🌍 Module 05: IP Addressing, Subnetting, CIDR & NAT

Core Focus: IPv4 Classful vs Classless Addressing (CIDR), Mathematical Subnetting Step-by-Step, Private vs Public IP Ranges (RFC 1918), NAT & PAT (Port Address Translation) Table Mechanics, IPv6 Architecture, and AWS VPC Subnetting in Payment Gateways.

📑 Table of Contents

1. IPv4 Fundamentals & Structure
2. Classful Addressing (Legacy Architecture)
   • 2.1 Classes A, B, C, D, E Breakdown
   • 2.2 Why Classful Routing Failed (Address Exhaustion)
3. CIDR & Subnetting Mastery
   • 3.1 CIDR Prefix Notation (/n)
   • 3.2 The Subnetting Math Formula
   • 3.3 Step-by-Step Practical Calculation Example
4. Public vs Private IP Addresses (RFC 1918)
   • 4.1 The 3 Private IP Ranges
   • 4.2 Special IP Ranges (Loopback, APIPA, Default Route)
5. Network Address Translation (NAT & PAT)
   • 5.1 Static NAT vs Dynamic NAT vs NAPT / PAT
   • 5.2 Complete NAT Translation Table Trace
6. IPv6: The Next-Generation Internet Protocol
7. Juspay & Payment Systems Real-World Context
8. High-Yield Interview Questions & Verbatim Answers

1. IPv4 Fundamentals & Structure

An IPv4 Address is a 32-bit binary number divided into 4 octets (8 bits each), separated by dots:

Every IP address is divided into two logical sections: $$\text{IPv4 Address} = \text{Network ID (Routing Prefix)} + \text{Host ID (Specific Device)}$$

2. Classful Addressing (Legacy Architecture)

In the 1980s, the IPv4 space was partitioned into 5 fixed classes determined by leading bits:

2.1 Classes A, B, C, D, E Breakdown

2.2 Why Classful Routing Failed (Address Exhaustion)

• Extreme Inefficiency: An organization needing 500 IP addresses could not fit into a Class C block (254 max) and was assigned a Class B block (65,534 addresses), wasting 65,000+ public IP addresses.
• Global Table Bloat: Backbone routers had to hold hundreds of thousands of individual routes.
• Solution (1993): CIDR (Classless Inter-Domain Routing) and VLSM (Variable Length Subnet Masking) replaced fixed classes.

3. CIDR & Subnetting Mastery

3.1 CIDR Prefix Notation (/n)

Instead of fixed classes, a Subnet Mask of arbitrary prefix length /n defines how many bits belong to the Network ID:

$$\text{Total Bits} = 32 = n (\text{Network Bits}) + h (\text{Host Bits})$$ $$h = 32 - n$$

3.2 The Subnetting Math Formula

For any subnet /n:

1. Total Number of IP Addresses: $$\text{Total IPs} = 2^h = 2^{32 - n}$$
2. Number of Usable Host IPs: $$\text{Usable Hosts} = 2^h - 2 = 2^{32 - n} - 2$$ (Subtract 2 because the First IP is the Network ID and the Last IP is the Broadcast ID).
3. Block Size (Step Size in the relevant octet): $$\text{Block Size} = 256 - \text{Subnet Mask Value in Octet}$$

3.3 Step-by-Step Practical Calculation Example

Interview Problem: Given IP 192.168.1.130/27, calculate:

1. Subnet Mask
2. Total & Usable Hosts
3. Network ID
4. Broadcast ID
5. Usable Host Range

4. Public vs Private IP Addresses (RFC 1918)

To conserve IPv4 addresses, the IETF reserved three non-routable IP blocks for local internal private networks:

4.1 The 3 Private IP Ranges (RFC 1918)

[!NOTE] Private IP packets are strictly non-routable over the public internet. Internet backbone routers immediately drop any packet with a private destination IP.

4.2 Special IP Ranges

5. Network Address Translation (NAT & PAT)

NAT (Network Address Translation) allows hundreds of private devices inside a LAN to share a single public IPv4 address to access the internet.

5.1 NAT Variations:

1. Static NAT (1:1): Maps one private IP to one dedicated public IP (rare; used for public servers).
2. Dynamic NAT (M:N): Maps private IPs to a pool of public IPs on a first-come, first-served basis.
3. NAPT / PAT (Port Address Translation - M:1): The Universal Standard. Maps thousands of private IPs to a single public IP by multiplexing source TCP/UDP Port numbers.

5.2 Complete NAT Translation Table Trace

Suppose Laptop A and Laptop B on the same WiFi both open https://api.juspay.in simultaneously:

6. IPv6: The Next-Generation Internet Protocol

• Format: Written as 8 groups of 4 hexadecimal digits (hextets) separated by colons: 2001:0db8:85a3:0000:0000:8a2e:0370:7334
• Compression Rules:
  1. Omit leading zeros in any group: 0042 $\rightarrow$ 42.
  2. Replace consecutive groups of all zeros with a single :: (can only be done once per address): 2001:0db8:0000:0000:0000:0000:0000:0001 $\rightarrow$ 2001:db8::1
• Key Architectural Upgrades over IPv4:
  • No NAT Required: Every connected device (phone, smart toaster, laptop) can have a globally routable public IPv6 address.
  • No Broadcast: Replaced with efficient Multicast and Anycast.
  • Simplified Fixed Header: 40-byte fixed header structure allows faster router hardware switching.

7. Juspay & Payment Systems Real-World Context

1. Static Elastic IP Whitelisting for Bank Networks:
   • Partner banks (SBI, HDFC, ICICI) enforce strict enterprise firewall whitelisting.
   • All outbound payment requests originating from private microservices pass through a dedicated AWS NAT Gateway with a static public Elastic IP. Banks whitelist only this static IP.
2. VPC Peering & Transit Gateways:
   • Internal microservices communicate over non-overlapping private subnets (10.1.0.0/16 to 10.2.0.0/16) via encrypted AWS VPC Peering, ensuring cardholder data never touches the public internet.

8. High-Yield Interview Questions & Verbatim Answers

Q1: "How does NAPT / PAT allow multiple devices to share one public IP address?"

Spoken Answer:
"NAPT (Network Address Translation with Port Translation) multiplexes multiple private IP connections onto a single public IP address by tracking Layer 4 TCP and UDP port numbers.
When a device inside the private network (e.g., 192.168.1.10:54321) initiates an outbound connection, the NAT router rewrites the source IP to its own public IP (e.g., 203.0.113.5) and assigns a unique translated source port (e.g., 40001). It stores this mapping in its internal NAT state table.
When the destination server replies to 203.0.113.5:40001, the NAT router looks up the port in its state table, translates the destination back to 192.168.1.10:54321, and forwards the packet to the correct local device."

Q2: "What are the private IP ranges defined by RFC 1918? Why are they needed?"

Spoken Answer:
*"RFC 1918 defines three private, non-routable IP ranges:

• Class A: 10.0.0.0/8 (10.0.0.0 – 10.255.255.255 $\approx 16.7\text{M}$ addresses)
• Class B: 172.16.0.0/12 (172.16.0.0 – 172.31.255.255 $\approx 1\text{M}$ addresses)
• Class C: 192.168.0.0/16 (192.168.0.0 – 192.168.255.255 $\approx 65.5\text{K}$ addresses)

They are needed to prevent IPv4 address exhaustion by allowing organizations to reuse the same private IP address space internally across billions of local networks, while securing internal hosts from direct unsolicited inbound internet access."*

Q3: "Calculate the network address, broadcast address, and usable host count for 10.0.5.20/22."

Spoken Answer:
*"For prefix /22:

1. Host bits $h = 32 - 22 = 10$ bits.
2. Total IP capacity is $2^{10} = 1024$ addresses; Usable hosts = $1024 - 2 = \mathbf{1022}$.
3. Subnet mask is 255.255.252.0 (since $22 = 8 + 8 + 6 \implies 11111100_2 = 252$).
4. Block size in the 3rd octet is $256 - 252 = 4$.
5. The subnets in the 3rd octet increment in multiples of 4: 10.0.0.0, 10.0.4.0, 10.0.8.0.
6. Since the IP is 10.0.5.20, it falls within the 10.0.4.0 subnet.

Therefore:

• Network Address: 10.0.4.0
• Broadcast Address: 10.0.7.255
• Usable Host Range: 10.0.4.1 to 10.0.7.254"*