Networking Basics - IP address, netmasks and subnets

In this tutorial, we will cover some networking basics. We won't be hacking anything, but by the end of the tutorial you'll learn a lot of things which will be useful later, especially when you'll use nmap. Please note that it is advised that you go through wikipedia pages of all the concepts covered here since the discussion won't be exhaustive in any way.

IP address

An IP address is simply a 32 bit address that every device on any network (which uses IP/TCP protocol) must have. It is usually expressed in the decimal notation instead of binary because it is less tedious to write it that way. For example,
Decimal notation - 192.168.1.1
Binary  - 11000000.10101000.00000001.00000001
It is clear from the binary form that the IP is indeed 32 bits. It can range from 0.0.0.0 to 255.255.255.255 (for the binary all 0s and all 1s respectively) [A lot of time, the first octet usually goes upto 127 only. However, we aren't concerned with that here.]

Parts of an IP address

Now this IP address has 2 parts, the network address and host address. A lot of wireless routers keep the first 3 octets (8 bits, hence octets) for the network address and the last octet as host address. A very common configuration being 192.168.1.1 . Here, 192.168.1.0 is the network address and 0.0.0.1 is host address. I hope you can see that the host address can vary from 0.0.0.0 to 0.0.0.255 (though usually 0 and 255 are reserved for the network and broadcast respectively).

Need for Netmasks

But different networks have different needs. The previous configuration lets you have a lot of different possible networks (the first 3 octets are for the network and can take different values, not just 192.168.1.0) but only 256 (254 actually) hosts. Some networks may want more hosts (more than 255 hosts per network). This is why there is no "hardcoded" standard enforced on networks for the network and host addresses, and instead, they can specify their own configuration. The first 3 octets being network address and last octet being host address is common, but in no way mandatory. Using Netmasks, we can have very versatile set of configurations, for each and every need.

Netmask

A netmask is used to divide the IP address in subnets. 
We'll start with a basic example. Suppose we want to define a netmask which configures our network like wireless router in the previous example. We want the first 3 octets to correspond to the network and next 1 octet for host address. 
Let's think of an operation which we can use to separate the network and host part of the IP address. For simple purposes, we could have just defined after which octet does the host part start [basically saying that anything after the third period(.) is host address]. While this is a simple solution, it is not very versatile. 
A more elegant and mathematical solution was proposed.

Netmask - Working

First I'll tell you the mathematical functionality of a netmask. Assume A to be an IP address and M to be a netmask. Then, 
A & M gives the Network address
A & (~M) gives the Host address.
Where,
& is bitwise And
~ is bitwise Not (i.e. complement, 1s complement to be more precise)

So, basically a netmask is another 32 bit binary number (just like an IP address), but with the purpose of giving Host address and network address when the operation bitwise and is carried out on it (and it's complement) with A.

Example

You'll understand better with example.
A = 192.168.1.1 is you IP address
M = 255.255.255.0
We convert it  to binary, and then carry out the desired operations.


A   =    11000000.10101000.00000001.00000001  (192.168.1.1)
M   =    11111111.11111111.11111111.00000000  (255.255.255.0)
A&M =    11000000.10101000.00000001.00000000  (192.168.1.0)
A&M is network IP that we desired


A   =    11000000.10101000.00000001.00000001  (192.168.1.1)
~M  =    00000000.00000000.00000000.11111111  (0.0.0.255)
A&~M=    00000000.00000000.00000000.00000001  (0.0.0.1)
A&~M is host IP that we desired

Explanation

Basically, if you realize that 11111111 is 255 in decimal, then you can see that for the parts of the IP address that you want for networks, you set the subnet to 255, and for the ones you want for host, you set it to 0.
So, if you want to reserve 2 octets for networks and 2 for hosts, then the subnet will be-
M = 255.255.0.0
If you want 3 octets for host, then
M = 255.0.0.0
Hence, we can see that using netmasks we can achieve what we wanted, i.e. to define networks with whatever number of hosts we require. Now we go a bit further.

Subnets

Now suppose you want to divide your network into parts. It is the sub-networks that are known as subnets (it is correct to call them subnetwork as well). 
We'll jump right to it, consider the netmask M
M = 11111111.11111111.11111111.11000000
Now, the first 3 octets describe the network. But the 4th octet, which is supposed to be for the host, has the 2 most significant bits (i.e. leftmost bits) as 1. Thus, the 2 most significant (leftmost) bits of the 4th octet will show up when we carry out the bitwise AND operation. They will, thus, be a part of the network address. However, they belong to the host octet. Thus, these 2 bits, which belong to the host octet but show up in the network IP address divide the network into subnets. The 2 bits can represent 4 possible combinations, 00, 01, 10 and 11, and hence the network will have 4 subnets. 

Example of Subnetwork

Back to our previous "A",


A   =    11000000.10101000.00000001.xx000001  (192.168.1.1)
M   =    11111111.11111111.11111111.11000000  (255.255.255.192)
A&M =    11000000.10101000.00000001.xx000000  (192.168.1.0)


Earlier, irrespective of what was there in 4th octet of A, we would have got all 0s in 4th octet of A&M i.e. network address. This time we will get the 2 most significant bits in the network address. Four subnets will be formed depending on the value of xx (which can be 00,01,10 or 11). Now, we will see which subnet has which set of hosts.

Which subnet has which hosts

11000000.10101000.00000001.00000000
has hosts 192.168.1.0-63 (00000000 to 00111111)

11000000.10101000.00000001.01000000
has hosts 192.168.1.64-127 (01000000 to 01111111)

11000000.10101000.00000001.10000000
has host 192.168.1.128-191 (10000000 to 10111111)

11000000.10101000.00000001.11000000
has host 192.168.1.192-255 (11000000 to 11111111)

So the netmask M divided the network into 4 equal subnets with 64 hosts each. There are some subnets which are much more complicated and have their applications in certain specific areas. I recommend going through Wikipedia page on Subnetworks to get some more idea. I have covered enough and now you can understand Wikipedia;s content on the topic without any difficulty.

Some Special IPs

0.0.0.0 = All IPs on local machine. Anything hosted on this IP is available to all devices on the network.

127.0.0.1 = LocalHost, this loops back to the machine itself.

255.255.255.255 = Broadcast, anything sent to this IP is broadcasted (like radio is broadcasted to everyone) to all hosts on the network.

Finally

You see the notation in this pic?  

This way of representing subnets using /24, /25, /26, etc. is quite useful while doing vulnerability scans on networks (using nmap, etc.). /24 represents the netmask 255.255.255.0 , the first example we took of Wireless router. It is the most common configuration you'll use while doing nmap scan. The one we discussed later, in the subnets section, is /26. It has 4 subnetworks. /25 has 2 subnets. /27 has 8. /31 has 128 subnets! In this subnet, only 2 host can be there per network, and it is used for 1 to 1 or point to point links. I hope the next time you have to deal with networks, you won't be having difficulties. There are topic like Multicast etc. which build up on this, and you can do further reading on them. That was all for this tutorial. Good luck.