SHADOWXLAB CYBER-OS · ENTERPRISE ADDRESSING & SUBNET ARCHITECTURE

IP Address → MAC Address → Network ID → Host ID → VLSM

Master network boundaries from the ground up: 32-bit binary arithmetic, bitwise AND filtering, CIDR-to-mask equivalence, Magic Number block calculations, VLSM subnet tree planning, RFC 1918 private spaces, and firewall micro-segmentation.

01 · FOUNDATION — WHAT IDENTIFIES A DEVICE ON A NETWORK? LAYER 2 VS LAYER 3

MAC ADDRESS · LAYER 2 (DATA LINK)

A 48-bit physical address burned into the Network Interface Card (NIC). It facilitates local hop-to-hop frame delivery on the same broadcast domain.

Example: 00:50:56:C0:00:08 (OUI: 00:50:56 = VMware)

IP ADDRESS · LAYER 3 (NETWORK)

A 32-bit (IPv4) or 128-bit (IPv6) logical address representing a network endpoint. Routers read the network portion to forward packets across the global internet.

Example: 192.168.10.37/24 (Net: 192.168.10.0, Host: .37)

The End-to-End Addressing Flow:

Application Socket →NIC MAC (L2) →Logical IP (L3) →Subnet Mask →Network ID →Host ID →Routing / Delivery

02 · INTERACTIVE IP / NETWORK / HOST ID CALCULATOR BITWISE AND ENGINE

IPv4 ADDRESS

CIDR

/24 = 255.255.255.0

NETWORK ID—

HOST ID—

BROADCAST—

USABLE HOSTS—

FIRST VALID HOST—

LAST VALID HOST—

IP————

MASK (∧)————

NETWORK (=)————

WILDCARD————

How bitwise AND works: For each bit position, 1 AND 1 = 1; anything with 0 = 0. Where the mask bit is 1, the IP's bit passes straight through (Network ID). Where the mask bit is 0, the output is forced to 0. The remaining bits form the Host ID.

03 · LOCAL DELIVERY VS ROUTED GATEWAY DECISION L2/L3 DECISION LOGIC

💻

SOURCE
192.168.10.37

🔀

GATEWAY / ROUTER
192.168.10.0/24

🖥️

TARGET
192.168.10.20

IP PACKET

Analyze first. The lab will evaluate destination IP against source subnet mask to decide if ARP is broadcast locally or sent to default gateway.

Host Decision Logic:

          IF (Source_IP ∧ Mask) == (Target_IP ∧ Mask):

            → Target is LOCAL (ARP directly for Target MAC)

          ELSE:

            → Target is REMOTE (ARP for Default Gateway MAC, IP stays Target_IP)

04 · SUB NETTING MATHEMATICS & THE MAGIC NUMBER METHOD FAST CALCULATIONS

1. Fundamental Formulas

          • Total Addresses = 2h (where h = 32 − CIDR)

          • Usable Hosts = 2h − 2 (Subtract Net & Bcast)

          • Subnets Created = 2s (where s = borrowed bits)

          • Wildcard Mask = 255.255.255.255 − Subnet_Mask

2. The "Magic Number" (Block Size)

Find which octet the subnet boundary falls in (the interesting octet). Subtract that octet's mask value from 256.

          Example /26 (Mask 255.255.255.192):

          Block Size = 256 − 192 = 64

          Subnet boundaries: .0, .64, .128, .192

3. Fast Subnet Identifier

Given IP 10.20.30.75/26:
1. Block size = 64.
2. Multiples of 64: 0, 64, 128.
3. 75 falls between 64 and 127.
→ Network ID: 10.20.30.64
→ Broadcast: 10.20.30.127
→ Valid Range: 10.20.30.65 – 10.20.30.126

05 · VLSM (VARIABLE LENGTH SUBNET MASKING) ARCHITECTURE PLANNER NO ADDRESS WASTAGE

Why VLSM? Fixed-length subnetting forces every subnet to the same size. VLSM carves the largest requirement first, then divides remaining address blocks for smaller subnets.

Enterprise Allocation Request

BASE NETWORK ALLOCATION

1. Production Web Servers: Needs 50 hosts → Requires /26 (62 usable)
2. Corporate Office LAN: Needs 25 hosts → Requires /27 (30 usable)
3. Branch Management: Needs 10 hosts → Requires /28 (14 usable)
4. Router Point-to-Point Link: Needs 2 hosts → Requires /30 (2 usable)

Allocated Subnet Map

Click Compute to generate optimal VLSM partition map.

06 · RFC 1918 PRIVATE SPACES & RESERVED IP RANGES IANA SPECIFICATIONS

RFC 1918 (Non-Routable Private)

          • 10.0.0.0/8: 10.0.0.0 – 10.255.255.255 (16.7M IPs, Large Enterprise)

          • 172.16.0.0/12: 172.16.0.0 – 172.31.255.255 (1M IPs, Mid-size)

          • 192.168.0.0/16: 192.168.0.0 – 192.168.255.255 (65.5K IPs, Small/Home)

Special Purpose Ranges

          • 127.0.0.0/8: Loopback (127.0.0.1 localhost)

          • 169.254.0.0/16: APIPA / Link-Local (DHCP failure fallback)

          • 224.0.0.0/4: Multicast (OSPF, RIPv2, PIM)

          • 100.64.0.0/10: Carrier-Grade NAT (RFC 6598)

Why Private IPs Need NAT

Internet core routers (BGP) drop RFC 1918 traffic by policy. When an internal client communicates with the public web, the edge router uses NAT (Network Address Translation) or PAT (Port Address Translation) to map the private IP to an internet-routable public IP.

07 · HISTORICAL CLASSFUL NETWORKING (A, B, C, D, E) VS CLASSLESS CIDR HISTORICAL CONTEXT

In 1993, RFC 1519 introduced CIDR (Classless Inter-Domain Routing) to stop the rapid depletion of IPv4 addresses caused by rigid classful boundaries.

CLASS	FIRST OCTET (DEC)	LEADING BITS	DEFAULT MASK	DEFAULT CIDR	MAX NETWORKS	HOSTS PER NETWORK
A	1 – 126	0...	255.0.0.0	/8	126	16,777,214
B	128 – 191	10...	255.255.0.0	/16	16,384	65,534
C	192 – 223	110...	255.255.255.0	/24	2,097,152	254
D	224 – 239	1110...	—	—	Multicast Groups	—
E	240 – 255	1111...	—	—	Experimental / Reserved	—

08 · FULL CIDR REFERENCE TABLE (/8 TO /32) ENGINEERING LOOKUP

CIDR	SUBNET MASK	WILDCARD MASK	NET BITS	HOST BITS	TOTAL ADDRESSES	USABLE HOSTS

09 · SOC INCIDENT TELEMETRY & NETWORK MICRO-SEGMENTATION DEFENSIVE SECURITY

SOC Telemetry Stream (Internal Reconnaissance)

21:04:1110.10.20.44 begins host discovery.

21:04:14Multiple destinations inside 10.10.20.0/24.

21:04:18SYN sweep across 10.10.50.0/24 (PCI-DSS).

21:04:24Firewall drops unauthorized cross-subnet traffic.

Analyst Assessment: Subnetting divides broadcast domains. Without a routed boundary, an attacker at Layer 2 can ARP-spoof and sniff all local hosts. Subnetting + Layer 3 firewalls forces all cross-zone traffic through inspection policies.

Cyber Pressure Mission: Subnet Triage

MISSION ACTIVE

10 · CHECKPOINT MASTERY QUIZ & INSTANT DRILLS VERIFY KNOWLEDGE