Stop Memorizing IP Ranges — Start Understanding Them

Why your IP address looks the way it does, and how under the hood bits turn into buildings.

You open the AWS console, click “Create VPC,” and it asks for a CIDR block like 10.0.0.0/16. Most tutorials just tell you to type it in and move on — copy, paste, pray. Nobody actually explains what those numbers mean. So let's fix that, in plain English, with zero scare factor.

To understand VPCs, Subnets, and ECS, picture building a secure, private office building. That’s the analogy we’ll use the whole way through.

The Cloud Hierarchy: From Big to Small

Cloud networking is just a big pool of IP addresses, sliced into smaller and smaller pieces:

[ VPC ]  ---> Entire Office Building (e.g., 10.0.0.0/16 - 65,536 IPs)
    |
    +---> [ Public Subnet ]  ---> Front Lobby, faces the internet (e.g., 10.0.1.0/24 - 256 IPs)
    |        |
    |        +---> [ ECS Task 1 ] ---> One desk (e.g., IP: 10.0.1.15)
    |
    +---> [ Private Subnet ] ---> Back Office, no internet access (e.g., 10.0.2.0/24 - 256 IPs)

Each layer down = a smaller, more specific slice of the layer above it. Let’s build up to that, starting with why IP addresses look the way they do.

1. Why the Dots? (And Why 255 Is the Ceiling)

An IP address like 192.168.1.10 is really just one 32-bit binary number wearing a disguise for humans:

11000000.10101000.00000001.00001010

Nobody wants to read 32 digits of 1s and 0s in a row, so engineers chopped it into four 8-bit chunks, called octets, and separated them with dots. That’s the entire reason for the dots — they’re just dividers.

Why can’t an octet go past 255? Quick math:

Each bit has 2 possible values (0 or 1) An octet has 8 bits Total combinations 2 × 2 × 2 × 2 × 2 × 2 × 2 × 2 = ²⁸ = 256

256 possible values, counting from zero, lands you at 0 through 255. That’s it. There’s no rule being enforced — there’s simply no more room. 192.168.1.400 isn't "invalid," it's physically impossible to fit inside 8 bits.

2. Why Bits Instead of Normal Numbers?

Because of what’s actually inside your computer: billions of transistors — tiny electrical switches that are either letting power through, or not. No in-between.

• On = 1
• Off = 0

That’s the whole reason binary exists. Hardware can’t represent “7” directly — it can only flip switches on or off. Every IP address, image, and word you’ve ever seen on a screen is just patterns of these switches underneath.

And speed matters here too. Routers make millions of routing decisions per second. Comparing binary is electrically instant — just checking which switches match. Decimal comparison would mean constantly translating in and out of binary, which slows everything down. So binary isn’t there to make your life harder — it’s there because it’s the only language the hardware speaks, and the fastest one for routers to act on.

3. CIDR: Drawing the Line in the Sand

A CIDR block — that /16 after your IP — draws a line across the 32 bits, splitting them into two zones:

• Network bits (left of the line): identifies which building this address belongs to
• Host bits (right of the line): identifies which exact desk inside that building

The slash number tells you where the line falls — and the further right it moves, the fewer bits are left over for individual devices:

CIDR Network Bits (locked) Host Bits (free) Total Addresses /16 16 16 ²¹⁶ = 65,536 /24 24 8 ²⁸ = 256 /28 28 4 ²⁴ = 16

Smaller slash = more room. Bigger slash = smaller, tighter allocation. That’s why a /16 feels huge and a /28 barely fits anything.

VPC → Subnet → ECS: The Office Building, Floor by Floor

VPC — the whole building’s floor plan

A VPC (Virtual Private Cloud) is your entire private network. You assign it a big CIDR block up front:

• Example: 10.0.0.0/16
• Meaning: the first two numbers (10.0.) are locked. You get all 65,536 addresses from 10.0.0.0 to 10.0.255.255, entirely to yourself.
• The Analogy: this is the total square footage of your office building.

Subnets — the individual rooms

You don’t throw every server into one giant pool — that’s insecure and messy. You divide the VPC into Subnets, each getting its own non-overlapping slice:

• Public Subnet: 10.0.1.0/24 → 256 IPs (10.0.1.0–10.0.1.255), connected to the internet. Web servers live here.
• Private Subnet: 10.0.2.0/24 → 256 IPs (10.0.2.0–10.0.2.255), cut off from the internet. Databases live here.
• The Analogy: these are the individual rooms in the building. The lobby has different keys than the accounting office.

ECS — the desk inside the room

An ECS (Elastic Container Service) task or instance is your actual running application. When you launch one inside a subnet, AWS automatically plucks one free IP out of that subnet’s range and hands it to your task.

• Example: launch an ECS task in 10.0.1.0/24 → it gets assigned something like 10.0.1.15.
• The Analogy: this is one specific desk assigned to one specific employee in the lobby.

Why the Split Even Matters

When traffic comes in, a router only needs to check the network bits to know which building to send it to — it doesn’t care about the exact desk yet. Once it arrives at the right subnet, that’s when the last few bits decide the exact device. This is also why AWS won’t let two subnets in the same VPC overlap — you can’t have two rooms claiming the same desk number.

Recap

• Dots exist because 32 raw bits are unreadable to humans, so we group them into four 8-bit octets — capped at 255 because ²⁸ = 256 possible values.
• Bits exist because transistors are physical on/off switches, and binary comparisons are the fastest thing a router can do.
• CIDR draws a line across those bits to separate the network’s identity (VPC, Subnet) from individual resource identity (ECS, EC2, RDS).

Next up in this series: calculating subnet ranges by hand, the 5 IPs AWS always reserves per subnet, and designing a real public/private layout for production.

If this made CIDR click for you, let me know which part landed — the octet math, the transistor bit, or the office building analogy. Follow for the next piece in the “Under The Hood” series.