Core concepts
- IPv4 addresses contain 32 bits and are commonly written as four decimal octets.
- Private ranges include 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16.
- CIDR notation such as /24 describes how many leading bits identify the network.
RR CYBERLAB • Networking
IP Addresses & Subnets
Understand IPv4 addressing, CIDR and the security value of knowing where a system sits on a network.
QUICK READ
An IP address identifies a network interface. A subnet defines the local address range. During an investigation, the source and destination IPs help establish who communicated with whom.
Use this page after the daily quiz: learn the concept first, then follow the investigation workflow and examples.
Security investigation workflow
- Identify source and destination IPs.
- Determine whether each address is internal, private, public, VPN, proxy or infrastructure.
- Resolve the asset owner and expected role.
- Check timing, frequency, destination port and related authentication or endpoint events.
- Compare the activity with the normal baseline before deciding it is suspicious.
Practical example
For 192.168.10.25/24, the network is 192.168.10.0, the broadcast is 192.168.10.255 and typical host addresses are 192.168.10.1–192.168.10.254. A connection from this workstation to an unfamiliar internal server should be investigated using the server role and surrounding telemetry.Common mistakes
- Treating every public IP as malicious.
- Assuming an internal IP is automatically trusted.
- Ignoring NAT, VPN or proxy infrastructure.
- Looking at a single connection without its time sequence.
Daily quiz hook
A workstation at 192.168.10.25 connects to an internal server. What should an analyst check first: the source/destination context, subnet, asset role and surrounding events.
Quiz flow: introduce this topic briefly on social media, ask the question, reveal the answer, then send learners here for the detailed investigation.
Analyst practice note
CIDR notation describes address ranges and helps analysts interpret whether a destination is local, routed, or part of a larger network. An address may be private, translated, shared, or reassigned, so connect it to a timestamp, device, and network boundary before attributing activity.
Map a synthetic source and destination to their fictional subnets, then identify the expected gateway and segment boundary. Do not infer a person or physical location from an IP address alone.
Continue practicing: open a fictional mission and test your reasoning against the simulated evidence.