6.1 IPv4 Addressing

Every device that communicates on an IP network needs a unique Layer-3 address. On the Cyber Test, IPv4 addressing questions test whether you can read an address, interpret its mask, recognize private vs public space, and explain what the network and host portions mean. This section builds that foundation before you subnet in the next section.

What an IPv4 Address Is

An IPv4 address is a 32-bit binary number. Humans rarely write thirty-two zeros and ones, so we group the bits into four octets (8 bits each) and convert each octet to decimal. The familiar form is dotted-decimal notation:

192.168.10.45

Each octet ranges from 0 to 255 because 2⁸ = 256 possible values (0 through 255). If you see a number like 192.168.1.300, it is not a valid IPv4 address — the last octet exceeds 255.

In binary, that same address looks like:

11000000.10101000.00001010.00101101

You do not need to convert every address on the exam, but you should be comfortable converting when a question gives binary or asks how many host bits remain after a mask.

---

Network Portion vs Host Portion

An IPv4 address alone does not tell a router which bits identify the network. That job belongs to the subnet mask (or its modern shorthand, the prefix length).

Example: 192.168.10.45 with mask 255.255.255.0 (/24) means:

• Network portion: 192.168.10
• Host portion: .45
• Network address: 192.168.10.0
• Broadcast address: 192.168.10.255

All hosts with addresses 192.168.10.1 through 192.168.10.254 (usable hosts on a /24) share the same Layer-3 subnet when that mask is used.

---

Classful Addressing (Historical Context)

Early IPv4 used classful addressing. The first octet determined the default mask:

Classful rules waste space: a Class A network "owns" 16 million-plus host addresses even if the organization needs a few thousand. Modern networks almost always use classless addressing (CIDR), where any prefix length is allowed — /20, /27, /30, and so on — regardless of the first octet.

Exam tip: If a question mentions "Class C default mask," answer /24 or 255.255.255.0. If it shows a non-default mask like 192.168.1.0/26, treat it as classless and ignore the old class letter for host-count math.

---

Private Address Ranges (RFC 1918)

The Internet Assigned Numbers Authority reserved three IPv4 blocks for private (non-Internet-routable) use. Memorize them exactly:

Key points:

• Private addresses can be reused inside different organizations.
• A NAT (Network Address Translation) device or proxy typically translates private addresses to a public address when traffic leaves to the Internet.
• 172.15.0.1 is not private (it is below 172.16). 172.32.0.1 is also not private (it is above 172.31). Only 172.16 through 172.31 count.

Public addresses are globally unique and routable on the public Internet (subject to assignment by ISPs and registries).

---

Special and Reserved Addresses

Several patterns appear often on aptitude and networking questions:

Worked recognition example

Host 10.20.30.40 with mask 255.255.0.0 (/16):

• Network: 10.20.0.0
• Broadcast: 10.20.255.255
• Usable hosts: 10.20.0.1 – 10.20.255.254
• This address sits in the 10.0.0.0/8 private space

---

Why This Matters for Cyber Work

Cyber operators read packet captures, firewall rules, and access-control lists constantly. Misreading whether 172.20.5.9 is private, or treating a network address as a host, leads to broken filters and bad incident analysis. On the Cyber Test, expect identification questions ("which is private?") and structure questions ("what is the network address?") more than advanced routing theory.

Quick self-check

1. Convert the idea "first 24 bits are network" into mask 255.255.255.0 and prefix /24.
2. Spot invalid octets (>255) and invalid private claims outside RFC 1918.
3. Separate classful history from classless reality used in modern subnetting.