IP Addressing and How Routing Decides

An IP address identifies an interface on a network, not a computer and definitely not a service. A laptop with Wi-Fi, Ethernet, a VPN tunnel, and a container bridge has four or five addresses at once, and packets to each arrive on a different path.

An IPv4 address is 32 bits, written as four decimal octets. The header is 20 bytes when there are no options, and it carries the pieces routers actually read: source, destination, protocol number, TTL, and the fragmentation fields.

Only some of that 32-bit space is usable. RFC 1918 reserves 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16 for private use, 127.0.0.0/8 is loopback, 169.254.0.0/16 is link-local, 224.0.0.0/4 is multicast, and 100.64.0.0/10 is the shared space RFC 6598 carved out for carrier NAT. Roughly 4.3 billion addresses on paper, considerably fewer in circulation.

IPv6 uses 128-bit addresses written as eight hex groups, with one run of zero groups collapsible to a double colon. 2001:db8:0:0:0:0:0:1 becomes 2001:db8::1.

What matters is not the size of the number but the structural changes:

• The header is a fixed 40 bytes. No options field, no header checksum, no in-path fragmentation. Routers do less per packet.
• A /64 is the standard subnet everywhere, because stateless address autoconfiguration builds the low 64 bits on the host.
• Every interface also has a link-local address in fe80::/10 that never routes, used for neighbour discovery and routing protocols.
• An interface normally holds several global addresses at once, including rotating privacy addresses.

Deployment is real but partial. In April 2026 Google's own measurement of IPv6-capable users crossed 50 percent for the first time, while APNIC Labs, which weights by estimated internet users per economy, put the figure near 42 percent (APNIC Blog, April 2026). Cloudflare's 2025 Radar Year in Review reported that 29 percent of requests from dual-stack-capable clients actually used IPv6.

The original internet split addresses into fixed classes: class A gave you 16.7 million addresses, class B gave you 65,536, class C gave you 256. An organisation needing 500 addresses had to take a class B and waste 65,000 of them.

Classless Inter-Domain Routing, standardised in RFC 4632, replaced classes with an explicit prefix length. 192.0.2.0/24 means the first 24 bits are the network and the last 8 identify hosts within it. Any length works, so allocations can match actual need.

CIDR did two things at once. It slowed IPv4 exhaustion by ending class-sized waste, and it enabled aggregation: a provider holding 16 adjacent /24 blocks can announce one /20 to the rest of the world instead of 16 separate routes. Every routing table on the internet is smaller because of that second property.

The prefix length is also the whole basis of forwarding, as the next few steps show.

You are handed 198.51.100.0/24 and need four subnets of at least 50 hosts each. Work in binary on the last octet.

50 hosts needs 6 host bits, since 2 to the 6 is 64 and you lose 2 addresses per subnet to the network and broadcast identifiers. 32 minus 6 gives a /26. A /24 contains four /26 blocks, so the arithmetic works out exactly.

/26 mask   = 255.255.255.192   (11111111.11111111.11111111.11000000)
block size = 256 - 192 = 64

198.51.100.0/26     network .0    usable .1   to .62    broadcast .63
198.51.100.64/26    network .64   usable .65  to .126   broadcast .127
198.51.100.128/26   network .128  usable .129 to .190   broadcast .191
198.51.100.192/26   network .192  usable .193 to .254   broadcast .255

Membership test, no calculator needed. Is 198.51.100.130 inside 198.51.100.128/26? A /26 fixes the top 2 bits of the final octet. 130 is 10000010, 128 is 10000000. Both start 10, so yes, and its 62 usable neighbours run from .129 to .190.

Two shortcuts worth memorising: block size is 256 minus the last non-zero mask octet, and usable hosts are 2 to the power of the host bits, minus 2.

A routing table is a list of prefixes with instructions. Each row says: for destinations inside this prefix, hand the packet to this next hop, out of this interface, and prefer this row over competing rows by this metric.

Here is a real table from a laptop:

Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0    10.80.251.251    10.80.251.127     35
      10.80.251.0    255.255.255.0         On-link      10.80.251.127    291
    10.80.251.127  255.255.255.255         On-link      10.80.251.127    291
        127.0.0.0        255.0.0.0         On-link          127.0.0.1    331
     172.23.112.0    255.255.240.0         On-link       172.23.112.1    271

Things worth noticing. 0.0.0.0/0 is the default route: it matches everything, which is why it is the last resort. "On-link" means the destination is directly reachable on that interface, so no gateway is needed and ARP resolves it. 10.80.251.127/32 is the machine's own address. 172.23.112.0/20 is a virtualisation bridge, invisible to the outside world.

A router does not store paths. It stores one next hop per prefix and trusts that the next router knows what to do after that.

Several rows can match the same destination. The rule that resolves it is simple and universal: the most specific matching prefix wins, regardless of order in the table or metric.

0.0.0.0/0        -> 203.0.113.1     default
10.0.0.0/8       -> 10.1.0.1        corporate backbone
10.20.0.0/16     -> 10.1.0.9        European sites
10.20.30.0/24    -> 10.1.0.17       Lisbon office

Work three lookups:

• 10.20.30.5 matches /0, /8, /16 and /24. The /24 is longest, so the packet goes to 10.1.0.17.
• 10.20.40.5 matches /0, /8 and /16. Longest is /16, so 10.1.0.9.
• 93.184.216.34 matches only /0, so it goes out the default route.

This single rule has a consequence you must remember for the rest of this lesson: announcing a more specific prefix beats every less specific announcement, everywhere on the internet, with no negotiation. Nobody has to accept your route as better. Longest-prefix match makes it better automatically.

Traceroute exploits the TTL field. Send a packet with TTL 1 and the first router decrements it to zero, discards it, and returns ICMP Time Exceeded, revealing itself. Send TTL 2 for the second router, and so on.

> tracert -d 1.1.1.1
  1     8 ms     2 ms     4 ms  10.80.251.251
  2     *        *        *     Request timed out.
  3     *        *        *     Request timed out.
  8    23 ms    16 ms    24 ms  193.5.122.38
  9    21 ms    20 ms    26 ms  138.187.130.209
 11    37 ms    28 ms    27 ms  213.242.83.222
 12    19 ms    21 ms    21 ms  162.158.148.39

Read it carefully. Stars are not lost packets, they are routers configured not to answer or to rate-limit ICMP; traffic still passes through them. Hop 11 shows higher latency than hop 12, which does not mean the network got faster: each number is a separate round trip to a different device with a different ICMP priority. And because routing is per-packet, successive probes can take genuinely different paths.

Traceroute shows the forward path only. The return path can be completely different and is invisible here.

Network address translation, described in RFC 3022, lets many private hosts share one public address. The NAT box rewrites the source address and source port of outbound packets, records the mapping in a table, and reverses the rewrite on the way back.

The original internet design assumed any host could address any other host. NAT ended that:

• Inbound connections have nowhere to land, because there is no mapping until the inside host speaks first.
• The mapping is state. Reboot the NAT and every connection through it dies. Idle connections are reaped after a timeout, which is why long-lived sockets need keepalives.
• Protocols that embed addresses in their payload, classically FTP and SIP, break unless the NAT parses and rewrites them too.
• Carrier-grade NAT puts thousands of subscribers behind one address, so an IP-based ban or rate limit hits strangers.

The workaround stack is substantial. STUN discovers your public mapping, TURN relays when nothing else works, and ICE tries every candidate path. Every video call and peer-to-peer app carries this machinery because addresses stopped being globally meaningful.

An autonomous system is one network under one routing policy, identified by an AS number. BGP is how those networks tell each other which prefixes they can reach and by what path.

BGP, specified in RFC 4271, is a path vector protocol. A router announces a prefix along with the AS_PATH, the ordered list of autonomous systems the announcement has traversed. That path serves two purposes: loop detection, since an AS that sees itself in the path rejects the route, and comparison.

But BGP does not choose the fastest path. It applies a decision process in which locally configured preference outranks path length. In practice that means money. A network prefers routes learned from its customers, who pay it, over routes learned from peers, which are free, over routes from transit providers, which it pays for. A shorter AS path through an expensive transit link routinely loses to a longer path through a customer.

The scale is public. Geoff Huston's AS65000 BGP table report at potaroo.net showed 1,066,053 active IPv4 prefixes and 79,044 unique autonomous systems on 20 July 2026. Every one of those routes exists because some operator chose to accept it.

Two documented incidents show the two ways this fails.

On 24 June 2019 a route optimiser inside a small Pennsylvania provider generated more-specific sub-prefixes of other networks' address space, purely for internal traffic steering. Those announcements escaped to a transit customer and onward to Verizon, which propagated them globally. Longest-prefix match did the rest: every router on the internet preferred the more specific route and sent traffic into a network far too small to carry it. Cloudflare's own postmortem reported losing about 15 percent of its global traffic at the peak, with Amazon and Linode also affected.

On 4 October 2021 Meta's engineering team published a different failure. A maintenance command took down the backbone between datacentres. Meta's DNS servers were configured to withdraw their BGP advertisements whenever they could not reach a datacentre, treating that as a health signal. They did exactly that. Meta's authoritative nameservers were still running, but no longer had routes to them, so the entire company vanished from the internet for hours, including the internal tools needed to fix it.

One incident announced too much. The other announced too little.

BGP has no built-in authentication. A router believes what its neighbour tells it. Three layers of filtering are bolted on top:

RPKI is the strongest of the three. A resource holder publishes a Route Origin Authorisation naming the AS allowed to originate a prefix and the maximum prefix length, and routers drop announcements that contradict it. The maximum-length field is what would have stopped the 2019 leak: the more-specific sub-prefixes were invalid on their face. Coverage is publicly tracked by the NIST RPKI Monitor and by Cloudflare at isbgpsafeyet.com, and it is partial, because a prefix with no published authorisation is simply unknown rather than invalid.

Even full RPKI deployment validates only the origin. Path-level protection, the work of BGPsec and ASPA, remains largely undeployed.