High School IntermediateModule I1Lesson 2 of 8

I1.2 IP Addressing, Subnets, and Network Boundaries

Read fictional IPv4 address context, compare subnet boundaries, identify local and routed communication, and correlate DHCP, VLAN, route, firewall, inventory, and change evidence.

Lesson Progress

IP Addressing, Subnets, and Network Boundaries

High School IntermediateI1: Networking for Defenders • Lesson 2 of 8

25% complete

Readiness Check

Before You Start

0/4 ready

Professional Hook

Two Devices Can Look Almost Identical but Still Be Separated by a Network Boundary

A device at 10.24.18.44 and another at 10.24.18.93 appear similar. With a /24 prefix, they are local neighbors. With a /26 prefix, they belong to different subnets and may require a gateway, routing decision, firewall rule, and approved trust path. Intermediate defenders read the entire address context before making a conclusion.

Weak response

“The first three octets match, so the devices must be on the same subnet.”

Strong response

“Check both addresses, prefix lengths, network ranges, VLANs, gateways, routes, firewall zones, and timestamps.”

Objective 1

Explain how IPv4 addresses, prefixes, subnet masks, gateways, and network boundaries work together.

Objective 2

Identify whether two fictional IPv4 addresses belong to the same subnet using beginner-friendly prefix reasoning.

Objective 3

Distinguish private, public, loopback, link-local, network, broadcast, and documentation-address concepts.

Objective 4

Use address, DHCP, VLAN, route, and firewall evidence to explain a fictional network-boundary problem.

Objective 5

Separate confirmed address facts from assumptions about user identity, device ownership, and application purpose.

Why This Matters

Address Context Connects Devices to Networks, Boundaries, Routes, and Controls

Defenders use address context to understand where a device belongs, whether a destination is local or remote, which gateway should carry the traffic, which firewall zone should apply, and which evidence sources should be correlated. A single IP address is not a complete identity, but it is an important part of a larger evidence chain.

Address Context

IPv4 Address Types Defenders Commonly Recognize

Private IPv4

10.0.0.0/8 · 172.16.0.0/12 · 192.168.0.0/16

Used inside private networks. These addresses are not normally routed directly across the public internet.

Defensive use

Helps identify internal address space, network zones, and expected local communication.

Public IPv4

Globally routable address space assigned for internet communication

Used for systems or gateways that communicate across public networks.

Defensive use

Requires ownership, reputation, service, direction, and business-purpose context.

Loopback

127.0.0.0/8 · commonly 127.0.0.1

Refers back to the local device rather than another system.

Defensive use

Useful when determining whether a service is intended to remain local to the host.

Link-local

169.254.0.0/16

May appear when an IPv4 device cannot obtain a normal address through automatic configuration.

Defensive use

Can indicate a DHCP, connectivity, or configuration problem, but requires supporting evidence.

Documentation ranges

192.0.2.0/24 · 198.51.100.0/24 · 203.0.113.0/24

Reserved for examples and documentation rather than real production addressing.

Defensive use

Safe for fictional lessons, diagrams, reports, labs, and portfolio artifacts.

Core Concept

An IPv4 Address Has a Network Portion and a Host Portion

The prefix length determines how much of the address identifies the subnet. In 10.24.18.44/24, the first 24 bits identify the network. In 10.24.18.44/26, more bits identify the network, creating smaller address ranges and more boundaries.

Address

10.24.18.44

Identifies a fictional interface within an address range.

Prefix

/26

Defines how many bits identify the subnet.

Gateway

10.24.18.1

Carries approved traffic toward destinations outside the local subnet.

Key Vocabulary

Intermediate Addressing and Boundary Terms

IPv4 address

A 32-bit logical address commonly written as four decimal octets, such as 10.24.18.44.

Octet

One eight-bit section of an IPv4 address. IPv4 addresses contain four octets.

Prefix length

The number after the slash in CIDR notation, such as /24 or /26. It shows how many address bits identify the network portion.

Subnet mask

A value that separates the network portion of an IPv4 address from the host portion.

Network address

The first address in a subnet. It identifies the subnet itself rather than a normal endpoint.

Broadcast address

The final IPv4 address in a traditional subnet, used for local broadcast communication rather than a normal endpoint.

Host address

An address assigned to an endpoint or interface within a subnet.

Default gateway

The router address a device normally uses to reach destinations outside its local subnet.

CIDR

Classless Inter-Domain Routing notation, which writes an address and prefix together, such as 192.0.2.44/24.

Subnet

A defined range of IP addresses that share the same network prefix.

Routing

The process of selecting a path for traffic between different networks.

Boundary

A point where traffic moves between subnets, VLANs, zones, environments, or trust levels.

Subnet Reference

Read the Prefix Before Comparing Addresses

The same IPv4 address can belong to different network ranges depending on its prefix length. Never decide whether addresses share a subnet by looking only at the first three octets.

Subnet

10.24.18.0/24

Mask

255.255.255.0

Network

10.24.18.0

Normal host range

10.24.18.1–10.24.18.254

Broadcast

10.24.18.255

The first three octets identify the network. Addresses from .1 through .254 are normal host candidates.

Subnet

10.24.18.0/26

Mask

255.255.255.192

Network

10.24.18.0

Normal host range

10.24.18.1–10.24.18.62

Broadcast

10.24.18.63

A /26 divides a /24 into blocks of 64 addresses. This is the first block.

Subnet

10.24.18.64/26

Mask

255.255.255.192

Network

10.24.18.64

Normal host range

10.24.18.65–10.24.18.126

Broadcast

10.24.18.127

This is the second /26 block. It is a different subnet from 10.24.18.0/26.

Subnet

192.0.2.32/27

Mask

255.255.255.224

Network

192.0.2.32

Normal host range

192.0.2.33–192.0.2.62

Broadcast

192.0.2.63

A /27 uses blocks of 32 addresses. This documentation subnet is safe for fictional examples.

Guided Practice

Do These Addresses Share a Local Subnet?

Address pair

10.24.18.44/24

10.24.18.93/24

Same subnet

Both addresses share the 10.24.18 network portion when the prefix is /24.

Address pair

10.24.18.44/26

10.24.18.93/26

Different subnets

10.24.18.44 belongs to 10.24.18.0/26, while 10.24.18.93 belongs to 10.24.18.64/26.

Address pair

192.0.2.42/27

192.0.2.61/27

Same subnet

Both addresses are inside the 192.0.2.32/27 range.

Address pair

192.0.2.42/27

192.0.2.70/27

Different subnets

192.0.2.42 is in 192.0.2.32/27, while 192.0.2.70 is in 192.0.2.64/27.

Evidence Analysis

Address Evidence Is Powerful but Incomplete

Evidence source

DHCP lease

Can support

A device identifier, assigned address, gateway, lease time, and sometimes network or scope context.

Cannot prove alone

That the expected person used the device for every action during the lease.

Evidence source

Endpoint network settings

Can support

The current address, mask or prefix, gateway, DNS settings, and interface state.

Cannot prove alone

That the route or remote service actually worked.

Evidence source

Switch or VLAN record

Can support

The local segment, switch port, interface, MAC address, or VLAN assignment.

Cannot prove alone

The complete application purpose or remote destination result.

Evidence source

Router record

Can support

A routing decision, next hop, interface, or missing path between networks.

Cannot prove alone

That the application accepted the user's request.

Evidence source

Firewall record

Can support

Source, destination, direction, service, rule decision, and zone context.

Cannot prove alone

The complete identity, intent, or application content by itself.

Evidence source

Identity or inventory record

Can support

Expected owner, device group, role, approved subnet, or business purpose.

Cannot prove alone

That the current address assignment or observed traffic is correct without technical evidence.

Defensive Workflow

Review Address and Boundary Problems in Six Steps

1

Identify the interface

Confirm which fictional device and network interface generated the evidence.

2

Read the full address context

Record the IP address, prefix or mask, gateway, VLAN, zone, and timestamp.

3

Determine the local subnet

Identify the network address, expected host range, and broadcast boundary.

4

Compare the destination

Decide whether the destination is local or requires routing through a gateway.

5

Correlate supporting records

Connect DHCP, switch, route, firewall, endpoint, inventory, and change evidence.

6

Document the conclusion

State confirmed facts, likely explanation, uncertainty, owner, and authorized next action.

Fake Dashboard

Fake Address and Boundary Dashboard

Training dashboard for the fictional Harborview Learning Network. It compares expected device placement with observed DHCP, VLAN, gateway, and firewall evidence.

Expected subnet

10.44.20.0/26

Student media devices should use the first /26 block and the student-media gateway.

Observed address

10.44.20.93/26

The device is actually inside the second /26 block: 10.44.20.64/26.

Observed zone

Guest

Firewall records classify the address into the guest zone instead of student-media.

Fake SOC Alert

Approved Media Device Appears in the Wrong Subnet

Source: Fake Network Configuration Monitor • Time: 10:22 AM

Medium Severity
A fictional managed device expected in 10.44.20.0/26 received 10.44.20.93/26 after a DHCP scope update. Its approved upload traffic is denied by the guest-zone policy.
Defensive recommendation: Preserve address, DHCP, VLAN, firewall, inventory, and change records; verify the intended scope and request an authorized correction with validation and rollback.

Fake Log Panel

Fake Subnet Boundary Evidence Timeline

training-log-viewer.log
10:13:02 INVENTORY device='media-lab-08' expected_subnet='10.44.20.0/26' expected_vlan='220'
10:14:10 DHCP device='media-lab-08' address='10.44.20.93' prefix='/26' gateway='10.44.20.65'
10:14:12 SWITCH device='media-lab-08' observed_vlan='220' port='access-08'
10:14:30 DNS query='uploads.media-training.test' result='192.0.2.80'
10:14:32 FIREWALL source='10.44.20.93' source_zone='guest' destination='192.0.2.80' service='https' action='deny'
10:16:04 CHANGE title='DHCP scope split for media lab' status='approved'
10:18:25 DESIGN vlan='220' intended_subnet='10.44.20.0/26' intended_gateway='10.44.20.1'
10:22:09 CORRELATION finding='address assigned from incorrect /26 scope' confidence='high'

Training note: this is fake data for defensive analysis practice only.

Analyze the Evidence

Which Boundary Explanation Is Best Supported?

The fictional device inventory expects subnet 10.44.20.0/26 and gateway 10.44.20.1.
DHCP assigned 10.44.20.93/26 and gateway 10.44.20.65.
10.44.20.93 belongs to 10.44.20.64/26 rather than 10.44.20.0/26.
The switch record shows the expected VLAN 220.
The firewall classifies the assigned address in the guest zone and denies approved HTTPS traffic.
An approved DHCP scope-split change occurred shortly before the issue.

What is the strongest conclusion and next action?

Common Mistakes

Mistakes That Weaken Address and Subnet Analysis

Comparing only the first three octets without checking the prefix length.
Assuming every /24 and /26 has the same host range.
Treating the network or broadcast address as a normal endpoint address.
Assuming a private address identifies one specific person.
Assuming a DHCP lease proves the current user or the application purpose.
Confusing a VLAN identifier with an IP subnet even though they are related but different concepts.
Changing subnet masks, gateways, routes, or firewall rules without authorization and rollback planning.
Using real private diagrams, production addresses, or internal network records in a portfolio.

Safe Practice Lab

Build a Fictional Subnet and Trust-Boundary Review

Fictional Environment

Summit Arts Academy

The fictional school uses separate /27 documentation subnets for media devices, staff devices, guest devices, and servers. A new device receives an unexpected address after a DHCP change, and an approved internal service becomes unreachable.

Required Analysis

  1. Label each fictional subnet, prefix, normal host range, and gateway.
  2. Identify the network and broadcast addresses.
  3. Determine whether each communication path is local or routed.
  4. Connect DHCP, VLAN, route, firewall, inventory, and change evidence.
  5. State what the IP evidence confirms and what remains uncertain.
  6. Recommend an authorized correction and validation plan.
  7. Document rollback and post-change monitoring steps.
Use documentation address ranges and fictional diagrams only. Do not include real school, home, company, cloud, or public network addresses or configurations.

Scenario Decision Lab

A Device Receives a Link-Local Address

A fictional lab device shows 169.254.22.18, has no normal gateway, and cannot reach the approved learning portal. Nearby managed devices received expected private addresses from DHCP.

Scenario Decision Lab

The Address Is Valid, but the Gateway Is Outside the Local Subnet

A fictional device has 192.0.2.42/27 but lists 192.0.2.97 as its gateway. The local subnet is 192.0.2.32/27, and the approved gateway should be 192.0.2.33.

Defender Habits

IP Addressing and Boundary Review Checklist

Check Your Understanding

I1.2 Mini Quiz: IP Addressing, Subnets, and Boundaries

Choose your answers first. Explanations appear only after submission.

1. What does the /24 in 10.24.18.44/24 describe?

2. Which address is the network address for 10.24.18.44/24?

3. Which pair belongs to different /26 subnets?

4. What is the main role of a default gateway?

5. What may a 169.254.x.x address indicate?

6. Why can a DHCP lease not prove the identity of every user action?

7. What is the strongest response to a likely subnet or VLAN mismatch?

Portfolio Prompt

Portfolio Prompt

Create a fictional Network Boundary Review using documentation address ranges. Include at least four subnets, prefix lengths, network addresses, normal host ranges, gateways, VLAN or zone labels, trust boundaries, approved communication paths, and one fictional misconfiguration. Add an evidence table showing what DHCP, switch, route, firewall, inventory, and change records confirm and cannot prove alone.

Use documentation ranges such as 192.0.2.0/24, 198.51.100.0/24, or 203.0.113.0/24.
Show at least one /24, /26, or /27 comparison clearly.
Include confirmed facts, uncertainty, owner, recommended action, validation, and rollback.
Do not use real home, school, company, cloud, VPN, or public network details.

Key Takeaways

What You Should Remember

1.The prefix length determines the boundary between the network and host portions of an IPv4 address.
2.Addresses that look similar may belong to different subnets when the prefix changes.
3.Default gateways carry approved traffic toward destinations outside the local subnet.
4.DHCP, switch, route, firewall, inventory, identity, and change evidence must be correlated.
5.An IP address is useful technical evidence but does not prove a complete user identity or business purpose by itself.
6.Network changes should be authorized, documented, tested, reversible, and validated.

Navigation

Continue Module I1