Addresses and Local Networks

Every device on a network carries two addresses, and a home router's settings page lists both. The IP address is a number the network gives the device. The MAC address is set in the device's network hardware at the factory, though software can change it, and most phones now show each Wi-Fi network a made-up one. Look at the figure and work out why one device would need two.

The two addresses do different jobs. The MAC address is how devices on the same local network find each other; it doesn't leave that network. The IP address, the number routers read to decide where traffic goes next, is how traffic finds its way across networks, as many as it takes. A parcel works the same way: the address on the label stays the same from start to finish, like the IP address, while each truck along the way is told only its next stop, which is the MAC address's job inside one local network.

Inside the house, the laptop, the phone, and the printer share one local network. The box from the internet provider usually holds three devices in one: an access point that reaches devices by radio, a switch that passes traffic between the devices plugged into it, and a router that connects the home network to everything outside. The access point and the switch deliver by MAC address. Only the router works with networks beyond the house. Open one up and the three devices are a single circuit board. The port marked WAN, for wide area network, connects to the provider. The four marked LAN, for local area network, belong to the switch, and the antenna socket belongs to the access point.

When the laptop joins the Wi-Fi, it doesn't have an IP address yet. It asks the network for one, through DHCP, and the router answers with 192.168.1.23, along with the router's own inside address, 192.168.1.1, called the default gateway: the laptop sends everything bound for the outside there. When the laptop later wants to print, it knows the printer's IP address but not its MAC address, so it asks the whole local network who has 192.168.1.40, and the printer replies with its MAC address. That question is ARP, and ARP doesn't check who is answering, and attackers on a local network take advantage of that.

Every inside address in this house begins 192.168.1. A computer stores each of the four numbers as 8 bits, binary digits that are each 0 or 1, so a whole IPv4 address is 32 bits; 8 bits make one byte. Addresses are handed out in blocks, written with a slash: 192.168.1.0/24 means every address whose first 24 bits, the first three numbers, are 192.168.1. The last number can be anything from 0 to 255, so the block holds 256 addresses. A smaller number after the slash fixes fewer bits and makes a bigger block. How many addresses are in a /22?

A /22 fixes two fewer bits than a /24, and each bit freed doubles the count: 256, then 512, then 1,024 addresses. Going the other way, a /25 fixes one more bit and holds 128.

Routers on the internet announce to their neighbors which address blocks can be reached through them. These are BGP announcements, the kind Facebook's DNS servers stopped making during the 2021 outage. When two blocks overlap, a router follows the smaller, more specific one. YouTube's servers used the block 208.65.152.0/22. Pakistan Telecom was under a government order to block YouTube inside Pakistan, and on February 24, 2008, it announced a route for 208.65.153.0/24, a quarter of YouTube's block, meant to send Pakistani users nowhere. Its provider, PCCW Global in Hong Kong, passed the announcement on to the rest of the internet, and within minutes routers around the world preferred the more specific /24. For about two hours, people in many countries who tried to reach YouTube had their traffic sent to Pakistan Telecom.

YouTube's engineers answered with the same rule. They announced the /24 themselves, then two /25s, each half of it and more specific than Pakistan Telecom's route. Routers that accepted the /25s switched back to YouTube, but many networks ignore any route for a block smaller than a /24, such as a /25, so the /25s reached few of them. The outage ended when PCCW withdrew Pakistan Telecom's announcement, a little over two hours after it began. Nothing in the routing system had checked that Pakistan Telecom was allowed to speak for those addresses.