IP Addresses

Introduction to IP Addresses

An Internet Protocol (IP) address is a numerical identifier
assigned to a network interface so that devices can be identified and
communicate using the Internet Protocol.

When a computer, smartphone, server, printer, or other network-connected
device communicates across an IP network, IP addressing helps identify the
source and destination of the communication.

For a cyber security professional, understanding IP addresses is essential
because network logs, firewall events, intrusion detection alerts, server
logs, and other security records frequently contain IP addresses.

What Does an IP Address Do?

An IP address helps identify where network traffic is coming from and where
that traffic is intended to go.

Consider a simple communication:

Computer A
192.168.1.10
     |
     |  Request
     v
Server B
192.168.1.20

The IP addresses provide addressing information that allows the network to
deliver packets toward the intended destination.

IPv4

IPv4 is the most widely recognized version of the Internet
Protocol. An IPv4 address consists of 32 bits and is normally written as four
decimal numbers separated by periods.

Example:

192.168.1.10

Each decimal section is called an octet. Each octet can
represent a value from 0 through 255.

Another example is:

10.20.30.40

IPv4 Address Structure

An IPv4 address contains 32 binary bits.

For example:

192.168.1.10

Binary representation:

11000000.10101000.00000001.00001010

The address is used together with a subnet mask or prefix length to determine
which part identifies the network and which part identifies a host within
that network.

Private IPv4 Addresses

Certain IPv4 ranges are reserved for private networks. Private addresses are
commonly used inside homes, schools, businesses, laboratories, and other
internal networks.

The commonly used private IPv4 ranges are:

• 10.0.0.0/8
• 172.16.0.0/12
• 192.168.0.0/16

For example:

192.168.1.10
192.168.1.20
10.0.0.5
172.16.20.15

These addresses are commonly used internally and are not directly routable
as public internet addresses.

Public IP Addresses

A public IP address is an address used for communication
across networks where globally routable addressing is required.

Internet-facing servers, routers, and other systems may use public IP
addresses depending on their architecture.

A public IP address can be visible to external systems communicating with a
service, although the exact network architecture may involve NAT, proxies,
load balancers, VPNs, or other intermediary systems.

Static IP Address

A static IP address is configured so that the address remains
consistent unless an administrator changes it.

Static addressing can be useful for systems that need predictable network
addresses, such as:

• Servers
• Network appliances
• Printers
• Infrastructure devices

Dynamic IP Address

A dynamic IP address is assigned automatically, commonly
through DHCP.

Dynamic addressing reduces the need to manually configure every device on a
network.

For example, when a laptop joins a home Wi-Fi network, the router or DHCP
server may automatically assign an address such as:

192.168.1.25

Default Gateway

A default gateway is the network device that a host normally
uses when it needs to communicate with destinations outside its local network.

In a typical home or small-office network, the default gateway is often the
local router.

Example:

Computer
IP:       192.168.1.25
Gateway:  192.168.1.1

If the computer wants to communicate with a remote internet server, it can
send the traffic toward the default gateway.

Subnet Mask

A subnet mask helps determine which portion of an IPv4
address represents the network and which portion represents hosts within that
network.

Example:

IP Address:
192.168.1.25

Subnet Mask:
255.255.255.0

This configuration is commonly represented using CIDR notation as:

192.168.1.25/24

The /24 indicates that the first 24 bits are associated with
the network prefix.

What Is a Subnet?

A subnet is a logically divided portion of an IP network.
Subnetting can help organizations organize devices, control traffic, and
use address space efficiently.

For example, an organization could separate different groups into different
network segments:

• Administration
• Students
• Servers
• Guest devices
• Security infrastructure

Why Subnetting Matters in Cyber Security

Subnetting can support network segmentation.

For example, if guest devices are placed on a separate network from internal
servers, security policies can restrict unnecessary communication between the
two networks.

             Router / Firewall
                    |
          +---------+---------+
          |                   |
          v                   v
     Staff Network       Guest Network
     192.168.10.0/24     192.168.20.0/24
          |                   |
       Servers              Visitors

IPv6

IPv6 is the newer version of the Internet Protocol.
It was developed in part to provide a much larger address space than IPv4.

IPv6 addresses use 128 bits and are normally written using hexadecimal
characters separated by colons.

Example:

2001:db8:1234:5678::1

The notation can be shortened using rules that allow groups of zeros to be
compressed.

IPv4 vs IPv6

Loopback Address

A loopback address allows a device to communicate with
itself through the network stack.

The most familiar IPv4 loopback address is:

127.0.0.1

It is commonly associated with the hostname:

localhost

For example, a developer may run a website on a local computer and access it
through:

http://127.0.0.1

Link-Local Addressing

IPv4 and IPv6 have mechanisms for local communication when normal network
configuration is unavailable or when certain network conditions require
local addressing.

A common IPv4 link-local range is:

169.254.0.0/16

An address in this range can indicate that a device did not obtain its normal
IPv4 configuration through DHCP, although the exact cause must be investigated
using the network environment and configuration.

Network Address and Broadcast Address

In traditional IPv4 subnetting, an address can identify the network itself,
while another address can be used for broadcast communication within the
subnet.

For example, in:

192.168.1.0/24

the network address is:

192.168.1.0

and the traditional broadcast address is:

192.168.1.255

The usable host range in this common example is:

192.168.1.1
through
192.168.1.254

IP Addresses in Security Logs

Security systems frequently record IP addresses.

A firewall log might contain information such as:

Source IP:      192.168.1.50
Destination IP: 203.0.113.20
Protocol:       TCP
Destination:    443
Action:         ALLOW

An analyst can use this information to investigate communication between a
source and destination.

However, an IP address alone does not necessarily identify a particular person.
Addresses can be shared, dynamically assigned, translated through NAT, or
associated with infrastructure such as proxies and VPN services.

NAT and IP Addresses

Network Address Translation (NAT) allows network devices to
translate addresses between different network contexts.

A common example is a home router translating private addresses into a public
address when devices access the internet.

Laptop
192.168.1.10
      |
      v
Home Router
      |
      | NAT
      v
Public Network

This means that several devices using private addresses can share a public
internet connection through a router.

IP Address Discovery

On a computer, administrators can inspect IP configuration using operating
system networking tools.

On Windows, a commonly used command is:

ipconfig

A more detailed Windows command is:

ipconfig /all

On Linux, common commands include:

ip addr

and:

ip route

These commands are useful for legitimate administration and troubleshooting.

Testing Network Connectivity

The ping utility can be used to test IP connectivity using
ICMP echo messages where permitted.

For example:

ping 192.168.1.1

A response may indicate that the destination is reachable and responding to
the relevant traffic, but a lack of response does not by itself prove that a
host is offline because firewalls and network policies can block ICMP.

IP Addresses and Cyber Security

Cyber security professionals encounter IP addresses in many areas, including:

• Firewall logs
• Web server logs
• DNS logs
• VPN logs
• Intrusion detection systems
• Security information and event management systems
• Network monitoring systems
• Incident response investigations

Example Security Investigation

Suppose a server log contains repeated connection attempts from an unfamiliar
IP address.

A security analyst should not automatically conclude that the source is
malicious solely because the address is unfamiliar.

The analyst can investigate:

1. What service was contacted?
2. Which port was targeted?
3. How many attempts occurred?
4. Were the connections successful?
5. What time did the activity occur?
6. Was the source address expected?
7. Are there related events in firewall or application logs?
8. Does the activity match an authorized test or business process?

This approach demonstrates why IP addresses are useful evidence but should be
considered together with other network and security information.

Practical Exercise

On an authorized computer or laboratory machine, identify:

• IPv4 address
• IPv6 address, if configured
• Default gateway
• DNS server
• Network interface

Windows users can begin with:

ipconfig /all

Linux users can begin with:

ip addr
ip route

Do not scan or probe systems that you do not own or have explicit permission
to test.

Code Example: PHP IP Information

<?php

$server_ip = $_SERVER['SERVER_ADDR'] ?? 'Unknown';
$client_ip = $_SERVER['REMOTE_ADDR'] ?? 'Unknown';

echo "Server IP: " . htmlspecialchars($server_ip, ENT_QUOTES, 'UTF-8') . "<br>";
echo "Client IP: " . htmlspecialchars($client_ip, ENT_QUOTES, 'UTF-8');

?>

This PHP example demonstrates how a web application can access IP-related
request information. The result should not be treated as proof of a user’s
identity because network architectures can involve proxies, NAT, VPNs, and
other intermediaries.

Important Security Reminder

IP addresses are network identifiers, not automatic proof of identity,
ownership, intent, or malicious activity.

Responsible cyber security analysis combines IP information with timestamps,
ports, protocols, authentication records, application logs, network topology,
and other relevant evidence.

Lesson Summary

An IP address provides addressing information for communication across
Internet Protocol networks. IPv4 uses 32-bit addresses, while IPv6 uses
128-bit addresses.

IP addresses may be public or private and may be assigned statically or
dynamically. Subnet masks and prefixes help define network boundaries, while
default gateways provide a path toward other networks.

For cyber security professionals, IP addresses are important when analyzing
network traffic, firewall events, server logs, incident reports, and
connectivity problems.