IP networking, addressing and IPv6

Every network security design depends on addressing. Firewall rules, access control lists, segmentation plans, log analysis and incident response all speak in IP addresses and prefixes. A manager does not need to subnet in their head at speed, but they do need to read an address plan, recognize when a rule is far broader than intended, and understand why IPv6 changes some long-standing assumptions. This lesson covers IPv4 addressing and subnetting, private addressing and network address translation, IPv6 and its security implications, and the routing concepts that tie networks together. Lesson 3 then looks at the protocols that run on top of IP.

IPv4 addresses and prefixes

An IPv4 address is 32 bits long, written as four decimal numbers from 0 to 255 separated by dots, such as 192.0.2.10. Each address has a network part and a host part. Classless inter-domain routing, CIDR, written as a slash and a prefix length, says how many leading bits form the network part. In 192.0.2.0/24, the first 24 bits identify the network and the last 8 bits identify hosts, giving \(2^8 = 256\) addresses. The first address in a subnet is the network address and the last is the broadcast address, so a /24 has 254 usable host addresses. The same information can be written as a subnet mask, 255.255.255.0 for a /24.

Before CIDR was introduced in 1993, addresses were divided into classes: class A (first octet 1 to 126, default /8), class B (128 to 191, /16) and class C (192 to 223, /24), with class D (224 to 239) for multicast and class E (240 to 255) reserved. Classful addressing wasted huge numbers of addresses and is obsolete, but you may still see the terms in older material and in questions about multicast. Address 127.0.0.0/8 is reserved for loopback, so 127.0.0.1 always means the local host.

Subnetting divides a larger block into smaller ones by borrowing host bits for the network part. Each extra prefix bit halves the size of each subnet and doubles the number of subnets. A /24 split into four equal parts gives four /26 subnets of 64 addresses each, 62 usable. Security architects subnet for two reasons: to fit address space to the size of each group of hosts, and to create boundaries where traffic must pass through a router or firewall that can enforce policy. A flat network where every host shares one subnet has no such boundary.

import ipaddress
net = ipaddress.ip_network('10.20.0.0/24')
zones = ['users', 'printers and IoT', 'servers', 'management']
for zone, sub in zip(zones, net.subnets(new_prefix=26)):
    hosts = list(sub.hosts())
    print(f"{str(sub):16s} {zone:17s} first {hosts[0]}  last {hosts[-1]}  usable {len(hosts)}")
print('Is 10.20.0.130 in the server zone?', ipaddress.ip_address('10.20.0.130') in ipaddress.ip_network('10.20.0.128/26'))

10.20.0.0/26     users             first 10.20.0.1  last 10.20.0.62  usable 62
10.20.0.64/26    printers and IoT  first 10.20.0.65  last 10.20.0.126  usable 62
10.20.0.128/26   servers           first 10.20.0.129  last 10.20.0.190  usable 62
10.20.0.192/26   management        first 10.20.0.193  last 10.20.0.254  usable 62
Is 10.20.0.130 in the server zone? True

Private addresses and network address translation

RFC 1918 reserves three IPv4 blocks for private networks: 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. These addresses are not routed on the public internet, so many organizations can reuse them internally. RFC 6598 adds 100.64.0.0/10 for carrier-grade NAT, and 169.254.0.0/16 is used for link-local automatic addressing when a host cannot reach a DHCP server. Documentation and examples should use the blocks reserved for that purpose, 192.0.2.0/24, 198.51.100.0/24 and 203.0.113.0/24, as this course does.

Network address translation, NAT, rewrites addresses as packets cross a boundary. Static NAT maps one private address to one public address. Dynamic NAT maps private addresses to a pool of public ones. Port address translation, PAT, also called NAT overload, maps many private hosts to one public address by tracking source ports; it is what home routers and most corporate internet gateways do. NAT conserves IPv4 addresses and hides internal numbering, but it is not a security control in itself. It blocks unsolicited inbound connections only as a side effect of having no translation entry, and it breaks protocols that embed addresses in their payload, complicates logging and makes end-to-end protocols such as IPsec in transport mode harder. A proper stateful firewall policy should exist whether or not NAT is used.

The cloud metadata address deserves a special mention. Major cloud platforms expose instance credentials and configuration at 169.254.169.254. Server-side request forgery attacks trick a web application into fetching that address and leaking temporary credentials, which was central to a well-known 2019 breach at a large US bank. Controls include requiring session-token versions of the metadata service, filtering outbound requests from applications and least-privilege instance roles. Lesson 9 returns to cloud networking.

IPv6

IPv6 addresses are 128 bits long, written as eight groups of four hexadecimal digits separated by colons, such as 2001:0db8:0000:0000:0000:ff00:0042:8329. Leading zeros in each group can be dropped, and one run of consecutive zero groups can be replaced with a double colon, giving 2001:db8::ff00:42:8329. The block 2001:db8::/32 is reserved for documentation. A typical site receives a /48, and a standard subnet is a /64, leaving 64 bits for the interface identifier. That means a single subnet holds \(2^{64}\), about 18 quintillion, addresses.

import ipaddress
site = ipaddress.ip_network('2001:db8:abcd::/48')
print('Subnets of /64 in a /48:', 2 ** (64 - 48))
print('Addresses in one /64:', f"{2**64:,}")
first = next(site.subnets(new_prefix=64))
print('First /64:', first)
print('Compressed form:', ipaddress.ip_address('2001:0db8:0000:0000:0000:ff00:0042:8329').compressed)
# Brute-force sweep of one /64 at a million probes per second
years = 2**64 / 1e6 / (365.25 * 24 * 3600)
print(f'Years to sweep one /64 at 1 million probes/s: {years:,.0f}')

Subnets of /64 in a /48: 65536
Addresses in one /64: 18,446,744,073,709,551,616
First /64: 2001:db8:abcd::/64
Compressed form: 2001:db8::ff00:42:8329
Years to sweep one /64 at 1 million probes/s: 584,542

IPv6 changes several security assumptions. First, the enormous subnet size makes blind scanning impractical, so attackers find hosts through DNS, logs, certificate transparency records, predictable addresses such as ::1 or addresses derived from MAC addresses, and neighbour discovery on the local link. Second, there is no broadcast; IPv6 uses multicast and the Neighbor Discovery Protocol, built on ICMPv6, to find routers and neighbours and to resolve addresses. ICMPv6 is essential to IPv6 operation and cannot be blocked wholesale the way some administrators blocked ICMP for IPv4; RFC 4890 gives filtering guidance. Third, hosts can configure their own addresses through stateless address autoconfiguration, SLAAC, using router advertisements. A rogue device sending false router advertisements can redirect traffic, so switches should support RA Guard and DHCPv6 snooping.

Fourth, and most important for many organizations, IPv6 is often running even where no one planned it. Modern operating systems enable IPv6 by default and prefer it when available. If security monitoring, firewalls and logging cover only IPv4, an attacker on the local network can use IPv6 to bypass them, for example by acting as a rogue router or DHCPv6 server and becoming the victim's DNS server. Transition mechanisms such as dual stack, where hosts run both protocols; tunnelling, such as 6in4, 6to4 and Teredo, which carry IPv6 inside IPv4; and translation, such as NAT64 with DNS64, each create paths that controls must understand. The manager's rule is simple: either manage IPv6 deliberately, with policy, monitoring and filtering equal to IPv4, or disable it consistently where it is genuinely not needed. Ignoring it is not an option.

IPv6 also brings some improvements. IPsec support was originally mandatory in IPv6 implementations, though it is now recommended rather than required, and use is still a deployment choice. Privacy extensions (RFC 8981) give hosts temporary random interface identifiers so that their addresses cannot be used to track them across networks. The larger header is simpler, with optional extension headers; however, extension headers have themselves been abused to evade inspection, and many networks drop unusual ones at the edge.

Routing basics

Routers forward packets based on the destination address and a routing table that lists prefixes and next hops. When several entries match, the router chooses the longest prefix match, the most specific route. Routes are learned in three ways: directly connected networks, static routes configured by hand and dynamic routes learned from routing protocols. Interior gateway protocols run inside one organization: distance-vector protocols such as RIP, now largely obsolete, and link-state protocols such as OSPF and IS-IS, which build a map of the network and compute shortest paths. Between organizations, the Border Gateway Protocol, BGP, exchanges routes between autonomous systems, the independently managed networks that make up the internet.

Routing protocols trust their neighbours by default, so a misconfigured or malicious router can inject false routes. Controls inside an organization include authenticating routing protocol neighbours with cryptographic keys, filtering which prefixes are accepted, and logging routing changes. On the internet, BGP route hijacks and leaks, where an autonomous system announces prefixes it does not own, have repeatedly redirected traffic. Resource Public Key Infrastructure, RPKI, lets address holders sign route origin authorizations so that other networks can reject invalid origins; lesson 10 discusses an example. Longest prefix match explains why hijackers often announce more specific prefixes than the legitimate owner: routers everywhere prefer the more specific route.

Addressing as a security tool

A good address plan makes security easier. If every zone has its own contiguous block, such as 10.20.0.0/26 for users and 10.20.0.128/26 for servers, firewall rules can be written with a few clear prefixes, logs can be read at a glance and anomalies stand out. If addresses are scattered, rules become long lists of individual hosts, and every list is a chance for error. Address management also supports asset inventory: a current IP address management system, linked to DHCP and DNS records, tells responders which device held an address at the time of an incident. Without it, investigations stall while teams try to work out who 10.20.0.77 was last Tuesday.

The exam may ask what a manager should require of an address plan. Good answers include documented allocations by zone, reserved space for growth, consistent IPv4 and IPv6 plans, anti-spoofing filters that drop traffic arriving from the wrong direction for its source prefix, and retention of DHCP and NAT logs long enough to support investigations and legal obligations. Ingress filtering at the internet edge, described in BCP 38, drops inbound packets claiming internal or reserved source addresses; egress filtering drops outbound packets whose source is not one of the organization's own prefixes, which stops the organization's hosts being used in spoofed attacks.

Thinking like a manager

Addressing questions on the exam usually test judgement, not arithmetic. A rule with a far broader prefix than needed is a change management and review failure. A network where IPv6 is enabled but unmonitored is a governance gap. NAT presented as a firewall is a misunderstanding to correct. When asked for the best long-term fix, prefer answers that build structure: a documented address plan aligned with security zones, consistent policy for both IP versions, and automated rule review.