Punit IP addressing and subnetting
IP addressing

IP addressing and subnetting, worked out in binary

Every route, firewall rule and design I write depends on getting Internet Protocol (IP) addresses right. This page covers binary, masks and Classless Inter Domain Routing (CIDR), a complete mask table, a calculator that shows its working, and IPv6, with animated worked examples you can step through.

  • Binary
  • Subnet masks
  • CIDR
  • VLSM
  • Summarisation
  • Wildcards
  • IPv6
  • SLAAC
Start with the binary Where I use it
One /24 carved into right sized subnets The block 10.1.10.0/24 is shown as a bar split into a /25, a /26, a /27, a /28 and small /30 links. Below it, the 32 bits of an address are split into network bits and host bits. 10.1.10.0/24 /25126 hosts /2662 /27 /28 /30 32 BITS 10 1 10 77 network: 24 bits host: 8
Live view · one block, many right sized subnets
Binary

An address is just 32 bits

Subnetting stops being hard once the binary is clear. Every mask, range and summary on this page comes from the same idea: some bits name the network and the rest name the host.

Reading an IPv4 address in binary One octet shown as eight bits with place values 128 to 1, first holding 192, then 168. Then the whole address 192.168.10.77 as 32 bits, and finally the /24 mask under it, splitting the network bits from the host bits. 128 64 32 16 8 4 2 1 11000000= 192128 + 64 = 192 10101000= 168128 + 32 + 8 = 168 192168107711000000.10101000.00001010.0100110111000000.10101000.00001010.01001101Four octets of 8 bits: 32 bits in all 192168107711000000.10101000.00001010.0100110111111111111111111111111100000000Mask 255.255.255.0, written /24: twenty four 1s, then 0sNetwork: 192.168.10.0Host: 77

Swipe sideways to see the whole diagram.

Step 1

  1. Each bit in an octet has a value, doubling from right to left: 1, 2, 4 and so on up to 128. To read an octet, I add up the values of the bits that are 1. Here 128 + 64 makes 192.

  2. The same method gives 168: 128 + 32 + 8. With eight bits, one octet can hold any value from 0 to 255.

  3. An IPv4 address is 32 bits, written as four octets in decimal with dots between them. 192.168.10.77 is really one 32 bit number.

  4. The mask marks which bits are the network and which are the host. A /24 mask has 24 ones, so 192.168.10 is the network and 77 is the host.

Try it: one octet, bit by bit

Click a bit to switch it on or off, or type a number from 0 to 255.

1286432168421
Binary
11000000
Hexadecimal
0xC0
Sum
128 + 64 = 192
IPv4 structure

Classes, private ranges and special blocks

IPv4 addresses are not all equal. Some ranges are private, some are reserved for documentation or loopback, and some tell me straight away that something has gone wrong.

IPv4 address classes and special ranges by first octet A ruler of the first octet from 0 to 255. In the classes view it is split into class A (0 to 127), B (128 to 191), C (192 to 223), D for multicast (224 to 239) and E reserved (240 to 255). In the special ranges view, pins mark private 10, 172.16 and 192.168, shared address space 100.64, loopback 127, link local 169.254, multicast 224 and reserved 240. A · /80 to 127B · /16128 to 191C · /24192 to 223DEmulticastreservedClass A: first octet 1 to 126 (0 and 127 are reserved), default mask /8, about 16.7 million hosts.Class B: 128 to 191, default /16, 65,534 hosts. Class C: 192 to 223, default /24, 254 hosts.Classes were replaced by Classless Inter Domain Routing (CIDR) in 1993. First octet, 0 to 255where the special ranges sit10100.64127169.254172.16192.168224240Private: 10/8, 172.16/12 and 192.168/16 (RFC 1918). Shared, for carrier NAT: 100.64/10.Loopback: 127/8. Link local (APIPA): 169.254/16. Multicast: 224/4. Reserved: 240/4.Documentation: 192.0.2/24, 198.51.100/24 and 203.0.113/24. 255.255.255.255 is local broadcast.

Swipe sideways to see the whole diagram.

Classes. The first bits of an address used to fix its class and its mask. Class A started with a 0 bit, B with 10, C with 110, D (multicast) with 1110 and E (reserved) with 1111. Since CIDR, any mask can go with any address, but the Routing Information Protocol (RIP) version 1 still behaves classfully, which is why the history matters.

Special ranges. Some blocks never appear on the public internet. Seeing one tells me something at once: 169.254 means a client never reached a Dynamic Host Configuration Protocol (DHCP) server, 100.64 means carrier grade network address translation (NAT), and 127 is the host talking to itself.

Animation

Ranges I check first

RangePurposeWhat it tells me
10.0.0.0/8Private, from Request for Comments (RFC) 1918Inside an organisation. Large estates and data centres use it most.
172.16.0.0/12Private (RFC 1918)Covers 172.16 to 172.31, not the whole of 172.
192.168.0.0/16Private (RFC 1918)Homes and small sites. Clashes often appear after mergers and virtual private network (VPN) links.
100.64.0.0/10Shared address space (RFC 6598)Carrier grade NAT. VMware NSX also uses it inside its gateways by default.
127.0.0.0/8LoopbackThe host talking to itself.
0.0.0.0/8This networkOnly valid as a source, for example a DHCP Discover.
169.254.0.0/16Link local (Automatic Private IP Addressing, APIPA)The client asked for DHCP and nobody answered.
224.0.0.0/4Multicast224.0.0.0/24 is link local and never routed, for Open Shortest Path First (OSPF), the Hot Standby Router Protocol (HSRP) and similar.
240.0.0.0/4ReservedNot used on networks.
198.18.0.0/15Benchmark testing (RFC 2544)Lab and test traffic.
192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24Documentation (RFC 5737)Safe for examples, like the ones on this site.
Subnet table

Every mask from /0 to /32

This is the table I use most. The highlighted rows are the common ones: /8, /16 and /24 for plans and summaries, /25 to /29 for real subnets, /30 and /31 for links, and /32 for loopbacks.

Every IPv4 prefix length from /0 to /32
PrefixMaskWildcardAddressesUsable hostsBlock size
/00.0.0.0255.255.255.2554,294,967,296the default routewhole address space
/1128.0.0.0127.255.255.2552,147,483,6482,147,483,646128 in the 1st octet
/2192.0.0.063.255.255.2551,073,741,8241,073,741,82264 in the 1st octet
/3224.0.0.031.255.255.255536,870,912536,870,91032 in the 1st octet
/4240.0.0.015.255.255.255268,435,456268,435,45416 in the 1st octet
/5248.0.0.07.255.255.255134,217,728134,217,7268 in the 1st octet
/6252.0.0.03.255.255.25567,108,86467,108,8624 in the 1st octet
/7254.0.0.01.255.255.25533,554,43233,554,4302 in the 1st octet
/8255.0.0.00.255.255.25516,777,21616,777,2141 in the 1st octet
/9255.128.0.00.127.255.2558,388,6088,388,606128 in the 2nd octet
/10255.192.0.00.63.255.2554,194,3044,194,30264 in the 2nd octet
/11255.224.0.00.31.255.2552,097,1522,097,15032 in the 2nd octet
/12255.240.0.00.15.255.2551,048,5761,048,57416 in the 2nd octet
/13255.248.0.00.7.255.255524,288524,2868 in the 2nd octet
/14255.252.0.00.3.255.255262,144262,1424 in the 2nd octet
/15255.254.0.00.1.255.255131,072131,0702 in the 2nd octet
/16255.255.0.00.0.255.25565,53665,5341 in the 2nd octet
/17255.255.128.00.0.127.25532,76832,766128 in the 3rd octet
/18255.255.192.00.0.63.25516,38416,38264 in the 3rd octet
/19255.255.224.00.0.31.2558,1928,19032 in the 3rd octet
/20255.255.240.00.0.15.2554,0964,09416 in the 3rd octet
/21255.255.248.00.0.7.2552,0482,0468 in the 3rd octet
/22255.255.252.00.0.3.2551,0241,0224 in the 3rd octet
/23255.255.254.00.0.1.2555125102 in the 3rd octet
/24255.255.255.00.0.0.2552562541 in the 3rd octet
/25255.255.255.1280.0.0.127128126128 in the 4th octet
/26255.255.255.1920.0.0.63646264 in the 4th octet
/27255.255.255.2240.0.0.31323032 in the 4th octet
/28255.255.255.2400.0.0.15161416 in the 4th octet
/29255.255.255.2480.0.0.7868 in the 4th octet
/30255.255.255.2520.0.0.3424 in the 4th octet
/31255.255.255.2540.0.0.122 (point to point, RFC 3021)2 in the 4th octet
/32255.255.255.2550.0.0.011 (a host route)1 in the 4th octet

Usable hosts

Take the number of addresses and remove two: the network address and the broadcast address. A /27 has 32 addresses and 30 usable hosts.

Wildcard masks

A wildcard is the mask turned inside out: 255.255.255.255 minus the mask. A 0 bit must match and a 1 bit can be anything. Access lists and OSPF network statements use them, so 0.0.0.255 matches a /24.

Block size

In the octet where the mask stops being 255, the block size is 256 minus that octet. A mask of 255.255.255.224 gives blocks of 32: .0, .32, .64 and so on.

Calculator

A subnet calculator that shows its working

Type any address and pick a prefix. The calculator shows the network, broadcast and usable range, and the binary underneath, with network bits and host bits in different colours.

You can also type the prefix with the address, such as 172.16.45.200/21. Examples:

Network
10.20.30.64/27
Broadcast
10.20.30.95
Usable range
10.20.30.65 to 10.20.30.94
Hosts
30 usable of 32
Mask
255.255.255.224 (/27)
Wildcard
0.0.0.31
Next subnet
10.20.30.96/27
Type of address
Private (RFC 1918)

Address00001010.00010100.00011110.01001101Mask11111111.11111111.11111111.11100000

network bits host bits

I checked this calculator against Python’s own ipaddress library for 58 IPv4 cases, including /0, /31 and /32. For a /31, both addresses are usable on a point to point link and there is no broadcast.

Block size method

Subnetting in your head, with one subtraction

I do not convert everything to binary. The block size method gives the network, broadcast and host range in seconds, for any mask, once you know which octet to look at.

Subnetting with the block size method The address 10.20.30.77/27 on a number line for the 4th octet. The mask octet 224 gives a block size of 32, the blocks start every 32, 77 falls in the block from 64 to 95, so the network is .64, the broadcast .95 and there are 30 hosts. A second example, 172.16.45.200/21, uses a block of 8 in the 3rd octet. 10.20.30.77 /27mask 255.255.255.224 224The interesting octet is neither 255 nor 0: here it is the 4th, 224 0326496128160192224256 Block size = 256 − 224 = 32 .77 77 sits in the block from 64 to 95 Network10.20.30.64First host10.20.30.65Last host10.20.30.94Broadcast10.20.30.95Hosts32 − 2 = 30 172.16.45.200 /21mask 255.255.248.0The 3rd octet is 248, so the block is 256 − 248 = 83240485645Network172.16.40.0First host172.16.40.1Last host172.16.47.254Broadcast172.16.47.255Hosts2,046

Swipe sideways to see the whole diagram.

Step 1

  1. Write out the mask and find the octet that is not 255 and not 0. For a /27 it is the 4th octet, 224. Everything before it is fixed network; everything after it is host.

  2. Take that octet away from 256. Here 256 − 224 = 32, so the subnets start at 0, 32, 64, 96 and so on in the 4th octet. This is often called the magic number.

  3. Find the multiple of 32 that sits at or below 77. That is 64, and the next block starts at 96, so this block runs from 64 to 95.

  4. The network is the first address, .64, and the broadcast the last, .95. The hosts sit between them, .65 to .94: 30 in all.

  5. For 172.16.45.200/21 the interesting octet is the 3rd, 248, so the block is 8. 45 sits in the block from 40 to 47, so the network is 172.16.40.0 and the broadcast 172.16.47.255, with 2,046 hosts.

How many subnets fit?

Two to the power of the bits borrowed. Four /26s fit in a /24, because 26 − 24 = 2 and 2² = 4. Sixty four /30s fit in a /24.

How many hosts?

Two to the power of the host bits, minus two. A /28 has 4 host bits: 2⁴ − 2 = 14 hosts.

Which mask for N hosts?

Find the smallest power of two that is at least N + 2. Fifty hosts need 52 addresses, so 64, which is a /26.

VLSM

One block, many right sized subnets

Variable length subnet masking (VLSM) lets each subnet have the mask it needs. The rule that keeps it tidy is simple: allocate the biggest subnets first, and start every block on a multiple of its own size.

Carving one /24 with variable length subnet masks The block 192.168.10.0/24 is split, biggest first. A /25 serves 100 users, a /26 serves 50 servers and a /27 serves 20 printers and cameras. A /28 holds 10 management interfaces, two /30s serve WAN links, and a /29 stays spare. 192.168.10.0/24 · 256 addresses to share Users: 100 hosts Servers: 50 Printers and cameras: 20 Management: 10 Two WAN links: 2 each Users/25 Servers/26 /27 /28 192.168.10.0/25: usershosts .1 to .126 (126)Biggest first, so it starts on .0 192.168.10.128/26: servershosts .129 to .190 (62)Starts where the /25 ended 192.168.10.192/27: printershosts .193 to .222 (30)Every block starts on a multiple of its size 192.168.10.224/28: managementhosts .225 to .238 (14)16 addresses left over .240/30 and .244/30: WAN links2 hosts eachand .248/29 kept spare for growth .0 .128 .192 .224 .240 used: 248 of 256 addressesspare: one /29

Swipe sideways to see the whole diagram.

Step 1

  1. Write down every subnet and how many hosts it needs, now and in a few years. Then sort them from biggest to smallest.

  2. One hundred users need 102 addresses, so the next power of two is 128: a /25, from .0 to .127.

  3. Fifty servers need 52 addresses, so 64: a /26 starting at .128.

  4. Twenty printers and cameras need 22, so 32: a /27 starting at .192, which is a multiple of 32.

  5. Ten management interfaces need 12, so 16: a /28 at .224.

  6. Each point to point link needs 2 hosts: a /30 each at .240 and .244 (or /31s). The last 8 addresses stay free as a /29 for growth.

Summarisation

Fewer routes, a calmer network

Route summarisation, sometimes called supernetting, advertises one larger prefix in place of many small ones. Smaller routing tables converge faster, and faults stay inside the area they started in.

Route summarisation in binary Four networks, 10.1.0.0/24 to 10.1.3.0/24, share their first 22 bits, so they summarise to 10.1.0.0/22. A second set, 10.1.2.0/24 to 10.1.5.0/24, shares only 21 bits and does not start on a /22 boundary, so it needs two /23 summaries. NetworkThird octet in binary 10.1.0.0/2400000000 10.1.1.0/2400000001 10.1.2.0/2400000010 10.1.3.0/2400000011 10.1.2.0/2400000010 10.1.3.0/2400000011 10.1.4.0/2400000100 10.1.5.0/2400000101 6 matching bits First the 16 bits of 10.1, then 6 more that match: 16 + 6 = 22 10.1.0.0/22255.255.252.0One route instead of four Only 5 bits match, and 10.1.2.0 is not a multiple of 4.So these need two summaries: 10.1.2.0/23 and 10.1.4.0/23.

Swipe sideways to see the whole diagram.

Step 1

  1. A site uses four contiguous /24s, 10.1.0.0 to 10.1.3.0. Without summarising, every router in the network carries four routes for one site.

  2. Write the changing octet in binary. The first six bits are the same in all four, so the summary keeps 16 + 6 = 22 bits.

  3. 10.1.0.0/22 covers exactly those four networks. The site advertises one route, and a flapping subnet inside it no longer disturbs the rest of the network.

  4. A summary must start on a multiple of its own size. 10.1.2.0 to 10.1.5.0 is four networks, but 10.1.2.0 is not a multiple of 4, so it cannot be one /22. It takes two /23s, which is why I plan addresses to summarise from day one.

Where I summarise

At OSPF area borders, at the edge of each site or region, and between the data centre fabric and the rest of the network. The commands differ: area 1 range in OSPF, aggregate-address ... summary-only in the Border Gateway Protocol (BGP).

The discard route

A router that creates a summary also installs a route to Null0 for it. Traffic for a part of the summary that does not exist is dropped there, instead of looping back towards the default route.

The trade off

A summary can attract traffic for a subnet that is down, and can hide a better path. I accept that in exchange for stability, and keep specific routes only where traffic engineering needs them.

Addressing plan

An addressing plan that scales and summarises

A good plan is boring to read and easy to extend. It is hierarchical, so it summarises; it never overlaps with cloud, partners or future acquisitions; and it lives in an IP address management (IPAM) tool, not a spreadsheet only one person understands.

A hierarchical addressing plan for a multi site estate An address tree. The organisation has 10.0.0.0/8. Regions each get a /12: UK, Europe, Americas and a separate cloud block. The UK region holds sites with a /16 each: London, Manchester and the data centre. London is split by function into users, voice, Wi-Fi, IoT, management, and links. Each level advertises one summary upwards. Organisation10.0.0.0/8 UK10.0.0.0/12 Europe10.16.0.0/12 Americas10.32.0.0/12 Cloud10.128.0.0/12 London10.1.0.0/16 Manchester10.2.0.0/16 Data centre10.10.0.0/16 Users10.1.10.0/24 Voice10.1.20.0/24 Wi-Fi10.1.32.0/22 IoT10.1.40.0/22 Mgmt10.1.250.0/24 Links10.1.255.0/24 London advertises 10.1.0.0/16. The UK core advertises 10.0.0.0/12.

Swipe sideways to see the whole diagram.

Step 1

  1. I start with one private block for the whole organisation, usually 10.0.0.0/8, and keep separate blocks for cloud and partners so nothing ever overlaps.

  2. Each region gets a large, summarisable block. Four /12s still leave most of the /8 free for growth and acquisitions.

  3. Each site gets a /16 from its region. A site number that matches the second octet makes every address easy to read.

  4. Inside a site, each function has a fixed place: users, voice, Wi-Fi, Internet of Things (IoT) devices, management, and links and loopbacks. IoT and Wi-Fi pools are sized well ahead of today’s count, often ten times.

  5. Because the plan is hierarchical, each site advertises one /16 and each region one /12. The routing table stays small, and the same layout repeats at every site.

Data centre fabric underlay

ItemHow I address itWhy
Loopback 0One /32 per switch from a /24Router ID and BGP peering
Loopback 1One /32 per leaf, plus a shared /32 per leaf pairVirtual Extensible LAN (VXLAN) tunnel endpoint (VTEP) source
Spine to leaf links/31 per link (RFC 3021), or IP unnumberedSaves half the space of /30s
Sizing example4 spines × 64 leaves = 256 links = 512 addressesExactly a /23
ManagementIts own range and virtual routing and forwarding (VRF) instance on the out of band networkReachable when the fabric is down
IPv6A /48 per site and a /64 per segmentRoom for every segment, always

No overlaps, ever

Overlapping ranges after a merger or with a cloud provider force NAT between them, which breaks logs, troubleshooting and some applications. I reserve cloud and partner blocks from the start.

Size for growth

A /24 for IoT looks fine until the building adds sensors. I size IoT and Wi-Fi pools for ten times today’s count and plan for IPv6 where devices support it.

Autonomous system numbers too

The same thinking applies to BGP autonomous system (AS) numbers. The 2 byte private range, 64512 to 65534, has only 1,023 numbers. Large fabrics use the 4 byte private range, 4200000000 to 4294967294.

IPv6

IPv6: 128 bits and no broadcast

IPv6 fixes address exhaustion for good. The rules are simpler than IPv4 in many ways: every segment is a /64, there is no broadcast and no NAT is needed. What changes most is how hosts find routers and each other.

IPv6 address anatomy, compression and types The address 2001:0db8:85a3:0010:0000:0000:0000:0001 split into a 48 bit global routing prefix, a 16 bit subnet ID and a 64 bit interface ID. The same address compressed to 2001:db8:85a3:10::1. The address types: global unicast, unique local, link local, multicast, loopback and unspecified. 2001 : 0db8 : 85a3 : 0010 : 0000 : 0000 : 0000 : 0001 Global routing prefix: /48from the provider or registrySubnet ID16 bitsInterface ID: 64 bitsSLAAC, EUI-64 or randomA /48 per site holds 65,536 subnets, each a /64.Every LAN segment gets a /64, however few hosts it has. Full form2001:0db8:85a3:0010:0000:0000:0000:0001Drop leading zeros2001:db8:85a3:10:0:0:0:1Replace one zero run with ::2001:db8:85a3:10::1Only one :: per address:: replaces the longest runWrite hex in lower case Global unicast2000::/3Unique localfc00::/7, fd in useLink localfe80::/10Multicastff00::/8Loopback::1Unspecified::Multicast groups worth knowing: ff02::1 all nodes, ff02::2 all routers,ff02::1:ffxx:xxxx solicited node, ff02::5 and ff02::6 for OSPFv3.

Swipe sideways to see the whole diagram.

Anatomy. An IPv6 address is 128 bits, written as eight groups of four hexadecimal digits. The left half is the network: a global prefix and a subnet ID. The right half identifies the interface. Stateless address autoconfiguration (SLAAC) builds it from the media access control (MAC) address in the Extended Unique Identifier (EUI-64) format, or picks it at random.

Writing it short. Leading zeros in each group can be dropped, and one run of all zero groups can become a double colon. Doing it the same way every time (RFC 5952) makes addresses easy to search in logs.

Address types. IPv6 has no broadcast. Multicast does that job, and every interface also has a link local address, which routing protocols use as their next hop.

Animation

IPv6 helper

Full form
2001:0db8:85a3:0010:0000:0000:0000:0001
Short form
2001:db8:85a3:10::1
Type
Documentation (2001:db8::/32)
Prefix
2001:db8:85a3:10::/64
Room inside
exactly one /64
EUI-64 interface ID
250:56ff:feab:cdef
Link local address
fe80::250:56ff:feab:cdef

EUI-64 splits the 48 bit MAC address, puts ff:fe in the middle and flips the seventh bit. Many hosts now use random interface IDs instead, for privacy.

Prefix lengths in a typical plan

PrefixWhereNote
/32An organisation from a registry, or a providerRoom for 65,536 sites of /48
/48A site65,536 subnets of /64
/56A small site, a home, or a data centre pod256 subnets of /64
/64Every local area network (LAN) segmentSLAAC needs exactly 64 bits of interface ID
/127Point to point links (RFC 6164)Like a /31 in IPv4
/128LoopbacksA single address

The header is simpler

The IPv6 header is a fixed 40 bytes. Routers never fragment: only the sender can, and every link must carry at least 1,280 bytes. Internet Control Message Protocol for IPv6 (ICMPv6) packet too big messages must be allowed through.

Link local everywhere

Every IPv6 interface has an fe80:: address, even with no global address. Routers advertise their link local address as the gateway, and routing protocols peer over it.

Commands to check IPv6

ipv6 unicast-routing turns routing on in Cisco IOS. show ipv6 interface brief, show ipv6 neighbors and show ipv6 route are the IPv6 versions of the familiar IPv4 checks.

Neighbour Discovery

How IPv6 hosts find routers and neighbours

Neighbour Discovery Protocol (NDP) runs over ICMPv6 and replaces the Address Resolution Protocol (ARP), router discovery and parts of DHCP. Because it is so central, it also needs its own first hop security.

IPv6 Neighbour Discovery and SLAAC A new IPv6 host forms a link local address and checks it is unique with duplicate address detection. It sends a router solicitation and receives a router advertisement with the prefix and flags. It builds a global address with SLAAC, then finds a neighbour’s MAC address with a neighbour solicitation and advertisement. New hostMAC 0050.56ab.cdef SwitchRA guard on Routerfe80::1 Other host2001:db8:10:20::5 fe80::250:56ff:feab:cdef NS 135 to ff02::1:ffab:cdef: anyone using this? RS 133 to ff02::2: any routers here? RA 134: prefix 2001:db8:10:20::/64, gateway fe80::1 2001:db8:10:20:250:56ff:feab:cdef NS 135, then NA 136: the MAC for ::5 The host builds a link local address from fe80::/64 and its interface ID.It can talk on the local link at once, before any router answers. Duplicate address detection: it asks, from ::, whether anyone already has the address,using the solicited node multicast group. No answer means the address is unique. A router solicitation asks every router on the link to announce itself now,rather than waiting for the next periodic advertisement. The router advertisement carries the prefix, the router lifetime and two flags: M for DHCPv6addresses, O for other settings such as DNS. The gateway is the router’s link local address. With SLAAC the host adds its interface ID to the prefix to make a global address.Here the O flag is set, so it asks a stateless DHCPv6 server for DNS servers. To reach a neighbour, the host sends a neighbour solicitation to that address’s solicited node group,and gets a neighbour advertisement with the MAC. This replaces ARP.

Swipe sideways to see the whole diagram.

Step 1

  1. Before anything else, the host gives itself a link local address. It needs no router and no server.

  2. The host checks nobody else has the address by sending a neighbour solicitation to a special multicast group. Silence means it is safe to use.

  3. The host asks for routers. Routers also send advertisements every few minutes on their own.

  4. The router answers with the prefix and the flags that say how hosts should get their addresses and other settings.

  5. Stateless address autoconfiguration (SLAAC) builds the global address with no server at all. Stateful DHCP for IPv6 (DHCPv6) is used where the M flag is set and addresses must be tracked.

  6. Neighbour solicitation and advertisement replace ARP, using multicast instead of broadcast, so only the target host is disturbed.

The five messages

ICMPv6 typeMessagePurpose
133Router solicitation (RS)A host asks routers to announce themselves
134Router advertisement (RA)Prefix, flags, router lifetime and the gateway
135Neighbour solicitation (NS)Address resolution and duplicate address detection
136Neighbour advertisement (NA)The answer: this address is at this MAC
137RedirectA better first hop on the same link

How hosts get addresses

RA flagsAddress fromDomain Name System (DNS) servers and other settings from
M off, O offSLAACThe RA itself, through its recursive DNS server (RDNSS) option, if the host supports it
M off, O onSLAACStateless DHCPv6
M onStateful DHCPv6 (UDP 546 and 547)DHCPv6

RA guard

A rogue router advertisement can make every host on a virtual LAN (VLAN) send its traffic to an attacker. RA guard on access switches drops advertisements from ports where no router should be.

DHCPv6 guard and source guard

The IPv6 versions of DHCP snooping and IP source guard stop rogue DHCPv6 servers and spoofed source addresses.

Neighbour discovery in the data centre

In large fabrics, neighbour discovery and ARP are the main source of flooded traffic. Ethernet VPN (EVPN) can answer them locally at the leaf, which I cover on the VXLAN EVPN page.

Dual stack

Running IPv4 and IPv6 side by side

Most networks run dual stack for years, not a sudden switch. The design rule is simple: build IPv6 in from day one, and check every rule, route and test twice, once for each protocol. Where an IPv6 only client must reach an IPv4 only server, NAT64 (address translation from IPv6 to IPv4) and DNS64 (a DNS service that builds matching IPv6 answers) bridge the gap.

Dual stack, tunnelling and NAT64 In dual stack a laptop, router and server all run IPv4 and IPv6 side by side. In tunnelling two IPv6 sites are joined across an IPv4 core by wrapping IPv6 in IPv4. In NAT64 an IPv6 only laptop reaches an IPv4 server through a gateway, with DNS64 creating an IPv6 address for the server. 6in4 tunnel LaptopIPv4 and IPv6IPv6 site A2001:db8:a::/48LaptopIPv6 only Routerdual stackIPv4 coretunnel: protocol 41NAT64 gateway64:ff9b::/96 ServerA and AAAAIPv6 site B2001:db8:b::/48Server198.51.100.80 DNS returns both. IPv6 is tried first IPv4 still works alongside IPv6 packets wrapped in IPv4 to cross the core Easy, but adds overhead and costs MTU DNS64 answers 64:ff9b::c633:6450 for the server The gateway translates to 198.51.100.80

Swipe sideways to see the whole diagram.

Dual stack. Hosts, routers and servers run IPv4 and IPv6 side by side. It is the approach I recommend, because nothing is translated and each protocol can be checked on its own. Browsers try both and use whichever answers first (Happy Eyeballs), preferring IPv6.

Tunnelling. IPv6 islands are joined across an IPv4 only core by wrapping IPv6 inside IPv4 (6in4 uses IP protocol 41). It is quick to set up, but it hides the real path and lowers the maximum transmission unit (MTU).

Translation. An IPv6 only client reaches an IPv4 only server through NAT64. DNS64 builds a fake AAAA (IPv6 address) record by putting the IPv4 address inside the 64:ff9b::/96 prefix, and the gateway translates the packets. Mobile networks use this widely.

Animation
Faults

Addressing faults I see again and again

Most addressing faults look like something else: a slow application, a flaky Wi-Fi network or a broken VPN. These six cover the majority of what I find, with the checks that prove each one.

Six common addressing faults A PC, a switch, a router and a server or DHCP server. Six views show common faults: overlapping subnets, a wrong mask, a duplicate IP address, a wrong default gateway, a link local 169.254 address because DHCP did not answer, and a DHCP scope that has run out. PC10.1.10.20/24PC10.1.10.20/16PC10.1.10.20PCgateway .254PC169.254.33.7New laptopno address SwitchVLAN 10 Routergateway 10.1.10.1Routergateway 10.1.10.1RouterARP entry keeps changingRouteris really .1Routerno ip helperRouterrelay to server Server, other site10.1.10.50, same rangeServer10.1.20.50/24Printer10.1.10.20 as wellServer10.1.20.50DHCP servernever reachedDHCP serverscope 100% used The PC thinks the server is local ARP for a host that is not on the LAN Two MACs claim one address Local works, everything remote fails DHCP never answered Discover sent, no offer comes back

Swipe sideways to see the whole diagram.

Overlapping subnets. Two sites, or a site and a VPN partner, use the same range. Hosts think the far end is local, so they ARP instead of routing. Check the routing table on both sides and the VPN selectors. Fix by readdressing one side; NAT between them is a stopgap, not a cure.

Wrong mask. A /16 on a /24 network makes the personal computer (PC) treat 10.1.20.50 as local. It works only if proxy ARP covers for it. Check ipconfig /all or ip addr against the DHCP scope or the documented plan. Fix the mask, and turn proxy ARP off so the mistake shows up straight away.

Duplicate IP address. Two devices answer for one address, so connections break at random as ARP caches change. Check show ip arp twice and watch the MAC change, Windows duplicate address warnings, or show ip dhcp conflict. Fix the static address, reserve it in DHCP, and use DHCP snooping with IP source guard.

Wrong default gateway. The PC can reach everything in its own subnet but nothing beyond it. Check the gateway setting, then arp -a to see whether it ever resolved. Fix the gateway, usually the first hop redundancy virtual address.

A 169.254 address. The client asked for DHCP and nobody answered. Check the VLAN on the port, the ip helper-address on the gateway, and DHCP snooping trust on the uplinks. Fix whichever link in that chain is broken.

DHCP scope exhausted. Existing clients are fine, new ones get nothing. It often follows a guest or IoT rollout. Check the scope use and lease time on the server, or show ip dhcp pool. Fix by growing the subnet or shortening leases where clients come and go quickly.

Animation

The full method, with faults at every layer, is on the troubleshooting page. For DHCP and ARP in more depth, see networking fundamentals.

Projects

Where I have planned and cleaned up addressing

Addressing decisions outlive the hardware they were made on. These are the places where getting them right, or fixing them, mattered most.

Manx Telecom · 2016

Provider address space

Managed provider IP space and AS numbers with RIPE NCC (the European regional internet registry), including Resource Public Key Infrastructure (RPKI) route origin authorisations, for a Tier 3 data centre serving over 300 customer sites.

AVEVA · 2020 to 2021

A merged address space, tidied

Cleaned up regional internet registry records across the merged address space during the reverse merger, and secured the consolidated internet edge with RPKI based BGP origin validation.

Penguin Random House · 2013 to 2015

Two estates becoming one

Post merger infrastructure integration across a multi site estate, including distribution centres, with warehouse automation segmented from corporate information technology (IT).

Home lab

A plan I can read at a glance

Each lab site has its own 10.x range, the provider core uses /29 links, a /30 joins the London router to its core switch, and the ESXi hosts sit on /25 VLANs. See the addressing tables.

Backed by CCNP Enterprise, CCNP Routing and Switching, CCDP and CCNA. See all credentials

Explore

More areas I design and deliver

Every page follows the same idea: how it works, the choices that matter, and where I have used it. The foundations pages explain the basics the others build on.

Foundations (this area)

Networking fundamentals Switching and campus LAN Routing protocols Security fundamentals Troubleshooting Support and service management Glossary

Networks and security

SD-WAN and SDN WAN, MPLS and VPN SD-Access campus fabric Wireless and mobile Security Firewall platforms Load balancing Network automation

Data centre and cloud

Data centre networks VXLAN EVPN and ACI VMware NSX Data centre facilities Servers and virtualisation Private cloud and storage Cloud architecture AWS, Azure and Google Cloud AI infrastructure

Industry and governance

Operational technology IoT and edge Government and defence Design authority Resilience, risk and cost

Back to the home lab