🧮 Subnetting and CIDR Without the Pain

Subnetting and CIDR Without the Pain

Subnetting has a reputation for being hard. It is not — it is one idea (a boundary inside a 32-bit number) plus a table of powers of two that you will have memorised after about twenty minutes of practice. Everything else follows: firewall rules, routing tables, cloud VPC design, and reading a log line and knowing instantly whether an address is internal.

The binary you actually need

An IPv4 address is 32 bits written as four 8-bit octets. Inside an octet the bit values are always 128 64 32 16 8 4 2 1. That is the whole refresher:

192  .  168  .   10  .    0
11000000.10101000.00001010.00000000
  ^128+64   ^128+32+8   ^8+2

A prefix length — the /24 in 192.168.10.0/24 — is simply how many leading bits are fixed. Those bits identify the network; the remaining bits identify hosts inside it. The subnet mask is the same information written as an address: a run of ones followed by a run of zeros.

/24  11111111.11111111.11111111.00000000  = 255.255.255.0    → 8 host bits
/26  11111111.11111111.11111111.11000000  = 255.255.255.192  → 6 host bits

The three addresses that define a subnet

• Network address — all host bits zero. It names the subnet and is never assigned to an interface.
• Broadcast address — all host bits one. Traffic to it reaches every host on the subnet, so it is also not assignable.
• Usable hosts — everything in between: 2(32 − prefix) − 2.

The arithmetic is bitwise. Network = address AND mask. Broadcast = network OR the inverted mask. The shortcut that makes it mental arithmetic: the block size is 256 − (last non-zero mask octet). For a /26, that is 256 − 192 = 64, so subnets start at 0, 64, 128 and 192.

Worked example: 192.168.10.0/24 split into four /26s

Borrowing two host bits from a /24 gives 2² = 4 subnets, each with 2⁶ = 64 addresses and 62 usable hosts. Mask 255.255.255.192 throughout.

Read the pattern rather than memorising the rows: each network address is the previous broadcast plus one, the first host is network + 1, and the broadcast is the next network − 1. The intermediate step of splitting the same /24 into two /25s gives 192.168.10.0/25 (hosts .1–.126, broadcast .127) and 192.168.10.128/25 (hosts .129–.254, broadcast .255) — halving again gives the four rows above.

You do not have to split evenly. VLSM means using different prefix lengths inside the same block: a /25 for 100 desktops, a /28 for 12 servers, and /30s or /31s for point-to-point links. Also note that "subnet zero" and the all-ones subnet are perfectly usable on any equipment made this century; the old rule against them is a relic.

The table worth memorising

/31 is the exception to the minus-two rule: RFC 3021 allows both addresses on a point-to-point link, because a two-node link has no need for a broadcast address. Check any of these rows in the subnet calculator →, and use the CIDR toolkit → to summarise or split blocks and test whether an address falls inside one.

Ranges to recognise on sight

Seeing 169.254.x.x on an interface means DHCP failed. Seeing 100.64.x.x as your "public" address means your ISP has put you behind CGNAT. Both diagnoses come free once you know the ranges.

IPv6: different maths, easier answers

IPv6 addresses are 128 bits, written as eight groups of four hex digits. Because each hex digit is exactly 4 bits, prefix lengths on multiples of 4 line up with digit boundaries — which is why real-world IPv6 designs stick to nibble boundaries: /48, /52, /56, /60, /64.

Notation is standardised by RFC 5952: lowercase hex, leading zeros in a group suppressed, and one run of all-zero groups replaced by ::. The double colon may appear only once, must be used on the longest run of zero groups (the leftmost such run if there is a tie), and must not be used to shorten a single zero group.

2001:0db8:0000:0000:0000:ff00:0042:8329   full form
2001:db8::ff00:42:8329                    RFC 5952 canonical form
2001:db8:0:0:0:ff00:42:8329               legal, but not canonical
2001:db8::acad::1                         INVALID — two "::" is ambiguous

The structural difference is that IPv6 subnetting is not about conserving addresses. A LAN is a /64, always. That is not a convention someone picked for tidiness: stateless address autoconfiguration (SLAAC) builds an address from a 64-bit prefix plus a 64-bit interface identifier, so a longer prefix silently breaks SLAAC and privacy addressing. A site typically receives a /48 or /56 and carves /64s out of it — a /48 holds 65,536 of them, one per VLAN, with no arithmetic beyond incrementing the fourth group:

2001:db8:acad::/48        the site allocation
  2001:db8:acad:0000::/64   VLAN 0  (management)
  2001:db8:acad:0001::/64   VLAN 1  (users)
  2001:db8:acad:0002::/64   VLAN 2  (servers)
  … up to 2001:db8:acad:ffff::/64

There is no broadcast address in IPv6 — its jobs are done by multicast — and no "minus two" for hosts. The all-zeros interface identifier in a subnet is reserved as the subnet-router anycast address (RFC 4291), so a /64 gives you 2⁶⁴ addresses minus a handful of reserved ones, which is not a number anyone needs to compute. Worth recognising: fe80::/10 link-local (always present on every interface), fc00::/7 unique local — in practice fd00::/8 with a randomly generated 40-bit global ID — and 2001:db8::/32, the documentation range used throughout this page (RFC 3849). Work an IPv6 prefix in the calculator → to see expansion, compression and subnet counts side by side.