What is an IP address? Explain IPv4 vs IPv6, private vs public ranges, subnets and CIDR notation, and NAT, with examples from cloud or container networking.

1. Reading a CIDR block

10.0.1.0/24

00001010 . 00000000 . 00000001 . 00000000
└───────── network (24 bits) ─────────┘ └ host (8) ┘

range: 10.0.1.0 – 10.0.1.255
mask:  255.255.255.0

Two hosts are on the same subnet if their network bits match; otherwise traffic goes via a router (the default gateway).

2. NAT

laptop 192.168.1.20:51544 ──► home router ──► 203.0.113.7:40001 ──► server 198.51.100.5:443
                              (rewrites source, remembers the mapping)
reply 198.51.100.5:443 ──► 203.0.113.7:40001 ──► router looks up mapping ──► 192.168.1.20:51544

Consequences:

• Servers see the NAT's public IP, not the client's private IP.
• Many clients behind one NAT share ports; heavy outbound traffic can exhaust SNAT ports (a common Azure and AWS NAT gateway issue).
• Inbound connections to a private host need port forwarding or a load balancer.

3. IPv6 in practice

• Addresses are often auto-configured (SLAAC) and every device can be globally reachable, so firewalls matter more than NAT.
• Dual-stack hosts have both IPv4 and IPv6. localhost may resolve to ::1 first; a server bound only to 127.0.0.1 then refuses the connection.
• .NET sockets created with AddressFamily.InterNetworkV6 and DualMode = true accept both.

4. Containers and Kubernetes

• Docker's default bridge uses 172.17.0.0/16, and containers are NATed out through the host.
• Kubernetes has a pod CIDR and a service CIDR. Service IPs are virtual; kube-proxy or eBPF translates them to pod IPs.
• Overlapping CIDRs between a cluster and a peered VNet or VPN break routing in confusing ways.

5. .NET APIs

var ip = IPAddress.Parse("10.0.1.25");
var network = IPNetwork.Parse("10.0.0.0/16");   // System.Net.IPNetwork, .NET 8+
bool inside = network.Contains(ip);              // true
bool isLoopback = IPAddress.IsLoopback(ip);      // false

6. Try it yourself

1. Run ip addr (Linux) or ipconfig (Windows) and identify your private IP, subnet mask and gateway.
2. Visit a "what is my IP" site and compare with your private IP to see NAT.
3. Calculate how many usable hosts are in 10.20.0.0/22 (1,024 minus reserved).
4. In C#, check whether several IPs are inside 172.16.0.0/12 with IPNetwork.Contains.

// Allow-list check for an internal admin endpoint using CIDR ranges (.NET 8+ System.Net.IPNetwork)
var allowed = new[]
{
    IPNetwork.Parse("10.0.0.0/8"),
    IPNetwork.Parse("192.168.0.0/16"),
    IPNetwork.Parse("fd00::/8")
};

app.MapGet("/admin/health-details", (HttpContext ctx) =>
{
    var remote = ctx.Connection.RemoteIpAddress;
    if (remote is null) return Results.Forbid();
    if (remote.IsIPv4MappedToIPv6) remote = remote.MapToIPv4(); // ::ffff:10.0.0.5 → 10.0.0.5

    return allowed.Any(n => n.Contains(remote))
        ? Results.Ok(GetDetails())
        : Results.Forbid();
});
// Behind a proxy, RemoteIpAddress is the proxy's IP unless ForwardedHeaders is configured.

# Useful commands
ip addr show            # Linux interfaces and CIDRs
ip route                # default gateway and routes
ipconfig /all           # Windows
curl -s https://ifconfig.me   # public IP as seen from outside (after NAT)