IP Protocol (IPv4) classes and subnets

IPv4 addresses are composed of 4 bytes (32 bits), represented by 4 decimal numbers, for example, Each host (server, switch, router, firewall, etc.) in the IP network needs at least one IP address. Within a network all IP addresses must be unique.

An IP address consists of two fields, a network prefix and a host number. For instance, in the IP address, the network prefix is 10 and the host number is 121.12.16.

All hosts in the same network can communicate directly to each other. Hosts in other networks can only be reached using a router. For example, consider the following three hosts:

Host A IP address:     192. 168. 1.   1 
with subnet mask:      255. 255. 255. 0 
is in network:         192. 168. 1.   0 
with broadcast address 192. 168. 1.   255 
and is host number                    1 in that network 
Host B IP address:     192. 168. 3.   4 
with subnet mask:      255. 255. 255. 0
is in network:         192. 168. 3.   0 
with broadcast address 192. 168. 3.   255 
and is host number                    4 in that network 
Host C IP address:     192. 168. 3.   8 
with subnet mask:      255. 255. 255. 0 
is in network:         192. 168. 3.   0 
with broadcast address 192. 168. 3.   255 
and is host number                    8 in that network

To have host B ( and C ( communicating with each other no routing is needed since both hosts are in the same network (

To have host A ( and B ( communicating with each other, however, a router must be setup to route packets between networks and It is important to note that routers route packets between networks (sets of IP addresses) and do not route between individual IP addresses.

The first three bits of the first byte of an IP address define the class of the address. Three classes of networks are defined:

In a typical class C address like, the network is 195.23.221 and the host number is 23.



First byte

Max number of hosts

Number of available networks













This means that the IP address is a class B network. This network can have 65,534 hosts in it. The problem is that there are only 16,384 class B networks available worldwide, and only 128 class A networks. Only very large companies (like IBM) and some governments own a class A network, all other organizations sometimes use a class B, and mostly use a class C network.

Classful network design served its purpose in the startup stage of the Internet, but it lacked scalability in the face of the rapid expansion of the network in the 1990s. For instance, when an organization only needs five hosts in their network, they needed to get a class C network, even if they used only five of its 254 available host addresses.

To solve the problem of this inefficient use of IP addresses the class system of the address space was replaced with Classless Inter-Domain Routing (CIDR) in 1993. CIDR is based on variable-length subnet masking (VLSM) to allow allocation and routing based on arbitrary-length prefixes. This system is also known as subnetting.


Subnetting is used to split up the host part of an IP network in smaller subnets, each forming a new IP network. Consider the following example:

In this case, the IP address has a network prefix of 196.121.12 and a host number of 241 (in the host range between 1 and 254).

For IPv4 a network mask is a 32-bit number (expressed in four decimals) where bits set to 1 signify the network prefix and bits set to 0 the host part of the address. Essentially to get the network address from an IP address the IP address and the subnet mask are ANDed together, to get the host part the IP address and the negated subnet mask are ANDed together. The default subnet mask of a class C network is

As an alternative, the routing prefix can also be expressed in Classless Inter-Domain Routing (CIDR) notation. It is written as the address of a network, followed by a slash character (/), and ending with the bit-length of the host space. For example, is the network mask for the notation.

Now consider the following example using a subnet:

In this case, the IP address has a network prefix of 196.121.12, a subnet of 240 and a host number of 1 (in the host range between 1 and 14).

Using subnets, the available IP address space can be used much more efficiently, as unused host addresses are simply not reserved or wasted. In the next table, the number of hosts that can be used is shown for certain subnet masks.

CIDR prefix

Subnet mask

Available subnets

Hosts per subnet
























2 (only point-to-point)

To directly connect two routers with each other, a subnet with 4 addresses is needed (each router needs one IP address, plus the subnet needs a broadcast address and a network address), leading to a subnet mask of Point/to/point connections need no broadcast or network address and can use a subnet mask of

Using subnets allows Internet Service Providers to for instance provide 32 organizations with six public IP addresses each and only using one class C IP network for it.

To maximize the number of IP addresses available in the various LAN segments in an internal network and to minimize the size of routing tables in routers, a well-designed IP addressing plan is needed. In such an addressing plan the available IP ranges are divided in various subnets, each with its own set of users.

Private IP ranges

Since the number of unique IP addresses on the Internet is limited and because hosts with public Internet IP addresses can reach the internet directly, private IP addresses should be used for LANs instead. The following IPv4 address ranges can be used for internal use – so-called private IP address ranges:

  • to (class A address range)
  • to (class B address range)
  • to (class C address range)

These IP addresses are not used on the Internet and by default they are not routed by Internet routers. This means each organization can use these IP ranges internally without introducing conflicts on the Internet. It is a good practice to create separate subnets within the chosen address range for:

  • Production environment workstations
  • Production environment servers
  • Office environment workstations
  • Office environment servers
  • Development and test environments
  • De-Militarized Zone
  • Systems management network segment
  • Printers
  • Remote users
  • Server clusters
  • Guest users’ workstations

Routing between these subnets should be done using routers with access-lists, to block undesired network traffic.

This entry was posted on Vrijdag 07 December 2012

Earlier articles

Quantum computing

My Book

Security bij cloudproviders wordt niet beter door overheidsregulering

Passend Europees cloudinitiatief nog ver weg

Data Nederlandse studenten in cloud niet grootschalig toegankelijk voor bedrijven VS

VS kan nog steeds Europese data Microsoft opeisen ondanks nieuwe regels

The cloud is as insecure as its configuration

Infrastructure as code

DevOps for infrastructure

Infrastructure as a Service (IaaS)

(Hyper) Converged Infrastructure

Object storage

Software Defined Networking (SDN) and Network Function Virtualization (NFV)

Software Defined Storage (SDS)

What's the point of using Docker containers?

Identity and Access Management

Using user profiles to determine infrastructure load

Public wireless networks

Supercomputer architecture

Desktop virtualization

Stakeholder management

x86 platform architecture

Midrange systems architecture

Mainframe Architecture

Software Defined Data Center - SDDC

The Virtualization Model

What are concurrent users?

Performance and availability monitoring in levels

UX/UI has no business rules

Technical debt: a time related issue

Solution shaping workshops

Architecture life cycle

Project managers and architects

Using ArchiMate for describing infrastructures

Kruchten’s 4+1 views for solution architecture

The SEI stack of solution architecture frameworks

TOGAF and infrastructure architecture

The Zachman framework

An introduction to architecture frameworks

How to handle a Distributed Denial of Service (DDoS) attack

Architecture Principles

Views and viewpoints explained

Stakeholders and their concerns

Skills of a solution architect architect

Solution architects versus enterprise architects

Definition of IT Architecture

What is Big Data?

How to make your IT "Greener"

What is Cloud computing and IaaS?

Purchasing of IT infrastructure technologies and services

IDS/IPS systems

IP Protocol (IPv4) classes and subnets

Introduction to Bring Your Own Device (BYOD)

IT Infrastructure Architecture model

Fire prevention in the datacenter

Where to build your datacenter

Availability - Fall-back, hot site, warm site

Reliabilty of infrastructure components

Human factors in availability of systems

Business Continuity Management (BCM) and Disaster Recovery Plan (DRP)

Performance - Design for use

Performance concepts - Load balancing

Performance concepts - Scaling

Performance concept - Caching

Perceived performance

Ethical hacking

Computer crime

Introduction to Cryptography

Introduction to Risk management

The history of UNIX and Linux

The history of Microsoft Windows

Engelse woorden in het Nederlands

Infosecurity beurs 2010

The history of Storage

The history of Networking

The first computers

Cloud: waar staat mijn data?

Tips voor het behalen van uw ITAC / Open CA certificaat

Ervaringen met het bestuderen van TOGAF

De beveiliging van uw data in de cloud

Proof of concept

Een consistente back-up? Nergens voor nodig.

Measuring Enterprise Architecture Maturity

The Long Tail

Open group ITAC /Open CA Certification

Human factors in security

Google outage

SAS 70

De Mythe van de Man-Maand

TOGAF 9 - wat is veranderd?

Landelijk Architectuur Congres LAC 2008

InfoSecurity beurs 2008

Spam is big business

De zeven eigenschappen van effectief leiderschap

Een ontmoeting met John Zachman

Persoonlijk Informatie Eigendom

Archivering data - more than backup

Sjaak Laan

Recommended links

Genootschap voor Informatie Architecten
Ruth Malan
Gaudi site
XR Magazine
Esther Barthel's site on virtualization
Eltjo Poort's site on architecture


XML: RSS Feed 
XML: Atom Feed 


The postings on this site are my opinions and do not necessarily represent CGI’s strategies, views or opinions.


Copyright Sjaak Laan