Decode IPv4 bits, calculate CIDR boundaries, and distinguish private addressing from actual isolation.
45 min 135 XPSkills: IPv4 conversion, CIDR boundaries, Address classification
Brief
At Halcyon Clinics, a replacement scanner receives 172.32.8.70. The installation sheet calls every address beginning with 172 private, while the firewall request labels the scanner's /26 a Class C network. A reviewer approves the request without calculating either boundary. The address inventory and the rule scope now disagree with the intended design.
Your job is to translate address notation into testable facts: which bits identify a network, which addresses a rule includes, and whether an address is private or special-purpose. These facts support asset inventory and least-privilege network controls. An auditor needs the approved prefix, deployed interface configuration, and effective rules, not a reassuring label on a worksheet.
An address range describes scope. It does not prove isolation, authorisation, or encryption.
Four octets, thirty-two decisions
An IPv4 address contains 32 bits displayed as four eight-bit octets. Each octet ranges from 0 to 255 because eight bits provide 256 combinations. The positions in an octet have weights 128, 64, 32, 16, 8, 4, 2, 1. Thus 192 is 11000000 and 168 is 10101000: add only the weights whose bits are one. Decimal 256 cannot fit in an octet.
For 192.168.10.70, the last octet is 01000110: 64 + 4 + 2 = 70. Preserve all eight positions when doing mask calculations; omitting leading zeros can hide which bit crosses a prefix boundary. Dots separate display groups, not four independent network identifiers. A /26 boundary falls inside the last octet rather than between dots.
Inventory validation should reject malformed octets before generating rules. Retain the original source record and the validated address so a reviewer can trace a rejected entry. An auditor may ask whether the rule generator checks numerical addresses or merely accepts any string with three dots.
Dotted decimal and binary describe the same thirty-two bits.
CIDR is a bit boundary, not a class label
CIDR appends a prefix length: /26 means 26 network bits followed by six host bits. A subnet mask has contiguous ones followed by zeros, so /26 is 11111111.11111111.11111111.11000000, or 255.255.255.192. A mask with ones reappearing after zeros is not a valid CIDR mask. Historically, class A, B, and C unicast allocations used default /8, /16, and /24 boundaries; CIDR makes the explicit prefix authoritative instead of inferring a boundary from an address's leading bits.
Apply bitwise AND to 192.168.10.70 and its /26 mask: 01000110 AND 11000000 gives 01000000, decimal 64. The subnet is 192.168.10.64/26. Six host bits give 64 total addresses, ending at 192.168.10.127. In an ordinary broadcast subnet, .64 is the network address, .127 the broadcast, and .65 through .126 are 62 usable host addresses. The familiar subtract-two rule has exceptions: /31 point-to-point links use both addresses, and /32 denotes one address.
The four /26 blocks within 192.168.10.0/24 start at .0, .64, .128, and .192. Replacing a /26 rule with /24 therefore expands its scope fourfold. For least-privilege evidence, preserve the requested prefix and compare it with the deployed rule; ask whether a broader summary unintentionally permits adjacent segments. Same-subnet routing decisions also depend on the interface's configured prefix, not simply matching the first three octets.
A /26 selects one aligned block of sixty-four addresses, not an entire /24.
Private space has exact edges
RFC 1918 reserves three private blocks: 10.0.0.0/8 spans 10.0.0.0 through 10.255.255.255; 172.16.0.0/12 spans 172.16.0.0 through 172.31.255.255; 192.168.0.0/16 spans 192.168.0.0 through 192.168.255.255. For the /12 block, the second octet begins with binary 0001, leaving its last four bits variable. That produces second-octet values 16 through 31, not all 172 addresses.
Consequently 172.31.255.255 lies inside the private block, while 172.32.0.0 does not. Membership alone does not decide whether an address is assignable as a host; that still depends on its subnet. Nor does being outside RFC 1918 automatically mean an address is public or globally reachable: other special-purpose ranges exist, and routing and filtering also matter.
Private addresses are reusable across organisations and are not intended for global Internet routing. They can still communicate through internal routes, tunnels, or address translation. Private is not synonymous with trusted: segmentation needs explicit policy and enforcement. Evidence should pair the address plan with rule exports and connectivity tests; an auditor can ask how two private segments are prevented from reaching each other.
Loopback and link-local are not ordinary private leases
The loopback block is 127.0.0.0/8; 127.0.0.1 is only its most familiar member. Loopback traffic stays within the local host's network stack rather than reaching a remote machine. A service responding on loopback demonstrates local availability, not remote reachability. Binding a service only to loopback can limit exposure, but local processes may still access it.
IPv4 link-local uses 169.254.0.0/16 and is scoped to the local link; routers do not forward it as ordinary routed traffic. Automatic selection normally uses 169.254.1.0 through 169.254.254.255 and includes conflict detection. An unexpected link-local address on a managed endpoint may indicate failed dynamic configuration, but it is not proof of compromise and does not mean the interface has no address.
For availability and exposure reviews, collect the interface address and prefix, lease status, service listener bindings, and tests from the relevant network location. A successful test to 127.0.0.1 cannot close a finding about remote service access. An auditor should ask where a probe ran and whether its source and destination test the claimed control boundary.
Tasks
Answers are graded on the server: the answer key never reaches your browser.
Task 1: The inherited class label
Scenario sim+45 XP
Read the brief and answer both questions.
Incident brief
A scanner has 192.168.10.70/26. The installer calls it a Class C address and requests a 255.255.255.0 mask because 'three octets always identify the network'. The approved design explicitly requires /26; determine the mask and network address from that prefix, not the historical label.
1.1What dotted-decimal mask implements the approved prefix? (four decimal octets)
1.2What is the scanner's network address, without a prefix suffix? (four decimal octets)
Task 2: The private range expands on paper
Scenario sim+45 XP
Read the brief and answer both questions.
Incident brief
An inventory owner claims that 172.16.0.0/12 ends at 172.255.255.255 and therefore marks a new 172.32.8.70 endpoint private. The reviewer must record the actual upper boundary and the correct RFC 1918 block before accepting the classification.
2.1What is the highest address in the RFC 1918 block under discussion? (four decimal octets)
2.2What CIDR block should replace the owner's all-172 classification? (CIDR notation)
Task 3: Two reassuring but irrelevant tests
Scenario sim+45 XP
Read the brief and answer both questions.
Incident brief
After dynamic address configuration fails, an endpoint selects 169.254.12.8. A technician calls it an ordinary private lease and proves the remote service works by connecting to 127.0.0.1 on the same endpoint. The audit question concerns access from another routed subnet, not local process health.
The scanner inventory lists a host at 192.168.10.70/26, but the operator copied a /24 mask into the change request and marked private addressing as proof of isolation. The host and approved prefix are authoritative; the copied mask and security claim are not.
Complete the YAML with the approved prefix, exact subnet boundaries, ordinary broadcast-subnet host capacity, address category, and an evidence source that could substantiate the segmentation claim. The evidence field asks for the artefact type, not an invented filename.
A handover mixes calculations, legacy terminology, and service tests. Its author insists every confident statement can be accepted because the addresses look familiar.
Judge each claim exactly as written. Reject incorrect scope or arithmetic, but do not reject a correct statement just because it uses a special-purpose address.
Verdicts are accept or reject. Every rejection needs one reason code from: private-boundary | mask-mismatch | loopback-scope | link-local-scope.
Handover claims
IPV-1: 172.31.255.255 is inside RFC 1918 private space; that alone does not establish host assignability.
IPV-2: 172.32.0.1 is RFC 1918 private because every 172 address is private.
IPV-3: A /26 mask is 255.255.255.0.
IPV-4: Reaching 127.0.0.1 proves the service is reachable from another host.
IPV-5: 169.254.12.8 is an ordinary routed RFC 1918 address.
IPV-6: With an explicit /26, CIDR uses 26 network bits regardless of the historical class label.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
Checks
Every line in the fixture carries a verdict
Accept and reject land on the right lines
Each rejection cites a valid reason code
Next on your path · Networking Fundamentals
Subnetting in Depth
Calculate IPv4 boundaries, allocate unequal networks, and challenge unsafe route summaries with reproducible evidence.
