IPv4 — address format, classes, subnetting, CIDR notation: Visual walkthrough

Prerequisites we lean on: Binary and Positional Number Systems (what a bit is worth) and Subnet Mask and ANDing (the AND trick). Everything else we build here. Parent: IPv4 — Address Format, Classes, Subnetting, CIDR.

Step 1 — What one octet is: a row of 8 light switches

WHAT. An IPv4 address is 32 bits (a bit = a single 0-or-1). We look at it 8 bits at a time; each group of 8 is an octet. One octet is just 8 switches in a row.

WHY. Before we can "split" an address into network and host, we must agree what a switch is worth. The value of a switch depends only on its position, exactly like the columns in ordinary decimal.

PICTURE. Each switch sits over a fixed number — its place value. Turn a switch ON and you add that number to the octet's total.

Figure — IPv4 — address format, classes, subnetting, CIDR notation

Step 2 — Where does "the network" end and "the host" begin?

WHAT. The number after the slash — the prefix length $n$ — says: the first $n$ switches (reading left to right, across all 32) are the network; the remaining $32 - n$ are the host. For /27, the first 27 switches are network, the last $32 - 27 = 5$ are host.

WHY. A router wants to route to streets, not houses. The prefix is literally the pencil line drawn between street-name digits and house-number digits. Move the line right → more network, fewer hosts.

PICTURE. All 32 switches in a row. The red vertical line falls after switch 27. Only the last octet is cut — the first three octets are entirely inside the network part.

Step 3 — Turning the pencil line into a number: the subnet mask

WHAT. The subnet mask is a fake 32-bit "address" that is all 1s on the network side and all 0s on the host side. For /27: twenty-seven 1s, then five 0s. As dotted decimal that is 255.255.255.224.

WHY. A router can't hold a pencil. It needs the line as bits so it can compute with it (Step 4). The mask is the line drawn in ink.

PICTURE. The mask lines up switch-for-switch under the address. Its last octet is 11100000.

Step 4 — AND: forcing all house-switches to 0 gives the network address

WHAT. The network address is the address with every host switch turned OFF. We get it by ANDing the address with the mask. AND means: a switch stays on only if it is on in both rows. Mask host-switches are 0, so every host switch is killed; mask network-switches are 1, so every network switch survives untouched.

WHY. Every house on the street shares one street name. Wiping the house digits to zero collapses every address on the subnet onto the same number — the network's own label. That shared label is what routers compare against. (Deep dive: Subnet Mask and ANDing.)

PICTURE. Only the last octet does anything interesting — the first three octets AND with 255 and pass straight through.

Step 5 — Block size: why networks land only on multiples of 32

WHAT. With $h = 5$ host switches, the host part counts through $2^{h} = 2^{5} = 32$ patterns before it "rolls over" and the network number ticks up. That rollover distance — $32$ here — is the block size. Network addresses in this octet can only be $0, 32, 64, 96, 128, \dots$

WHY. The host switches are the lowest 5 switches of the octet. The lowest 5 switches can hold any number from $0$ to $31$ ; the moment you need $32$ you must borrow into a network switch. So each subnet occupies a clean run of 32 consecutive addresses, and the next subnet must start at the next multiple of 32.

PICTURE. A number line $0 \to 255$ chopped into 8 equal blocks of 32. Our address $45$ sits inside the block $[32, 63]$ ; its floor multiple is $32$ .

Step 6 — The two forbidden houses: network & broadcast (the "−2")

WHAT. Inside the block $[32, 63]$ , the lowest address ( $32$ , all host switches 0) is the network address — the street's own name, not a house. The highest ( $63$ , all host switches 1) is the broadcast address — "shout to every house." Neither can be given to a real machine.

WHY. All-zeros host = the label we built in Step 4, so it is the network, not a member of it. All-ones host is reserved to mean "everyone on this subnet at once." That is where the famous $- 2$ comes from.

PICTURE. The block $32 \to 63$ with its two red endpoints crossed out and the green middle marked "usable."

Step 7 — Edge cases: what if the block were the whole octet, or a single host?

WHAT. We check the extremes so no scenario surprises you.

WHY. A rule you only tested in the middle isn't a rule yet. We push $h$ to its limits.

PICTURE. Three miniature number lines: a fat /24 block, a thin /30 block, and the degenerate /31.

Larger $n$ ⇒ smaller $h$ ⇒ smaller network — the opposite of what the big number suggests. (This is Trap 2 from the parent.)

The one-picture summary

Everything above is one pipeline: address + prefix → mask → AND → block → endpoints. This final figure compresses all seven steps into a single flow you can redraw on a napkin.

Recall Feynman retelling — the whole walkthrough in plain words

Think of 10.20.30.45/27. The /27 is a pencil line: the first 27 switches are the street name, the last 5 are the house number. To find the street's official label, I flip every house switch to OFF — that's the AND with the mask 255.255.255.224, and it turns .45 into .32. Because there are 5 house switches, houses come in runs of $2^{5} = 32$ , so streets can only start at $0, 32, 64, \dots$ — and $45$ falls in the run that starts at $32$ . Inside that run of 32, the very first address (.32) is the street's own name and the very last (.63) means "shout to the whole street," so neither is a real house. That leaves $32 - 2 = 30$ real houses, numbered .33 to .62. Push the pencil line all the way right and networks shrink to nothing (/32 = one house); push it to an octet boundary (/24) and a whole 256-address block reappears. Same five moves every single time.

Next: see the same AND from the mask's side in Subnet Mask and ANDing, how routers pick the longest matching prefix in Routing Tables and Longest Prefix Match, and how private blocks get rewritten in NAT — Network Address Translation.