I1.2 IP Addressing, Subnets, and Network Boundaries
Read fictional IPv4 address context, compare subnet boundaries, identify local and routed communication, and correlate DHCP, VLAN, route, firewall, inventory, and change evidence.
Lesson Progress
IP Addressing, Subnets, and Network Boundaries
High School Intermediate • I1: Networking for Defenders • Lesson 2 of 8
Readiness Check
Before You Start
0/4 ready
Professional Hook
Two Devices Can Look Almost Identical but Still Be Separated by a Network Boundary
A device at 10.24.18.44 and another at 10.24.18.93 appear similar. With a /24 prefix, they are local neighbors. With a /26 prefix, they belong to different subnets and may require a gateway, routing decision, firewall rule, and approved trust path. Intermediate defenders read the entire address context before making a conclusion.
Weak response
“The first three octets match, so the devices must be on the same subnet.”
Strong response
“Check both addresses, prefix lengths, network ranges, VLANs, gateways, routes, firewall zones, and timestamps.”
Objective 1
Explain how IPv4 addresses, prefixes, subnet masks, gateways, and network boundaries work together.
Objective 2
Identify whether two fictional IPv4 addresses belong to the same subnet using beginner-friendly prefix reasoning.
Objective 3
Distinguish private, public, loopback, link-local, network, broadcast, and documentation-address concepts.
Objective 4
Use address, DHCP, VLAN, route, and firewall evidence to explain a fictional network-boundary problem.
Objective 5
Separate confirmed address facts from assumptions about user identity, device ownership, and application purpose.
Why This Matters
Address Context Connects Devices to Networks, Boundaries, Routes, and Controls
Defenders use address context to understand where a device belongs, whether a destination is local or remote, which gateway should carry the traffic, which firewall zone should apply, and which evidence sources should be correlated. A single IP address is not a complete identity, but it is an important part of a larger evidence chain.
Address Context
IPv4 Address Types Defenders Commonly Recognize
Private IPv4
10.0.0.0/8 · 172.16.0.0/12 · 192.168.0.0/16
Used inside private networks. These addresses are not normally routed directly across the public internet.
Defensive use
Helps identify internal address space, network zones, and expected local communication.
Public IPv4
Globally routable address space assigned for internet communication
Used for systems or gateways that communicate across public networks.
Defensive use
Requires ownership, reputation, service, direction, and business-purpose context.
Loopback
127.0.0.0/8 · commonly 127.0.0.1
Refers back to the local device rather than another system.
Defensive use
Useful when determining whether a service is intended to remain local to the host.
Link-local
169.254.0.0/16
May appear when an IPv4 device cannot obtain a normal address through automatic configuration.
Defensive use
Can indicate a DHCP, connectivity, or configuration problem, but requires supporting evidence.
Documentation ranges
192.0.2.0/24 · 198.51.100.0/24 · 203.0.113.0/24
Reserved for examples and documentation rather than real production addressing.
Defensive use
Safe for fictional lessons, diagrams, reports, labs, and portfolio artifacts.
Core Concept
An IPv4 Address Has a Network Portion and a Host Portion
The prefix length determines how much of the address identifies the subnet. In 10.24.18.44/24, the first 24 bits identify the network. In 10.24.18.44/26, more bits identify the network, creating smaller address ranges and more boundaries.
Address
10.24.18.44
Identifies a fictional interface within an address range.
Prefix
/26
Defines how many bits identify the subnet.
Gateway
10.24.18.1
Carries approved traffic toward destinations outside the local subnet.
Key Vocabulary
Intermediate Addressing and Boundary Terms
IPv4 address
A 32-bit logical address commonly written as four decimal octets, such as 10.24.18.44.
Octet
One eight-bit section of an IPv4 address. IPv4 addresses contain four octets.
Prefix length
The number after the slash in CIDR notation, such as /24 or /26. It shows how many address bits identify the network portion.
Subnet mask
A value that separates the network portion of an IPv4 address from the host portion.
Network address
The first address in a subnet. It identifies the subnet itself rather than a normal endpoint.
Broadcast address
The final IPv4 address in a traditional subnet, used for local broadcast communication rather than a normal endpoint.
Host address
An address assigned to an endpoint or interface within a subnet.
Default gateway
The router address a device normally uses to reach destinations outside its local subnet.
CIDR
Classless Inter-Domain Routing notation, which writes an address and prefix together, such as 192.0.2.44/24.
Subnet
A defined range of IP addresses that share the same network prefix.
Routing
The process of selecting a path for traffic between different networks.
Boundary
A point where traffic moves between subnets, VLANs, zones, environments, or trust levels.
Subnet Reference
Read the Prefix Before Comparing Addresses
The same IPv4 address can belong to different network ranges depending on its prefix length. Never decide whether addresses share a subnet by looking only at the first three octets.
Subnet
10.24.18.0/24
Mask
255.255.255.0
Network
10.24.18.0
Normal host range
10.24.18.1–10.24.18.254
Broadcast
10.24.18.255
The first three octets identify the network. Addresses from .1 through .254 are normal host candidates.
Subnet
10.24.18.0/26
Mask
255.255.255.192
Network
10.24.18.0
Normal host range
10.24.18.1–10.24.18.62
Broadcast
10.24.18.63
A /26 divides a /24 into blocks of 64 addresses. This is the first block.
Subnet
10.24.18.64/26
Mask
255.255.255.192
Network
10.24.18.64
Normal host range
10.24.18.65–10.24.18.126
Broadcast
10.24.18.127
This is the second /26 block. It is a different subnet from 10.24.18.0/26.
Subnet
192.0.2.32/27
Mask
255.255.255.224
Network
192.0.2.32
Normal host range
192.0.2.33–192.0.2.62
Broadcast
192.0.2.63
A /27 uses blocks of 32 addresses. This documentation subnet is safe for fictional examples.
Guided Practice
Do These Addresses Share a Local Subnet?
Address pair
10.24.18.44/24
10.24.18.93/24
Same subnet
Both addresses share the 10.24.18 network portion when the prefix is /24.
Address pair
10.24.18.44/26
10.24.18.93/26
Different subnets
10.24.18.44 belongs to 10.24.18.0/26, while 10.24.18.93 belongs to 10.24.18.64/26.
Address pair
192.0.2.42/27
192.0.2.61/27
Same subnet
Both addresses are inside the 192.0.2.32/27 range.
Address pair
192.0.2.42/27
192.0.2.70/27
Different subnets
192.0.2.42 is in 192.0.2.32/27, while 192.0.2.70 is in 192.0.2.64/27.
Evidence Analysis
Address Evidence Is Powerful but Incomplete
Evidence source
DHCP lease
Can support
A device identifier, assigned address, gateway, lease time, and sometimes network or scope context.
Cannot prove alone
That the expected person used the device for every action during the lease.
Evidence source
Endpoint network settings
Can support
The current address, mask or prefix, gateway, DNS settings, and interface state.
Cannot prove alone
That the route or remote service actually worked.
Evidence source
Switch or VLAN record
Can support
The local segment, switch port, interface, MAC address, or VLAN assignment.
Cannot prove alone
The complete application purpose or remote destination result.
Evidence source
Router record
Can support
A routing decision, next hop, interface, or missing path between networks.
Cannot prove alone
That the application accepted the user's request.
Evidence source
Firewall record
Can support
Source, destination, direction, service, rule decision, and zone context.
Cannot prove alone
The complete identity, intent, or application content by itself.
Evidence source
Identity or inventory record
Can support
Expected owner, device group, role, approved subnet, or business purpose.
Cannot prove alone
That the current address assignment or observed traffic is correct without technical evidence.
Defensive Workflow
Review Address and Boundary Problems in Six Steps
Identify the interface
Confirm which fictional device and network interface generated the evidence.
Read the full address context
Record the IP address, prefix or mask, gateway, VLAN, zone, and timestamp.
Determine the local subnet
Identify the network address, expected host range, and broadcast boundary.
Compare the destination
Decide whether the destination is local or requires routing through a gateway.
Correlate supporting records
Connect DHCP, switch, route, firewall, endpoint, inventory, and change evidence.
Document the conclusion
State confirmed facts, likely explanation, uncertainty, owner, and authorized next action.
Fake Dashboard
Fake Address and Boundary Dashboard
Training dashboard for the fictional Harborview Learning Network. It compares expected device placement with observed DHCP, VLAN, gateway, and firewall evidence.
Expected subnet
10.44.20.0/26
Student media devices should use the first /26 block and the student-media gateway.
Observed address
10.44.20.93/26
The device is actually inside the second /26 block: 10.44.20.64/26.
Observed zone
Guest
Firewall records classify the address into the guest zone instead of student-media.
Fake SOC Alert
Approved Media Device Appears in the Wrong Subnet
Source: Fake Network Configuration Monitor • Time: 10:22 AM
Fake Log Panel
Fake Subnet Boundary Evidence Timeline
10:13:02 INVENTORY device='media-lab-08' expected_subnet='10.44.20.0/26' expected_vlan='220' 10:14:10 DHCP device='media-lab-08' address='10.44.20.93' prefix='/26' gateway='10.44.20.65' 10:14:12 SWITCH device='media-lab-08' observed_vlan='220' port='access-08' 10:14:30 DNS query='uploads.media-training.test' result='192.0.2.80' 10:14:32 FIREWALL source='10.44.20.93' source_zone='guest' destination='192.0.2.80' service='https' action='deny' 10:16:04 CHANGE title='DHCP scope split for media lab' status='approved' 10:18:25 DESIGN vlan='220' intended_subnet='10.44.20.0/26' intended_gateway='10.44.20.1' 10:22:09 CORRELATION finding='address assigned from incorrect /26 scope' confidence='high'
Training note: this is fake data for defensive analysis practice only.
Analyze the Evidence
Which Boundary Explanation Is Best Supported?
What is the strongest conclusion and next action?
Common Mistakes
Mistakes That Weaken Address and Subnet Analysis
Safe Practice Lab
Build a Fictional Subnet and Trust-Boundary Review
Fictional Environment
Summit Arts Academy
The fictional school uses separate /27 documentation subnets for media devices, staff devices, guest devices, and servers. A new device receives an unexpected address after a DHCP change, and an approved internal service becomes unreachable.
Required Analysis
- Label each fictional subnet, prefix, normal host range, and gateway.
- Identify the network and broadcast addresses.
- Determine whether each communication path is local or routed.
- Connect DHCP, VLAN, route, firewall, inventory, and change evidence.
- State what the IP evidence confirms and what remains uncertain.
- Recommend an authorized correction and validation plan.
- Document rollback and post-change monitoring steps.
Scenario Decision Lab
A Device Receives a Link-Local Address
A fictional lab device shows 169.254.22.18, has no normal gateway, and cannot reach the approved learning portal. Nearby managed devices received expected private addresses from DHCP.
Scenario Decision Lab
The Address Is Valid, but the Gateway Is Outside the Local Subnet
A fictional device has 192.0.2.42/27 but lists 192.0.2.97 as its gateway. The local subnet is 192.0.2.32/27, and the approved gateway should be 192.0.2.33.
Defender Habits
IP Addressing and Boundary Review Checklist
Check Your Understanding
I1.2 Mini Quiz: IP Addressing, Subnets, and Boundaries
Choose your answers first. Explanations appear only after submission.
1. What does the /24 in 10.24.18.44/24 describe?
2. Which address is the network address for 10.24.18.44/24?
3. Which pair belongs to different /26 subnets?
4. What is the main role of a default gateway?
5. What may a 169.254.x.x address indicate?
6. Why can a DHCP lease not prove the identity of every user action?
7. What is the strongest response to a likely subnet or VLAN mismatch?
Portfolio Prompt
Portfolio Prompt
Create a fictional Network Boundary Review using documentation address ranges. Include at least four subnets, prefix lengths, network addresses, normal host ranges, gateways, VLAN or zone labels, trust boundaries, approved communication paths, and one fictional misconfiguration. Add an evidence table showing what DHCP, switch, route, firewall, inventory, and change records confirm and cannot prove alone.
Key Takeaways
What You Should Remember
Navigation