ExamFinch.com My Study

Study guide

6.1 IPv4 Addressing

Practice this exam

U.S. Air Force Cyber Test CSAT/ICTL

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

1.1 Current Exam Facts 1.2 Cyber AFSCs & Qualification Pipeline 1.3 How to Use This Guide & Study Plan

2 Number Systems & Encoding

2.1 Binary & Decimal Conversion 2.2 Hexadecimal & ASCII 2.3 Bitwise Operations & Two's Complement

3 Computing Architecture

3.1 Memory Hierarchy 3.2 CPU, Components & Data Path 3.3 Core Data Structures

4 Boolean Logic & Storage

4.1 Boolean Algebra & Logic Gates 4.2 Encoding, Files & Storage Concepts

5 Networking Models

5.1 OSI Model 5.2 TCP/IP Model & Encapsulation 5.3 Topologies & Transmission Media

6 Addressing & Subnetting

6.1 IPv4 Addressing 6.2 Subnetting & CIDR 6.3 IPv6 Fundamentals

7 Protocols & Network Services

7.1 TCP, UDP & Well-Known Ports 7.2 DNS & DHCP 7.3 Routing & Switching Basics

8 Cybersecurity Foundations

8.1 CIA Triad & Security Goals 8.2 Threats, Vulnerabilities & Malware 8.3 Social Engineering & Human Factors

9 Defensive Controls

9.1 Access Control & Authentication 9.2 Firewalls, IDS & IPS 9.3 SIEM & Defense in Depth

10 Programming Fundamentals

10.1 Variables, Types & Operators 10.2 Control Flow 10.3 Functions & Recursion

11 Languages & Debugging

11.1 Python Essentials for the Cyber Test 11.2 C++ Basics & Debugging Concepts

12 Operating Systems

12.1 Linux Fundamentals & Commands 12.2 Windows Fundamentals 12.3 Processes, Permissions & File Systems

13 Cryptography

13.1 Symmetric Encryption (AES) 13.2 Asymmetric Crypto & PKI 13.3 Hashing, MACs & Integrity

14 ICTL-Style Logic Reasoning

14.1 Deductive Logic & Syllogisms 14.2 Sequences & Pattern Recognition 14.3 Arrangement & Conditional Puzzles

15 Test Strategy & Mixed Review

15.1 Pacing, Elimination & AF Testing Day 15.2 Mixed Domain Review & Next Steps

6.1 IPv4 Addressing

Key Takeaways Explain This Topic AI

An IPv4 address is a 32-bit value written as four decimal octets (0–255) separated by dots

A subnet mask or prefix length splits each address into a network portion and a host portion

Classful classes A/B/C used fixed first-octet ranges; modern networks use classless CIDR instead

Private RFC 1918 ranges are 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 — not routed on the public Internet

  • Special addresses include network, broadcast, loopback (127.0.0.0/8), and APIPA (169.254.0.0/16)
  • Last updated: July 2026

Every device that communicates on an IP network needs a unique Layer-3 address. On the Cyber Test, IPv4 addressing questions test whether you can read an address, interpret its mask, recognize private vs public space, and explain what the network and host portions mean. This section builds that foundation before you subnet in the next section.

What an IPv4 Address Is

An IPv4 address is a 32-bit binary number. Humans rarely write thirty-two zeros and ones, so we group the bits into four octets (8 bits each) and convert each octet to decimal. The familiar form is dotted-decimal notation :

192.168.10.45

Each octet ranges from 0 to 255 because 2⁸ = 256 possible values (0 through 255). If you see a number like 192.168.1.300 , it is not a valid IPv4 address — the last octet exceeds 255.

In binary, that same address looks like:

11000000.10101000.00001010.00101101

You do not need to convert every address on the exam, but you should be comfortable converting when a question gives binary or asks how many host bits remain after a mask.

Network Portion vs Host Portion

An IPv4 address alone does not tell a router which bits identify the network. That job belongs to the subnet mask (or its modern shorthand, the prefix length ).

  • Concept Role
  • Network bits Shared by all hosts on the same subnet; routers use them to forward toward that network
  • Host bits Unique to each device (or reserved for network/broadcast) within that subnet
  • Subnet mask 32-bit pattern of 1s (network) followed by 0s (host), e.g. 255.255.255.0
  • Prefix length Count of leading 1s in the mask, written as /24 for 255.255.255.0

Example: 192.168.10.45 with mask 255.255.255.0 ( /24 ) means:

  • Network portion: 192.168.10
  • Host portion: .45
  • Network address: 192.168.10.0
  • Broadcast address: 192.168.10.255

All hosts with addresses 192.168.10.1 through 192.168.10.254 (usable hosts on a /24) share the same Layer-3 subnet when that mask is used.

Classful Addressing (Historical Context)

Early IPv4 used classful addressing. The first octet determined the default mask:

  • Class First-octet range Default mask Prefix Intended use
  • A 1–126 255.0.0.0 /8 Huge networks
  • B 128–191 255.255.0.0 /16 Medium networks
  • C 192–223 255.255.255.0 /24 Small networks
  • D 224–239 n/a n/a Multicast
  • E 240–255 n/a n/a Experimental

Classful rules waste space: a Class A network "owns" 16 million-plus host addresses even if the organization needs a few thousand. Modern networks almost always use classless addressing (CIDR), where any prefix length is allowed — /20 , /27 , /30 , and so on — regardless of the first octet.

Exam tip: If a question mentions "Class C default mask," answer /24 or 255.255.255.0 . If it shows a non-default mask like 192.168.1.0/26 , treat it as classless and ignore the old class letter for host-count math.

Private Address Ranges (RFC 1918)

The Internet Assigned Numbers Authority reserved three IPv4 blocks for private (non-Internet-routable) use. Memorize them exactly:

  • Private block Prefix Approximate size
  • 10.0.0.0 – 10.255.255.255 10.0.0.0/8 16,777,216 addresses
  • 172.16.0.0 – 172.31.255.255 172.16.0.0/12 1,048,576 addresses
  • 192.168.0.0 – 192.168.255.255 192.168.0.0/16 65,536 addresses

Key points:

Private addresses can be reused inside different organizations.

A NAT (Network Address Translation) device or proxy typically translates private addresses to a public address when traffic leaves to the Internet.

172.15.0.1 is not private (it is below 172.16). 172.32.0.1 is also not private (it is above 172.31). Only 172.16 through 172.31 count.

Public addresses are globally unique and routable on the public Internet (subject to assignment by ISPs and registries).

Special and Reserved Addresses

Several patterns appear often on aptitude and networking questions:

  • Address / range Meaning
  • Network address All host bits 0 — identifies the subnet itself, not a host
  • Broadcast address All host bits 1 — delivers to every host on that subnet
  • 127.0.0.0/8 Loopback — traffic to 127.0.0.1 stays on the local machine
  • 169.254.0.0/16 APIPA / link-local — automatic address when DHCP fails
  • 0.0.0.0 "This host" / default route context (depends on usage)
  • 255.255.255.255 Limited broadcast (local network segment)
  • Worked recognition example

Host 10.20.30.40 with mask 255.255.0.0 ( /16 ):

  • Network: 10.20.0.0
  • Broadcast: 10.20.255.255
  • Usable hosts: 10.20.0.1 – 10.20.255.254
  • This address sits in the 10.0.0.0/8 private space
  • Why This Matters for Cyber Work

Cyber operators read packet captures, firewall rules, and access-control lists constantly. Misreading whether 172.20.5.9 is private, or treating a network address as a host, leads to broken filters and bad incident analysis. On the Cyber Test, expect identification questions ("which is private?") and structure questions ("what is the network address?") more than advanced routing theory.

Quick self-check

Convert the idea "first 24 bits are network" into mask 255.255.255.0 and prefix /24 .

Spot invalid octets (>255) and invalid private claims outside RFC 1918.

Separate classful history from classless reality used in modern subnetting.