YanoSec
Progress0 of 152 lessons complete

Course / 05 Networks / Lesson 02 of 09

MAC, IP, DHCP, and private ranges

Estimated time: 15 min reading · 15 min activity

The host table gives every device an address, but different addresses serve different jobs. An interface can have a link address for its local connection and an IP address used when communicating across networks. Do not treat every colon-separated value as the same kind of address.

MAC means Media Access Control. The MAC examples here are 48-bit link-interface identifiers written as six pairs of hexadecimal digits. IP means Internet Protocol. An IPv4 address contains 32 bits, commonly written as four decimal numbers separated by dots. Each number describes eight bits, called an octet.

The Code stage introduced bits, bytes and hex. Recall that eight bits can represent values 0 through 255; each IPv4 octet stays within that range. Two hex digits also describe eight bits, so the six pairs in these MAC examples describe 48 bits.

Before you begin

Estimated time
15 min reading, 15 min activity. Setup and optional practice may take longer.
Where you work
Use the supplied original network cards, packet tables and stream transcripts in any browser, including on a phone. You need no account, paid lab or live network access. Reading a saved file in Wireshark is optional; installation time is separate from the estimate. Optional challenges take about ten extra minutes.
Without a lab
The page prints every address, row and message needed for its activity. Follow the numbered steps in notes and label your conclusions as predictions or interpretations of supplied evidence. The pcapng files are synthetic, constructed examples; opening one is different from recording a network. Reading works without JavaScript. Answer checking needs JavaScript and a secure context, such as HTTPS. Saving correct progress also needs usable browser storage.

After this lesson you can:

  • Distinguish MAC, IPv4 and IPv6 notation on supplied cards.
  • Classify a supplied IPv4 value using the stated private ranges.
  • Explain the configuration and time limit in a fictional DHCP lease.

01Example

These fictional values show different address forms. The MAC uses a documentation range, and the IPv4 documentation address is reserved for examples. The classification is a hand reading of the card, not output from an interface command or a DHCP capture.

Link-interface example:
MAC 00-00-5E-00-53-0A
The colon form 00:00:5e:00:53:0a has the same 48 bits.

IPv4 private example:
10.8.0.4 belongs to the private 10.0.0.0/8 block.

IPv4 documentation example:
198.51.100.10 belongs to TEST-NET-2, not a private block.

02What each value is for

A link address helps identify an interface on its local link. An IP address supports delivery across networks. Neither address identifies a person by itself, and a host can have more than one interface or address. These examples are data to read, not values to copy onto a live interface.

A range is a block of addresses. Slash notation names how many leading bits define that block; those bits are its prefix. You will calculate prefix membership in the subnets lesson. For now, use these complete private ranges: 10.0.0.0 through 10.255.255.255; 172.16.0.0 through 172.31.255.255; and 192.168.0.0 through 192.168.255.255. Their shorthand is 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16.

Private addresses are set aside for use inside private networks and are not globally unique assignments. Private does not mean secret or safe. The documentation ranges 192.0.2.0/24, 198.51.100.0/24 and 203.0.113.0/24 are separately reserved for examples. They are not the three private blocks.

IPv6 is another IP version. Its text uses hexadecimal groups separated by colons. A double colon abbreviates one run of zero groups. You only need to recognize the supplied IPv6 form here; six two-digit MAC pairs and a compressed IPv6 address are different notations.

DHCP means Dynamic Host Configuration Protocol. It can provide a client with configuration such as an IP address, network prefix and router. A dynamic lease grants use of an address for a limited time. The fictional card assigns 10.8.0.20 for 3600 seconds, or one hour. Renewal can extend use; a later assignment can also differ. This card does not show a real DHCP exchange.

Align MAC notation, IPv4 reservation purpose and DHCP configuration with its time-limited lease.Model. A teaching model drawn by hand. It shows the idea, not real tool output.

Read the full explanation below.

Worked address and fictional lease fields

MAC 00-00-5E-00-53-0A
MAC 00:00:5e:00:53:0a
Private IPv4: 10.8.0.4 in 10.0.0.0/8
Documentation IPv4: 198.51.100.10 in TEST-NET-2
Lease address: 10.8.0.20
Prefix: 10.8.0.0/24
Router: 10.8.0.1
Lease: 3600 seconds
MAC hyphen formSame six MAC pairsPrivate blockDocumentation blockLeased addressLease prefixLease routerLease duration
What this part means

These punctuation/case forms name the same six pairs and 48 bits.

Notation changes do not change the address bits.

These punctuation/case forms name the same six pairs and 48 bits.

Follow the explanation

  1. These punctuation/case forms name the same six pairs and 48 bits.
  2. 10.8.0.4 is private; 198.51.100.10 is documentation TEST-NET-2, a different reservation purpose.
  3. Address, prefix and router are separate configuration fields in the fictional lease.
  4. 3600 seconds is one hour, not permanent address ownership.
Read every state and value

1. These punctuation/case forms name the same six pairs and 48 bits.

Selected parts
MAC hyphen form · Same six MAC pairs
Explanation
mac

2. 10.8.0.4 is private; 198.51.100.10 is documentation TEST-NET-2, a different reservation purpose.

Selected parts
Private block · Documentation block
Explanation
address-purpose

3. Address, prefix and router are separate configuration fields in the fictional lease.

Selected parts
Leased address · Lease prefix · Lease router
Explanation
configuration

4. 3600 seconds is one hour, not permanent address ownership.

Selected parts
Lease duration
Explanation
time
Align MAC notation, IPv4 reservation purpose and DHCP configuration with its time-limited lease.

03Classify a second card

The activity card uses a different MAC, private IPv4 value and documentation IPv4 value from the worked example. Compare complete dotted numbers with the printed ranges; a familiar beginning such as 172 is insufficient by itself.

Write the address type and its reason before uncovering the activity check. Then explain which lease fields describe network configuration and which describes time. All values are supplied, so you need no interface command or live network access.

Read different kinds of address

A bit has two values; an octet contains eight bits. IPv4 has four
8-bit octets written as decimal numbers from 0 through 255. The MAC
examples have six hex pairs, giving 48 bits. IPv6 uses longer hex
groups and can shorten one run of zero groups with ::.

Private IPv4 ranges, complete boundaries:
10.0.0.0 through 10.255.255.255       (10.0.0.0/8)
172.16.0.0 through 172.31.255.255     (172.16.0.0/12)
192.168.0.0 through 192.168.255.255   (192.168.0.0/16)
Private means reserved for private-network use, not secret or safe.
Documentation blocks are a different reservation for examples.

Original fictional cards. Not your computer's addresses. Not output from ip address.

Worked card
Kind            Value
MAC             00-00-5E-00-53-0A
IPv4 private    10.8.0.4
IPv4 document   198.51.100.10
IPv6 example    2001:db8:50::a

10.8.0.4 sits in 10.0.0.0/8, one of the three private blocks.
198.51.100.10 sits in 198.51.100.0/24, TEST-NET-2, a documentation block.
The MAC is a 48-bit documentation value for a link interface. It does not name a person.
The colon form 00:00:5e:00:53:0a is the same 48 bits. Letter case does not change the value.

Activity card
Kind     Value            Class on this card
MAC      00-00-5E-00-53-14  link interface
IPv4     172.16.8.4         private, inside 172.16.0.0/12
IPv4     203.0.113.8        documentation TEST-NET-3, not a private block
IPv6     2001:db8:40::14    IPv6 text, colons and hex, no arithmetic here

DHCP lease card, fictional
Client hint   desk
Assigned IPv4 10.8.0.20
Prefix        10.8.0.0/24
Router        10.8.0.1
Lease         3600 seconds
Dynamic allocation is for a limited time. A later lease can use another address.
This card is not a DHCP exchange and not a captured packet.

Predict before reading the check. Check: the private IPv4 on the activity card is 172.16.8.4.

Download the address cards

  1. Classify 00-00-5E-00-53-14 as a link-interface example.
  2. Classify 172.16.8.4 and 203.0.113.8. One sits in 172.16.0.0/12. The other is documentation TEST-NET-3.
  3. Check: the private IPv4 on the activity card is 172.16.8.4.
  4. Read the lease card as a fictional model. Do not run ip address and do not copy an address from your machine into the question.

04Optional challenge

Allow about ten extra minutes. Compare 00-00-5E-00-53-14 with 2001:db8:40::14. Explain how six hex pairs identify the MAC example while longer groups and :: identify the IPv6 example. Keep this as notation reading; IPv6 subnet arithmetic can wait.

05Fresh cases for the checks

Use these fictional cases for the checks below. They have different inputs from the worked examples. Read them here or make notes; no installation or external service is needed.

Address case AOwned fixture. An original file made for this course. Follow the activity's instructions in your own lab.

Value P: 00-00-5E-00-53-2B
Value Q: 172.32.6.9
Value R: 2001:db8:76::2b
Value S: 172.29.6.9
Private IPv4 ranges: 10.0.0.0–10.255.255.255; 172.16.0.0–172.31.255.255; 192.168.0.0–192.168.255.255.
MAC examples use six hex pairs. IPv4 uses four decimal octets. IPv6 uses longer hex groups and may contain ::.

Lease case B: independent configurationOwned fixture. An original file made for this course. Follow the activity's instructions in your own lab.

Assigned address: 10.24.6.44
Router: 10.24.6.1
Lease starts: 08:30 UTC
Lease length: 3600 seconds (one hour).
No renewal or later assignment is shown. Consider only the stated interval.
Method example on a DIFFERENT lease: 10:15 UTC plus one hour ends at 11:15 UTC.

06Explain your prediction

Optional written self-check: Name the notation, show whole-range comparisons and record address, router and lease time separately. A private range is neither a secrecy claim nor a permission grant.

07Common mistakes

If you call a documentation value private, compare it with the three stated private ranges. TEST-NET-3 is reserved for examples under a different rule.

If you think a lease means an address never changes, separate the address from its time limit. The card gives permission to use a configuration for a period, not a permanent identity.

If you compare 172 with the whole 172.16–172.31 range, read each complete octet instead. Type question addresses with the printed dots and no invented leading zeros.

References