1. What Is It?
An IP address is a numerical label assigned to every device on a network. IPv4 addresses are 32 bits written as four decimal octets (192.168.1.10); IPv6 addresses are 128 bits written in hex (2001:db8::1). They are how routers decide where to send packets — every connection you make includes a source IP and destination IP.
(Classless Inter-Domain Routing) is notation for expressing a range of IP addresses using a base address and a prefix length: 10.0.0.0/16 means "all IPs from 10.0.0.0 to 10.0.255.255." This matters to SDEs because cloud VPCs, security group rules, subnets, and firewall configs are all expressed in . Misreading a CIDR block is a common source of connectivity bugs and unintended network exposure.
2. How It Works
The prefix length (the /N part) tells you how many bits are fixed. The remaining bits are the "host" portion — all combinations are valid addresses in that range.
| CIDR | Fixed bits | Host bits | Address count | Range |
|---|---|---|---|---|
/32 | 32 | 0 | 1 | Single host |
/24 | 24 | 8 | 256 | x.x.x.0 – x.x.x.255 |
/16 | 16 | 16 | 65,536 | x.x.0.0 – x.x.255.255 |
/8 | 8 | 24 | 16,777,216 | x.0.0.0 – x.255.255.255 |
Subnet mask is the same concept in dot-decimal form: /24 = 255.255.255.0. You'll see both in configs.
Private vs. public IP ranges (RFC 1918 — these are never routed on the public internet):
10.0.0.0/8172.16.0.0/12(covers172.16.0.0–172.31.255.255)192.168.0.0/16
Concrete example — AWS :
When you create a with 10.0.0.0/16, you have 65,536 addresses to carve into subnets. A public subnet might be 10.0.1.0/24 (256 addresses) and a private subnet 10.0.2.0/24. When you add a security group rule allowing inbound traffic from 10.0.0.0/16, you're saying "any IP inside the VPC can reach this resource."
Read a subnet from its prefix
A /24 prefix fixes 24 IPv4 bits and leaves 8 host bits, giving 256 addresses in the subnet.
Slash twenty-four fixes the first three octets, so every address in this range starts with ten dot zero dot one.
Text version
- Slash twenty-four fixes the first three octets, so every address in this range starts with ten dot zero dot one.
- IPv4 has thirty-two bits, so eight bits remain for the host portion.
- Those eight bits give two hundred fifty-six total addresses, before any addresses are reserved for network management.
- The first three octets stay fixed while the last octet ranges from zero to two hundred fifty-five.
You are configuring a security group rule for a database server inside an AWS VPC with CIDR 10.0.0.0/16. You want to allow inbound connections only from application servers in the 10.0.2.0/24 subnet. How many IP addresses does the source CIDR 10.0.2.0/24 cover?
3. What SDEs Actually Need to Know
Reading in security configs:
0.0.0.0/0means "all IPv4 addresses" — the most permissive rule. If your database security group has this as an ingress rule on port 5432, anyone on the internet can attempt a connection.10.0.0.0/8means "any RFC 1918 IP starting with 10" — typical for intra- communication./32means a single specific IP — used to whitelist your office IP or a specific service.
Subnet sizing considerations:
- AWS reserves the first 4 and last 1 addresses in each subnet (GCP reserves the first 2 and last 2 of a primary range). A
/24subnet gives you 251 usable host addresses on AWS (252 on GCP), not 256. - Plan for growth: a
/28(11 usable IPs on AWS) fills up fast if you're running ECS tasks or Lambda in a .
Loopback and special addresses:
127.0.0.1(or::1in IPv6) is loopback — traffic to it never leaves the host.localhostresolves to this by default.0.0.0.0in a bind address means "listen on all interfaces." In a Docker container, if your service binds to127.0.0.1only, it's unreachable from outside the container.
IPv6 basics:
::1is loopback::/0is the IPv6 equivalent of0.0.0.0/0- Many cloud services now dual-stack (IPv4 + IPv6). Your security rules may need to handle both.
Read the scope of an ingress rule
An IPv4 /0 rule allows every source address, 10.0.0.0/8 limits the range, and /32 selects one specific IP.
A slash zero database ingress rule permits connection attempts from any IPv4 source on the allowed port.
Text version
- A slash zero database ingress rule permits connection attempts from any IPv4 source on the allowed port.
- Ten slash eight matches every private address that starts with ten, a common choice for internal traffic.
- A slash thirty-two rule selects one specific IP, such as an office address you want to allow.
A backend service running inside a Docker container binds to 127.0.0.1 on port 8080. When another container tries to reach it over the Docker network, the connection is refused. What is the most likely cause?
4. Tradeoffs & Decisions
selection:
Pick a large private range upfront (10.0.0.0/16, the largest block AWS allows). You can add secondary blocks later, but you can't resize or replace the primary block without recreating the — a painful migration. The tradeoff is that overlapping CIDRs between peered VPCs prevent peering, so coordinate across teams.
Public subnet vs. private subnet:
- Resources in public subnets that have a public IP (auto-assigned or an Elastic IP) are directly reachable from the internet (with appropriate security group rules).
- Resources in private subnets need a gateway to initiate outbound internet connections but cannot receive inbound connections from outside. Use for databases, internal services, workers.
- gateways cost money (AWS charges per hour + per GB of data). A common architecture mistake is routing all traffic through a NAT gateway unnecessarily.
IPv4 vs. IPv6:
- IPv4 addresses are scarce, so networks share them via NAT. IPv6 provides ~340 undecillion addresses with no NAT needed.
- IPv6 adoption is real but inconsistent. Most production infrastructure still runs dual-stack for compatibility.
Follow private subnet internet traffic
A service in a private subnet initiates outbound internet connections through a NAT gateway, which adds cost.
An internal service in a private subnet sends outbound internet traffic through a NAT gateway.
Text version
- An internal service in a private subnet sends outbound internet traffic through a NAT gateway.
- This NAT path lets the service reach the internet but blocks unsolicited inbound connections.
- AWS charges for NAT gateways by time and data volume, so unnecessary NAT traffic adds cost.
Your team is deploying a fleet of background worker services that need to pull jobs from an external API over the internet, but should never accept inbound connections from outside your network. Which subnet placement strategy best fits this requirement, and what is a key cost consideration?
5. Interview Cheat Sheet
Key sentences:
- " notation describes a range of IPs with a base address and a prefix length;
/24means 256 addresses,/16means 65,536." - "RFC 1918 defines private IP ranges (
10.x,172.16–31.x,192.168.x) that are never routed on the public internet — translates between them and public IPs." - "In a cloud ,
0.0.0.0/0in a security rule means 'any IP' — it's the most permissive ingress setting and the one most likely to create unintended exposure." - "A service binding to
127.0.0.1is reachable only from the same machine; binding to0.0.0.0accepts connections on all interfaces."
Common follow-ups:
Q: What's the difference between a public and private subnet in AWS? A: A public subnet has a route to an Internet Gateway, so instances can receive traffic from and send traffic to the public internet (with a public IP). A private subnet routes outbound internet traffic through a Gateway but has no inbound route — instances are not directly reachable from outside.
Q: How do overlapping CIDRs cause problems?
A: When two networks share a range (e.g., both use 10.0.0.0/16), routers can't distinguish which network an IP belongs to. peering and VPN connections fail if the address spaces overlap, because the routing table can't determine where to send packets.