Subnetting explained: CIDR, masks and host counts

An IPv4 address is 32 bits split into a network part and a host part. Subnetting is deciding where the split goes, and CIDR notation is how you write that decision down.

Reading a prefix

192.168.1.0/24 means the first 24 bits identify the network and the remaining 8 identify hosts within it.

Every step down the prefix doubles the size. /24 and 255.255.255.0 are the same statement in different notation.

Why two addresses are unusable

The first address in any subnet is the network address, which names the subnet itself. The last is the broadcast address, which reaches every host at once. Neither can be assigned to a machine.

That is where - 2 in the formula comes from, and it is why a /30 gives you exactly two usable addresses - the minimum for a point-to-point link.

The exception is /31, defined in RFC 3021 specifically for point-to-point links where there is nowhere to broadcast to. Both addresses are usable. A /32 is a single host route, used for loopbacks and for pinning a route to one machine.

Splitting a network

To divide a network, borrow bits from the host portion.

Splitting 10.0.0.0/24 into four means moving to /26. Each new subnet has 64 addresses and 62 usable hosts:

10.0.0.0/26     hosts 10.0.0.1   - 10.0.0.62
10.0.0.64/26    hosts 10.0.0.65  - 10.0.0.126
10.0.0.128/26   hosts 10.0.0.129 - 10.0.0.190
10.0.0.192/26   hosts 10.0.0.193 - 10.0.0.254

The pattern is that subnet boundaries land on multiples of the block size, and the block size is 256 - the last octet of the mask. For /26 that is 256 - 192 = 64, which is why the subnets start at 0, 64, 128 and 192.

Wildcard masks

A wildcard mask is the bitwise inverse of the subnet mask: /24 becomes 0.0.0.255.

Cisco ACLs and OSPF use it rather than the subnet mask, which means a rule written with the wrong one silently matches a completely different range. There is no error - just traffic going somewhere unexpected.

Private ranges

• 10.0.0.0/8 - 16.7 million addresses
• 172.16.0.0/12 - 1 million addresses
• 192.168.0.0/16 - 65,536 addresses

Also worth recognising: 100.64.0.0/10 is carrier-grade NAT, which is why a device behind some mobile networks has an address that looks public and is not. 169.254.0.0/16 is link-local - an address in that range means DHCP failed.

Pick a private range with room to grow and subnet it deliberately. Most cloud VPC pain comes from someone choosing 10.0.0.0/24 for a first environment and then needing to peer it with another network that used the same block.

IPv6

The exercise changes completely, because there is no scarcity and no broadcast address.

A /64 is the standard size for any single network regardless of how many devices sit on it - stateless address autoconfiguration assumes it. You subnet by taking prefixes shorter than /64: an ISP typically delegates a /56 or /48, giving you 256 or 65,536 /64 networks to hand out.

Do not subnet below /64 on a LAN. It works, and it breaks SLAAC and some neighbour discovery behaviour in ways that are tedious to diagnose.

Work out any of this quickly with the subnet calculator.