IP Addresses & CIDR

1. What Is It?

An IP address is a numerical label assigned to every device on a network. IPv4 addresses are 32 bits written as four decimal octets (192.168.1.10); IPv6 addresses are 128 bits written in hex (2001:db8::1). They are how routers decide where to send packets — every connection you make includes a source IP and destination IP.

CIDR (Classless Inter-Domain Routing) is notation for expressing a range of IP addresses using a base address and a prefix length: 10.0.0.0/16 means "all IPs from 10.0.0.0 to 10.0.255.255." This matters to SDEs because cloud VPCs, security group rules, subnets, and firewall configs are all expressed in CIDR. Misreading a CIDR block is a common source of connectivity bugs and unintended network exposure.

2. How It Works

The prefix length (the /N part) tells you how many bits are fixed. The remaining bits are the "host" portion — all combinations are valid addresses in that range.

Subnet mask is the same concept in dot-decimal form: /24 = 255.255.255.0. You'll see both in configs.

Private vs. public IP ranges (RFC 1918 — these are never routed on the public internet):

• 10.0.0.0/8
• 172.16.0.0/12 (covers 172.16.0.0 – 172.31.255.255)
• 192.168.0.0/16

-+ResetFullscreen

Concrete example — AWS VPC: When you create a VPC with CIDR 10.0.0.0/16, you have 65,536 addresses to carve into subnets. A public subnet might be 10.0.1.0/24 (256 addresses) and a private subnet 10.0.2.0/24. When you add a security group rule allowing inbound traffic from 10.0.0.0/16, you're saying "any IP inside the VPC can reach this resource."

3. What SDEs Actually Need to Know

Reading CIDR in security configs:

• 0.0.0.0/0 means "all IPv4 addresses" — the most permissive rule. If your database security group has this as an ingress rule on port 5432, anyone on the internet can attempt a connection.
• 10.0.0.0/8 means "any RFC 1918 IP starting with 10" — typical for intra-VPC communication.
• /32 means a single specific IP — used to whitelist your office IP or a specific service.

Subnet sizing considerations:

• AWS and GCP reserve the first 4 and last 1 addresses in each subnet for network management. A /24 subnet gives you 251 usable host addresses, not 256.
• Plan for growth: a /28 (14 usable IPs) fills up fast if you're running ECS tasks or Lambda in a VPC.

Loopback and special addresses:

• 127.0.0.1 (or ::1 in IPv6) is loopback — traffic to it never leaves the host. localhost resolves to this by default.
• 0.0.0.0 in a bind address means "listen on all interfaces." In a Docker container, if your service binds to 127.0.0.1 only, it's unreachable from outside the container.

IPv6 basics:

• ::1 is loopback
• ::/0 is the IPv6 equivalent of 0.0.0.0/0
• Many cloud services now dual-stack (IPv4 + IPv6). Your security rules may need to handle both.

4. Tradeoffs & Decisions

VPC CIDR selection: Pick a large private range upfront (10.0.0.0/16 or larger). Changing VPC CIDR later requires tearing down and recreating the VPC — a painful migration. The tradeoff is that overlapping CIDRs between peered VPCs prevent peering, so coordinate across teams.

Public subnet vs. private subnet:

• Resources in public subnets get a public IP and are directly reachable from the internet (with appropriate security group rules).
• Resources in private subnets need a NAT gateway to initiate outbound internet connections but cannot receive inbound connections from outside. Use for databases, internal services, workers.
• NAT gateways cost money (AWS charges per hour + per GB of data). A common architecture mistake is routing all traffic through a NAT gateway unnecessarily.

IPv4 vs. IPv6:

• IPv4 addresses are scarce and allocated via NAT. IPv6 provides ~340 undecillion addresses with no NAT needed.
• IPv6 adoption is real but inconsistent. Most production infrastructure still runs dual-stack for compatibility.

5. Interview Cheat Sheet

Key sentences:

• "CIDR notation describes a range of IPs with a base address and a prefix length; /24 means 256 addresses, /16 means 65,536."
• "RFC 1918 defines private IP ranges (10.x, 172.16–31.x, 192.168.x) that are never routed on the public internet — NAT translates between them and public IPs."
• "In a cloud VPC, 0.0.0.0/0 in a security rule means 'any IP' — it's the most permissive ingress setting and the one most likely to create unintended exposure."
• "A service binding to 127.0.0.1 is reachable only from the same machine; binding to 0.0.0.0 accepts connections on all interfaces."

Common follow-ups:

Q: What's the difference between a public and private subnet in AWS? A: A public subnet has a route to an Internet Gateway, so instances can receive traffic from and send traffic to the public internet (with a public IP). A private subnet routes outbound internet traffic through a NAT Gateway but has no inbound route — instances are not directly reachable from outside.

Q: How do overlapping CIDRs cause problems? A: When two networks share a CIDR range (e.g., both use 10.0.0.0/16), routers can't distinguish which network an IP belongs to. VPC peering and VPN connections fail if the address spaces overlap, because the routing table can't determine where to send packets.