The previous discussion describes how IP delivers datagrams over router-connected networks. This section describes the other important component of IP: the addressing scheme.

In reality, there are multiple addressing and naming schemes in use on a typical IP network at any one time. For example, there are host naming schemes (as opposed to numbering schemes) that allow humans to refer to computers with easy-to-remember names. The Internet's DNS (Domain Name Service) provides a service that translates names into IP addresses. Refer to "DNS (Domain Name Service)" for more information about Internet naming schemes. There is also the IP addressing scheme, which consists of both a network identifier and a host identifier. And then there is MAC addressing, which identifies computers via the hardwired address built into network interface cards.

Keep in mind that IP host addressing is a network layer function that identifies a specific computer across an internetwork. It is part of IP's "overlay" internetwork addressing scheme. MAC addressing is a data link layer function that operates within LAN boundaries (i.e., a specific broadcast domain). When a packet arrives at a router, the router translates the destination host's IP address into a MAC address, then puts the data in frames that are addressed to the host with that particular MAC address.

The IP address scheme is discussed in RFC 791 and the following RFCs. Also refer to "Internet Organizations and Committees" and "Registries on the Internet" for more information about the organizations and techniques for allocation IP addresses on the Internet.

• RFC 1335 (A Two-Tier Address Structure for the Internet: A Solution to the Problem of Address Space Exhaustion, May 1992)
• RFC 1466 (Guidelines for Management of IP Address Space, May 1993)
• RFC 1814 (Unique IP Addresses are Good, June 1995).
• RFC 2050 (Internet Registry IP Allocation Guidelines, November 1996)
• RFC 2071 (Network Renumbering Overview: Why would I want it and what is it anyway? January 1997)
• RFC 2072 (Router Renumbering Guide, January 1997)

An IP address is a 32-bit binary number that contains two separate pieces of information:

• Network identifier    Indicates the network (a group of computers). Networks with different identifiers can be interconnected with routers.
• Host identifier    Indicates a specific computer on the network.

While computers work with IP addresses as 32-bit binary values, humans normally use the dotted-decimal notation. A binary address and its dotted-decimal equivalent are shown below. Note that the 32-bit address is divided into four 8-bit fields called octets.

You can pull out your binary-to-decimal calculator to do these conversions (if you run Windows, open the Calculator and choose Scientific on the View menu). For example, type in 192, then convert it to binary to get 11000000. It is common to refer to the four 8-bit fields as follows for simplicity:

Using this abbreviated form makes it easier to discuss the different addressing schemes without having to show the full set of binary digits when they are not necessary to the discussion. For example, if only the right-most eight bits are essential to the discussion, then i'll use a notation similar to "w.x.y.00000101."

In the early days of the Internet, the 32-bit IP address space was allocated into three address classes: class A, class B, and class C. As discussed later, the class system would be all but phased out by now except that so many organizations "own" class-based blocks of addresses and many will not voluntarily give them up. Also, the changeover has been difficult.

Keep in mind that the address is split, with the left part indicating the network and the right part indicated a host. The question is, where does the network part end and the host part begin? It varies depending on which class of network address you are referring to. The three classes are outlined below. The important thing to notice is that each class support a specific number of networks and a specific number of hosts on each of those networks.

The IP address classes are pictured in Figure 4 and described below. Keep in mind that you are assigned an IP address by an Internet organization or service provider, based on your needs (number of hosts) and the address range that is available. The address you are assigned is just the network identifier portion. You are responsible for assigning addresses to individual hosts within your network. As discussed later, you can also use subnetting techniques to subdivide a given range of addresses.

Figure 4: IP address classes

• Class A    Identified by the first bit set as 0. The next 7 bits define the network address, and the remaining 24 bits identify hosts. Network number 127 is reserved for loopback testing. The 24-bit host address space identifies 16,777,214 hosts per each of the 126 networks. Most class A network schemes were assigned to U.S. government agencies, educational institutions, research organizations, and large companies in the early days of the Internet.
• Class B    Identified by the first 2 bits set as 10. The next 14 bits define the network address, and the remaining 16 bits identify hosts. This scheme defines 16,384 networks and 65,534 hosts per network.
• Class C    Identified by the first 3 bits set as 110. The next 21 bits define the network address, and the remaining 8 bits identify hosts. This scheme defines 2,097,152 networks and 254 hosts per network.

A class D scheme also exists for multicasting. The first 4 bits (1110) identify the class, and the remaining 28 bits refer to a group of hosts, all of which receive the same IP packet. Refer to "Multicasting." A class E was also defined for future use, with the first four bits being 1111.

There are some guidelines for working with network and host numbers:

• Network 127 in the class A scheme is reserved for loopback testing.
• The IP broadcast address is all the network bits set to 1.
• All 0s in the network address represents an address for the local network. Only the host portion of the address is significant.
• If all the bits in the host identifier are set to 1, the address is a broadcast address used to send packets to all hosts on the current network.
• If all the bits in the host identifier are set to 0, the address represents the network itself and no specific host.

A private IP addressing scheme allows an organization to use any IP internal addressing scheme (class and subnetting scheme) that fits it requirements. Any devices connected directly to the Internet (Web servers, e-mail servers, etc.) require a public IP network address, which can be obtained from a network registrar.

A proxy server or NAT (network address translation) server separates the internal and external networks and acts as a "gateway" between them. What these servers do is intercept outgoing packets and change the private IP address to a public IP address. When a response to the packets comes back, the servers convert the public IP address back to the appropriate private IP address. Lookup tables are maintained, while an internal host maintains an external session. A pool of public IP addresses is kept on hand for use in the translation. This pool does not need to equal the number of internal hosts, assuming that all of those hosts don't access the Internet at the same time. See "Proxy Servers" and "NAT (Network Address Translation)" for more information.

Private IP addresses help to hide internal hosts addresses from potential hackers. In addition, you have the freedom to create any networking scheme you need instead of being tied to an Internet-assigned scheme.

Three address blocks were reserved for private use as defined in RFC 1918 (Address Allocation for Private Internets, February 1996). These addresses are never used on the public Internet and are not even accessible across routers. A host on one of these private addresses must go through a proxy server or NAT to access the Internet:

• Class A: 10.0.0.0 to 10.255.255.255
• Class B: 172.16.0.0 to 172.31.255.255
• Class C: 192.168.0.0 to 192.168.255.255

A subnet mask is an IP address feature that serves as a sort of template to indicate which bits in the IP address define the network and which bits define the host. All devices on the same IP network must use the same subnet mask. The subnet mask became necessary when subnetting procedures (described next) were developed for IP addresses. The standard subnet masks used for the class A, B, and C networks are shown in the following table, along with the binary equivalent:

Note how the binary 1s indicate the bits that are used for the network address portion of the IP address. They essentially "mask out" the network address to reveal the host address. As an example, a class B address of 128.10.50.25 and a class B subnet mask of 255.255.0.0 are shown in the following table. The mask indicates that the first two bytes are the network address, so the last two bytes are the host address.

A subnet is a logical subsection of an IP network. You create subnets to separate groups of hosts for security reasons, for traffic control purposes, or other reasons. Subnets are usually created within enterprise networks to create departmental networks. A service provider with a large block of IP addresses creates subnets so that it can allocate blocks of IP addresses to subscribers. Just like networks on the Internet, routers are required at subnet boundaries to transmit packets from one subnet to another.

In terms of addressing, subnetting is equivalent to adding a third level to the Internet addressing hierarchy. The normal levels include all the networks of the Internet and then the hosts on those networks. Subnetting creates a sublevel of networks within each network. An enterprise or an ISP may configure subnetting to divide a large network into two or more smaller networks that are easier to manage and that match the physical and transmission requirements of the underlying networks.

Subnetting is discussed in RFC 917 (Internet subnets, October 1984), RFC 932 (Subnetwork addressing scheme, January 1985), RFC 950 (Internet Standard Subnetting Procedure, August 1985), and RFC 1219 (On the assignment of subnet numbers, April 1991).

For example, a class A addressing scheme provides over 16 million host addresses for a single network. But a single network that uses even 1/100 of 1 percent of those addresses would be too large to meet the specifications of most LANs. The specifications for Ethernet allow only 1,024 nodes per network. In additional, there are electrical parameters and cable length limitations.

Most important, the broadcast nature of LANs like Ethernet makes it impossible to support a large number of hosts at the same time. Ethernet networks are shared media systems. When a host wants to transmit, it checks to make sure no other host is transmitting. If there are thousands of computers on the network, a computer may never get a chance to transmit. In addition, multiple computers will still attempt to transmit at the same time, especially if the network is so large that it is hard to detect that a distant node has begun transmitting. Busy Ethernet networks may exhibit performance problems with as few as 50 hosts.

So the basic problem is that you have one IP network address, but you need to subdivide your network into multiple interconnected networks for management or performance reasons. One way to do this is to obtain additional IP address blocks from service providers. A better choice is to use private network addressing, then install a proxy server or NAT between the internal network and the Internet. This latter method gives you the freedom to use any addressing scheme that fits your needs.

But subnetting will be necessary if you are working with a legacy network that already uses Internet-compatible addresses, or if you plan to connect the network to the Internet and you only want to have one public IP address. In this case, subnetting is all about conserving and making the best use of the available address space. That means subdividing the address space into multiple networks, each with enough host addresses to fit your needs. However, as you will see, dividing the address spaces involves making trade-offs between the number of networks and the number of hosts.

Note that this section discusses static subnetting, in which the same subnet mask is used over the entire network of subnets. Variable-length subnetting allows different subnet masks, as discussed in the next section.

Assume you have one large Ethernet network with 1,000 hosts and a single class B network address. The network is saturated and you must subdivide it into separate broadcast domains to contain traffic and to separate users into departments and workgroups. Subnetting lets you create hundreds or even thousands of individual networks out of the class B address. You then need routers to interconnect the new subnetworks. Routers forward messages to the proper subnet by evaluating the subnet mask.

The key to subnetting is to use some of the host bits for the subnet address. The two-part IP address becomes a three-part IP address as shown here:

The subnet identifier must be at least 1 bit. A 1-bit value means that only two subnets exist (either the bit is 0 or 1). If the subnet identifier is two bits, then four subnets are possible (00, 01, 10, 11). Assume you are using the IP network address 192.168.0.0. The bit pattern for this address is:

To subnet this address, you use one or more of the host bits, depending on how many subnetworks are needed. In Table 1, the underlined bits in the third octet (the y octet) are used for subnetting. A 3-bit value provides eight possible decimal numbers as shown, giving eight subnets (subnets 0, 32, 64, 96, etc.). If you're confused about the binary/decimal relationship, pull out your binary to decimal calculator and you'll see, for example, that "01000000" converts to "64" and vice versa.

Table 1: Using 3 bits for subnetting

The /19 notation is a shorthand technique to indicate that the 19 leftmost bits are the network address. This notation is usually used in place of specifying the entire 32-bit binary subnet mask, as explained below.

The actual range of host IP addresses that can be derived out of the class B network address in Table I-1 (with three bits used for subnetting) is outlined in Table I-2.

RFC 1878 (Variable Length Subnet Table For IPv4, December 1995) provides subnet tables, as well as network IDs, host ranges, and IP broadcast addresses with emphasis on Class c subnets. Tables I-3 shows how subnetting works in terms of the subnet mask for class C addressing.

In the second column, you can see that as you increase the bit width of the subnet identifier field (the 1s), you decrease the size of the host identifier field (the 0s), thus reducing the number of host you can have on each subnet. For example, if you use four bits to subnet a class C address, you can create 16 subnetworks. But that only leaves four bits for the host address, meaning that only 14 hosts may exist on each subnetwork. Keep in mind that all 0s and 1s are reserved for the network identifier and broadcast address respectively.

To subnet an IP address, you first need to get an idea of the number of networks you need and the number of hosts to be connected to each network, now and in the future. The fourth and fifth column in Tables I-3 show the number of subnets and hosts per subnet. As mentioned, you can use subnet notation in place of using the entire 32-bit subnet mask. The notation is listed in the third column of Table 3. Also, only RIP v2 or the OSPF routing protocol fully support subnetting. For more information about subnetting, refer to the following Web sites:

Subnetting can be taken one step further. As mentioned previously, basic subnetting requires that you find a subnet value that provides a balance between the number of subnets you need and the number of hosts on each of those subnets. For example, for a class C network, you might choose a 3-bit subnet mask to obtain eight networks with up to 30 hosts each. But assume you have one network with 50 hosts and six networks with 10 or fewer hosts. Which subnet scheme do you use? In fact, there is no class C configuration that satisfies this requirement.

Variable-length subnetting solves this problem by eliminating the "one configuration must fit all" restriction of standard subnetting. It is defined in RFC 1878 (Variable Length Subnet Table For IPv4, December 1995). Variable-length subnetting and CIDR (discussed next) move away from the classful interpretation of addresses as has been discussed in the previous sections. Classful interpretation is being able to determine the class of an address (A, B, C, D, E) and the subnet mask to use by looking at the first few bits in the address (class A = 0, class B = 10, and class C = 110).

Basically, variable-length subnetting involves "subnetting the subnets." First, you subnet the existing address space into top-level subnetworks, then you subnet those networks into yet smaller subnets to fit your needs. Those subnetworks can also be subnetted. The final address space will be hierarchical. Figure 5 and Table 4 show how a class C network address is "sub-subnetted."

This hierarchy has the advantage of aggregating the network address space so that routers at the top of the hierarchy do not need to maintain routing information for all of the subnetworks. A packet passing through the top-level router will be routed within the subnetted hierarchy.

Just as an organization can use variable-length subnetting to divide its network into multiple subnets, CIDR (pronounced "cider") provides a way for ISPs to subdivide their address blocks into pieces that fit the size of their customers. CIDR employs address aggregation, in which multiple contiguous blocks of addresses are referred to by the network number they have in common. In addition, subnetting presents an organization's network address to the outside world as a single address while allowing multiple internal networks.

CIDR also provides this capability for ISPs. The rest of the Internet sees only a single network address for the block of addresses it has been assigned. Internally, the ISP is subdividing the address and routing packets appropriately. This has great benefit for the Internet routing tables because only a single entry is needed for an ISP's network. The ISP's routers then handle all routing within its network. See "OSPF (Open Shortest Path First)" for information about interior routing. See "BGP (Border Gateway Protocol)" for information about exterior routing.

While many organizations typically deal with class C-size network addresses, in the past ISPs have been assigned class A or class B network address, or multiple class B and class C addresses. Some ISPs allocate part of their address space to lower-level ISPs, and those lower-level ISPs may allocate parts of their address space to other ISPs or organizations.

The important point is that addresses are allocated as a contiguous block that are aggregated and advertised to the outside world as a single IP network address. This single network address is all that the higher-level ISP needs to know about. In turn, this ISP has an aggregation of addresses that it advertises as a single network address to even higher-level ISPs or backbone routers.

Historically, supernetting was first discussed in RFC 1338 (Supernetting: an Address Assignment and Aggregation Strategy, June 1992), which was later replaced with RFC 1519 (Classless Inter-Domain Routing: an Address Assignment and Aggregation Strategy, September 1993). According to Tim Bass in a paper about exterior routing protocols (see link of related entries page):

For more information, refer to "CIDR (Classless Interdomain Routing)" Also refer to RFC 1787 (Routing in a Multi-provider Internet, April 1995), RFC 2008 (Implications of Various Address Allocation Policies for Internet Routing, October 1996), RFC 2519 (A Framework for Inter-Domain Route Aggregation, February 1999), and RFC 2050 (Internet Registry IP Allocation Guidelines, November 1996).

A proposed Internet protocol called RSIP (Realm-Specific Internet Protocol) solves some of the address problems of IPv4, and provides better support for multimedia. The IETF has stated that RSIP is a replacement for NAT (network address translation) and a potential alternative to IPv6. At the same time, RSIP provides a transition path to IPv6 for organizations that implement it.

NAT has some shortcomings, such as its inability to work with the IPSec (IP Security) protocol and the inability to establish TCP peer-to-peer connections. A NAT translates an internal address into an address that can be used on the Internet, effectively hiding internal addresses. Thus, an organization does not need an Internet-compatible IP address for all its internal hosts, which saves Internet addresses. However, IPSec requires that the same IP address be used from host to host and not be converted by some device in between. RSIP solves this problem by allowing routers to support host-to-host IPSec sessions.

RSIP was still in draft form at the time of this writing. 3Com developed the protocol in early 1998. It is undergoing development and modifications and may emerge with many changes by the time you read this. Refer to RSIP (Realm-Specific Internet Protocol) for more information.