The Network Layer: IP Addressing, Subnets, and CIDR

Hook #

The link layer from the last course only gets a frame across one hop — machine to the next switch. But the internet is billions of machines separated by dozens of hops across networks that have never coordinated. The network layer is what stitches those hops into an end-to-end path, and its currency is the IP address: a globally-meaningful number that names a machine's location in the network well enough that routers, none of which know the whole internet, can each make one good local decision about where to send a packet next. This lesson is about that addressing scheme — how IP addresses are structured, how they're grouped into subnets, and how CIDR notation (the /24 you've typed into security-group rules and never fully understood) encodes it all. It's the vocabulary that turns a firewall rule, a VPC config, or a 10.0.0.0/8 from an incantation into something you actually read.

What you'll be able to do by the end of this lesson #

• Explain what an IP address is and how it differs from a MAC address (network-layer, routable, end-to-end vs. link-layer, one-hop).
• Read CIDR notation (192.168.1.0/24) and say how many addresses a block holds and what the network/host split is.
• Explain subnetting — why you carve a network into smaller ranges — and recognize private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).
• Explain, at a high level, why IPv6 exists (IPv4 address exhaustion) and what changed.

A quick try before we start #

Before reading: you've written a security-group or firewall rule like "allow 10.0.0.0/16." How many IP addresses does that /16 cover, and why? (A /16 fixes the first 16 bits as the network, leaving 16 bits for hosts — so 2¹⁶ ≈ 65,536 addresses.) If the /16 → 65k jump isn't obvious yet, that's exactly the CIDR math this lesson makes intuitive — and once it clicks, every subnet rule you've ever copy-pasted becomes readable.

Why this matters here #

IP addressing is infrastructure literacy. Every cloud VPC you configure, every subnet you carve, every security-group rule, every route table, every "why can't these two services talk to each other" networking bug comes down to addressing and subnets. An engineer who can read CIDR reasons about network topology — "this subnet is /24, so it maxes at ~254 hosts; these two VPCs overlap at 10.0.0.0/16 so they can't peer" — while one who can't copies rules and hopes. This is also the layer where a huge amount of cloud and container networking lives: Kubernetes pod CIDRs, service meshes, NAT gateways, and the private/public subnet split of every well-architected VPC are all this lesson applied. It's not glamorous, but it's the difference between configuring infrastructure with understanding and configuring it by superstition.

Within the course, this is the middle layer the whole networking quarter needed. The last course gave you the top (HTTP, DNS, TLS) and the bottom (link/physical); it left a gap — how does a packet actually cross the internet from your machine to a server continents away? That's the network layer (addressing and routing, lessons 1–2) plus the transport layer (reliability, lessons 3–4). This lesson is the addressing half: before a packet can be routed, it needs a source and destination address that mean something globally. Lesson 2 is how routers use those addresses to forward packets hop by hop.

The engineer's lens #

The core idea is that an IP address is hierarchical on purpose — the network/host split is what makes routing scale, and it's the same "encode structure into the identifier so lookups can be aggregated" trick you use in system design. An IP address isn't a flat random number; it's split into a network part and a host part, and the /N in CIDR says where the split falls (/24 = first 24 bits are network, last 8 are host). This structure is what lets routers scale: a router doesn't need a route for every one of the billions of individual machines — it needs a route for each network prefix, and it forwards by longest-prefix match (the most specific matching prefix wins). Millions of addresses collapse into one routing-table entry because they share a prefix. This is aggregation-by-hierarchy, the same principle behind DNS delegation (last course), behind database index prefixes, behind how you'd shard a keyspace by a structured key so a whole range routes together. When you design any system that must route or partition by an identifier, encoding hierarchy into that identifier — so you can match and aggregate by prefix instead of enumerating every element — is the move, and CIDR is its cleanest example. The reason /24 and /16 and /8 exist is precisely so that "everything under this prefix" is a single, cheap thing to reason about and route.

The second lens is IPv4 exhaustion and the workarounds it forced, which is a lesson in what happens when an address space is under-provisioned and you can't easily migrate. IPv4 has 32-bit addresses — about 4 billion, which seemed infinite in the 1980s and ran out in the 2010s. Rather than the world instantly switching to IPv6 (128-bit, effectively unlimited), a set of workarounds absorbed the pressure: private address ranges (the 10.x/172.16.x/192.168.x blocks every home and cloud network reuses internally) plus NAT (next lesson — many private machines sharing one public address) let the world keep running on IPv4 far past its nominal exhaustion. This is a recurring engineering reality: when a foundational resource is under-sized and migration is expensive (everyone must change at once), you get long-lived compatibility hacks rather than a clean cutover — the same story as 32-bit-to-64-bit, as the slow IPv6 rollout still happening today. Recognizing that "the clean fix exists (IPv6) but the workaround (NAT + private ranges) is what actually runs the world" is a realistic model of how large systems evolve under constraint, and it's exactly why you configure private subnets and NAT gateways in every cloud network.

What to focus on in Kurose & Ross Ch. 4 (+ Practical Networking) #

• CIDR and the network/host split — until the math is intuitive. This is the load-bearing skill. Be able to look at any /N and know the network/host boundary and the address count. Practical Networking's subnetting series is the fastest path if binary subnet math has ever intimidated you.
• Longest-prefix match. Understand that routers forward by the most specific matching prefix. This one idea explains how routing scales and why route tables are prefix-based.
• Private ranges and the reason for them. Memorize the three private blocks; you'll see them in every VPC and home network. Understand they exist because public IPv4 is scarce.
• Skip on first pass: the IPv6 header-format details, IP fragmentation mechanics, and the deep router data-plane internals. Know IPv6 exists and why (exhaustion), and that routers forward by prefix; the byte-level specifics are reference.

Explain it back #

Explain to a colleague why routers can forward internet traffic without storing a route for every individual machine on earth. A strong answer names the hierarchical network/host structure of IP addresses and longest-prefix-match forwarding: routers keep routes for network prefixes (like 203.0.113.0/24), not individual hosts, so millions of addresses that share a prefix collapse into one routing-table entry, and a router just forwards toward the most specific prefix that matches the destination. Bonus: connect prefix aggregation to another hierarchy you've used to make lookups scale (DNS delegation, sharding by a structured key).

Where this connects #

Backward: Last course's link layer (IP rides on top of it — the network layer stitches many single hops into an end-to-end path) and its MAC-vs-IP distinction (this lesson is the "IP" half, in depth). The prefix-aggregation idea echoes DNS's hierarchical delegation from the same course.

Forward: Lesson 2 is how routers actually use these addresses — routing protocols that build the forwarding tables, plus NAT/DHCP/ARP (the glue that makes private addressing and address assignment work). Lessons 3–4 are the transport layer riding on top of IP: TCP turning this best-effort packet delivery into a reliable stream. Addressing and subnets reappear constantly in Year 3's system design (VPCs, network partitioning).