label                  |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|         Payload Length        |  Next Header  |   Hop Limit   |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                                                               |
+                                                               +
|                                                               |
+                         Source Address                        +
|                           (128 bits)                          |
+                                                               +
|                                                               |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                                                               |
+                                                               +
|                                                               |
+                      Destination Address                      +
|                           (128 bits)                          |
+                                                               +
|                                                               |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

• Version (4 bits): Set to 0110 (decimal 6).
• Traffic Class (8 bits): Equivalent to IPv4 ToS/DiffServ (DSCP/ECN).
• Flow Label (20 bits): Identifies specific packet flows requiring uniform QoS handling by routers without packet inspection.
• Payload Length (16 bits): Length of the data payload following the 40-byte base header (including any IPv6 extension headers).
• Next Header (8 bits): Replaces the IPv4 Protocol field. Points directly to the upper-layer protocol (TCP=6, UDP=17) or to the first Extension Header in a chained sequence.
• Hop Limit (8 bits): Replaces IPv4 TTL. Decremented by 1 at each router hop; dropped at 0.
• No Header Checksum: Eliminates router processing overhead. Integrity verification is delegated to Layer 2 and Layer 4 checksums.

IPv6 Extension Headers

Optional controls are implemented via chained extension headers inserted between the base header and the transport payload:

• 0 = Hop-by-Hop Options (processed by every router along the path)
• 43 = Routing (source routing controls)
• 44 = Fragment (contains identification, offset, and M flag for fragmented packets)
• 50 = Encapsulating Security Payload (ESP)
• 51 = Authentication Header (AH)
• 60 = Destination Options (processed only by the destination host)

Penetration Testing Consideration: In dual-stack environments, organizations frequently configure enterprise firewalls and intrusion detection systems to monitor IPv4 while leaving IPv6 enabled by default on hosts. Attackers can exploit this blind spot using tools like mitm6 to spoof rogue DHCPv6/DNS configurations, forcing hosts to route internal traffic over unmonitored IPv6 pathways.