Overview
An IP address is the numeric identifier that lets machines find and talk to each other across a network. In a CTF, almost every networking, web, and pwn challenge starts with an address — the target box you are allowed to attack, given to you by the organizers. Before you can scan a port, resolve a name, or send a packet, you need to understand what an IP address is, how it is structured, and how to reason about the private, isolated ranges you will meet in lab environments.
This lesson builds that foundation using only safe, authorized practice framing: every address you touch in a CTF is one the event has explicitly provided for you.
Learning objectives
- Explain what an IP address is and the job it does on a network.
- Distinguish IPv4 from IPv6 and read both notations.
- Interpret a subnet mask and CIDR notation to reason about address ranges.
- Recognize private, loopback, and link-local ranges common in CTF labs.
- Map an IP address to a CTF target and describe how you use it safely.
Core concept
Every device that participates in an IP network has at least one IP address: a logical address used to route data to and from that device. Think of it as the destination written on a package. When your machine sends data to a target, it stamps the packet with a source address (yours) and a destination address (the target), and the network uses the destination to deliver it.
There are two versions in use today:
- IPv4 — a 32-bit address written as four decimal numbers (octets) separated by dots, each from 0 to 255, e.g.
10.10.14.7. There are about 4.3 billion possible IPv4 addresses, which is why private ranges and address reuse exist. - IPv6 — a 128-bit address written as eight groups of four hexadecimal digits separated by colons, e.g.
2001:0db8:85a3:0000:0000:8a2e:0370:7334. It was created because the world ran out of unique IPv4 addresses.
An IP address alone identifies a host. To identify a specific service on that host you also need a port (covered in the next lesson), and to route traffic beyond your local network you rely on a gateway and routing.
How it works
An IPv4 address is split into two logical parts: a network portion and a host portion. The split is defined by a subnet mask. Machines use the mask to decide, "Is this destination on my local network, or do I need to send it to the gateway to be routed elsewhere?"
The mask is often written in CIDR notation as a slash and a number, e.g. /24. The number is how many leading bits belong to the network:
/24means the first 24 bits are the network and the last 8 bits are the host. For192.168.1.0/24, hosts range from192.168.1.1to192.168.1.254, with192.168.1.0as the network address and192.168.1.255as the broadcast address./16means the first 16 bits are network — a much larger range like10.10.0.0/16covering10.10.0.0through10.10.255.255./32means a single, specific host.
Some ranges are reserved and never routed on the public internet. You will see these constantly in CTF labs because the whole environment is isolated:
- Private ranges (RFC 1918):
10.0.0.0/8,172.16.0.0/12, and192.168.0.0/16. Used inside private networks and labs. - Loopback:
127.0.0.0/8, almost always127.0.0.1("localhost") — the machine talking to itself. - Link-local:
169.254.0.0/16— auto-assigned when no address is configured.
When your challenge says "the target is at 10.10.10.5," the private range tells you this is an isolated lab address, reachable only through the CTF's provided network (often a VPN).
Practical example
Suppose a CTF gives you VPN access and tells you your attacking machine has address 10.8.0.14 and the challenge box is 10.10.10.5. You want to know whether these are on the same subnet.
# Illustrative: view your own interface addresses
$ ip addr show tun0
inet 10.8.0.14/24 scope global tun0
# Check basic reachability to the authorized target
$ ping -c 1 10.10.10.5
64 bytes from 10.10.10.5: icmp_seq=1 ttl=63 time=41.2 ms
Your address is 10.8.0.14/24, so your local network is 10.8.0.0/24 — addresses 10.8.0.1–10.8.0.254. The target 10.10.10.5 is not in that range, so traffic to it is routed through the VPN gateway rather than delivered directly on your local segment. The ttl=63 in the reply is a small clue: TTL values typically start at 64 and decrease by one per router hop, so a value of 63 suggests the reply crossed one hop to reach you.
None of this touches the public internet — the entire exchange happens inside the CTF's authorized, isolated range.
Cybersecurity relevance
IP addressing is the bedrock of almost all network security work:
- Reconnaissance begins with knowing the target's address and which subnet it lives on. Understanding CIDR lets you reason about how large an authorized scope is (a
/24is 254 hosts; a/16is tens of thousands). - Scope discipline depends on IP literacy. In real engagements and in CTF rules, you are authorized to touch only specific addresses or ranges. Misreading a range can lead you to probe out-of-scope systems — a serious ethical and legal error.
- Defenders use IP ranges for firewall rules, segmentation, and log analysis. Recognizing private vs public and loopback vs remote addresses is essential when reading traffic.
- Pivoting and internal networks: many challenges model a foothold that can reach an internal
10.0.0.0/8network the outside cannot, mirroring real segmented environments.
Common mistakes
- Confusing an IP address with a hostname. A name like
web.ctf.localmust be resolved to an IP via DNS before packets can flow; the IP is what routing uses. - Miscounting a CIDR range and assuming more or fewer hosts are in scope than actually are.
- Forgetting the network and broadcast addresses (
.0and.255in a/24) are not usable host addresses. - Treating
127.0.0.1as the target box. Loopback always means "this same machine," so on a remote shell it refers to the target's own services, not yours. - Probing outside the authorized range because you misread which subnet the target is on.
Key takeaways
- An IP address is the logical identifier used to route data to a host; IPv4 is 32-bit dotted-decimal, IPv6 is 128-bit hex.
- A subnet mask / CIDR (
/24,/16) splits an address into network and host parts and defines the range. - Private (
10/8,172.16/12,192.168/16), loopback (127/8), and link-local (169.254/16) ranges appear constantly in isolated CTF labs. - The target's IP defines your authorized scope; reading it correctly keeps you inside the rules.
Check your understanding
- Given the target
10.10.10.5and your address10.8.0.14/24, are they on the same local subnet, and how do you know? - How many usable host addresses are in a
/24network, and which two addresses are reserved? - Why does a private IP range tell you that a CTF target is inside an isolated lab rather than on the public internet?