Every IP packet has a source and destination address. The shape and structure of those addresses dictates routing — both inside your own VPC and across the public internet. Subnetting is the everyday operational skill that decides whether your security group is right, whether your pod can reach its database, and whether your route table accidentally sends traffic via the public internet.

This is the bread-and-butter skill every operator reaches for daily.

IPv4 Structure and CIDR

An IPv4 address is 32 bits, written as four decimal octets (192.168.1.10). The address is split into a network prefix (the part that identifies the network) and a host identifier (the part that identifies a specific interface on that network).

CIDR (Classless Inter-Domain Routing, RFC 4632) expresses the split with a slash and prefix length: 192.168.1.0/24 means the first 24 bits are the network; the last 8 bits identify hosts on that network.

The two reserved addresses per subnet are the network address (10.0.0.0 — all host bits zero) and the broadcast address (10.0.0.255 — all host bits one). Most modern infrastructure supports /31 point-to-point links to save IPv4 space.

The subnet mask (255.255.255.0) is the older notation for the same idea: bitwise AND of the mask and address yields the network prefix. CIDR is the same concept written as a suffix.

Private Address Space

Three IPv4 ranges are reserved for private use (RFC 1918); they are not routable on the public internet by design, and the whole internet relies on this:

The IPv4 protocol has only ~4.3 billion addresses total (~1993 estimate: enough for ~two per person). The internet kept growing because NAT + private space let billions of devices share the ~4 billion public addresses — your home router sits between RFC 1918 space inside your house and one public address outside.

NAT and PAT

Network Address Translation rewrites the source (or destination) address of a packet as it crosses a router. The most common flavour is PAT — port address translation, “many-to-one NAT”, also called “NAT overload”:

• Inside your network, every device has a private address (e.g., 192.168.1.10).
• The router has one public address (e.g., 203.0.113.5).
• When an internal host sends a packet, the router rewrites the source address to its own public address and allocates a unique source port, recording the mapping in a state table.
• The reply arrives at (203.0.113.5, port), and the router maps the port back to the original internal address.

internal:192.168.1.10:54321 ──→ router ──→ public:203.0.113.5:18001 ──→ internet
internal:192.168.1.15:5000   ──→ router ──→ public:203.0.113.5:18002 ──→ internet

The router holds state per connection; this is why NAT is stateful and why a connection’s packets must traverse the same router.

NAT Traversal

NAT breaks the end-to-end model — the public internet cannot initiate a connection to an internal host. Three common techniques circumvent this:

• Port forwarding: a static mapping on the router routes external connections of a given port to a fixed internal host.
• STUN / TURN / ICE (WebRTC): the internal host discovers its public mapping through a STUN server, then senders address packets to that mapping.
• Hole punching: two peers behind NAT each open a mapping (sending a packet to the other’s public address); the mapping now allows arrival of the other’s packets.

NAT traversal is the engineering behind every “peer-to-peer” call where neither peer has a public address.

IPv6 — What Changed

IPv6 addresses are 128 bits, written in hex as eight 16-bit groups (2001:0db8:1a2b:3c4d:5e6f:7a8b:9c0d:1e2f). Enough addresses to give every grain of sand on Earth one, with a few billion left over.

Two consequences:

• NAT becomes optional, not required. A public IPv6 address on every device restores the original end-to-end principle; peering becomes simpler in theory.
• Configuration differs — SLAAC lets a host build its own address from the network prefix + its MAC (or a random identifier); DHCPv6 is still common in managed environments.

Dual-Stack and Transition

The IPv6 migration has been “two years away” since 1998. Real deployment runs dual-stack: every host gets both an IPv4 and an IPv6 address; the resolver returns both records (A for IPv4, AAAA for IPv6); the host prefers whichever is reachable.

Two fallback mechanisms carryIPv4-only traffic across IPv6-only links:

• Tunnels (6to4, Teredo, GRE) — wraps one protocol’s packets inside the other’s.
• Translation (NAT64 + DNS64) — the application resolves an IPv4 name to a synthetic IPv6 address; a stateful translator at the network boundary rewrites IPv6 traffic to IPv4 and back.

Most operators will need to read IPv6 and dual-stack configurations, not write them — but the read skill is non-negotiable; misreading a /64 as a /24 opens a security group to far more than intended.

Practice Trajectory

1. Decompose 192.168.50.0/22. List the network address, broadcast address, and host range. Identify the four /24 subnets contained in it.
2. For a VPC 10.10.0.0/16, design a subnet layout: 4 AZs × 2 tiers (public + private). Explain your prefix length choice.
3. Trace the packet path from a laptop 192.168.1.30:5000 to a public web server via PAT. Identify the four state-table entries the home router must hold.
4. An IPv6 box has both a global address (2001:db8::a) and a link-local (fe80::a). Explain which address is used for what, and why link-local exists.
5. Identify one service in your stack that runs IPv4-only. Describe what NAT64 or a tunnel would do to make it reachable from an IPv6-only client.

When It’s the Right Tool