Questions? Call 1.800.716.8955

Chapter 6

IPv4 Addressing

Exam topics covered

1.6 Configure and verify IPv4 addressing and subnetting

1.7 Describe private IPv4 addressing

1.10 Verify IP parameters for Client OS (Windows, Mac OS, Linux)

Foundation. Every device that talks over an IPv4 network needs an address, and nearly every CCNA topic, from routing tables to ACLs to NAT, assumes you can read one fluently. This chapter builds that fluency. You will learn how a 32-bit IPv4 address is written, how to convert between binary and decimal quickly, how the subnet mask splits an address into network and host parts, which addresses are special or private, and how to configure and verify addresses on a Cisco router and on Windows, macOS and Linux clients. Chapter 7 then builds on these skills to subnet a network.

6.1 The Structure of an IPv4 Address

An IPv4 address is a 32-bit binary number. Humans find 32 ones and zeros unreadable, so we write the address in dotted-decimal notation: the 32 bits are split into four 8-bit octets, each octet is converted to decimal (0 to 255), and the four values are separated by dots. Figure 6-1 shows the address 192.168.10.77 in both forms.

192 . 168 . 10 . 77

Octet 1 (bits 1–8) Octet 2 (bits 9–16) Octet 3 (bits 17–24) Octet 4 (bits 25–32) 11000000 10101000 00001010 01001101

Figure 6-1 The same 32-bit address written in dotted decimal (top) and binary (bottom).

Because each octet has 8 bits, it can hold 2

8 = 256 values, which is why no octet can exceed

  • 255. The whole address space contains 2

, about 4.3 billion, addresses: a number that looked

enormous in 1981 and has long since run out. Private addressing and NAT (Section 6.6) and IPv6 (Chapter 9) are the responses to that shortage.

6.2 Binary and Decimal Conversion

Subnetting is far easier if you can convert a single octet between binary and decimal in a few seconds. Each bit position in an octet has a place value, a power of two, from 128 on the left down to 1 on the right.

Table 6-1 Place values in one octet, with two worked conversions Bit position 8 7 6 5 4 3 2 1 Result

  • Place value 128 64 32 16 8 4 2 1
  • 201 to binary 1 1 0 0 1 0 0 1 128+64+8+1 = 201
  • 45 to binary 0 0 1 0 1 1 0 1 32+8+4+1 = 45
  • 10110100 to decimal 1 0 1 1 0 1 0 0 128+32+16+4 = 180
  • 6.2.1 Decimal to binary: subtract the place values

Work from left to right. If the remaining value is at least the place value, write 1 and subtract; otherwise write 0. For 201: 201 ≥ 128 so write 1 (73 left); 73 ≥ 64, write 1 (9 left); 9 < 32, write 0; 9 < 16, write 0; 9 ≥ 8, write 1 (1 left); 0, 0, then 1 ≥ 1, write 1. Result: 11001001 .

6.2.2 Binary to decimal: add the place values

Add the place value of every bit that is 1. For 10110100 , the 1 bits sit under 128, 32, 16 and 4, so the value is 180. Applying this to a whole address, 172.16.45.201 becomes 10101100.00010000.00101101.11001001 .

Subnet masks only ever contain a run of ones followed by zeros, so only nine values can appear in a mask octet. Memorise Table 6-2; you will use it constantly.

Table 6-2 The nine possible subnet mask octet values

Binary 00000000 10000000 11000000 11100000 11110000 11111000 11111100 11111110 11111111 Decimal 0 128 192 224 240 248 252 254 255

Mask bits 0 1 2 3 4 5 6 7 8

Tip

Before the exam begins, many candidates jot the place values 128 64 32 16 8 4 2 1 and the mask values 128 192 224 240 248 252 254 255 on their erasable note board. The second row is just the running total of the first.

6.3 Network and Host Portions, Masks and Prefixes

Every IPv4 address has two parts. The network portion (the high-order bits) identifies the subnet; every device on the same subnet shares it. The host portion (the remaining low-order bits) identifies one interface on that subnet. Routers forward packets by looking only at the network portion; the host portion matters only on the final subnet.

The subnet mask marks where the split falls. It is another 32-bit value in which a 1 marks a network bit and a 0 marks a host bit. Mask 255.255.255.0 is 24 ones followed by 8 zeros, so the first 24 bits are the network. The same information can be written as a prefix length (CIDR notation): /24 simply counts the ones. Cisco IOS configuration uses the dotted mask ( ip address 192.168.10.1 255.255.255.0 ), while most show commands, Linux and documentation use the prefix.

Figure 6-2 A bitwise AND of address and mask keeps the network bits and zeroes the host bits, giving the network (subnet) ID 192.168.10.0/24.

Within any subnet, two host-portion values are reserved. When all host bits are 0, the address is the network ID (subnet ID) that names the subnet itself; when all host bits are 1, it is the directed broadcast address for that subnet. Everything in between can be assigned to hosts.

A subnet with h host bits therefore has 2

h − 2 usable addresses. For 192.168.10.0/24: network

192.168.10.0, broadcast 192.168.10.255, usable hosts .1 to .254 (2 8 − 2 = 254).

6.4 Classful Addressing (Historical)

Before 1993, the network/host boundary was fixed by the first few bits of the address, the address class. Classless Inter-Domain Routing (CIDR) replaced this scheme, and modern routers ignore classes when forwarding. Classes still matter because the vocabulary (“a class B network”) persists, because some commands such as RIP and EIGRP network statements and auto-summary think in classful terms, and because the exam expects you to know the ranges.

Table 6-3 IPv4 address classes

Exam alert

Identify the class from the first octet alone: 1–126 A, 128–191 B, 192–223 C, 224–239 D. Note that 127 belongs to no usable class: 127.0.0.0/8 is reserved for loopback. Expect questions such as “which address is a valid class B host address?”

6.5 Unicast, Broadcast, Multicast and Special Addresses

IPv4 defines three ways to address a packet, illustrated in Figure 6-3. A unicast address identifies one interface. A broadcast reaches every host on a subnet: the limited broadcast 255.255.255.255 never leaves the local subnet, while a directed broadcast such as 192.168.10.255 targets a specific subnet (routers drop directed broadcasts by default, the no ip directed-broadcast default). A multicast address (224.0.0.0/4) identifies a group of interested receivers; OSPF, for example, sends hellos to 224.0.0.5.

Unicast (one) Broadcast (all) Multicast (group)

192.168.10.20 to 255.255.255.255 to 224.0.0.5

Figure 6-3 Unicast reaches one host, broadcast reaches every host on the subnet, multicast reaches only the hosts that joined the group.

Several address blocks have special meanings and must never be assigned to an ordinary host interface. Table 6-4 lists the ones you should recognise on sight.

Table 6-4 Special-purpose IPv4 addresses

  • Address or block Name Meaning
  • 0.0.0.0 Unspecified /
  • “this host”
  • Source address of a host that has no address yet (DHCP

Discover). As a route, 0.0.0.0/0 is the default route.

127.0.0.0/8 Loopback Traffic to 127.0.0.1 (or any 127.x.x.x) never leaves the host. ping 127.0.0.1 tests the local TCP/IP stack.

All hosts on the local subnet; never forwarded by routers.

  • Host bits all 1 Directed
  • broadcast
  • All hosts on a specific subnet, e.g. 172.16.20.255 for

172.16.20.0/24.

Host bits all 0 Network ID Identifies the subnet itself, e.g. 172.16.20.0/24. 224.0.0.0/4 Multicast (class

D)

Group addresses; 224.0.0.0/24 is link-local control traffic

(224.0.0.5/6 OSPF, 224.0.0.10 EIGRP).

240.0.0.0/4 Reserved (class

E)

Not usable for hosts.

  • 100.64.0.0/10 Shared address
  • space
  • Carrier-grade NAT between an ISP and its customers (RFC

6598).

6.6 Private IPv4 Addressing

Public addresses are globally unique and allocated by the Regional Internet Registries. To stretch the supply, RFC 1918 reserves three blocks that anyone may use inside their own network without asking permission. Because thousands of organisations use the same private addresses, Internet routers do not route them; a router or firewall at the edge performs Network Address Translation (NAT, Chapter 24) to swap the private source address for a public one on the way out.

Table 6-5 RFC 1918 private address ranges

Block Range Classful equivalent Number of addresses

10.0.0.0/8 10.0.0.0 – 10.255.255.255 1 class A network 16,777,216 172.16.0.0/12 172.16.0.0 – 172.31.255.255 16 class B networks 1,048,576 192.168.0.0/16 192.168.0.0 – 192.168.255.255 256 class C networks 65,536 Private: 192.168.10.0/24 (RFC 1918)

Figure 6-4 Hosts use private addresses internally; R1 translates them to its public address before packets enter the Internet.

Exam alert

The 172 range is the trap: only 172.16.0.0 through 172.31.255.255 is private. An address such as 172.32.1.1 or 172.15.0.1 is public. Also remember that 169.254.x.x (APIPA) and 127.x.x.x are special-purpose, not RFC 1918 private.

6.7 The IPv4 Header

Chapter 2 introduced the IPv4 header as the Layer 3 envelope. With addresses now in focus, it is worth a second look at the fields that matter most for the CCNA. The header is at least 20 bytes long (Figure 6-5).

  • 0 8 16 24 31
  • Version (4) IHL (4) DSCP (6) ECN Total Length (16)
  • Identification (16) Flags Fragment Offset (13)
  • TTL (8) Protocol (8) Header Checksum (16)
  • Source IPv4 Address (32)
  • Destination IPv4 Address (32)
  • Options (rare) and padding

Figure 6-5 The IPv4 header: 20 bytes without options. The source and destination addresses are each 32 bits.

Key fields: TTL (time to live) is decremented by every router, and a packet whose TTL reaches 0 is discarded with an ICMP Time Exceeded message, which prevents endless loops and makes traceroute possible. Protocol identifies the payload: 1 = ICMP, 6 = TCP, 17 = UDP, 89 = OSPF. DSCP carries QoS markings (Chapter 27). Identification, Flags and Fragment Offset support fragmentation. The Header Checksum is recomputed by every router because the TTL changes at each hop.

6.8 Configuring and Verifying IPv4 on a Router

Router interfaces need an address and mask, and on most Cisco routers they are administratively down until you issue no shutdown . When you configure an address, IOS automatically adds a connected route for the subnet and a local /32 route for the address itself (Chapter 19). IOS also refuses obviously invalid combinations: it rejects the network ID or broadcast address as an interface address (“Bad mask”) and rejects a subnet that overlaps another interface's subnet.

Figure 6-6 Topology used for the configuration and client-verification examples in this chapter.

R1(config)# interface GigabitEthernet0/0/0
R1(config-if)# description LAN - client subnet
R1(config-if)# ip address 192.168.10.1 255.255.255.0
R1(config-if)# no shutdown
R1(config-if)# interface GigabitEthernet0/0/1
R1(config-if)# ip address 172.16.20.1 255.255.255.0
R1(config-if)# no shutdown
R1(config-if)# interface Loopback0
R1(config-if)# ip address 10.255.255.1 255.255.255.255 ! loopbacks are always up

The most useful verification command is show ip interface brief : one line per interface with its address, how the address was set (Method: manual, DHCP, NVRAM, unset) and two status columns. The Status column reflects Layer 1 and administrative state; the Protocol column reflects Layer 2. “administratively down / down” means someone (or the factory default) shut the interface; “down / down” usually means no cable or a dead far end; “up / down” points to a Layer 2 problem such as an encapsulation mismatch on a serial link. Device output in this book is illustrative of Cisco IOS 15 and IOS XE.

R1# show ip interface brief
  • Interface IP-Address OK? Method Status Protocol
  • GigabitEthernet0/0/0 192.168.10.1 YES manual up up
  • GigabitEthernet0/0/1 172.16.20.1 YES manual up up
  • Serial0/1/0 unassigned YES unset administratively down down

GigabitEthernet0 unassigned YES NVRAM administratively down down Loopback0 10.255.255.1 YES manual up up

R1# show ip interface GigabitEthernet0/0/0 | include line|Internet|Broadcast
  • GigabitEthernet0/0/0 is up, line protocol is up
  • Internet address is 192.168.10.1/24
  • Broadcast address is 255.255.255.255

Figure 6-7 Verifying router addressing. Note that show ip interface displays the mask as a prefix length even though it was configured in dotted decimal.

6.9 Verifying IP Parameters on Client Operating Systems

Exam topic 1.10 asks you to check a host's IP settings on Windows, macOS and Linux. On every OS you are looking for the same four parameters: IP address, subnet mask (or prefix), default gateway and DNS servers, plus whether they came from DHCP. A host with a correct address but a wrong mask or gateway can reach its own subnet but nothing beyond it, a classic troubleshooting scenario.

6.9.1 Windows

ipconfig shows the address, mask and gateway; ipconfig /all adds the MAC address, DHCP status and lease, and DNS servers. Related commands: ipconfig /release and /renew (DHCP), ipconfig /flushdns , and route print or netstat -rn for the routing table. Command Prompt — Win-PC

C:\> ipconfig /all
  • Windows IP Configuration
  • Host Name . . . . . . . . . . . . : Win-PC
  • Node Type . . . . . . . . . . . . : Hybrid
  • IP Routing Enabled. . . . . . . . : No
  • Ethernet adapter Ethernet:
  • Connection-specific DNS Suffix . : corp.example.com

Description . . . . . . . . . . . : Intel(R) Ethernet Connection I219-LM Physical Address. . . . . . . . . : 00-1A-2B-3C-4D-5E

DHCP Enabled. . . . . . . . . . . : Yes

Link-local IPv6 Address . . . . . : fe80::8d4c:2e1a:6b3f:91a2%12(Preferred) IPv4 Address. . . . . . . . . . . : 192.168.10.10(Preferred)

Subnet Mask . . . . . . . . . . . : 255.255.255.0

Lease Obtained. . . . . . . . . . : Sunday, October 4, 2026 8:02:11 AM Lease Expires . . . . . . . . . . : Monday, October 5, 2026 8:02:11 AM Default Gateway . . . . . . . . . : 192.168.10.1

  • DHCP Server . . . . . . . . . . . : 192.168.10.1
  • DNS Servers . . . . . . . . . . . : 192.168.10.1
  • 8.8.8.8
  • NetBIOS over Tcpip. . . . . . . . : Enabled

Figure 6-8 ipconfig /all on Windows: address, mask, gateway, DNS servers and DHCP lease details.

6.9.2 macOS

macOS inherits BSD's ifconfig , which shows the mask in hexadecimal: 0xffffff00 is 255.255.255.0 (ff = 255). The friendlier networksetup -getinfo "Wi-Fi" (or the name of the wired service) prints the address, mask and router in dotted decimal. Use netstat -rn to see the default route and scutil --dns for DNS resolvers. The same information is in System Settings > Network > Details.

Terminal — mac — zsh

student@Mac ~ % ifconfig en0

en0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500 ether a4:83:e7:12:34:56

inet6 fe80::1c3a:5bff:fe2e:9d10%en0 prefixlen 64 secured scopeid 0xe inet 192.168.10.11 netmask 0xffffff00 broadcast 192.168.10.255 status: active

Figure 6-9 Checking IPv4 parameters on macOS. ifconfig shows the mask in hex; networksetup shows it in dotted decimal with the default router.

6.9.3 Linux

Modern Linux distributions use the ip command from the iproute2 package: ip addr (or ip a ) for addresses in prefix notation, and ip route for the routing table, where the default via line is the gateway. DNS servers appear in /etc/resolv.conf or, on systemd-based systems, via resolvectl status . The older ifconfig and route -n commands (net-tools) still work on many systems.

bash — linux-host

student@linux-host:~$ ip addr show ens33

2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000

link/ether 00:0c:29:4f:8e:35 brd ff:ff:ff:ff:ff:ff

inet 192.168.10.12/24 brd 192.168.10.255 scope global dynamic noprefixroute ens33 valid_lft 86012sec preferred_lft 86012sec

  • inet6 fe80::20c:29ff:fe4f:8e35/64 scope link noprefixroute
  • valid_lft forever preferred_lft forever
  • student@linux-host:~$ ip route
  • default via 192.168.10.1 dev ens33 proto dhcp metric 100

192.168.10.0/24 dev ens33 proto kernel scope link src 192.168.10.12 metric 100 student@linux-host:~$ resolvectl dns ens33

Link 2 (ens33): 192.168.10.1

Figure 6-10 Linux shows the address in prefix notation (/24); dynamic means it was learned from DHCP.

Table 6-6 Client OS commands for verifying IP parameters

Task Windows macOS Linux

Address and mask ipconfig ifconfig en0 ip addr

All details incl.

Dns, mac

  • ipconfig
  • /all
  • networksetup -getinfo
<service>
ip addr , resolvectl status

Dhcp

sudo dhclient -r; sudo

dhclient or nmcli

Watch out

If a client shows an address in 169.254.0.0/16 and no default gateway, it did not get a DHCP reply. Check the cable, the VLAN, the DHCP server and any ip helper-address on the router before you touch the client's settings.

LAB Address a router and verify the clients

Goal: Configure R1 in Figure 6-6 and confirm that all three clients have correct parameters. Steps:

  • 1. Apply the configuration shown in Section 6.8 to G0/0/0, G0/0/1 and Loopback0.
  • 2. Run show ip interface brief . Expect both Gigabit interfaces up/up with Method manual.
  • 3. On each client, display the IP parameters with the commands from Table 6-6. Expect an address in 192.168.10.0/24, mask 255.255.255.0 (/24, 0xffffff00) and gateway 192.168.10.1.
  • 4. From each client, ping 192.168.10.1 , then ping 172.16.20.100 to prove that the gateway works.

Verify: If the first ping works but the second fails, re-check the client's default gateway and mask. If R1 shows administratively down, you forgot no shutdown .

Cidr

  • unicast
  • multicast
  • loopback

Apipa

Rfc 1918

Nat

Ttl

default gateway

Review questions

  • 1. What is the binary value of 222?
  • A. 11011110
  • B. 11101110
  • C. 11011010
  • D. 10111110
  • 2. Which mask is equivalent to /27?
  • A. 255.255.255.192
  • B. 255.255.255.224
  • C. 255.255.255.240
  • D. 255.255.224.0
  • 3. Which two addresses are RFC 1918 private addresses? (Choose two.)
  • A. 172.32.10.1
  • B. 10.200.1.1
  • C. 192.169.1.1
  • D. 172.20.5.5
  • E. 169.254.10.10
  • 4. To which class does 191.12.40.3 belong?
  • A. Class A
  • B. Class B
  • C. Class C
  • D. Class D
  • 5. A Windows PC shows IPv4 address 169.254.33.7 and no default gateway. What is the most likely cause?
  • A. The DNS server is down
  • B. The PC could not reach a DHCP server
  • C. The default gateway has a wrong mask
  • D. The address was set manually
  • 6. What is the network ID of host 192.168.10.77 255.255.255.0?
  • A. 192.168.0.0
  • B. 192.168.10.0
  • C. 192.168.10.255
  • D. 192.168.10.77
  • 7. Which address is used by a host to test its own TCP/IP stack without sending traffic on the network?
  • A. 0.0.0.0
  • B. 255.255.255.255
  • C. 127.0.0.1
  • D. 224.0.0.1
  • 8. A macOS ifconfig output shows netmask 0xfffffc00 . What is the prefix length?
  • A. /20
  • B. /21
  • C. /22
  • D. /23
  • 9. Which Linux command displays the default gateway?
  • A. ip addr
  • B. ip route
  • C. ipconfig /all
  • D. resolvectl dns
  • 10. show ip interface brief shows an interface as administratively down / down. What should you do?
  • A. Replace the cable
  • B. Configure no shutdown on the interface
  • C. Fix the encapsulation
  • D. Change the IP address
  • 11. Which two statements about the IPv4 header are true? (Choose two.)
  • A. Each router decrements the TTL
  • B. The Protocol field value 6 indicates UDP
  • C. The addresses are 32 bits each
  • D. The minimum header length is 40 bytes
  • E. The header has no checksum
  • 12. Which address type is delivered to all hosts on the local subnet and is never forwarded by a router?
  • A. 255.255.255.255
  • B. A directed broadcast
  • C. 224.0.0.5
  • D. 0.0.0.0
  • 13. Which is a valid host address in network 172.16.0.0/16?
  • A. 172.16.0.0
  • B. 172.16.255.255
  • C. 172.16.255.0
  • D. 172.17.0.1

Answers

  • 1. A. 222 = 128 + 64 + 16 + 8 + 4 + 2 = 11011110.
  • 2. B. 27 bits = 255.255.255 (24) + 3 bits = 224.
  • 3. B, D. 10.0.0.0/8 and 172.16.0.0–172.31.255.255 are private. 172.32.x and 192.169.x are public; 169.254.x is APIPA.
  • 4. B. Class B covers 128–191.
  • 5. B. 169.254.0.0/16 is self-assigned (APIPA) when DHCP fails.
  • 6. B. AND with 255.255.255.0 keeps the first three octets and zeroes the last.
  • 7. C. 127.0.0.1 is the loopback address.
  • 8. C. ff.ff.fc.00 = 255.255.252.0 = 8 + 8 + 6 = /22.
  • 9. B. The default via line of ip route is the gateway.
  • 10. B. Administratively down means the interface is shut down in the configuration.
  • 11. A, C. TTL is decremented per hop and addresses are 32 bits. Protocol 6 is TCP, the minimum header is 20 bytes, and there is a header checksum.
  • 12. A. The limited broadcast stays on the local subnet.
  • 13. C. 172.16.255.0 has host bits 11111111.00000000, which is neither all 0s nor all 1s, so it is a valid host. 172.16.0.0 is the network ID and 172.16.255.255 the broadcast; 172.17.0.1 is in a different network.
Use ← → to move between sections