Networking › Module 2 › Lesson 1
IPv4 Addressing
Understand IPv4 format, dotted decimal notation, and what an IP address identifies
Opening
An IP is a location on a network — not a name badge and not a password.
Module 1 taught you where a packet lives in the stack. This module names the Layer-3 label those packets carry: the IPv4 address. Firewall logs, DHCP leases, and "who connected to the VPN?" questions all collapse if you cannot read that label. Beginners treat an IP as identity ("it was Bob") or as a secret ("hide 192.168.1.10 like a credential"). Both fail. An address identifies an interface on a network at a moment in time. It can be reused, NAT-hidden, or spoofed. You will learn the format first, then what it is not.
1. 32 bits, four octets, one interface — not one human
IPv4 is a 32-bit number. Humans write it in dotted decimal: four octets (8-bit groups) separated by dots, each octet 0–255. 192.168.1.50 is easier than 11000000.10101000.00000001.00110010. The network still uses the bits. If any octet is 256 or contains a letter, it is not IPv4. That range exists because 2^8 = 256 possible values per octet — 0 through 255 inclusive.
What it identifies is an interface, not a building and not a person. One laptop can hold several IPv4 addresses at once: 127.0.0.1 on lo, a LAN address on eth0, a VPN address on tun0. Logs that say "the IP" without the iface or the time are incomplete. DHCP can hand a different number tomorrow. A MAC (Layer 2) is a different label on the same NIC — you already saw both in ip addr. Do not collapse them.
Part of the 32 bits names the network; the rest names the host on that network. The split is the subnet mask / CIDR, which is the next lesson. For now hold the idea: 192.168.1.50 and 192.168.1.80 can be neighbors on the same LAN, while 192.168.2.50 may be a different network even if the first three numbers "look close." Without the mask, you cannot know. That is why ip addr prints 192.168.1.50/24, not a bare host number.
Unicast is the normal case: this packet is for one interface. 127.0.0.1 (and the rest of 127.0.0.0/8) is loopback — this host talking to itself, never a neighbor. 255.255.255.255 is limited broadcast: conceptually "every host on this local segment," used by some local discovery; routers do not forward it onto the internet. 0.0.0.0 is context: in a listen address it often means "all IPv4 interfaces"; as a source it can mean "I do not have an address yet." Those three are not "mystery IPs." They are different jobs.
2. What an IPv4 address is not
It is not a password, API key, or proof of identity. Anyone can claim a source IP (spoofing on some paths); many users share one public IP through NAT (next lessons). It is not a MAC. It is not a hostname (DNS maps names to IPs in the next module). It is not "the laptop" forever — laptops roam. SOC value is correlation: this address, this time, this interface, this log source — then you still need authentication events to name a human.
It is also not automatically "the attacker." Malware on an internal host, a NAT gateway, a VPN egress, and a compromised cloud VM can all appear as a source IP. Treating the first number in a log as a moral verdict is how teams block their own CDN or their own users. Read the address; then ask which network it belongs to. That question is subnetting and public vs private — coming next.
3. Wrong vs right: copying the first inet you see
Worked failure mode — first ip addr. Stay on YOUR VM or WSL:
Wrong
You copy 127.0.0.1 into a "my IP" note and tell a teammate to SSH there. Or you paste every address into a public Discord as if it were a trophy. Or you treat 192.168.1.1 as a secret password. Or you scan the LAN to "find all IPv4 identities."
Right
Ignore lo when you need a LAN address. Record iface + inet CIDR from ip addr on a machine you own. Treat the number as a locator, not a credential and not a person. Do not probe other people's hosts to build your list.
4. Practical: read YOUR IPv4 on this machine
ip addr is an inventory of interfaces you already have. You are not discovering a target list. Write loopback vs a real inet, and one sentence on what the number is not.
Command guide
IPv4 inventory on your VM / WSL only
YOUR Linux VM, WSL, or spare box
Command — copy this
ip addr ip -br addr
Optional command
Find:
inet 127.0.0.1/8 → loopback (this host, not the LAN) inet a.b.c.d/NN → unicast IPv4 on a real iface (NN is CIDR; next lesson) link/ether → MAC (Layer 2), not an IP
Optional identity of the OS — still this machine
Command — copy this
cat /etc/os-release
NEVER: scan the LAN for "more IPs" NEVER: treat an address as a password or as proof of who a human is
Mission: three addresses, three jobs
On your own VM or WSL, run ip addr (or ip -br addr). Write: (1) loopback inet, (2) one non-lo IPv4 CIDR and its iface name, (3) one sentence: "This IP locates an interface; it is not a password and not a person." Do not scan other hosts. Do not add or flush addresses.
Stuck? Ask Cyberlium AI Mentor
If 127.0.0.1 and your LAN inet still feel interchangeable, ask Cyberlium AI Mentor for a hint — not a scan plan. Try: "Hint only: why would SSH to 127.0.0.1 never reach my teammate's VM?" Answer in your own words.
Module 1 gave you layers and hops. You can now read dotted decimal, separate unicast from loopback and broadcast, and refuse to treat an IP as a password or a person. Next up — Subnetting Basics — one worked /24 versus /26 so you can see where the network ends, where broadcast lives, and how many hosts fit.
Knowledge Check
APPLY: ip -br addr on your VM shows lo UP 127.0.0.1/8 and ens33 UP 192.168.56.10/24. A classmate asks for "the IP" to SSH from another VM on that host-only LAN. What do you send?
Multiple choice
Knowledge Check
APPLY: An intern stores the office printer IPv4 in a password manager "because IPs are credentials." Best correction?
Multiple choice
Knowledge Check
APPLY: True or False: Seeing 10.0.0.5 in a firewall log proves the human named on the DHCP reservation pressed the keys, the same way a password would.
True or False