Every packet needs a destination the routers can act on without knowing the whole internet. The IP address is that destination: a fixed-length number with a structure that tells each router how much of it to read. The version, the subnet split, and the forwarding rule below are the three ideas that make global delivery work with tables of manageable size.
Version 4 ran out, so version 6 expanded the space
Every device on the internet has an IP address. IPv4 uses 32-bit addresses, written as four numbers separated by dots (e.g., 192.168.1.1). The 32-bit space holds about 4.3 billion addresses — enough for the early internet, but exhausted at the global registries years ago, which is why address sharing (NAT) and markets for address blocks exist today.
IPv6 uses 128-bit addresses, written as eight groups of hexadecimal digits separated by colons (e.g., 2001:db8::1). The double-colon :: is shorthand for consecutive zero groups, so 2001:0db8:0000:0000:0000:0000:0000:0001 becomes 2001:db8::1. The space is effectively inexhaustible — 340 undecillion addresses — which removes the need for NAT-style sharing and lets every device hold a globally routable address again.
The two versions do not interoperate on the wire: an IPv4-only host cannot parse an IPv6 header. Dual-stack deployment, tunneling, and translation gateways exist precisely because the upgrade has taken decades and is still incomplete.
Subnets split one network into manageable pieces
A single IP network can be divided into smaller subnets. CIDR (Classless Inter-Domain Routing) notation expresses both the network and the subnet size: 192.168.1.0/24 means the network 192.168.1.0 with a 24-bit network prefix, leaving 8 bits for host addresses — that is, 256 possible addresses (254 usable, since the first is the network and the last is the broadcast).
| Notation | Network bits | Host bits | Addresses |
|---|---|---|---|
| /24 | 24 | 8 | 256 |
| /25 | 25 | 7 | 128 |
| /26 | 26 | 6 | 64 |
| /16 | 16 | 16 | 65,536 |
Subnets let you divide a large network into smaller ones — e.g., one subnet per floor in an office building — reducing broadcast traffic and improving security. The subnet mask is the same idea in older notation: 255.255.255.0 is a /24, marking the first 24 bits as network and the rest as host. Cloud VPCs expose exactly this control: you carve a /16 into public /24s for load balancers and private /24s for databases, and the routing table enforces which can reach the internet.
Routers forward by longest matching prefix
When a device wants to send a packet to another device, it checks whether the destination is on the same subnet. If so, it sends the packet directly (using the destination's MAC address via ARP).
If the destination is on a different subnet, the device sends the packet to its default gateway — a router. The router consults its routing table: a list of (destination network, next hop) pairs. It finds the entry that matches the destination IP and forwards the packet to the next hop. This process repeats at every router along the path. When two entries match, the longest prefix wins — a /24 route beats a /16 covering it — which is how a specific customer route overrides a general upstream one.
On the internet, BGP (Border Gateway Protocol) is the routing protocol that connects autonomous systems (networks operated by different organizations). Each autonomous system announces which IP ranges it can reach, and BGP routers exchange these announcements to build a global routing table — currently around one million prefixes, held in memory on every core router.
Private addresses stay inside, public addresses travel
Some IP ranges are private (not routable on the internet) — used inside home and office networks:
| Range | CIDR |
|---|---|
| 10.0.0.0 – 10.255.255.255 | 10.0.0.0/8 |
| 172.16.0.0 – 172.31.255.255 | 172.16.0.0/12 |
| 192.168.0.0 – 192.168.255.255 | 192.168.0.0/16 |
A NAT (Network Address Translation) router maps private addresses to a single public IP, allowing many devices to share one public address. It rewrites the source address and port on outbound packets and keeps a translation table — tens of thousands of entries on a home router — to steer replies back to the right internal host. The cost is end-to-end transparency: inbound connections need explicit port forwarding because the public address alone no longer names a machine.
Where this bites in production
- Overlapping CIDRs break peering. Two VPCs that both use
10.0.0.0/16cannot be peered without renumbering — plan private space allocation before the second VPC exists, not after. - A /32 host route overrides everything. Debugging "traffic goes to the wrong place" means reading the table longest-prefix-first; the most specific entry wins regardless of its position in the file.
- BGP misconfigurations leak globally. Announcing prefixes you do not own redirects other networks' traffic to you within minutes. Prefix filters and RPKI exist because typos here become international incidents.
Learn about ports and sockets · See how DNS resolves names to addresses
Production cost model and latency numbers
To apply IP Addresses, Subnets, and Routing effectively in production systems, engineers must move beyond qualitative diagrams and quantify the exact hardware and network costs at each boundary:
| Operation / Boundary | Typical Latency | Dominant Bottleneck | Production Mitigation |
|---|---|---|---|
| L1 / L2 Cache Access | 1 ns – 4 ns | Register dependency chains & pointer chasing | Contiguous memory layouts, cache-line alignment (64 B), and batch iteration |
| Main Memory (DRAM) Fetch | 60 ns – 100 ns | TLB misses, random heap indirection, NUMA hops | HugePages (2 MB), arena/slab allocators, and pre-allocated ring buffers |
| Kernel Syscall / Context Switch | 1 µs – 5 µs | User-to-kernel mode switch, page-table flush, lock contention | Non-blocking readiness loops (epoll / io_uring), batching, and zero-copy I/O |
| NVMe SSD Random Read / fsync | 50 µs – 500 µs | Block I/O queue depth, write amplification, WAL flushes | Group commit, sequential append logs, and bounded buffer-pool pinning |
| Intra-Region RPC Roundtrip | 0.5 ms – 2.5 ms | Serialization, TCP/TLS framing, tail queueing ($L = \lambda W$) | Connection pooling, deadline propagation, and p95 hedged requests |
Failure modes, debugging, and operational checklist
In real incidents, systems rarely fail at average (p50) load—they fail when a slow dependency, skewed hot key, or resource leak pushes concurrency across a non-linear saturation cliff. When reviewing code or architecture that relies on IP Addresses, Subnets, and Routing, walk through three verification questions:
- What is the invariant under partial failure or contention? If a worker crashes mid-operation, a network packet is delayed and reordered, or two threads race on the same state transition, prove which atomic primitive, version number, or idempotency key prevents silent corruption.
- How is backpressure enforced when demand exceeds capacity? Unbounded in-memory queues, unthrottled retries, and blocking calls without explicit deadlines turn a localized
100 msslowdown into a fleet-wide Out-Of-Memory (OOM) cascade. Always bound queue depths, propagate caller deadlines, and shed excess load early. - Which metrics and traces isolate the bottleneck in under 60 seconds? Instrument saturation, queue wait time vs service execution time, cache hit/miss ratios, and error rates by failure reason so on-call engineers can immediately distinguish a compute bottleneck from an I/O or lock-contention stall.