Addresses: IP, MAC, Ports, ARP and DHCP

By the end of this lesson you will be able to

• Name the three addresses every packet carries (MAC, IP, port) and say which layer uses each one and how far it travels.
• Read an IPv4 address in binary, split it into network and host parts with a subnet mask or CIDR prefix, and calculate network, broadcast, range and host count.
• Recognise private, public, loopback, link-local (169.254), CGNAT and documentation addresses, and read and shorten IPv6 addresses.
• Explain ports, sockets and the 5-tuple, and the well-known, registered and ephemeral port ranges.
• Walk through DHCP (DORA, leases) and ARP (request, reply, cache, gratuitous ARP, off-subnet traffic), including what goes wrong: no DHCP server, IP conflicts, rogue servers and spoofing.
• Spot four common myths: that MAC addresses are permanent, that IPv6 comes with mandatory IPsec, that 255.255.255.0 is a “classful” mask, and that the switch does ARP.

#Three addresses on every packet

When your laptop sends anything over a network, the data carries three different addresses, one per layer:

The notes define the first two:

• IP (Internet Protocol) gives devices a logical address on the network and carries packets towards it. “Logical” means it is assigned by configuration, not burned into hardware, and it depends on which network you are on.
• MAC (Media Access Control) is the hardware address that identifies a network interface on the local network. Frames on Ethernet and Wi-Fi are delivered by MAC.

#IPv4 addresses

An IPv4 address is a 32-bit number. To make it readable, it is written as four octets (8-bit bytes) in decimal, separated by dots: dotted-decimal notation. Each octet is 0–255.

To convert an octet, add up the bit values that are 1: 128, 64, 32, 16, 8, 4, 2, 1. For 192 that is 128 + 64, so 11000000; for 10 it is 8 + 2, so 00001010.

32 bits give 2³² ≈ 4.3 billion addresses. That sounds a lot, but with phones, laptops, servers and IoT devices it ran out: the central pool (IANA) was exhausted in 2011, and the regional registries (APNIC for Bangladesh and Asia-Pacific) soon after. Private addresses, NAT and IPv6 are the answers you will meet below.

#Network part and host part

Every IPv4 address has two parts:

• the network part (prefix): which network the address belongs to, the same for every device on that subnet;
• the host part: which device inside that network.

Where the split happens is given by the subnet mask, written either in dotted form or as a CIDR prefix length (Classless Inter-Domain Routing): the number of leading 1-bits.

IP address    192.168.1.10   11000000.10101000.00000001.00001010
Subnet mask   255.255.255.0  11111111.11111111.11111111.00000000   (= /24)
              ───────── network (24 bits) ─────────  host (8 bits)
Network       192.168.1.0    (host bits all 0)
Broadcast     192.168.1.255  (host bits all 1)
Usable hosts  192.168.1.1 – 192.168.1.254   →   2⁸ − 2 = 254

The address with all host bits 0 names the network itself, and the one with all host bits 1 is the subnet’s broadcast address (“everyone on this subnet”). That is why usable hosts = 2^(host bits) − 2.

Each extra prefix bit halves the block. Splitting a network into smaller ones is called subnetting: a /24 can become two /25s, four /26s, and so on.

Those are exactly the two reasons networks are subnetted:

• Less broadcast traffic. ARP requests and DHCP discovers go to every device on the subnet. With 1,000 devices on one flat network, every machine spends time on everyone else’s broadcasts; with 5 subnets of 200, each broadcast reaches only its own room, because routers do not forward broadcasts.
• Easier security and access control. Traffic between subnets must pass a router or firewall, so you can write one rule for a whole room: “the guest Wi-Fi subnet may reach the internet but not the accounts subnet”.

Real subnets come in powers of two, not neat 200s. For 5 rooms of up to 200 devices you would use five /24 subnets (254 usable each), for example 10.1.1.0/24 to 10.1.5.0/24.

#Local or not? The decision every host makes

Before sending, a host compares the destination with its own network, using the mask (a bitwise “and” of the bits):

• Same network part → on my subnet: find the destination’s MAC with ARP and deliver the frame directly.
• Different network part → somewhere else: send the frame to the default gateway (the router), using the router’s MAC.

With mask /24, 192.168.1.20 is local to 192.168.1.10, but 192.168.2.5 and 198.51.100.20 are not. Try both in the calculator above. A wrong mask is a classic misconfiguration: hosts try to ARP for machines that are really behind the router, or send local traffic to the router for no reason.

#Public, private and special addresses

Some ranges are reserved for special purposes. Knowing them lets you read a configuration at a glance:

Everything else is (roughly) public: globally unique, assigned through registries to ISPs and companies, and routable on the internet.

• A private address is unique only inside its own network. Millions of homes use 192.168.1.10 at the same time. To reach the internet, the router’s NAT swaps it for a public address (lesson 1.7 covers NAT in detail).
• CGNAT: many ISPs, especially mobile operators, no longer give each home router a public IPv4 address. The router gets a 100.64.x.x address and the ISP translates again. The side effect: nobody on the internet can open a connection into your home.

#IPv6 addresses

IPv6 uses 128-bit addresses: 2¹²⁸ ≈ 3.4 × 10³⁸, enough to give every device a globally unique address with no NAT. They are written as eight groups of four hexadecimal digits, separated by colons:

Full:        2001:0db8:0000:0000:0000:ff00:0042:8329
Rule 1 (drop leading zeros in each group):
             2001:db8:0:0:0:ff00:42:8329
Rule 2 (replace ONE run of consecutive all-zero groups with ::):
             2001:db8::ff00:42:8329

:: may appear only once, otherwise you could not tell how many zero groups each one hides.

The usual split is /64: the first 64 bits are the network prefix (given by the router), the last 64 bits the interface ID, which a device can generate itself (SLAAC, shown in the DHCP animation below). In a URL, an IPv6 address goes in brackets so its colons are not confused with the port: https://[2001:db8::10]:443/.

Most networks today run dual stack: devices have both IPv4 and IPv6 addresses, and DNS returns both A and AAAA records.

The notes list IPv6’s benefits as auto-configuration (SLAAC, above), no need for NAT (every device can have a global address, though a firewall still decides what may come in) and “strong built-in security (IPsec)”. The last one needs a correction:

#MAC addresses

A MAC address is 48 bits (6 bytes), written as six pairs of hex digits: 3c:22:fb:01:01:01 (Linux, macOS) or 3C-22-FB-01-01-01 (Windows).

• The first 3 bytes are the OUI (Organizationally Unique Identifier), assigned by the IEEE to the manufacturer. You can look up a vendor from it. The last 3 bytes are chosen by the manufacturer.
• ff:ff:ff:ff:ff:ff is the broadcast MAC: every device on the link accepts the frame.
• A MAC belongs to a network interface, not to a device: a laptop has one for Wi-Fi and another for Ethernet.
• It is meant to be unique but is not fixed: software can change it, and phones and laptops now use a random MAC per Wi-Fi network for privacy (the second hex digit is then 2, 6, A or E, marking a “locally administered” address). Never treat a MAC as a secure identity.

#IP address vs MAC address

From the notes:

• The IP address identifies the packet’s network-level source and destination.
• The MAC address helps the frame reach the next device on the local link.
• When your computer sends to the router, the destination IP can be the server’s IP, but the destination MAC is usually the router’s local interface MAC.
• When the router forwards on the next link it builds a new link-layer frame, so the MAC addresses change on every link.
• In normal routing without NAT, the source and destination IPs stay the same end to end.
• An IPv4 router decrements TTL when it forwards a packet; in IPv6 the equivalent field is Hop Limit.

#Ports

An IP address gets a packet to the right machine; a port gets it to the right program on that machine. A port is a 16-bit number, 0–65535, in the TCP or UDP header. TCP and UDP have separate port spaces: TCP 53 and UDP 53 are different.

The example from the notes: your computer opens a connection to a web server over HTTPS. (The addresses are reserved documentation examples, not a real Google server.)

In simple words:

• Source IP: where the packet is sent from.
• Destination IP: which IP the packet should reach.
• Source port: identifies this particular connection on the client.
• Destination port: identifies which transport service on the server the data goes to.

Port 443 is only the conventional port for HTTPS; it is not mandatory (https://example.com:8443 works fine). Likewise the client port 53000 is just an example, not a fixed rule: the operating system picks a free one for each new connection.

Ports worth knowing by heart:

#Sockets and the 5-tuple

• A socket is one endpoint of a conversation: IP address + port (+ protocol), for example 198.51.100.20:443.
• A server listens on a socket. A client connects from its own socket with an ephemeral port.
• Each connection is uniquely identified by its 5-tuple: protocol, source IP, source port, destination IP, destination port. That is how one server on port 443 handles thousands of clients at once, and how two browser tabs to the same site stay separate.

Two failure messages tell you a lot: “connection refused” (a fast TCP RST) means the machine is reachable but nothing listens on that port; a timeout usually means a firewall dropped the packet or the host is unreachable.

#DHCP: getting an address automatically

A device needs four things before it can use a network: an IP address, a subnet mask, a default gateway and DNS servers. Typing them by hand on every phone would be impossible, so DHCP (Dynamic Host Configuration Protocol) hands them out automatically. On a home network, the Wi-Fi router is the DHCP server.

The four-message exchange is remembered as DORA:

1. Discover (client → broadcast): “Is there a DHCP server?” The client has no IP yet, so it sends from 0.0.0.0 to 255.255.255.255, UDP port 68 → 67.
2. Offer (server → client): “You can have 192.168.1.10, mask /24, gateway .1, DNS .1, for 24 hours.”
3. Request (client → broadcast): “I accept the offer from 192.168.1.1.” Broadcast so other DHCP servers know they were not chosen.
4. Acknowledge (server → client): “Confirmed.” The lease starts. The ACK also carries the mask, the default gateway and the DNS servers.

Details that matter in practice:

• Leases expire. At 50 % of the lease the client renews directly with the server; at 87.5 % it asks any server; at 100 % it must stop using the address.
• Reservations make the server always give the same IP to the same MAC address: good for printers and home servers. Static addresses must be kept outside the DHCP pool, or you get conflicts.
• Broadcasts do not cross routers, so in big networks a DHCP relay on the router forwards requests to a central DHCP server.
• If no server answers, Windows and macOS self-assign 169.254.x.x (APIPA): the device can only reach other devices on the same link, with no internet. Seeing 169.254 means “DHCP failed”.
• Anyone can run a DHCP server, so a rogue DHCP server can hand out itself as gateway. Managed switches block this with DHCP snooping.

#ARP: from IP address to MAC address

The host now knows which IP to send to (the destination itself, or the gateway). But Ethernet and Wi-Fi deliver frames by MAC. ARP (Address Resolution Protocol) finds the MAC address that belongs to an IP address on the local network.

How it works:

1. The host checks its ARP cache. If the IP is there, done.
2. If not, it broadcasts an ARP request (destination MAC ff:ff:ff:ff:ff:ff, EtherType 0x0806): “Who has 192.168.1.20? Tell 192.168.1.10.”
3. Every host on the link receives it; only the owner of that IP sends a unicast ARP reply: “192.168.1.20 is at aa:bb:cc:00:00:20.”
4. The sender caches the answer for a while and sends the frame.

Key points:

• ARP is used only for neighbours on the same subnet. For any off-subnet destination, the host ARPs for its default gateway, never for the remote server. ARP broadcasts never cross a router.
• Gratuitous ARP is an announcement nobody asked for (“192.168.1.100 is at my MAC”). Devices send it when they come up, and high-availability pairs use it to move a virtual IP to the standby machine within a second.
• IP conflict: two devices with the same IP both answer ARP, and neighbours’ caches flip between them. Operating systems probe with ARP before using an address and warn “IP address conflict”.
• ARP spoofing: ARP has no authentication, so an attacker on the same LAN can claim the gateway’s IP and become a man-in-the-middle. Defences are Dynamic ARP Inspection on switches and, above all, encryption (TLS, SSH, VPN).
• IPv6 replaces ARP with NDP (Neighbor Discovery Protocol), which uses multicast ICMPv6 messages instead of broadcasts.

#Putting it all together

When your laptop joins a Wi-Fi network and opens a website, the addresses come into play in this order:

1. DHCP gives the laptop its IP (192.168.1.10/24), gateway (192.168.1.1) and DNS server.
2. The laptop wants to ask DNS. The DNS server is off-subnet (or is the router itself), so it ARPs for the gateway and caches the router’s MAC.
3. DNS (lesson 1.8) turns the name into the server’s IP, 198.51.100.20.
4. The laptop opens a TCP connection from an ephemeral port (53000) to port 443, sending frames to the router’s MAC with the server’s IP inside.
5. The router applies NAT and the packet crosses the internet hop by hop, with new MACs on every link (lesson 1.5).

#Addressing in system design

• Plan cloud networks with CIDR. A VPC might be 10.0.0.0/16, split into /24 subnets per availability zone, public and private. Make the ranges non-overlapping with your office, other VPCs and partners, because you cannot connect overlapping networks with peering or VPN without painful NAT. Leave room to grow; AWS also reserves 5 addresses in every subnet.
• Private by default. Databases, caches and internal services live in private subnets with no public IP; only load balancers face the internet. Security groups and firewalls are written in terms of CIDR blocks and ports (“allow TCP 5432 from 10.0.1.0/24”).
• Do not hard-code IPs. Instances, containers and pods get new addresses when they restart. Use DNS names and service discovery, and floating/virtual IPs where needed.
• Ports are a finite resource. Proxies and NAT gateways that open many connections to one destination can run out of ephemeral ports. Connection pooling and keep-alive avoid it.
• IPv4 is scarce and costs money. Clouds now charge for public IPv4 addresses, which is pushing services towards IPv6 and shared load balancers.
• Know the special ranges when debugging. 169.254.x.x means DHCP failed (also used by cloud metadata services at 169.254.169.254); 100.64.x.x on your router’s WAN means CGNAT; a 127.0.0.1 binding means local only.

#Try it yourself

# Your IP, mask, gateway, DNS, MAC and DHCP lease
ipconfig /all                 # Windows
ip addr; ip route             # Linux ("default via ..." is your gateway)
ifconfig; netstat -rn         # macOS

# Your ARP / neighbour cache
arp -a                        # Windows, macOS, Linux
ip neigh                      # Linux

# Release and renew the DHCP lease (watch DORA in Wireshark with filter "dhcp")
ipconfig /release && ipconfig /renew     # Windows
sudo dhclient -r && sudo dhclient        # Linux

# Which programs listen on which ports, and your open connections (5-tuples)
netstat -ano                  # Windows
ss -tlnp                      # Linux: listening TCP sockets
ss -tn                        # Linux: established connections

# Your public IP as the internet sees it (compare with ipconfig!)
curl -4 https://ifconfig.me
curl -6 https://ifconfig.me

If ipconfig shows 192.168.x.x but curl -4 ifconfig.me shows something else, that difference is NAT. If your router’s WAN address starts with 100.64–100.127, you are behind CGNAT.

#Summary

Key takeaways

• Every packet carries a MAC (L2, one hop, rewritten at every router), an IP (L3, end to end unless NAT) and a port (L4, which program).
• IPv4 is 32 bits in four octets. The subnet mask / CIDR prefix splits it into network and host parts; usable hosts = 2^(host bits) − 2 (a /24 has 254).
• A host sends directly (after ARP) to destinations on its subnet, and to the default gateway for everything else.
• Private ranges 10/8, 172.16/12, 192.168/16 are reused everywhere and need NAT; also know 127.0.0.1 loopback, 169.254 (DHCP failed), 100.64/10 (CGNAT) and the documentation ranges.
• IPv6 is 128 bits in hex groups; drop leading zeros and replace one run of zero groups with ::. Link-local fe80::, loopback ::1, no broadcast, /64 subnets.
• Ports 0–65535: well-known (22, 53, 80, 443…), registered (3306, 5432, 6379), ephemeral (49152–65535). A socket is IP:port; a connection is a unique 5-tuple.
• DHCP (Discover, Offer, Request, Acknowledge) leases an IP, mask, gateway and DNS. ARP maps an IP to a MAC on the local link with a broadcast request and unicast reply, cached; gratuitous ARP announces, spoofing abuses it.
• Myths to drop: MACs are not permanent (phones use a random MAC per Wi-Fi network); IPv6 does not force IPsec on (RFC 6434 made it optional); 255.255.255.0 is just /24 written differently, not “classful”; the host sends ARP, the switch only forwards it.
• Subnet for two reasons: smaller broadcast domains and access control between subnets.

Self-check: addresses, ports, ARP and DHCP30 questions