All-in-one IP monitor PRTG

IP stands for Internet Protocol and describes a set of standards and requirements for creating and transmitting data packets, or datagrams, across networks. The Internet Protocol (IP) is part of the Internet layer of the Internet protocol suite. In the OSI model, IP would be considered part of the network layer. IP is traditionally used in conjunction with a higher-level protocol, most notably TCP. The IP standard is governed by RFC 791.

How IP works

IP is designed to work over a dynamic network. This means that IP must work without a central directory or monitor, and that it cannot rely upon specific links or nodes existing. IP is a connectionless protocol that is datagram-oriented., so each packet must contain the source IP address, destination IP address, and other data in the header to be successfully delivered.

Combined, these factors make IP an unreliable, best effort delivery protocol. Error correction is handled by upper level protocols instead. These protocols include TCP, which is a connection-oriented protocol, and UDP, which is a connectionless protocol.

Most internet traffic is TCP/IP.

There are two versions of IP in use today, IPv4 and IPv6. The original IPv4 protocol is still used today on both the internet, and many corporate networks. However, the IPv4 protocol only allowed for 2³² addresses. This, coupled with how addresses were allocated, led to a situation where there would not be enough unique addresses for all devices connected to the internet.

IPv6 was developed by the Internet Engineering Task Force (IETF), and was formalized in 1998. This upgrade substantially increased the available address space and allowed for 2¹²⁸ addresses. In addition, there were changes to improve the efficiency of IP packet headers, as well as improvements to routing and security.

IPv4 addresses are actually 32-bit binary numbers, consisting of the two subaddresses (identifiers) mentioned above which, respectively, identify the network and the host to the network, with an imaginary boundary separating the two. An IP address is, as such, generally shown as 4 octets of numbers from 0-255 represented in decimal form instead of binary form.

For example, the address 168.212.226.204 represents the 32-bit binary number 10101000.11010100.11100010.11001100.

The binary number is important because that will determine which class of network the IP address belongs to.

An IPv4 address is typically expressed in dotted-decimal notation, with every eight bits (octet) represented by a number from one to 255, each separated by a dot. An example IPv4 address would look like this:

192.168.17.43

IPv4 addresses are composed of two parts. The first numbers in the address specify the network, while the latter numbers specify the specific host. A subnet mask specifies which part of an address is the network part, and which part addresses the specific host.

A packet with a destination address that is not on the same network as the source address will be forwarded, or routed, to the appropriate network. Once on the correct network, the host part of the address determines which interface the packet gets delivered to.

Subnet masks

A single IP address identifies both a network, and a unique interface on that network. A subnet mask can also be written in dotted decimal notation and determines where the network part of an IP address ends, and the host portion of the address begins.

When expressed in binary, any bit set to one means the corresponding bit in the IP address is part of the network address. All the bits set to zero mark the corresponding bits in the IP address as part of the host address.

The bits marking the subnet mask must be consecutive ones. Most subnet masks start with 255. and continue on until the network mask ends. A Class C subnet mask would be 255.255.255.0.

IP address classes

Before variable length subnet masks (introduced with RFC-1519 in 1993) allowed networks of almost any size to be configured regardless of the actual address, the IPv4 address space was broken into five classes as follows:

Class A 

In a Class A network, the first eight bits, or the first dotted decimal, is the network part of the address, with the remaining part of the address being the host part of the address. There are 128 possible Class A networks.

0.0.0.0 to 127.0.0.0

However, any address that begins with 127. is considered a loopback address.

Example for a Class A IP address:

2.134.213.2

Class B

In a Class B network, the first 16 bits are the network part of the address. All Class B networks have their first bit set to 1 and the second bit set to 0. In dotted decimal notation, that makes 128.0.0.0 to 191.255.0.0 as Class B networks. There are 16,384 possible Class B networks.

Example for a Class B IP address:

135.58.24.17

Class C

In a Class C network, the first two bits are set to 1, and the third bit is set to 0. That makes the first 24 bits of the address the network address and the remainder as the host address. Class C network addresses range from 192.0.0.0 to 223.255.255.0. There are over 2 million possible Class C networks.

Example for a Class C IP address:

192.168.178.1

Class D

Class D addresses are used for multicasting applications. Unlike the previous classes, the Class D is not used for "normal" networking operations. Class D addresses have their first three bits set to “1” and their fourth bit set to “0”. Class D addresses are 32-bit network addresses, meaning that all the values within the range of 224.0.0.0 – 239.255.255.255 are used to uniquely identify multicast groups. There are no host addresses within the Class D address space, since all the hosts within a group share the group’s IP address for receiver purposes.

Example for a Class D IP address:

227.21.6.173

Class E

Class E networks are defined by having the first four network address bits as 1. That encompasses addresses from 240.0.0.0 to 255.255.255.255. While this class is reserved, its usage was never defined. As a result, most network implementations discard these addresses as illegal or undefined. The exception is 255.255.255.255, which is used as a broadcast address.

Example for a Class D IP address:

243.164.89.28

Overview: IP address classes and bit-wise representations

Class A
  0.  0.  0.  0 = 00000000.00000000.00000000.00000000
127.255.255.255 = 01111111.11111111.11111111.11111111
                  0nnnnnnn.HHHHHHHH.HHHHHHHH.HHHHHHHH

Class B
128.  0.  0.  0 = 10000000.00000000.00000000.00000000
191.255.255.255 = 10111111.11111111.11111111.11111111
                  10nnnnnn.nnnnnnnn.HHHHHHHH.HHHHHHHH

Class C
192.  0.  0.  0 = 11000000.00000000.00000000.00000000
223.255.255.255 = 11011111.11111111.11111111.11111111
                  110nnnnn.nnnnnnnn.nnnnnnnn.HHHHHHHH

Class D
224.  0.  0.  0 = 11100000.00000000.00000000.00000000
239.255.255.255 = 11101111.11111111.11111111.11111111
                  1110XXXX.XXXXXXXX.XXXXXXXX.XXXXXXXX

Class E
240.  0.  0.  0 = 11110000.00000000.00000000.00000000
255.255.255.255 = 11111111.11111111.11111111.11111111
                  1111XXXX.XXXXXXXX.XXXXXXXX.XXXXXXXX

Private addresses

Within the address space, certain networks are reserved for private networks. Packets from these networks are not routed across the public internet. This provides a way for private networks to use internal IP addresses without interfering with other networks. The private networks are

10.0.0.1 - 10.255.255.255

172.16.0.0 - 172.31.255.255

192.168.0.0 - 192.168.255.255

Special addresses

Certain IPv4 addresses are set aside for specific uses:

IPv4 address exhaustion

The original IPv4 specification was designed for the DARPA network that would eventually become the internet. Originally a test network, no one contemplated how many addresses might be needed in the future. At the time, the 2³² addresses (4.3 billion) were certainly considered sufficient. However, over time, it became apparent that as currently implemented, the IPv4 address space would not be big enough for a worldwide internet with numerous connected devices per person. The last top-level address blocks were allocated in 2011. 

To avoid the seemingly reoccurring issue in technology, where a specification’s limitation seems more than sufficient at the time, but inevitably becomes too small, the designers of IPv6 created an enormous address space for IPv6. The address size was increased from 32 bits in IPv4 to 128 bits in IPv6.

The IPv6 has a theoretical limit of 3.4 x 10³⁸ addresses. That’s over 340 undecillion addresses, which is reportedly enough addresses to assign one to every single atom on the surface of the earth.

IPv6 addresses are represented by eight sets of four hexadecimal digits, and each set of numbers is separated by a colon. An example IPv6 address would look like this:

2DAB:FFFF:0000:3EAE:01AA:00FF:DD72:2C4A

IPv6 address abbreviation

With IPv6 addresses being so long, there are conventions to allow for their abbreviation. First, leading zeros from any one group of numbers may be eliminated. For example, :0033: can be written as :33:

Second, any consecutive sections of zeros can be represented by a double colon. This may be done only once in any address. The number of sections removed using this abbreviation can be determined as the number required to bring the address back up to eight sections. For example, 2DAB::DD72:2C4A would need to have five sections of zeroes added back in place of the double colon.

(2DAB:0000:0000:0000:0000:0000:DD72:2C4A)

The loopback address

0000:0000:0000:0000:0000:0000:0000:0001

may be abbreviated as ::1.

IPv6 private addresses

Like in IPv4 certain address blocks are reserved for private networks. These addresses are not routed over the public internet. In IPv6, private addresses are called Unique Local Addresses (ULA). Addresses from the FC00:: /7 block are ignored and not routed by default.

In both IPv4 and IPv6, remembering the IP address of every device is not possible, except on the smallest of networks. Name resolution provides a way to lookup an IP address from an easier to use name. 

On the internet, name resolution is handled by the Domain Name System (DNS). With DNS, a name in the format host.domain can be used in place of the destination’s IP address. When the connection is initiated, the source host will request the IP address of the destination host from a DNS server. The DNS server will reply with the destination’s IP address. This IP address will then be used for all communications sent to that name.