IPv4

An IPv4 address has 32 bits, written as four bytes in dotted decimal, for example 192.168.10.37. A subnet mask (or prefix length $p$) says how many leading bits identify the network; the remaining $32-p$ bits identify the host. With all host bits 0 you get the network address; with all host bits 1 you get the directed broadcast address. Neither can be assigned to a host.

To find the class, look at the first byte only. Special addresses: 0.0.0.0 means "this host" (used as the source by a host that has no address yet), 255.255.255.255 is the limited broadcast (never forwarded by a router), and 127.x.x.x is loopback.

Subnetting borrows host bits to create more, smaller networks. CIDR (Classless Inter-Domain Routing) drops the class rules: any prefix length from /0 to /32 is allowed and a block is written a.b.c.d/p. Convention used here: all-zeros and all-ones subnet numbers are allowed (as in CIDR). Older classful questions sometimes exclude them, which removes 2 subnets; read the question for which convention applies.

VLSM (variable-length subnet masks): when subnets need different sizes, allocate the largest first, each starting at an address that is a multiple of its own size (its number of addresses). This keeps blocks aligned and unused space contiguous.

Supernetting / route aggregation: $2^k$ contiguous blocks of equal size can be advertised as one block with the prefix shortened by $k$, provided the first block's address is a multiple of the combined size. Check: for four /24 blocks the third octet of the first block must be a multiple of 4. Aggregation into one block fails if the blocks are not contiguous, if the first is not aligned, or if the number of blocks is not a power of 2 (then more than one prefix is needed).

A router's forwarding table holds entries of the form (prefix, next hop or interface). For a destination address the router finds every entry whose prefix matches the leading $p$ bits of the destination, then picks the one with the longest prefix (most specific). The default route 0.0.0.0/0 matches everything but has length 0, so it is chosen only when nothing else matches.

The header checksum is the 16-bit one's-complement of the one's-complement sum of the header's 16-bit words. The data is not covered. Source and destination addresses are 32 bits each. Limits that follow from the field sizes: a datagram with a 20-byte header carries at most $65535-20=65515$ bytes of data, and the largest offset value is $2^{13}-1=8191$, which is byte position $8191\times 8=65528$.

Each link has an MTU, the largest IP datagram (header included) it can carry. If a datagram is larger than the MTU and DF is 0, the sending host or router splits it into fragments. Each fragment carries a piece of the data and its own IP header: Identification, source and destination stay the same; total length, MF, offset and checksum are set for the fragment; options are copied only if their copy flag is set. Fragments are reassembled only at the destination. If DF is 1 and the datagram does not fit, it is dropped and ICMP "destination unreachable (fragmentation needed)" is sent.

NAT (Network Address Translation) lets many hosts with private addresses share one or a few public addresses. The most common form, port address translation (PAT, often just called NAT), rewrites the source address and source port of outgoing packets and records the mapping in a NAT table: (private IP, private port) to (public IP, public port). Replies are matched against the table and rewritten back. Because the table is keyed on port numbers, a single public address can support many simultaneous connections, limited by the 16-bit port space per transport protocol. An inbound packet with no table entry is dropped unless a static mapping (port forwarding) has been set up for it. NAT must update the IP header checksum, and also the TCP or UDP checksum, because that checksum covers a pseudo-header containing the IP addresses as well as the ports. Addresses 169.254.0.0/16 are link-local, not part of the private ranges above.

Traceroute uses TTL. It sends probes with TTL = 1, 2, 3, ... The first router discards the TTL-1 probe and returns an ICMP time-exceeded message, revealing its address; the next probe goes one hop further. When a probe finally reaches the destination, the destination replies (for UDP probes, ICMP port unreachable; for ICMP probes, echo reply), which ends the trace.