Subnetting Basics: CIDR and VLSM

A practical, ground-up guide to IPv4 addressing, subnet math, CIDR notation, and Variable-Length Subnet Masking for network engineers and certification candidates.

Table of Contents

• Chapter 1: Why Subnetting Exists: The Big Picture
• Chapter 2: IPv4 Addressing and Binary Fundamentals
• Chapter 3: Classful Addressing and Its Limits
• Chapter 4: Subnet Masks Explained
• Chapter 5: CIDR Notation and Prefix Length
• Chapter 6: Anatomy of a Subnet: Network, Hosts, and Broadcast
• Chapter 7: Subnetting Step by Step: Fixed-Length Subnetting
• Chapter 8: VLSM: Variable-Length Subnet Masking
• Chapter 9: Route Summarization and Supernetting
• Chapter 10: Practical Design, Tools, and Troubleshooting
• Chapter 11: Mastery, IPv6 Preview, and Next Steps

Chapter 1: Why Subnetting Exists: The Big Picture

Before you learn how to subnet, it helps enormously to understand why subnetting exists at all. Subnetting can feel like an arbitrary exercise in binary arithmetic when you first meet it, but every rule you will learn was invented to solve a real, painful problem that early network engineers faced. This chapter tells that story. By the end, you will understand the forces that shaped modern IP addressing and be able to explain—in plain language and with concrete examples—what subnetting does and why it still matters today.

Learning Objectives

• Explain the purpose of subnetting in modern IP networks.
• Describe the historical problems (address exhaustion, routing table bloat) that subnetting and CIDR solved.
• Identify where subnetting fits in the OSI/TCP-IP model and in day-to-day network design.

What Is a Subnet?

Imagine a large office building with a single, wide-open floor plan and no interior walls. Every conversation—every phone call, every shouted question, every side chat—happens in one giant room. With ten people, this is fine. With ten thousand, it is chaos: the noise is deafening, nobody can hear their own conversation, and if one person starts a rumor, everyone hears it whether they care or not. The obvious fix is to add walls: break the floor into offices and departments so that most conversations stay local and only the messages that need to travel between departments do so.

A subnet is one of those walled-off rooms for a computer network. More precisely, a subnet (short for “subnetwork”) is a logical subdivision of a larger IP network—a group of devices that share a common address range and can communicate directly with one another. Subnetting is the process of dividing one big network into these smaller, more manageable pieces [Source: https://www.geeksforgeeks.org/computer-networks/introduction-to-subnetting/].

Networks vs. Hosts

To understand subnets, you first need to understand how an IP address is structured. IPv4 (Internet Protocol version 4) is the addressing system that has run the Internet since the early 1980s. It uses 32-bit addresses, which you normally see written in “dotted-decimal” form like 192.168.10.25.

Every IPv4 address is split into two conceptual parts:

• Network portion — identifies which network the device belongs to. Think of this as the street name.
• Host portion — identifies the specific device on that network. Think of this as the house number on that street.

A host is simply any device with an IP address: a laptop, a server, a printer, a phone, a router interface. Two devices whose addresses share the same network portion are on the same network and can talk to each other directly; two devices on different networks must send their traffic through a router.

Subnetting works by adding a third level to this hierarchy. The original scheme was a two-level hierarchy—network, then host. Subnetting introduces a network → subnet → host hierarchy by borrowing bits from the host portion and reassigning them to identify a subnet [Source: https://www.sciencedirect.com/topics/computer-science/subnetting]. This is done with a subnet mask, a companion value that tells a device exactly where the network-and-subnet part of an address ends and the host part begins. (You will learn to work masks in detail in later chapters; for now, just picture it as an adjustable dividing line.)

Returning to our building analogy: the network portion is the building’s street address, the subnet is the floor or department, and the host is the individual desk. Borrowing “host bits” to make subnets is exactly like taking a wide floor and using some of its space to build interior walls.

Figure 1.1: The network to subnet to host addressing hierarchy

graph TD
    Network["Network<br/>(building street address)"]
    Network --> SubnetA["Subnet A<br/>(floor / department)"]
    Network --> SubnetB["Subnet B<br/>(floor / department)"]
    SubnetA --> HostA1["Host<br/>(desk / device)"]
    SubnetA --> HostA2["Host<br/>(desk / device)"]
    SubnetB --> HostB1["Host<br/>(desk / device)"]
    SubnetB --> HostB2["Host<br/>(desk / device)"]

Broadcast Domains

The single most important reason subnets exist is the concept of a broadcast domain. Certain kinds of network messages are broadcasts—a device sends one message that is delivered to every other device in its group, rather than to a single recipient. Broadcasts are essential; computers use them constantly for tasks like discovering the hardware address of a neighbor or finding services on the local network.

A broadcast domain is the set of all devices that will receive one another’s broadcasts. This is the digital equivalent of everyone within earshot in our open-plan office. In a flat, unsubnetted network, every device is in one broadcast domain, so every broadcast reaches every device.

Here is the key relationship you must remember: each subnet is its own broadcast domain [Source: https://gcore.com/learning/what-is-a-subnet-how-subnetting-works]. When you carve a network into subnets, a broadcast sent inside one subnet stays inside that subnet and does not spill into the others. You have effectively built acoustic walls: shouting in the accounting department no longer interrupts engineering.

Figure 1.2: A broadcast stays confined to its own subnet

flowchart TD
    subgraph Accounting["Accounting Subnet (broadcast domain)"]
        Sender["Device sends broadcast"]
        A1["Accounting device"]
        A2["Accounting device"]
        Sender --> A1
        Sender --> A2
    end
    subgraph Engineering["Engineering Subnet (broadcast domain)"]
        E1["Engineering device"]
        E2["Engineering device"]
    end
    Router{{"Router boundary"}}
    Sender -. broadcast blocked .-x Router
    Router -.-x Engineering

Why One Flat Network Doesn’t Scale

Now we can see why a single, flat network breaks down as it grows. Consider a company that grows from 50 devices to 5,000 devices, all on one flat network.

Subnetting attacks all four problems at once by replacing one giant broadcast domain with several small ones. Reducing the size of broadcast domains is, in fact, the core performance mechanism of subnetting—we will return to each of these benefits later in the chapter [Source: https://uptimerobot.com/knowledge-hub/devops/subnet-explained/].

One more important placement note: subnetting is a Layer 3 activity. In the OSI model, Layer 3 is the Network layer, which handles logical addressing (IP addresses) and routing—moving packets between networks. In the TCP/IP model, this same role belongs to the Internet layer. Because IP addresses and routing live at Layer 3, and subnetting is the act of dividing IP address space, a subnet is a Layer 3 logical network whose members can communicate directly at Layer 3 [Source: https://www.cloudflare.com/learning/network-layer/what-is-the-network-layer/]. This is why subnetting is distinct from (though related to) VLANs, which enforce segmentation at Layer 2—a distinction we will revisit at the end of the chapter [Source: https://evanmccann.net/blog/networking-101/vlans-and-network-layers].

Key Takeaway: A subnet is a logical subdivision of an IP network, created by borrowing bits from the host portion of an address to add a network → subnet → host hierarchy. Each subnet is its own broadcast domain, so subnetting shrinks broadcast traffic, improves performance and security, and lets a network scale where a single flat network cannot. Subnetting is a Layer 3 (Network/Internet layer) function.

A Brief History of IP Addressing

Subnetting and its successor, CIDR, were not invented in a vacuum. They were responses to a series of scaling crises that threatened to overwhelm the early Internet. Understanding that history makes the rules you will learn later feel logical rather than arbitrary.

Classful Addressing Origins

When IP addresses were first standardized, engineers needed a way to accommodate networks of very different sizes—some organizations had a handful of machines, others had thousands. The original 8-bit network identifier could describe only 256 networks, which was clearly not enough. So in September 1981, RFC 791 (authored by Jon Postel) introduced address classes to divide the 32-bit space into networks of a few fixed sizes [Source: https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing].

This is known as classful addressing. It defined three practical sizes for ordinary use:

The design was elegant and simple, but it had a fatal flaw baked in: it offered only three fixed sizes. There was no middle ground. If your organization had, say, 2,000 devices, your choices were grim:

• A Class C block gave you only 254 usable addresses—far too small.
• A Class B block gave you 65,534 addresses—vastly more than you needed, wasting more than 63,000 addresses.

Because most organizations were too big for a Class C but nowhere near big enough to justify a Class B, huge swaths of the address space were handed out and then left unused. This allocation inefficiency was the original sin of classful addressing [Source: https://jumpcloud.com/it-index/classful-vs-classless-addressing-understanding-ip-allocation-methods].

Subnetting arrives (RFC 950). The first fix came in August 1985 with RFC 950, which formally introduced subnetting into the IP world. RFC 950 defined the subnet mask mechanism and even added new ICMP message types—“Address Mask Request” and “Address Mask Reply”—so that a host could discover its own subnet mask when it booted [Source: https://datatracker.ietf.org/doc/html/rfc950]. Subnetting let an organization take a single network number and internally divide it across many physical segments, instead of demanding a brand-new network number from the Internet authorities every time it added a segment. This directly solved two early problems: the constant requests for new network numbers, and the resulting growth of routing tables [Source: https://www.rfc-editor.org/rfc/rfc950.html].

IPv4 Address Exhaustion

Subnetting helped, but it addressed the problem from the inside of an organization. Two larger, Internet-wide crises were building through the late 1980s and early 1990s, and all three of the following forces converged at once:

1. Exhaustion of Class B space. Because Class B was the “just right” size for so many organizations, demand for Class B blocks was outstripping supply. The middle tier was running dry [Source: https://en.wikipedia.org/wiki/IPv4_address_exhaustion].
2. Routing-table growth. Every separately announced network needed its own entry in the routing tables of Internet routers. Geographically dispersed networks each required individual route announcements, and the tables were growing beyond what contemporary hardware, software, and staff could effectively manage [Source: https://datatracker.ietf.org/doc/html/rfc4632].
3. Exhaustion of the entire 32-bit space. Underlying both problems was the looming reality that the 32-bit IPv4 address space itself—about 4.3 billion addresses—was finite and being consumed rapidly [Source: https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing].

An analogy: imagine a national postal system where mail can only be routed if every single street in the country has its own line in the master delivery directory. As the country grows, that directory swells until no post office can hold it, and the sorting clerks can no longer keep up. That is routing-table bloat. Meanwhile, the country is also running out of valid street addresses to assign at all. That is address exhaustion. The Internet faced both at the same time.

The Move to Classless Routing

The solution was to abandon the rigid class boundaries entirely. In September 1993, the IETF published RFC 1518 and RFC 1519, formalizing Classless Inter-Domain Routing (CIDR) to replace the classful architecture [Source: https://datatracker.ietf.org/doc/rfc1519/]. Classless routing means exactly what it sounds like: routing that no longer cares about the old A/B/C class boundaries.

CIDR made two powerful moves:

• Allocation on any bit boundary. Instead of being stuck with three fixed sizes, address space could now be allocated on any address-bit boundary, using variable-length subnet masking (VLSM). An organization needing 2,000 addresses could get a block sized close to 2,000, rather than being forced up to 65,534. This is the “right-sizing” that classful addressing could never do [Source: https://www.techtarget.com/searchnetworking/definition/CIDR].
• Route aggregation (supernetting). CIDR let many contiguous small networks be advertised to the rest of the Internet as a single larger route. For example, sixteen contiguous /24 networks whose first 20 bits match can be aggregated and advertised as one /20 entry—turning sixteen routing-table lines into one [Source: https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing].

Figure 1.3: Supernetting aggregates many small routes into one

flowchart LR
    N1["Network: 192.168.0.0/24"]
    N2["Network: 192.168.1.0/24"]
    N3["Network: ... (16 total)"]
    N4["Network: 192.168.15.0/24"]
    Agg{{"CIDR route aggregation"}}
    Supernet["Advertised route: 192.168.0.0/20<br/>(one routing-table entry)"]
    N1 --> Agg
    N2 --> Agg
    N3 --> Agg
    N4 --> Agg
    Agg --> Supernet

The impact was dramatic and measurable. Routing-table growth actually spiked in late 1993 and early 1994, because CIDR supernet blocks had been assigned but were still being routed as separate legacy Class-C networks. Then, in 1994, the tables dropped sharply once providers deployed BGP4, the routing protocol that could finally advertise the aggregated supernet blocks as single entries [Source: https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing].

CIDR remains the foundation of Internet addressing today. The original specification in RFC 1519 was later refined and obsoleted by RFC 4632 in 2006, which is the current standard [Source: https://datatracker.ietf.org/doc/html/rfc4632].

Key Takeaway: Classful addressing (RFC 791, 1981) offered only three fixed network sizes, which wasted enormous amounts of address space. Subnetting (RFC 950, 1985) let organizations divide a single network number internally, and CIDR (RFC 1518/1519, 1993) went further by abandoning class boundaries entirely—enabling right-sized allocation via VLSM and route aggregation via supernetting, both of which remain foundational today.

Benefits of Subnetting

History explains why subnetting was invented; this section explains why network engineers still reach for it every day. The benefits fall into three broad categories: security, performance, and efficient address allocation.

Security Segmentation

Subnetting is one of the primary tools engineers use for network segmentation—the practice of dividing a network into isolated zones so that a problem in one zone cannot freely spread to the others.

By placing sensitive systems on their own subnet, administrators gain the ability to control exactly which devices and users can reach them. Because traffic between subnets must pass through a router (or firewall), that boundary becomes a natural place to enforce access-control policies. If an attacker compromises a device, the damage can be contained to a single subnet instead of spreading across the entire organization [Source: https://gcore.com/learning/what-is-a-subnet-how-subnetting-works].

Consider a hospital. Patient monitoring equipment, the guest Wi-Fi in the waiting room, and the administrative billing systems have very different security needs. Placing each on its own subnet means that a piece of malware picked up on the guest network cannot reach the patient monitors, and access to billing records can be tightly restricted to authorized staff. Without subnets, all three would sit in one flat network where any device could reach any other [Source: https://netseccloud.com/the-impact-of-subnets-and-vlans-on-network-security].

Figure 1.4: A firewall boundary enforces policy between subnets

flowchart TD
    Guest["Guest Wi-Fi subnet"]
    Firewall{{"Router / firewall<br/>(access-control policy)"}}
    Monitors["Patient monitor subnet"]
    Billing["Billing systems subnet"]
    Guest -->|"traffic must pass through"| Firewall
    Firewall -->|"blocked: no access"| Monitors
    Firewall -->|"blocked: no access"| Billing

It is worth being precise here: network segmentation is the broader security concept, and subnetting is its Layer 3 form. Segmentation can also be enforced at Layer 2 using VLANs. In practice the two are used together, but they operate at different layers of the model [Source: https://lightyear.ai/tips/network-segmentation-versus-subnetting].

Performance and Broadcast Control

The performance benefit of subnetting flows directly from the broadcast-domain concept introduced earlier. By limiting the number of devices in a single broadcast domain, subnetting reduces the volume of broadcast traffic each device has to process, which in turn reduces congestion and prevents any one segment from overwhelming the network [Source: https://uptimerobot.com/knowledge-hub/devops/subnet-explained/].

Because each subnet is its own broadcast domain, broadcasts reach only the devices within the same group. Traffic stays local, bandwidth is freed for useful work, and communication becomes faster and more efficient [Source: https://gcore.com/learning/what-is-a-subnet-how-subnetting-works].

Subnetting also makes networks dramatically easier to troubleshoot. When a fault occurs, a subnetted architecture helps an IT team pinpoint the problem far more quickly, because the issue is contained within a specific subnet rather than rippling across the whole network. The boundaries that contain broadcasts also contain problems [Source: https://www.devopstraininginstitute.com/blog/how-does-subnetting-improve-network-efficiency-and-security].

Efficient Address Allocation

Finally, subnetting—especially in its modern CIDR/VLSM form—lets engineers match address allocations to the actual size of each network segment, rather than wasting a full fixed-size block per site [Source: https://datatracker.ietf.org/doc/html/rfc950].

Recall the classful dilemma: an organization needing 2,000 addresses had to choose between a too-small Class C and a wasteful Class B. With subnetting and VLSM, you can carve out a block sized appropriately for each segment—a large block for a busy data center, a tiny block for a two-router point-to-point link, and everything in between—all from a single allocation. This conserves precious IPv4 address space and keeps internal structure tidy without exposing that structure to the global routing table [Source: https://www.sciencedirect.com/topics/computer-science/subnetting].

Think of it as the difference between a moving company that only stocks two box sizes—tiny and enormous—versus one that stocks a full range. With the full range, you pack each item in a box that fits, wasting no space. VLSM gives network engineers that full range of “box sizes” for addresses, a capability you will practice extensively in later chapters.

Key Takeaway: Subnetting delivers three enduring benefits. It improves security by isolating segments so breaches are contained and access is controlled; it improves performance by shrinking broadcast domains, cutting congestion, and speeding troubleshooting; and it enables efficient, right-sized address allocation through VLSM, conserving scarce IPv4 space.

Chapter Summary

Subnetting exists because a single flat network does not scale. As networks grow, one shared broadcast domain becomes congested, insecure, and hard to manage—much like an open-plan office with ten thousand people all shouting in one room. A subnet solves this by acting as a logical wall: it is a Layer 3 subdivision of an IP network, created by borrowing host bits to build a network → subnet → host hierarchy, and each subnet forms its own broadcast domain.

The historical arc explains the rules you will soon learn. Classful addressing (RFC 791, 1981) offered only three fixed network sizes and wasted enormous amounts of space, especially because Class C was too small and Class B too large for most organizations. Subnetting (RFC 950, 1985) let organizations subdivide a single network number internally. Then, facing the combined threats of Class B exhaustion, routing-table bloat, and the finite 32-bit IPv4 space, the IETF introduced CIDR (RFC 1518/1519, 1993). CIDR abandoned class boundaries, enabling right-sized allocation via variable-length subnet masking and route aggregation via supernetting—dramatically shrinking the global routing tables once BGP4 was deployed. RFC 4632 (2006) is the current standard.

Today, engineers subnet for three practical reasons: security (isolating and containing segments), performance (controlling broadcasts, easing troubleshooting), and efficient address allocation (matching block sizes to real needs). With this big-picture understanding in hand, you are ready to move from why to how—the binary structure of IP addresses and subnet masks that makes all of this work.

Key Terms

Chapter 2: IPv4 Addressing and Binary Fundamentals

Subnetting can feel like magic until you realize it is all built on one quiet truth: an IP address is really a string of 1s and 0s wearing a decimal costume. Every subnet mask, wildcard mask, CIDR prefix, and access-control list you will ever write ultimately operates on the binary form of an address, not the friendly dotted-decimal numbers you see on a router screen [Source: https://oneuptime.com/blog/post/2026-03-20-convert-ipv4-binary-decimal/view]. This chapter builds that foundation. By the end you will be able to slide between decimal and binary without a calculator, explain exactly what those four numbers in 192.168.10.1 mean at the bit level, and perform the single most important logical operation in all of subnetting: the bitwise AND.

Think of this chapter as learning to read the sheet music before you play the song. It is a small amount of arithmetic that pays for itself many times over.

Learning Objectives

By the end of this chapter, you will be able to:

• Convert between decimal and binary for IPv4 octets fluently, in both directions.
• Explain the 32-bit structure of an IPv4 address and how dotted-decimal notation maps onto it.
• Perform the bitwise operations relevant to subnetting, especially the AND operation used to find a network address.

The 32-Bit IPv4 Address

Four Octets

An IPv4 address is a 32-bit number. Thirty-two bits is a lot to look at all at once, so the designers of IPv4 split the address into four equal groups of 8 bits each. Each 8-bit group is called an octet (the prefix oct- means eight, as in octagon or octopus) [Source: https://en.wikipedia.org/wiki/Octet_(computing)]. Four octets of 8 bits each gives us 4 × 8 = 32 bits total [Source: https://en.wikipedia.org/wiki/IPv4].

Figure 2.1: The 32-bit IPv4 address split into four 8-bit octets

graph TD
    A["IPv4 Address (32 bits)"]
    A --> O1["Octet 1 (8 bits)"]
    A --> O2["Octet 2 (8 bits)"]
    A --> O3["Octet 3 (8 bits)"]
    A --> O4["Octet 4 (8 bits)"]
    O1 --> D1["Decimal 0-255"]
    O2 --> D2["Decimal 0-255"]
    O3 --> D3["Decimal 0-255"]
    O4 --> D4["Decimal 0-255"]

• A bit is a single binary digit: it can only be 0 or 1. It is the smallest unit of information a computer stores.
• An octet is a group of exactly 8 bits.

Analogy: Think of a 32-character license plate that would be impossible to read aloud. Instead, we chunk it into four readable groups, the same way a long phone number is broken into pieces (like 555-0142) so a human can actually process it. The chunks do not change the underlying number; they just make it manageable.

Dotted-Decimal Notation

Writing out all 32 bits — for example 11000000101010000000101000000001 — is error-prone and painful for humans. So we use dotted-decimal notation: we convert each 8-bit octet into its decimal equivalent (a number from 0 to 255) and separate the four resulting numbers with dots (periods) [Source: https://www.sciencedirect.com/topics/computer-science/dotted-decimal-notation]. That 32-bit string above becomes the familiar 192.168.10.1.

The table below shows how the same address lives in two representations at once. This dual view — decimal for humans, binary for the machine — is the mental habit you must build.

The dots are purely for human convenience. The computer sees one continuous 32-bit stream; the dots simply mark where one octet ends and the next begins [Source: https://medium.com/@dhwanipopat2000/networking-made-easy-a-simple-and-clear-guide-to-ip-addresses-octets-binary-and-cidr-697cc153cae6].

Address Range 0-255 Per Octet

Why does each octet only go from 0 to 255? Because an 8-bit field can represent exactly 2^8 = 256 distinct values, and by convention we count them starting at 0 — so the range is 0 through 255 inclusive [Source: https://en.wikipedia.org/wiki/IPv4].

• The minimum, 0, is every bit turned off: 00000000.
• The maximum, 255, is every bit turned on: 11111111. As we will see, 128 + 64 + 32 + 16 + 8 + 4 + 2 + 1 = 255 [Source: https://www.networkacademy.io/ccna/ip-subnetting/converting-ip-addresses-into-binary].

Because each of the four octets independently spans 0-255, the entire 32-bit IPv4 space contains 2^32 ≈ 4.29 billion unique addresses [Source: https://en.wikipedia.org/wiki/IPv4]. If you ever see an octet larger than 255 (say 192.300.10.1), you know immediately it is invalid — 300 simply cannot fit in 8 bits.

Key Takeaway: An IPv4 address is 32 bits split into four 8-bit octets, written in dotted-decimal notation like 192.168.10.1. Each octet is a decimal stand-in for 8 binary bits and therefore ranges from 0 to 255, giving the whole address space roughly 4.29 billion possible values.

Binary and Decimal Conversion

Everything in subnetting flows through binary, so fluent conversion between decimal and binary is the core skill of this chapter. The good news: you only ever have to convert one octet at a time — a number between 0 and 255 — and there is a fast, calculator-free method built on a fixed table.

Place Values: 128 64 32 16 8 4 2 1

Within a single octet, each of the eight bit positions carries a fixed place value (also called a bit weight). Reading left to right, from the most significant bit to the least significant bit, the place values are the powers of two from 2^7 down to 2^0 [Source: https://www.networkacademy.io/ccna/ip-subnetting/converting-ip-addresses-into-binary]:

Commit this row to memory: 128, 64, 32, 16, 8, 4, 2, 1. Notice each value is double the one to its right, and each is half the one to its left. This is the single most useful thing to have memorized in all of subnetting.

Analogy: Place value in binary works exactly like place value in ordinary decimal — you already do this without thinking. In the number 305, the 3 is worth 300 (hundreds place), the 0 is worth nothing (tens place), and the 5 is worth 5 (ones place). Binary is the same idea, except each column is worth a power of two instead of a power of ten, and each digit can only be 0 or 1.

The decimal value of any octet is simply the sum of the place values of every bit that is set to 1. Bits set to 0 contribute nothing [Source: https://www.networkacademy.io/ccna/ip-subnetting/converting-ip-addresses-into-binary].

Binary to Decimal

To convert a binary octet to decimal, line the 8 bits up under the place-value table and add up the place values wherever there is a 1. Ignore every 0.

Worked Example 1 — convert 10101100:

Add the place values under each 1: 128 + 32 + 8 + 4 = 172 [Source: https://www.networkacademy.io/ccna/ip-subnetting/converting-ip-addresses-into-binary].

Worked Example 2 — convert 11100011:

Add: 128 + 64 + 32 + 2 + 1 = 227 [Source: https://www.techtarget.com/searchnetworking/tip/Binary-to-decimal-conversion].

That is the whole method: place the bits, sum the 1s, done.

Decimal to Binary

Going the other way, we use the “highest column that fits” subtraction method. Work left to right across the place-value table. For each column, ask: does this place value fit into the number I have left?

• If it fits, write a 1, then subtract that place value from your running total.
• If it does not fit, write a 0 and move to the next column.

Repeat across all eight columns. Once your remainder hits 0, every remaining column is 0 [Source: https://www.networkacademy.io/ccna/ip-subnetting/converting-ip-addresses-into-binary].

Figure 2.2: The “highest column that fits” decimal-to-binary process

flowchart TD
    Start["Start with decimal value<br/>Place value = 128"]
    Q{"Does place value fit<br/>into remaining number?"}
    Yes["Write 1<br/>Subtract place value<br/>from remaining"]
    No["Write 0"]
    Next{"More columns left?"}
    Done["Done: 8-bit binary octet"]
    Start --> Q
    Q -->|"Yes, it fits"| Yes
    Q -->|"No, too big"| No
    Yes --> Next
    No --> Next
    Next -->|"Yes, move to next<br/>place value (half)"| Q
    Next -->|"No"| Done

Worked Example 3 — convert 192 to binary:

Result: 192 = 11000000. (Shortcut: 128 + 64 = 192, so only the top two bits are on) [Source: https://www.networkacademy.io/ccna/ip-subnetting/converting-ip-addresses-into-binary].

Worked Example 4 — convert 244 to binary:

Result: 244 = 11110100 [Source: https://www.networkacademy.io/ccna/ip-subnetting/converting-ip-addresses-into-binary]. You can always check your work by converting back: 128 + 64 + 32 + 16 + 4 = 244. It matches.

A Shortcut Worth Memorizing

A small set of octet values shows up constantly as subnet-mask bytes, and recognizing them on sight will speed you up enormously. Each is formed by turning on the place values from the left with no gaps — 128, then 128+64, then 128+64+32, and so on [Source: https://www.networkacademy.io/ccna/ip-subnetting/converting-ip-addresses-into-binary]:

These “contiguous 1s from the left” values are exactly what legal subnet masks look like, which is why they recur throughout the chapters ahead.

Key Takeaway: Memorize the octet place values — 128, 64, 32, 16, 8, 4, 2, 1. Convert binary to decimal by summing the place values under every 1; convert decimal to binary with the left-to-right “highest column that fits” subtraction method. Practice until it is automatic, because every subnetting operation depends on it.

Bitwise Thinking for Subnetting

Now we put binary to work. Subnetting hinges on a single logical operation applied bit by bit across an address, and understanding it is what turns rote conversion into real network reasoning.

Network Bits vs Host Bits

Every IPv4 address is conceptually divided into two parts: a network portion (which network the address belongs to) and a host portion (which specific device on that network). A subnet mask is what draws the boundary. In a subnet mask, the 1 bits mark the network portion and the 0 bits mark the host portion [Source: https://en.wikipedia.org/wiki/Subnet].

For example, the common mask 255.255.255.0 in binary is:

11111111 . 11111111 . 11111111 . 00000000
└──────── network (24 ones) ─────────┘ └ host ┘

The first 24 bits are 1s (network), and the last 8 bits are 0s (host) [Source: https://www.networkacademy.io/ccna/ip-subnetting/the-subnet-mask].

Figure 2.3: How a subnet mask divides an address into network and host portions

graph TD
    M["Subnet Mask: 255.255.255.0"]
    M --> N["Mask 1 bits = Network portion"]
    M --> H["Mask 0 bits = Host portion"]
    N --> NB["First 24 bits (11111111.11111111.11111111)<br/>Identifies which network"]
    H --> HB["Last 8 bits (00000000)<br/>Identifies which device"]

Analogy: Think of a full street address like “Apartment 15, 200 Main Street.” The “200 Main Street” part identifies the building — that is the network portion, shared by everyone in it. The “Apartment 15” part identifies one specific unit inside the building — that is the host portion, unique to a single resident. The subnet mask is the rule that tells the postal system where the building name ends and the apartment number begins.

The AND Operation

To find which network an address belongs to — its network address (or network ID) — a host or router performs a bitwise AND between the IPv4 address and its subnet mask, comparing them one bit at a time [Source: http://cisco.num.edu.mn/CCNA_R&S1/course/module8/8.1.2.5/8.1.2.5.html].

Bitwise AND is a logical operation that outputs 1 only when both input bits are 1; in every other case it outputs 0. Here is the complete truth table [Source: https://www.networkacademy.io/ccna/ip-subnetting/the-subnet-mask]:

Analogy: AND is the strict club bouncer who lets a bit through only if both ID checks pass. Bit from the address says 1, and the mask also says 1? You may pass as a 1. If either one says 0, you are turned away as a 0.

The practical effect when you AND an address against its mask is elegant:

• Wherever the mask bit is 1 (network portion), the address bit passes through unchanged. (address AND 1 = the address bit itself.)
• Wherever the mask bit is 0 (host portion), the result is forced to 0. (address AND 0 = 0 always.)

This is why the operation is described as “zeroing out the host bits.” It keeps the network bits and erases the host bits, and whatever remains is the network address [Source: https://www.networkacademy.io/ccna/ip-subnetting/the-subnet-mask].

Figure 2.4: The bitwise AND process for finding a network address

flowchart LR
    IP["Address bit"] --> AND(("AND"))
    MB["Mask bit"] --> AND
    AND --> Check{"Are both bits 1?"}
    Check -->|"Yes (mask = 1, network)"| One["Result = 1<br/>Address bit passes through"]
    Check -->|"No (mask = 0, host)"| Zero["Result = 0<br/>Host bit erased"]
    One --> Net["Network Address"]
    Zero --> Net

Worked Example: Finding a Network Address

Let us find the network address for the host 192.168.0.15 using the mask 255.255.255.0. First convert both to binary, then AND them column by column [Source: https://www.networkacademy.io/ccna/ip-subnetting/the-subnet-mask]:

IP    192.168.0.15   = 11000000 . 10101000 . 00000000 . 00001111
Mask  255.255.255.0  = 11111111 . 11111111 . 11111111 . 00000000
------------------------------------------------------------ AND
Net   192.168.0.0    = 11000000 . 10101000 . 00000000 . 00000000

Walk through it octet by octet:

• Octets 1-3 sit under all-ones mask bytes (11111111), so every bit passes through unchanged: 192.168.0 stays 192.168.0.
• Octet 4 sits under an all-zeros mask byte (00000000), so every host bit is forced to 0: the 00001111 (decimal 15) becomes 00000000 (decimal 0).

The result is the network address 192.168.0.0 [Source: https://www.networkacademy.io/ccna/ip-subnetting/the-subnet-mask].

More examples using the same logic:

In the first case the host belongs to the 192.168.10.0/24 subnet; the .75 host bits are zeroed out [Source: http://cisco.num.edu.mn/CCNA_R&S1/course/module8/8.1.2.5/8.1.2.5.html]. In the second, the default Class B mask 255.255.0.0 keeps the first two octets and zeroes the last two, giving 140.179.0.0 [Source: https://docs.oracle.com/cd/E19253-01/816-4554/ipconfig-32/index.html]. This exact AND operation is how a host or router decides which network an address belongs to, and it underpins routing decisions, subnet-membership checks, and access-control lists [Source: https://www.digitalocean.com/community/tutorials/understanding-ip-addresses-subnets-and-cidr-notation-for-networking].

Powers of Two

One more concept ties the chapter together: the power of two. A power of two is any number you get by multiplying 2 by itself some number of times — 2^0 = 1, 2^1 = 2, 2^2 = 4, 2^3 = 8, and so on up to 2^7 = 128 within an octet. You have already seen them as the place values, but they show up again whenever we count how many things a group of bits can represent:

• An 8-bit octet holds 2^8 = 256 distinct values (0-255) [Source: https://en.wikipedia.org/wiki/IPv4].
• The full 32-bit address space holds 2^32 ≈ 4.29 billion addresses [Source: https://en.wikipedia.org/wiki/IPv4].
• In later chapters, n host bits will yield 2^n addresses per subnet, and m borrowed bits will create 2^m subnets.

The pattern to internalize now: the number of bits you set aside determines a power-of-two-sized count of possibilities. Every subnetting calculation you meet from here forward is really an application of this one idea.

Key Takeaway: A subnet mask uses 1 bits for the network portion and 0 bits for the host portion, and the bitwise AND of an address with its mask yields the network address by passing network bits through and zeroing host bits. AND outputs 1 only when both inputs are 1. Group sizes in subnetting are always powers of two, so n bits count off 2^n possibilities.

Chapter Summary

This chapter established the binary foundation that all of subnetting rests on. An IPv4 address is a 32-bit value divided into four 8-bit octets, written for humans in dotted-decimal notation such as 192.168.10.1; because an octet is 8 bits, each ranges from 0 to 255, and the full space holds about 4.29 billion addresses. Within an octet the place values run 128, 64, 32, 16, 8, 4, 2, 1 — powers of two — and you now convert in both directions: binary to decimal by summing the place values under each 1, and decimal to binary by the left-to-right “highest column that fits” subtraction method. Finally, you learned the operation at the heart of subnetting: the bitwise AND, which outputs 1 only when both inputs are 1. ANDing an address with its subnet mask passes the network bits through unchanged and forces the host bits to 0, revealing the network address — the very calculation routers use to decide where traffic belongs. With fluent conversion and the AND operation in hand, you are ready to interpret subnet masks and CIDR prefixes in the chapters ahead.

Key Terms

Chapter 3: Classful Addressing and Its Limits

Before the modern, flexible world of CIDR and VLSM that this book is really about, the Internet ran on a simpler—and much more wasteful—scheme called classful addressing. Understanding it is not just history for history’s sake. Class boundaries still linger in default subnet masks, in the layout of the private address ranges you type into routers every day, and in the very reason CIDR had to be invented. This chapter walks through the five address classes, the special ranges carved out of the address space, and the specific failures that forced the industry to abandon the classful model.

Learning Objectives

By the end of this chapter, you will be able to:

• Identify IPv4 address classes A, B, C, D, and E and their default subnet masks.
• Recognize private, loopback, and reserved address ranges and explain what each is for.
• Explain why classful addressing was inefficient and why it was ultimately deprecated in favor of CIDR.

The Five Address Classes

An IPv4 address is 32 bits long, usually written as four decimal numbers (octets) separated by dots—for example, 192.168.1.10. The original addressing scheme, defined in RFC 791 (1981) and refined into the classful model, split those 32 bits into a network portion (which network you belong to) and a host portion (which specific device you are). The trick was deciding where that split falls. In the classful system, the answer depended entirely on the value of the first few leading bits of the address [Source: https://www.geeksforgeeks.org/computer-networks/introduction-of-classful-ip-addressing/].

Think of it like a postal system with only three sizes of envelope. The class of an address is fixed by its leading bits, and the class in turn dictates the default mask—the natural boundary between network and host that comes “built in” before you do any custom subnetting.

Default mask (definition): The natural, class-derived subnet mask that separates the network portion from the host portion of an address based solely on its class. Class A defaults to 255.0.0.0, Class B to 255.255.0.0, and Class C to 255.255.255.0.

How the Leading Bits Determine the Class

The elegance of the classful scheme is that a router could determine an address’s class just by inspecting the high-order bits of the first octet:

Notice the pattern: each class “claims” one more leading bit than the last. If the first bit is 0, it’s Class A. If it starts 10, it’s Class B. If 110, Class C, and so on [Source: https://www.meridianoutpost.com/resources/articles/IP-classes.php].

Figure 3.1: Leading-bit decision tree for IPv4 classes A–E

graph TD
    Start["First bit of the address"]
    Start -->|"0"| A["Class A: 1–126 (large networks)"]
    Start -->|"1"| B1["Second bit?"]
    B1 -->|"0"| B["Class B: 128–191 (medium networks)"]
    B1 -->|"1"| C1["Third bit?"]
    C1 -->|"0"| C["Class C: 192–223 (small networks)"]
    C1 -->|"1"| D1["Fourth bit?"]
    D1 -->|"0"| D["Class D: 224–239 (multicast)"]
    D1 -->|"1"| E["Class E: 240–255 (experimental)"]

Class A, B, and C: The Assignable Classes

Classes A, B, and C are the ones that were actually handed out to organizations for host addressing. Each carves the 32 bits differently:

• Class A (0 prefix) uses 8 network bits and 24 host bits. With only 8 bits (minus the reservations) to name networks, there are just 126 of them—but each one contains a staggering 2²⁴ − 2 = 16,777,214 hosts. Class A was meant for the giants: early ISPs, large corporations, and governments [Source: https://www.tutorialspoint.com/ipv4/ipv4_address_classes.htm].

• Class B (10 prefix) splits evenly: 16 network bits, 16 host bits. That yields 2¹⁴ = 16,384 networks, each holding 2¹⁶ − 2 = 65,534 hosts. Class B was the “medium” envelope, intended for universities and mid-size enterprises.

• Class C (110 prefix) uses 24 network bits and just 8 host bits. This produces a huge number of networks—2²¹ = 2,097,152—but each one holds only 2⁸ − 2 = 254 hosts. Class C was for small local area networks: small businesses and branch offices [Source: https://www.guru99.com/ip-address-classes.html].

Why “minus 2”? In every network, two host addresses are unusable for actual devices. The all-zeros host portion identifies the network itself (the network address), and the all-ones host portion is the directed broadcast address used to reach every host at once. Neither can be assigned to a real machine, so usable hosts always equal 2^(host bits) − 2 [Source: https://www.meridianoutpost.com/resources/articles/IP-classes.php].

Here is the full picture for the assignable classes:

Figure 3.2: Network/host split of the 32-bit address per assignable class

graph LR
    subgraph "Class A (/8)"
        A1["Network<br/>8 bits"] --- A2["Host — 24 bits"]
    end
    subgraph "Class B (/16)"
        B1["Network — 16 bits"] --- B2["Host — 16 bits"]
    end
    subgraph "Class C (/24)"
        C1["Network — 24 bits"] --- C2["Host<br/>8 bits"]
    end

Worked Example: Classifying an Address

Suppose you’re handed the address 172.16.40.5 and asked to find its class and default mask.

1. Look at the first octet: 172. Which range does it fall into? 172 sits between 128 and 191, so this is a Class B address.
2. Apply the class rule. Class B’s default mask is 255.255.0.0, or /16 in CIDR notation.
3. Identify the split. The first 16 bits (172.16) are the network portion; the last 16 bits (40.5) are the host portion. Under pure classful rules, 172.16.0.0 is the network, and this address is host 40.5 within it.

Try a second one: 200.1.2.3. First octet is 200, which lands in 192–223, so it’s Class C, default mask 255.255.255.0 (/24). The network is 200.1.2.0 and the host is 3.

Class D and Class E: The Special-Purpose Classes

The last two classes are never assigned to individual hosts and are not split into network/host portions at all.

Class D (leading bits 1110, range 224–239) is the entire block 224.0.0.0/4, reserved for multicast. Rather than identifying a single machine, a Class D address identifies a group of subscribers. One host can send a single stream of data—say, a live video feed—and every host that has joined that multicast group receives it, without the sender transmitting a separate copy to each [Source: https://www.geeksforgeeks.org/computer-networks/introduction-of-classful-ip-addressing/].

Multicast (definition): A one-to-many delivery model in which a single packet stream sent to a group address (224.0.0.0/4) is delivered to all hosts that have joined that group—more efficient than sending an individual copy (unicast) to each recipient.

Analogy: Unicast is a phone call to one person. Broadcast is shouting in a room so everyone hears whether they want to or not. Multicast is a subscription newsletter—only the people who signed up get a copy, and the publisher writes it once.

Class E (leading bits 1111, range 240–255) is the block 240.0.0.0/4, reserved for research and experimental use. It was never assigned for normal host addressing. Note that the very last address, 255.255.255.255, is carved out separately as the limited broadcast address [Source: https://www.meridianoutpost.com/resources/articles/IP-classes.php].

Key Takeaway: IPv4’s classful model used the leading bits of the first octet to sort every address into one of five classes. Classes A, B, and C were assignable to hosts and each came with a fixed default mask (/8, /16, /24) that set the network/host boundary, while Class D was reserved for multicast and Class E for experiments. Usable hosts per network always equal 2^(host bits) − 2 because of the network and broadcast reservations.

Special and Reserved Ranges

Not every address in the 32-bit space is up for grabs. Certain blocks are permanently set aside for special jobs—private networks, loopback testing, auto-configuration, and documentation—and you will encounter them constantly in real work. These carve-outs are governed by the IANA IPv4 Special-Purpose Address Registry and a series of RFCs [Source: https://developers.cloudflare.com/cloudflare-one/networks/routes/reserved-ips/].

RFC 1918: The Private Address Ranges

The single most important set of reserved addresses is defined by RFC 1918 (“Address Allocation for Private Internets,” February 1996). These blocks are reserved for use inside private networks and are never routed on the public Internet. Because they never appear on the global Internet, any organization may reuse them freely without coordinating with anyone else—which is exactly why your home router almost certainly hands out addresses in 192.168.x.x [Source: https://systemsrubixjm.com/blog/2026/06/rfc-1918-private-ip-addresses-guide].

RFC 1918 (definition): The 1996 standard reserving three private IPv4 blocks—10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16—for internal use on private networks. These addresses are non-routable on the public Internet and can be reused by any organization.

Because these overlap privately across millions of networks, a device with an RFC 1918 address must go through Network Address Translation (NAT) to reach the public Internet—but NAT is a topic for a later chapter. For now, just recognize these three ranges on sight.

Analogy: RFC 1918 addresses are like internal room numbers in an office building. Thousands of buildings all have a “Room 101,” and that’s fine because the number is only meaningful inside the building. To receive mail from outside, the building needs one public street address (the job NAT performs).

Loopback: 127.0.0.0/8

The entire block 127.0.0.0/8 is reserved for loopback (RFC 1122). Any packet sent to a 127.x.x.x address never leaves the machine—it loops straight back to the sending host. The conventional address 127.0.0.1 is universally known as localhost, and developers use it to test network software against their own machine [Source: https://krasoff.com/networking/2025-12-12-16-00-non-routable-internet-addresses.html].

Loopback (definition): The reserved block 127.0.0.0/8 whose traffic is looped back to the local host rather than sent onto the network. 127.0.0.1 (“localhost”) is the standard address for a machine to communicate with itself.

This reservation is also the reason the assignable Class A range stops at 126 rather than 127: the entire 127 block was claimed for loopback, so it could never be an ordinary Class A network [Source: https://krasoff.com/networking/2025-12-12-16-00-non-routable-internet-addresses.html].

APIPA and Documentation Ranges

A few more special blocks round out the picture:

• 169.254.0.0/16 — Link-local / APIPA. Defined in RFC 3927, this is Automatic Private IP Addressing. When a host is set to obtain an address via DHCP but no DHCP server can be reached, it auto-assigns itself an address in this range so it can at least talk to other machines on the same local link. These addresses are never routed. If you’ve ever seen a device with a 169.254.x.x address, it’s a strong sign that DHCP failed [Source: https://developers.cloudflare.com/cloudflare-one/networks/routes/reserved-ips/].

• Documentation ranges (RFC 5737). Three blocks are reserved specifically so that examples, tutorials, and manuals can use realistic-looking addresses that will never collide with real routable space: 192.0.2.0/24 (TEST-NET-1), 198.51.100.0/24 (TEST-NET-2), and 203.0.113.0/24 (TEST-NET-3) [Source: https://cidrtools.net/cheatsheets/private-ranges/].

• 100.64.0.0/10 — CGNAT shared address space. Reserved by RFC 6598 (2012), this block gives ISPs 4,194,304 addresses to place between their customers and the public Internet for Carrier-Grade NAT, without colliding with the customers’ own RFC 1918 space [Source: https://docs.enclave.io/kb/what-are-100.64.x.x-ip-addresses/].

Here is a consolidated reference of the reserved and special-use ranges:

[Source: https://developers.cloudflare.com/cloudflare-one/networks/routes/reserved-ips/] [Source: https://krasoff.com/networking/2025-12-12-16-00-non-routable-internet-addresses.html]

Key Takeaway: Large chunks of the IPv4 space are permanently reserved. The three RFC 1918 private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) are non-routable and freely reusable inside any private network; 127.0.0.0/8 loops traffic back to the local host; and 169.254.0.0/16 (APIPA) is what a host assigns itself when DHCP fails. Documentation ranges like 192.0.2.0/24 exist so examples never clash with real addresses.

Why Classful Failed

The classful model was clean and easy for routers to parse, but it contained a fatal flaw: it offered only three coarse, fixed sizes, and none of them matched the size of a typical organization. That single mismatch cascaded into several serious problems that, by the early 1990s, threatened the growth of the Internet itself [Source: https://www.geeksforgeeks.org/classful-vs-classless-addressing/].

Problem 1: The Sizing Gap and Wasted Space

The heart of the failure was granularity. Recall the three assignable sizes:

• Class C: 254 hosts — too small for most organizations.
• Class B: 65,534 hosts — far too large for those same organizations.
• Class A: 16.7 million hosts — astronomically oversized.

There was nothing in between. Imagine an organization that needs to number 2,000 hosts. A Class C only holds 254—nowhere near enough. So the organization is forced to take an entire Class B, which holds 65,534. It uses 2,000 and wastes roughly 63,000 addresses, which are now locked away and cannot be used by anyone else [Source: https://www.practicalnetworking.net/stand-alone/classful-cidr-flsm-vlsm/].

Analogy: It’s like a shoe store that only stocks children’s size 1, adult size 9, and clown-sized 30. If you wear a size 11, your only option is the size 30—the rest of the shoe is wasted, and there’s no size 11 left for anyone who actually needs it.

This coarse granularity wasted enormous quantities of the finite 32-bit space (about 4.3 billion addresses total), directly accelerating overall IPv4 exhaustion [Source: https://www.practicalnetworking.net/stand-alone/classful-cidr-flsm-vlsm/].

Problem 2: Class B Exhaustion

Because Class B was the only “reasonable” size for medium and large organizations, everyone reached for it. Class B blocks were consumed rapidly and were projected to run out entirely. This impending exhaustion of the Class B pool was one of the two primary crises driving the search for a replacement [Source: https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing].

Problem 3: Routing-Table Explosion

The natural workaround for the sizing gap was to avoid handing out oversized Class B blocks and instead give organizations multiple Class C blocks stitched together. But this created a new problem at Internet scale. Each separate Class C block had to be advertised to the rest of the Internet as its own individual route. As thousands upon thousands of Class C prefixes were announced separately, the routing tables on Internet backbone routers ballooned, threatening to exceed the memory and processing capacity of the routers themselves [Source: https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing].

So the classful model created a lose-lose: allocate by Class B and waste addresses, or allocate by many Class Cs and overwhelm the routers.

Figure 3.3: The classful lose-lose dilemma

flowchart TD
    Need["Organization needs ~2,000 hosts (no matching class size)"]
    Need --> OptB["Option A: assign one Class B (65,534 hosts)"]
    Need --> OptC["Option B: assign many Class C blocks"]
    OptB --> Waste["Wastes ~63,000 addresses<br/>→ accelerates IPv4 exhaustion"]
    OptC --> Routes["Each block = a separate route"]
    Routes --> Explosion["Backbone routing tables explode<br/>→ exceed router memory"]

The Transition to CIDR

The solution, introduced in 1993 and formalized in RFC 1519 (later updated by RFC 4632), was CIDR—Classless Inter-Domain Routing. CIDR’s core idea is simple but transformative: abandon the rigid A/B/C class boundaries entirely and let the network/host split fall on any bit position, expressed as a prefix length such as /20 or /27 [Source: https://datatracker.ietf.org/doc/rfc1519/].

This delivered two decisive benefits that directly answered the three problems above:

1. Right-sized allocations. With arbitrary prefix lengths, address blocks could be cut to fit actual need. That organization needing 2,000 hosts could receive a /21 (2,046 usable hosts) instead of being forced into a full /16—slashing the waste from ~63,000 addresses down to a few dozen [Source: https://www.digitalocean.com/community/tutorials/understanding-ip-addresses-subnets-and-cidr-notation-for-networking].

2. Route aggregation (supernetting). Multiple contiguous prefixes could be summarized into a single routing-table entry. For example, the four networks 192.168.0.0/24, 192.168.1.0/24, 192.168.2.0/24, and 192.168.3.0/24 aggregate into a single 192.168.0.0/22—collapsing four routes into one and dramatically slowing routing-table growth [Source: https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing].

Working alongside CIDR is VLSM (Variable-Length Subnet Masking), the technique that lets a single network be subdivided into subnets of different sizes. A large user LAN might get a /24, while a point-to-point WAN link that needs only two host addresses gets a tiny /30—instead of forcing every subnet to use one fixed mask and wasting addresses on the small links [Source: https://www.practicalnetworking.net/stand-alone/classful-cidr-flsm-vlsm/].

Figure 3.4: How CIDR and VLSM answer the classful failures

flowchart LR
    Classful["Classful model<br/>(fixed A/B/C sizes)"] --> CIDR["CIDR (RFC 1519, 1993)<br/>arbitrary prefix lengths"]
    CIDR --> Right["Right-sized allocations<br/>(e.g. /21 for ~2,000 hosts)"]
    CIDR --> Agg["Route aggregation / supernetting<br/>(four /24 → one /22)"]
    CIDR --> VLSM["VLSM<br/>variable subnet sizes within one network"]
    Right --> Fix1["Fixes address waste"]
    Agg --> Fix2["Fixes routing-table explosion"]
    VLSM --> Fix3["Fixes intra-domain waste (e.g. /30 WAN links)"]

Together, CIDR (for inter-domain allocation and aggregation) and VLSM (for intra-domain subnetting) replaced the classful model completely and remain the foundation of IPv4 addressing today. The rest of this book is, in effect, a detailed study of the classless world that these two ideas created.

Key Takeaway: Classful addressing failed because its only three sizes—254, 65,534, and 16.7 million hosts—never matched real needs, forcing either massive address waste (oversized Class B allocations) or routing-table explosion (many separate Class C routes). CIDR (RFC 1519, 1993) fixed this by allowing arbitrary prefix lengths for right-sized allocations and route aggregation, with VLSM enabling variable subnet sizes within one network.

Chapter Summary

Classful addressing organized the 32-bit IPv4 space into five classes distinguished by their leading bits. Classes A (/8), B (/16), and C (/24) were assignable to hosts and carried fixed default masks that set the network/host boundary; each network’s usable host count is 2^(host bits) − 2 because of the network and broadcast reservations. Class D (224.0.0.0/4) was reserved for multicast and Class E (240.0.0.0/4) for experimentation.

Large portions of the space are permanently reserved for special jobs. The RFC 1918 private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) are non-routable and reusable inside any private network; 127.0.0.0/8 provides loopback (with 127.0.0.1 as localhost); 169.254.0.0/16 supplies APIPA link-local addresses when DHCP is unavailable; and blocks like 192.0.2.0/24 are set aside for documentation.

The classful model was ultimately deprecated because its three coarse sizes wasted enormous amounts of address space, drove Class B toward exhaustion, and—when worked around with many Class C blocks—caused backbone routing tables to explode. CIDR, introduced in 1993, solved all three by allowing arbitrary prefix lengths for right-sized allocations and route aggregation, with VLSM enabling variable subnet sizes within a single network. These classless techniques are the subject of the chapters that follow.

Key Terms

Chapter 4: Subnet Masks Explained

An IP address, on its own, is only half a story. The address 192.168.10.50 tells you who a device is, but it says nothing about where that device lives — which network it belongs to, and which of its neighbors it can talk to directly. The piece of information that supplies the missing half is the subnet mask: a companion 32-bit value that travels alongside every IPv4 address and draws the dividing line between “the network” and “the individual host.” This chapter takes the subnet mask apart, bit by bit, so that you can read one on sight, translate it between decimal and binary, and use it to compute exactly which network an address belongs to.

Learning Objectives

By the end of this chapter, you will be able to:

• Interpret a subnet mask in both dotted-decimal and binary form.
• Distinguish network bits from host bits using the mask.
• Map common subnet masks to their meaning.

What a Mask Does

Separating network from host

A subnet mask is a 32-bit number that partners with a 32-bit IPv4 address to answer a single question: which bits identify the network, and which bits identify the individual host on that network? [Source: https://en.wikipedia.org/wiki/Subnetwork]

Think of a full postal address. “1600 Pennsylvania Avenue NW, Washington, DC” contains two kinds of information wrapped together: the city and street (which neighborhood you are in) and the house number (which specific building you are). A subnet mask is the rule that tells you where the “city and street” part of an IP address ends and the “house number” part begins. Everyone who shares the same city-and-street is a local neighbor; anyone with a different one requires the mail to be routed elsewhere.

The mask does this by marking each of the 32 bits of the address as either a network bit or a host bit:

• Wherever the mask has a 1, the corresponding bit of the address belongs to the network portion (also called the network prefix).
• Wherever the mask has a 0, the corresponding bit belongs to the host portion. [Source: https://en.wikipedia.org/wiki/Subnetwork]

So for the address 192.168.10.50 with the mask 255.255.255.0, the first three octets (192.168.10) are the network and the final octet (50) is the host. [Source: https://en.wikipedia.org/wiki/Subnetwork]

Figure 4.1: How the mask splits an address into network and host portions

graph TD
    A["Subnet Mask: 255.255.255.0"] --> B["Mask bit = 1<br/>(network side)"]
    A --> C["Mask bit = 0<br/>(host side)"]
    B --> D["Network portion:<br/>192.168.10"]
    C --> E["Host portion:<br/>50"]
    D --> F["Identifies WHICH network<br/>(the neighborhood)"]
    E --> G["Identifies WHICH host<br/>(the specific building)"]

Contiguous 1s then 0s

A valid subnet mask is not just any arrangement of 1s and 0s. It must be a contiguous mask: a solid run of 1-bits followed by a solid run of 0-bits — ones first, then zeros, with no interleaving and no gaps. [Source: https://en.wikipedia.org/wiki/Subnetwork]

This rule has an important consequence. Because the 1s all come first and the 0s all come after, the boundary between the network portion and the host portion is a single point somewhere in the 32-bit string. You never have network bits scattered on both sides of host bits — the split is clean, like tearing a strip of paper once rather than shredding it.

The netmask bits must be contiguous, but they are not required to align on octet (byte) boundaries. That single detail is what makes masks like /26 or 255.255.255.192 legal: the dividing line can fall in the middle of an octet, not only at the neat 8-bit marks. [Source: https://en.wikipedia.org/wiki/Subnetwork] We will return to these non-octet-aligned masks shortly.

Reading masks in binary

A subnet mask is written exactly the way an IP address is written: four octets in dotted-decimal form, each octet being 8 bits, separated by dots — for example, 255.255.255.0. The decimal form is convenient for humans, but the meaning of a mask only becomes obvious once you expand it into binary. [Source: https://en.wikipedia.org/wiki/Subnetwork]

Written out, 255.255.255.0 is:

11111111.11111111.11111111.00000000

Read left to right, the 24 leading ones announce “the first 24 bits are network,” and the 8 trailing zeros announce “the last 8 bits are host.” [Source: https://www.networkacademy.io/ccna/ip-subnetting/the-subnet-mask]

This is the very same information that CIDR notation captures as /24. The prefix length after the slash is nothing more than the count of 1-bits in the mask. Counting the ones above gives 24, so 255.255.255.0 and /24 are two ways of writing the identical fact. [Source: https://www.networkacademy.io/ccna/ip-subnetting/the-subnet-mask]

The reason 255 appears so often in masks is that 255 is what you get when all eight bits of an octet are set to 1 (128 + 64 + 32 + 16 + 8 + 4 + 2 + 1 = 255). An octet of 0 means all eight bits are host bits. This is why fully “network” octets read as 255 and fully “host” octets read as 0.

Key Takeaway: A subnet mask is a 32-bit companion to an IP address whose 1-bits mark network bits and 0-bits mark host bits. A valid mask is always contiguous — a run of 1s followed by a run of 0s — and the count of those 1s is exactly the CIDR prefix length, so 255.255.255.0 and /24 mean the same thing.

Common Subnet Masks

255.0.0.0, 255.255.0.0, 255.255.255.0

Three masks show up constantly because they fall precisely on octet boundaries, which makes them the easiest to read at a glance:

• 255.0.0.0 (/8) — binary 11111111.00000000.00000000.00000000. The first octet is network; the last three are host. This is an enormous block.
• 255.255.0.0 (/16) — binary 11111111.11111111.00000000.00000000. The first two octets are network; the last two are host.
• 255.255.255.0 (/24) — binary 11111111.11111111.11111111.00000000. The first three octets are network; the last octet is host. This is the classic “one office LAN” size.

Because each of these masks either fully includes an octet (255) or fully excludes it (0), you can read the network/host split just by looking at which octets are 255. No binary math required.

Non-octet-aligned masks

The clean octet-boundary masks are the easy cases, but the mask boundary is allowed to fall inside an octet. When it does, that octet shows a value other than 0 or 255. This is where memorizing the “magic” octet values pays off.

Within a single octet, as network bits fill in from the high (left) end, the octet can only ever take one of nine legal values:

0, 128, 192, 224, 240, 248, 252, 254, 255

These correspond to 0 through 8 network bits in that octet. [Source: https://www.showmyip.com/learn/subnet-cheat-sheet/] The pattern is that each step turns on one more high-order bit:

These nine values are worth committing to memory, because they let you translate quickly between a CIDR prefix and a dotted-decimal mask. [Source: https://www.showmyip.com/learn/subnet-cheat-sheet/]

Worked example — converting /26 to a mask. A /26 has 26 network bits. That is 24 bits (three full octets of 255) plus 2 more bits in the fourth octet. Two bits set from the high end of an octet gives 11000000, which is 192. So:

/26  =  24 network bits + 2 more
     =  255 . 255 . 255 . (2 bits) 
     =  255 . 255 . 255 . 192

The mask 255.255.255.192 is perfectly valid even though its final octet is neither 0 nor 255 — the network/host boundary simply falls two bits into the last octet. [Source: https://www.showmyip.com/learn/subnet-cheat-sheet/]

The mask reference table

The table below maps common CIDR prefixes to their dotted-decimal subnet mask, the inverse wildcard mask, the total number of addresses in the block, and the number of usable hosts. This single table is one of the most-consulted tools in all of networking, and understanding how its columns relate is the goal of this chapter.

[Source: https://www.showmyip.com/learn/subnet-cheat-sheet/] [Source: https://www.ripe.net/documents/3545/IPv4_CIDR_Chart_2015.pdf]

Two of these columns deserve a note now; the host-count columns are explained in detail in the next section.

The wildcard mask column is the bit-for-bit inverse of the subnet mask, and it is easy to compute: subtract each octet of the subnet mask from 255. [Source: https://ipcisco.com/lesson/wildcard-mask/]

Subnet mask :  255.255.255.0
Subtraction :  255-255 . 255-255 . 255-255 . 255-0
Wildcard    :    0    .    0    .    0    .  255      ->  0.0.0.255

A wildcard mask looks identical to a subnet mask on paper — four dotted-decimal octets — but it carries the opposite meaning, bit for bit. In a subnet mask, a 1 means “this bit is part of the network”; in a wildcard mask, a 0 means “this bit must match exactly” and a 1 means “don’t care — this bit can be anything.” [Source: https://ipcisco.com/lesson/wildcard-mask/] [Source: https://packetlife.net/blog/2008/sep/11/mask-comparison-subnet-versus-wildcard/]

Structurally, this reversal shows up in where the runs sit: subnet masks put their 1s at the beginning (the network side), while wildcard masks put their 0s at the beginning. A larger CIDR prefix (a smaller host portion) therefore produces a smaller wildcard mask, and vice versa. [Source: https://ipcisco.com/lesson/wildcard-mask/]

You will rarely configure a wildcard mask on a host interface. Instead, they appear in Cisco IOS configurations wherever you need to specify a range of addresses — most commonly in Access Control Lists (ACLs) and in the network statements of routing protocols like OSPF and EIGRP. For instance, access-list 10 permit 192.168.1.0 0.0.0.255 matches every address in 192.168.1.0/24. [Source: https://www.ciscopress.com/articles/article.asp?p=3089353&seqNum=5] [Source: https://www.geeksforgeeks.org/computer-networks/wildcard-mask-in-networking/] One subtle difference: because wildcard bits only need to say “don’t care” per bit, wildcard masks are not strictly required to be contiguous — a freedom that lets them match patterns (such as only odd or only even subnets) that a contiguous subnet mask could never express. [Source: https://www.geeksforgeeks.org/computer-networks/wildcard-mask-in-networking/]

Key Takeaway: Octet-aligned masks (255.0.0.0, 255.255.0.0, 255.255.255.0) are read at a glance, while non-octet-aligned masks use one of the nine legal octet values (0, 128, 192, 224, 240, 248, 252, 254, 255) to place the boundary inside an octet. The reference table ties CIDR prefixes to masks, wildcard masks (the 255-minus-each-octet inverse), and host counts.

Applying the Mask

Knowing what a mask is becomes useful the moment you apply it to an address. The mask’s central job is to extract the network address from any host address, and it does so through one specific operation.

Deriving the network address

The mask is applied to an address through a bitwise AND. Performing IP address AND subnet mask yields the network address (also called the subnet address or routing prefix). [Source: https://en.wikipedia.org/wiki/Subnetwork]

The AND operation compares the two values one bit at a time, following this truth table:

• 1 AND 1 = 1
• 1 AND 0 = 0
• 0 AND 1 = 0
• 0 AND 0 = 0

[Source: https://networklessons.com/subnetting/subnetting-in-binary]

Notice the pattern hidden in that table: AND-ing any bit with 1 preserves it (1 AND 1 = 1, 0 AND 1 = 0 — the original bit survives), while AND-ing any bit with 0 clears it to 0 no matter what. Because the mask has 1s over the network portion and 0s over the host portion, the AND operation keeps the network bits exactly as they are and zeroes out every host bit. The result is the base address of the block. [Source: https://en.wikipedia.org/wiki/Subnetwork]

Worked example — 192.168.10.50 with 255.255.255.0. Let us line up the address and the mask in binary and AND them column by column:

IP address :  192.168.10.50   = 11000000.10101000.00001010.00110010
Subnet mask:  255.255.255.0   = 11111111.11111111.11111111.00000000
------------------------------  AND ---------------------------------
Network    :  192.168.10.0    = 11000000.10101000.00001010.00000000

[Source: https://www.netstuts.com/subnet-calculation]

Walk through it octet by octet. In the first three octets, the mask is all 1s, so every bit of the address is preserved — 192, 168, and 10 pass through unchanged. In the fourth octet, the mask is all 0s, so every bit of the host value 50 (00110010) is cleared to 0. The final octet becomes 00000000 = 0, giving the network address 192.168.10.0. [Source: https://www.netstuts.com/subnet-calculation]

This is exactly how a router decides whether a destination is local or must be forwarded: it ANDs the destination address with the relevant mask and checks whether the result matches its own network. Every host that produces the same result from this AND operation is on the same subnet. [Source: https://en.wikipedia.org/wiki/Subnetwork]

Figure 4.2: The bitwise AND process for deriving a network address

flowchart TD
    A["IP address<br/>192.168.10.50"] --> C{"Bitwise AND<br/>bit by bit"}
    B["Subnet mask<br/>255.255.255.0"] --> C
    C --> D["Mask bit = 1<br/>preserve the address bit"]
    C --> E["Mask bit = 0<br/>clear the address bit to 0"]
    D --> F["Network bits kept:<br/>192.168.10"]
    E --> G["Host bits zeroed:<br/>.0"]
    F --> H["Network address<br/>192.168.10.0"]
    G --> H

Identifying the host portion

If the AND operation isolates the network portion, the leftover bits — everything the mask marked with a 0 — are the host portion. In the worked example above, the host portion is the final octet, and for the address 192.168.10.50 the host value is 50.

A helpful way to see the split is to overlay the mask on the address and read off the two zones:

Address :  192 . 168 . 10 . 50
Mask    :  255 . 255 . 255 . 0
Role    :  NET   NET   NET   HOST

The three octets sitting under a mask value of 255 are network; the one octet sitting under a mask value of 0 is host. For non-octet-aligned masks, this same overlay works at the bit level — the boundary just lands partway through an octet, so a single octet can be split into some network bits and some host bits.

Mask and host count relationship

The mask does more than locate a network address — it also dictates how many hosts that network can hold. The relationship comes straight from the number of host bits.

Let n be the number of host bits, which is simply the total bits minus the prefix:

n = 32 − prefix

Then, for a normal subnet:

• Total addresses in the block = 2ⁿ
• Usable hosts = 2ⁿ − 2

[Source: https://www.showmyip.com/learn/subnet-cheat-sheet/]

The “minus 2” accounts for two addresses that cannot be assigned to a device: the all-zeros host address is reserved as the network address (the block’s base, which we just derived with the AND), and the all-ones host address is reserved as the broadcast address. [Source: https://www.showmyip.com/learn/subnet-cheat-sheet/]

Figure 4.3: Deriving host capacity from the prefix

flowchart LR
    A["Prefix length<br/>e.g. /24"] --> B["Host bits<br/>n = 32 − prefix"]
    B --> C["Total addresses<br/>2ⁿ"]
    C --> D["Subtract 2:<br/>network + broadcast"]
    D --> E["Usable hosts<br/>2ⁿ − 2"]

Worked example — how many hosts fit in a /24? A /24 has a prefix of 24, so:

n = 32 − 24 = 8 host bits
Total addresses = 2⁸ = 256
Usable hosts    = 2⁸ − 2 = 254

That matches the /24 row of the reference table exactly: 256 total, 254 usable. [Source: https://www.showmyip.com/learn/subnet-cheat-sheet/]

Worked example — the point-to-point case. A /30 has n = 32 − 30 = 2 host bits, so 2² = 4 total addresses and only 4 − 2 = 2 usable hosts. Two usable addresses is precisely what a link between two routers needs — one for each end — which is why /30 (and, increasingly, /31, which is a special-case exception to the minus-2 rule) is the classic choice for point-to-point links. [Source: https://www.showmyip.com/learn/subnet-cheat-sheet/]

The takeaway from this arithmetic is a design lesson: the more network bits you commit (the larger the prefix), the fewer host bits remain, and the fewer devices each subnet can hold. Choosing a mask is therefore always a trade-off between the number of subnets you can carve out and the number of hosts each one can support — the exact tension that VLSM, covered in a later chapter, is designed to resolve.

Key Takeaway: Apply a mask by AND-ing it with an IP address: 1-bits preserve the network portion and 0-bits zero out the host portion, yielding the network address. The host bits that remain determine capacity, where n = 32 − prefix gives 2ⁿ total addresses and 2ⁿ − 2 usable hosts after reserving the network and broadcast addresses.

Chapter Summary

A subnet mask is the 32-bit value that gives an IP address its meaning by splitting it into a network portion and a host portion. Its 1-bits mark network bits and its 0-bits mark host bits, and because a valid mask is always contiguous — a run of 1s followed by a run of 0s — that split is a single clean boundary. The count of 1-bits is the CIDR prefix, so 255.255.255.0 and /24 are the same fact expressed two ways.

Masks come in two flavors of readability. Octet-aligned masks (255.0.0.0, 255.255.0.0, 255.255.255.0) can be read directly, while non-octet-aligned masks place the boundary inside an octet using one of the nine legal octet values (0, 128, 192, 224, 240, 248, 252, 254, 255). The mask reference table ties each CIDR prefix to its dotted-decimal mask, its inverse wildcard mask, and its host count.

To use a mask, you AND it with an address: the operation preserves the network bits and clears the host bits, producing the network address that routers use to decide “local or remote.” Finally, the number of host bits fixes capacity — with n = 32 − prefix, a block holds 2ⁿ total addresses and 2ⁿ − 2 usable hosts, revealing the constant trade-off between number of subnets and hosts per subnet that shapes every subnetting decision.

Key Terms

Chapter 5: CIDR Notation and Prefix Length

Up to this point you have learned to think about IP addresses in terms of network and host portions, and you have seen the old “classful” system that carved the internet into a handful of fixed sizes. This chapter introduces the notation that replaced that rigid system and now underpins every modern network design: CIDR (Classless Inter-Domain Routing) and its compact companion, the prefix length. By the end of the chapter you will be able to read an address such as 10.0.0.0/8 at a glance, translate any /nn value into a dotted-decimal subnet mask in your head, and explain why this seemingly small change in notation was one of the most important upgrades in the history of the internet.

Learning Objectives

By the end of this chapter, you will be able to:

• Translate between CIDR prefix notation (the /nn slash) and dotted-decimal subnet masks in both directions.
• Explain how CIDR enables classless allocation and why that matters for the internet.
• Read and write addresses in /nn notation confidently, including special cases like /31 and /32.

The Slash Notation

If you have spent any time around routers, firewalls, or cloud consoles, you have seen addresses written with a slash and a number: 192.168.0.15/24, 10.0.0.0/8, 172.16.0.0/16. This is slash notation (also called CIDR notation), and it is simply a shorthand that packs an IP address and its subnet mask into a single, unambiguous string [Source: https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing].

The format is always the same: an IP address, a slash character /, and a decimal number. That number is the prefix length [Source: https://www.digitalocean.com/community/tutorials/understanding-ip-addresses-subnets-and-cidr-notation-for-networking].

Prefix length as a bit count

Here is the single most important idea in this chapter: the number after the slash is literally the count of consecutive leading 1 bits in the subnet mask, reading from left to right [Source: https://docs.netgate.com/pfsense/en/latest/network/cidr.html].

Recall that an IPv4 address is 32 bits long. The prefix length tells you how many of those 32 bits belong to the network portion; whatever is left over is the host portion.

• The prefix bits — the 1s — mark the network.
• The trailing bits — the 0s — mark the host.

So /24 means “the first 24 bits are network, the last 8 bits are host.” Written out in binary, the mask for /24 looks like this, grouped into four octets:

/24  →  11111111.11111111.11111111.00000000  →  255.255.255.0

Count the 1s in 255.255.255.0 and you get exactly 24 — which is why the network is written /24, pronounced “slash twenty-four” [Source: https://docs.netgate.com/pfsense/en/latest/network/cidr.html].

Figure 5.1: Prefix length as the bit boundary between network and host portions

flowchart LR
    subgraph Bits["32-bit IPv4 address"]
        direction LR
        N["Network portion<br/>bits 1-24<br/>(the prefix: 24 leading 1s)"]
        H["Host portion<br/>bits 25-32<br/>(trailing 0s)"]
    end
    N -. "boundary drawn at /24" .-> H
    N --> MaskN["Mask: 11111111.11111111.11111111"]
    H --> MaskH["Mask: 00000000"]
    MaskN --> Result["255.255.255.0  =  /24"]
    MaskH --> Result

Analogy — a phone number and its area code. Think of a full IP address like a complete phone number. The prefix length is like drawing a line that says “everything to the left of this point is the area code (which region you belong to), and everything to the right is your personal line number.” A /24 draws that line after 24 digits of binary; a /16 draws it earlier, after 16. The line can slide left or right, but everyone on the same side of the line for the network portion is considered “local” to one another.

The mask is not just for humans to read. At the packet level, a router applies the mask to an address using a bitwise AND operation, which zeroes out the host bits and leaves only the network address behind. That extracted network address is how the router decides where a packet belongs [Source: https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing].

Figure 5.2: How a router extracts the network address with a bitwise AND

flowchart TD
    A["IP address<br/>192.168.0.15"]
    B["Subnet mask (/24)<br/>255.255.255.0"]
    A --> AND{"bitwise AND<br/>(bit-by-bit)"}
    B --> AND
    AND --> C["Network address<br/>192.168.0.0"]
    C --> D["Router matches this against<br/>its routing table to decide<br/>where the packet belongs"]

/8, /16, /24, and everything in between

The old classful system only allowed three network sizes, and they happened to land on tidy octet boundaries:

• /8 (Class A) — 8 network bits.
• /16 (Class B) — 16 network bits.
• /24 (Class C) — 24 network bits.

The power of CIDR is that the prefix is not restricted to these multiples of 8. It can be any value from /0 to /32 [Source: https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing]. A /23 is perfectly valid (23 network bits, 9 host bits), as is a /26 or a /30. This freedom to place the network/host boundary at any bit position is the mathematical heart of variable-length subnet masking (VLSM), which CIDR is built on [Source: https://jumpcloud.com/it-index/what-is-cidr-classless-inter-domain-routing].

CIDR vs. classful

The contrast is worth stating plainly:

Under classful rules, the class of an address was implied by its first few bits, and the mask was assumed. Under CIDR, nothing is assumed — the prefix length is stated explicitly every time, which is exactly why the notation is so useful [Source: https://www.geeksforgeeks.org/classful-vs-classless-addressing/].

Key Takeaway: Slash notation writes an IP address and its mask as one string, address/prefix. The prefix length is the count of leading 1 bits in the mask — how many of the 32 bits are the network portion — and unlike the old classful system, it can be any value from /0 to /32.

CIDR and Address Allocation

Understanding what CIDR is leads naturally to the question of why it was invented. CIDR was introduced by the IETF in 1993 through RFC 1518 and RFC 1519 (later updated by RFC 4632 in 2006) to solve two urgent problems that classful addressing had created: the rapid exhaustion of the IPv4 address space, and the runaway growth of internet routing tables [Source: https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing]. These were the two original design goals of CIDR [Source: https://www.techtarget.com/searchnetworking/definition/CIDR].

The purpose: ending the waste of classful allocation

The classful system forced every network into one of a few predetermined sizes:

• Class A (/8) — roughly 16.7 million addresses.
• Class B (/16) — 65,536 addresses.
• Class C (/24) — 256 addresses.

Consider an organization that needs 500 addresses. A single Class C is too small — it holds only 254 usable hosts. So under classful rules, that organization was bumped up to a Class B allocation of over 65,000 addresses, of which it would use fewer than 1%. Roughly 99% of that enormous block sat idle, unusable by anyone else [Source: https://jumpcloud.com/it-index/classful-vs-classless-addressing-understanding-ip-allocation-methods].

CIDR fixes this by allowing right-sized (classless) allocation. Because the prefix can fall on any bit boundary, an administrator can hand out a block that closely matches the real requirement. For the 500-host organization, a /23 provides 510 usable hosts — a near-perfect fit instead of a wasteful /16 [Source: https://jumpcloud.com/it-index/classful-vs-classless-addressing-understanding-ip-allocation-methods]. This fine-grained control directly slows the depletion of the IPv4 address pool.

Analogy — renting the right amount of storage. Classful allocation was like a storage company that rented only three unit sizes: a closet, a garage, or an entire warehouse. If your belongings didn’t fit in the closet, your only option was the warehouse — and you paid for (and blocked off) all that empty space. CIDR is like a company that will build a unit to whatever size you actually need, so almost nothing is wasted.

Provider address blocks

CIDR reshaped how addresses flow from the top of the internet down to end users. Regional registries hand large blocks to Internet Service Providers (ISPs), and the ISPs then subdivide those blocks classlessly and delegate smaller pieces to their customers [Source: https://jumpcloud.com/it-index/what-is-cidr-classless-inter-domain-routing]. An ISP might hold a /16 and carve it into hundreds of customer-sized /24s, /26s, or /29s, each sized to the customer’s needs. The address block — a contiguous range of addresses described by a single CIDR prefix — becomes the fundamental unit of allocation.

Figure 5.3: Provider address-block allocation hierarchy

graph TD
    RIR["Regional Internet Registry<br/>hands out large blocks"]
    ISP["ISP holds a /16<br/>(65,536 addresses)"]
    C1["Customer A: /24<br/>(254 hosts)"]
    C2["Customer B: /26<br/>(62 hosts)"]
    C3["Customer C: /29<br/>(6 hosts)"]
    RIR --> ISP
    ISP --> C1
    ISP --> C2
    ISP --> C3

Reducing routing table size through supernetting

The second problem CIDR solved is subtler but just as important. Every distinct network the internet knows about needs an entry in the routing tables of core routers. Under classful routing, each network required its own separate entry, and as the internet grew, these tables ballooned toward sizes that threatened router memory and performance [Source: https://www.techtarget.com/searchnetworking/definition/CIDR].

CIDR’s answer is route aggregation, also called supernetting. Multiple contiguous network blocks that share the same leading bits can be collapsed into a single routing table entry described by a shorter prefix — a supernet [Source: https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing].

Here is a worked example. Suppose an ISP controls sixteen contiguous /24 networks that all share the same first 20 bits:

203.0.0.0/24
203.0.1.0/24
203.0.2.0/24
   ...
203.0.15.0/24     (16 networks in total)

Because all sixteen share their first 20 bits, they can be advertised to the rest of the internet as a single supernet:

203.0.0.0/20     (one routing entry replaces sixteen)

Figure 5.4: Supernetting collapses sixteen contiguous /24s into one /20 route

flowchart LR
    subgraph Sixteen["Sixteen separate /24 routes"]
        direction TB
        R1["203.0.0.0/24"]
        R2["203.0.1.0/24"]
        R3["203.0.2.0/24"]
        Rdot["..."]
        R16["203.0.15.0/24"]
    end
    Sixteen -->|"share first 20 bits<br/>→ route aggregation"| Super["203.0.0.0/20<br/>one supernet route"]

Sixteen routing entries collapse into one. Multiply that savings across the entire internet and the effect is dramatic: smaller routing tables, faster routing decisions, less router memory consumed, and better overall performance [Source: https://www.techtarget.com/searchnetworking/definition/CIDR]. Notice that supernetting is the mirror image of subnetting — subnetting makes a prefix longer to split a block into smaller pieces, while supernetting makes a prefix shorter to combine blocks into one.

Because classful networks could never be subdivided or combined beyond their class boundary, none of this was possible before CIDR. Today, classless addressing is the universal standard for allocation, routing protocols, and network planning [Source: https://networkustad.com/2019/08/27/classless-inter-domain-routing-cidr/].

Key Takeaway: CIDR was designed to slow IPv4 exhaustion and curb routing-table growth. It allows right-sized address blocks that match actual host needs instead of wasteful fixed classes, and it lets contiguous blocks be aggregated into a single supernet route, keeping internet routing tables lean.

Prefix-to-Mask Conversion

The everyday skill this chapter builds toward is fast, confident conversion between a prefix length and its dotted-decimal mask. This section gives you the full reference table, a mental shortcut, and the handful of prefixes worth memorizing outright.

The conversion table

Every IPv4 prefix from /0 to /32 maps to exactly one subnet mask. The total number of addresses in a block is 2^(32 − prefix), and the number of usable host addresses is normally 2^(32 − prefix) − 2 — you subtract one address for the network identifier and one for the broadcast address [Source: https://www.digitalocean.com/community/tutorials/understanding-ip-addresses-subnets-and-cidr-notation-for-networking].

[Source: https://www.digitalocean.com/community/tutorials/understanding-ip-addresses-subnets-and-cidr-notation-for-networking] [Source: https://networkcheckr.com/subnet-mask-cheat-sheet/]

Two rows deserve special attention. A /31 (defined in RFC 3021) is used for point-to-point links, where both addresses are usable and no network or broadcast address is reserved — giving you 2 usable addresses out of 2. A /32 describes a single host: exactly one address, used for host routes and loopback interfaces [Source: https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing].

Fast mental conversion

You do not need to memorize all 33 rows. The trick is to memorize just the eight possible values of a partial octet — the octet that is only partly filled with 1 bits [Source: https://www.digitalocean.com/community/tutorials/understanding-ip-addresses-subnets-and-cidr-notation-for-networking]:

These values come straight from binary. One leading 1 bit is 10000000 = 128; two are 11000000 = 192; and each additional bit adds the next power of two, until all eight bits give 11111111 = 255. A useful pattern: each value is the previous one plus a halving step (128, then +64, then +32, then +16, and so on).

With that table in hand, converting any prefix to a mask is a three-step recipe:

1. Fill whole octets. Every group of 8 prefix bits becomes a 255. A /26 has three full octets (24 bits), so the mask starts 255.255.255.
2. Handle the leftover bits. Subtract the full octets from the prefix to find the remainder. For /26, that is 26 − 24 = 2 leftover bits. Look up 2 bits in the table: 192. The mask is now 255.255.255.192.
3. Pad with zeros. Any octet after the partial one is 0. (For /26 there are none left.)

Figure 5.5: The three-step prefix-to-mask conversion recipe

flowchart TD
    Start["Start with a prefix<br/>e.g. /26"]
    Step1["Step 1 — Fill whole octets<br/>26 ÷ 8 = 3 full octets → 255.255.255"]
    Step2["Step 2 — Handle leftover bits<br/>26 − 24 = 2 bits → look up in table → 192"]
    Step3["Step 3 — Pad remaining octets with 0<br/>(none left for /26)"]
    Result["Mask: 255.255.255.192"]
    Start --> Step1 --> Step2 --> Step3 --> Result

Worked example — convert /20 to a mask.

• 20 = 16 + 4, so two full octets → 255.255.
• 4 leftover bits → look up 4 in the table → 240.
• Remaining octet is 0.
• Result: 255.255.240.0 — which matches the table above.

Worked example — the reverse, mask to prefix. Given 255.255.255.192, count the 1 bits. Two full 255 octets = 16 bits, a third 255 = 24 bits, and 192 is 2 bits → 24 + 2 = 26. So the prefix is /26.

Worked example — host counts from a prefix. For /26: total addresses = 2^(32 − 26) = 2^6 = 64, and usable hosts = 64 − 2 = 62. For /30: 2^(32 − 30) = 2^2 = 4 total → 2 usable, which is exactly why /30 is the classic choice for a router-to-router point-to-point link [Source: https://www.digitalocean.com/community/tutorials/understanding-ip-addresses-subnets-and-cidr-notation-for-networking].

Common exam prefixes

While you can convert any prefix on demand, a few show up so often — on certification exams and in real networks — that they are worth committing to memory:

[Source: https://networkcheckr.com/subnet-mask-cheat-sheet/] [Source: https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing]

Notice the pattern in the mask column as the prefix grows past /24: the final octet marches through the partial-octet values you memorized — 128, 192, 224, 240, and so on — while the host count halves at each step. Seeing that pattern rather than memorizing isolated facts is what makes conversion feel automatic.

Key Takeaway: Every prefix from /0 to /32 maps to one dotted-decimal mask. Memorize the eight partial-octet values (128, 192, 224, 240, 248, 252, 254, 255), fill whole octets with 255, place the partial value, and pad with zeros — and remember that usable hosts equal 2^(32 − prefix) − 2.

Chapter Summary

CIDR (Classless Inter-Domain Routing) and its slash notation are the language of every modern network. An address such as 192.168.0.15/24 bundles an IP address with its mask in one string, where the number after the slash — the prefix length — counts the leading 1 bits of the mask and thus marks how many of the 32 bits form the network portion. Unlike the classful system it replaced, the prefix can fall on any bit boundary from /0 to /32, which is the essence of variable-length subnet masking.

Introduced by the IETF in 1993 (RFCs 1518 and 1519, updated by RFC 4632), CIDR solved two crises at once. Classless allocation lets providers hand out right-sized address blocks — a /23 for 500 hosts instead of a wasteful /16 — slowing IPv4 exhaustion. And supernetting aggregates many contiguous networks into a single shorter-prefix route (sixteen /24s become one /20), keeping internet routing tables small and fast.

The practical payoff is fluent conversion. By memorizing the eight partial-octet mask values and applying a simple fill-and-pad recipe, you can translate any prefix to a mask and back in seconds, and compute usable hosts with 2^(32 − prefix) − 2. These skills are the foundation for the variable-length subnetting work in the chapters ahead.

Key Terms

Chapter 6: Anatomy of a Subnet: Network, Hosts, and Broadcast

Every subnet is a small, self-contained neighborhood of IP addresses. Like any well-organized neighborhood, it has a name that identifies the whole community, houses that people actually live in, and a public address system for making announcements to everyone at once. In networking terms, those roles map to the network address, the usable hosts, and the broadcast address. Once you can spot these landmarks in any subnet and count how many houses fit inside, you have mastered the single most tested and most practical skill in all of subnetting.

This chapter takes a subnet apart piece by piece. You will learn to identify the four key addresses of any subnet, calculate how many usable hosts a given prefix supports, and understand why the familiar formulas — 2^n and 2^n − 2 — work the way they do. We will lean heavily on tables and worked examples so the patterns become second nature.

Learning Objectives

By the end of this chapter, you will be able to:

• Identify the network address, first host, last host, and broadcast address of any subnet.
• Calculate the number of usable hosts for a given prefix length.
• Explain the 2^n and 2^n − 2 formulas, including the special cases for /31 and /32.
• Describe how borrowing bits from the host portion trades host capacity for more subnets.

The Four Key Addresses

Every ordinary subnet is a contiguous block of IP addresses bounded by two reserved endpoints [Source: https://www.digitalocean.com/community/tutorials/understanding-ip-addresses-subnets-and-cidr-notation-for-networking]. Think of the block as a numbered street: the addresses run in an unbroken sequence from a first house number to a last house number, with nothing skipped in between. Four positions in that sequence carry special meaning.

The Network Address

The network address (also called the network ID) is the first address in the block. It is defined by setting every host bit to 0 [Source: https://www.netstuts.com/subnet-calculation]. A host bit is any bit in the address that falls after the prefix boundary — the bits not “locked down” by the subnet mask.

The network address does not belong to any single machine. Instead, it names the subnet as a whole, the way “Maple Street” names an entire street rather than any one house on it. Routers use it as a label when they decide where to forward traffic.

You calculate the network address with a bitwise AND of the IP address and the subnet mask. The AND operation follows three simple rules:

1 AND 1 = 1
1 AND 0 = 0
0 AND 0 = 0

Because the mask has 0s in every host position, ANDing forces all host bits to 0 — exactly the definition of the network address [Source: https://www.netstuts.com/subnet-calculation].

First and Last Usable Host

The usable hosts are the addresses that can actually be assigned to a device’s network interface — a PC, a printer, a server, a router port. They occupy every position between the two reserved endpoints:

• First usable host = network address + 1.
• Last usable host = broadcast address − 1 [Source: https://www.netstuts.com/subnet-calculation].

In the street analogy, these are the houses people live in. The network address (the street name) and the broadcast address (the public address system, described next) are not livable, but everything in between is fair game.

The Broadcast Address

The broadcast address is the last address in the block. It is defined by setting every host bit to 1 [Source: https://www.netstuts.com/subnet-calculation]. It exists so that a device can reach every host on the subnet with a single message — the digital equivalent of a neighborhood loudspeaker announcement. Like the network address, it cannot be assigned to any individual host.

A handy way to remember the pattern: the network address is “all host bits low,” the broadcast address is “all host bits high,” and the usable hosts are everything in between.

Figure 6.1: The four landmark addresses within a subnet block

graph LR
    A["Network address<br/>(first, host bits all 0)"] --> B["First usable host<br/>(network + 1)"]
    B --> C["...usable host range...<br/>(assignable to devices)"]
    C --> D["Last usable host<br/>(broadcast - 1)"]
    D --> E["Broadcast address<br/>(last, host bits all 1)"]

The Binary Procedure, Step by Step

Here is the consistent procedure that produces all four addresses [Source: https://www.netstuts.com/subnet-calculation]:

1. Convert the IP address and the subnet mask from dotted decimal to binary.
2. Line up the 32 bits of the address against the 32 bits of the mask.
3. Network address = bitwise AND of address and mask (forces host bits to 0).
4. Broadcast address = take the network address and set all host bits to 1.
5. First host = network + 1; last host = broadcast − 1.

Figure 6.2: The procedure that derives all four addresses

flowchart TD
    A["Convert IP and mask to binary"] --> B["Line up 32 address bits<br/>against 32 mask bits"]
    B --> C["Bitwise AND address and mask<br/>(forces host bits to 0)"]
    C --> D["Network address"]
    D --> E["Set all host bits to 1"]
    E --> F["Broadcast address"]
    D --> G["Network + 1 = First host"]
    F --> H["Broadcast - 1 = Last host"]

Worked Example: 192.168.10.5 /24

Let’s find the network and broadcast addresses for the host 192.168.10.5 with a /24 prefix. A /24 mask is 255.255.255.0, meaning the first 24 bits are the network portion and the final 8 bits are host bits.

IP:        11000000.10101000.00001010.00000101   (192.168.10.5)
Mask:      11111111.11111111.11111111.00000000   (255.255.255.0)
Network:   11000000.10101000.00001010.00000000   -> 192.168.10.0
Broadcast: 11000000.10101000.00001010.11111111   -> 192.168.10.255

[Source: https://www.netstuts.com/subnet-calculation]

Reading the four landmarks off this result:

Worked Example: 192.168.10.0 /26

Now a subnet with fewer host bits. A /26 leaves 32 − 26 = 6 host bits. A useful shortcut here is the block size on the “interesting octet”: 256 minus the mask value in that octet. A /26 mask is 255.255.255.192, so the block size is 256 − 192 = 64 [Source: https://www.netstuts.com/subnet-calculation]. That means addresses advance in jumps of 64, and the first block is 0–63.

• Host bits = 6; block size = 64.
• Network: 192.168.10.0
• First usable host: 192.168.10.1
• Last usable host: 192.168.10.62
• Broadcast: 192.168.10.63

Figure 6.3: The four addresses of the 192.168.10.0 /26 block

graph LR
    A["Network<br/>192.168.10.0"] --> B["First host<br/>192.168.10.1"]
    B --> C["...62 usable hosts...<br/>block size 64"]
    C --> D["Last host<br/>192.168.10.62"]
    D --> E["Broadcast<br/>192.168.10.63"]

[Source: https://www.netstuts.com/subnet-calculation]

Worked Example: Splitting 192.168.0.0 /24 into Two /25s

Splitting a subnet cleanly shows how the four addresses reset at every block boundary. A /25 has a block size of 256 − 128 = 128, so a /24 divides into two /25 blocks [Source: https://www.omnicalculator.com/other/ip-subnet]:

Notice how the broadcast of the first block (…127) sits directly below the network address of the second block (…128) — the blocks butt up against each other with no gaps and no overlaps.

Key Takeaway: Every ordinary subnet has four landmark addresses: the network address (first, all host bits 0, found by ANDing the IP with the mask), the first and last usable hosts (the assignable range in between), and the broadcast address (last, all host bits 1). Set the host bits low for the network address and high for the broadcast address, and the usable range is everything between them.

Counting Hosts

Identifying addresses is one half of subnet anatomy; counting them is the other. Two short formulas do all the work.

Total Addresses: 2^h

The total number of addresses in a subnet is 2 raised to the power of the number of host bits:

Total addresses = 2^h, where h = 32 − prefix length (for IPv4) [Source: https://www.geeksforgeeks.org/computer-networks/how-to-calculate-number-of-host-in-a-subnet/].

Each host bit can be 0 or 1, and with h independent bits there are 2^h possible combinations — hence 2^h addresses. This count includes the network and broadcast addresses. For a /26, h = 6, so the block holds 2^6 = 64 total addresses — which matches the block size we calculated earlier.

Subtracting the Network and Broadcast: 2^h − 2

Not every address can be handed to a device. In every ordinary subnet, two addresses are reserved and cannot be assigned to a host interface [Source: https://www.geeksforgeeks.org/computer-networks/how-to-calculate-number-of-host-in-a-subnet/]:

• The first address (all host bits 0) is the network address, which represents the whole subnet.
• The last address (all host bits 1) is the broadcast address, used to reach every host at once.

Because neither belongs to an individual host, both are subtracted from the total:

Usable hosts = 2^h − 2 [Source: https://www.geeksforgeeks.org/computer-networks/how-to-calculate-number-of-host-in-a-subnet/].

The analogy holds neatly here: on our numbered street, the street name and the loudspeaker take up two “slots,” so the number of actual houses is always two fewer than the total number of slots.

Figure 6.4: From prefix to usable host count

flowchart TD
    A["Prefix length (e.g. /26)"] --> B["h = 32 - prefix<br/>(host bits)"]
    B --> C["Total addresses = 2^h"]
    C --> D["Subtract network address<br/>(all host bits 0)"]
    D --> E["Subtract broadcast address<br/>(all host bits 1)"]
    E --> F["Usable hosts = 2^h - 2"]

Host-Count Reference Table

The following table is worth memorizing — it appears constantly in real work and on exams [Source: https://www.geeksforgeeks.org/computer-networks/how-to-calculate-number-of-host-in-a-subnet/] [Source: https://www.techtarget.com/searchnetworking/tip/IP-addressing-and-subnetting-Calculate-a-subnet-mask-using-the-hosts-formula]:

Reading a few rows in plain language:

• A /24 gives 2^8 = 256 total addresses, minus 2 = 254 usable — for example, 192.168.1.1 through 192.168.1.254 in the subnet 192.168.1.0/24 [Source: https://www.techtarget.com/searchnetworking/tip/IP-addressing-and-subnetting-Calculate-a-subnet-mask-using-the-hosts-formula].
• A /26 gives 2^6 = 64 total, minus 2 = 62 usable.
• A /30 gives 2^2 = 4 total, minus 2 = 2 usable — the classic size for a point-to-point link between two routers [Source: https://www.geeksforgeeks.org/computer-networks/how-to-calculate-number-of-host-in-a-subnet/].

A crucial rule of thumb: subtract 2 when counting hosts, but never subtract 2 when counting subnets [Source: https://community.cisco.com/t5/network-management/when-it-comes-to-subnetting-when-do-you-subtract-2-from-the/td-p/3711602]. We return to subnet counting in the final section.

The /31 and /32 Exceptions

The 2^h − 2 formula breaks down at the two smallest prefixes, because it would produce zero or a nonsensical count. Both are handled as special cases.

The /31 subnet (RFC 3021). A /31 has only 2 total addresses (2^1 = 2). Applying 2^h − 2 gives 2^1 − 2 = 0 usable hosts, which would make the subnet useless [Source: https://datatracker.ietf.org/doc/html/rfc3021]. RFC 3021, “Using 31-Bit Prefixes on IPv4 Point-to-Point Links,” solves this by allowing both the all-zeros and all-ones addresses to be assigned as host addresses on point-to-point links [Source: https://www.rfc-editor.org/rfc/rfc3021]. The reasoning is elegant: a point-to-point link has exactly one neighbor at each end, so there is no need for a broadcast address — and if no address must be reserved for broadcast, none needs to be reserved at all. A /31 therefore delivers 2 usable hosts, precisely the two ends of the link.

The payoff is efficiency. A /31 consumes 2 addresses per link instead of the 4 a /30 uses — a 50% saving on point-to-point addressing, which adds up dramatically across the many router-to-router links in a large WAN [Source: https://oneuptime.com/blog/post/2026-03-20-use-31-subnets-point-to-point-rfc3021/view]. RFC 3021 is widely supported (Cisco IOS among others) and is the modern recommended practice for point-to-point links [Source: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipaddr_ipv4/configuration/xe-3s/asr903/ipv4-xe-3s-asr903-book/config-ipv4-addr.html].

The /32 subnet (host route). A /32 uses a full 32-bit mask (255.255.255.255) and defines a network containing exactly one address — 2^0 = 1 total, and the −2 formula does not apply [Source: https://datatracker.ietf.org/doc/html/rfc3021]. A single address cannot form a link (two endpoints need two addresses), so a /32 is used instead as a host route — a route to one specific machine. Typical uses include loopback interfaces, addresses assigned to a router or server, and specific-host firewall or routing rules.

Key Takeaway: A subnet holds 2^h total addresses, where h is the number of host bits, and 2^h − 2 usable hosts after reserving the network and broadcast addresses. The two smallest prefixes are exceptions: a /31 provides 2 usable hosts on point-to-point links (RFC 3021, no broadcast needed), and a /32 provides a single address used as a host route or loopback.

Counting Subnets

So far we have looked inside one subnet. Now we zoom out to ask the opposite question: if we carve a larger block into smaller pieces, how many pieces do we get?

Bits Borrowed from the Host Portion

To create more subnets, you take bits from the host portion and reassign them to the network portion. These reassigned bits are called borrowed bits [Source: https://community.cisco.com/t5/network-management/when-it-comes-to-subnetting-when-do-you-subtract-2-from-the/td-p/3711602]. Borrowing bits is the same thing as lengthening the prefix: going from a /24 to a /26 borrows 2 bits, moving the boundary two positions to the right.

Picture a fixed-length ruler divided into a network side and a host side. The ruler never grows — it is always 32 bits. Every bit you hand to the network side is a bit taken away from the host side. That tension is the heart of subnet planning.

Figure 6.5: Borrowing 2 host bits moves the /24 boundary to /26

graph TD
    subgraph After["/26 — 2 bits borrowed"]
        C["Network portion<br/>26 bits"]
        D["Host portion<br/>6 bits (4 subnets, 62 hosts each)"]
    end
    subgraph Before["/24 — starting point"]
        A["Network portion<br/>24 bits"]
        B["Host portion<br/>8 bits (1 subnet, 254 hosts)"]
    end
    Before --> After

The 2^s Formula

The number of subnets you can create by borrowing s bits is:

Subnets = 2^s, where s = number of borrowed bits [Source: https://www.geeksforgeeks.org/computer-networks/how-to-calculate-number-of-host-in-a-subnet/].

Note the deliberate absence of a ”− 2” here. Unlike host counting, subnet counting does not subtract two [Source: https://community.cisco.com/t5/network-management/when-it-comes-to-subnetting-when-do-you-subtract-2-from-the/td-p/3711602]. There is no “network subnet” or “broadcast subnet” to reserve; all 2^s subnets are legitimately available with modern CIDR-based equipment.

For example, borrowing 2 bits from a /24 (making it a /26) yields 2^2 = 4 subnets. Those are exactly the four /26 blocks inside a /24: the 0–63, 64–127, 128–191, and 192–255 ranges.

The Subnet-vs-Host Trade-off

Because the 32-bit ruler is fixed, every bit you borrow for subnets is a bit lost to hosts. Borrowing more bits gives you more subnets but fewer hosts in each one [Source: https://community.cisco.com/t5/network-management/when-it-comes-to-subnetting-when-do-you-subtract-2-from-the/td-p/3711602]. This inverse relationship is the central tension of subnet design.

The table below shows this trade-off as we borrow increasing numbers of bits from a starting /24 (which has 8 host bits to give away):

Read down the “Subnets” column and up the “Usable hosts” column and you see the see-saw clearly: as one rises, the other falls. Choosing a prefix is really choosing a point on this see-saw — enough subnets to cover your network segments, while still leaving each subnet large enough for the devices it must hold.

This trade-off is the foundation for Variable Length Subnet Masking (VLSM), covered in later chapters, where different segments get different prefixes so that each one is sized to its actual needs rather than forcing every subnet to be the same.

Key Takeaway: Borrowing s host bits creates 2^s subnets — and unlike host counting, you do not subtract two. Because the 32-bit boundary is fixed, more subnets always means fewer hosts per subnet, and choosing a prefix means balancing the number of subnets you need against the number of hosts each must support.

Chapter Summary

A subnet is a contiguous block of IP addresses with a predictable internal structure. Its four key addresses are the network address (first in the block, all host bits 0, computed by ANDing the IP with the mask), the first and last usable hosts (the assignable range in between), and the broadcast address (last in the block, all host bits 1). The network and broadcast addresses are reserved and cannot be assigned to devices.

Counting relies on two formulas. Total addresses equal 2^h, where h is the number of host bits (32 − prefix). Usable hosts equal 2^h − 2, because the network and broadcast addresses are subtracted. Two prefixes are exceptions: a /31 provides 2 usable hosts on point-to-point links under RFC 3021 (no broadcast is needed, saving 50% versus a /30), and a /32 is a single-address host route or loopback where the −2 rule does not apply.

Zooming out, borrowing s bits from the host portion creates 2^s subnets — with no subtraction of two. Since the 32-bit boundary is fixed, borrowing more bits produces more subnets at the cost of fewer hosts each. Mastering this network/host/broadcast anatomy and its counting formulas is the essential groundwork for the CIDR and VLSM design techniques in the chapters ahead.

Key Terms

Chapter 7: Subnetting Step by Step: Fixed-Length Subnetting

Up to this point you have learned what a subnet mask is, how prefix lengths and CIDR notation work, and how the network and host portions of an address are separated. This chapter turns that understanding into a concrete, repeatable skill: taking a single block of addresses and slicing it into a set of equal-sized pieces. This technique is called Fixed-Length Subnet Masking (FLSM) — traditional “classful-style” subnetting in which a parent network is divided into subnets that all have an equal number of addresses, so a single subnet mask applies to every one of them [Source: https://networkustad.com/2019/08/27/fixed-length-subnet-masking-flsm/].

Think of FLSM like cutting a sheet cake into equal squares. Once you decide how many pieces you want (or how big each piece needs to be), every cut is the same distance apart and every square is identical. It is simple and predictable — but if one guest only wants a bite and another wants a huge slice, equal squares waste cake. That trade-off between simplicity and efficiency is the heart of this chapter, and it is exactly why the next chapter introduces variable-length subnetting.

Learning Objectives

By the end of this chapter, you will be able to:

• Divide a network into equal-sized subnets given a host requirement or a subnet requirement.
• Apply a repeatable, seven-step subnetting procedure that works from either direction.
• Use the magic number (block size) shortcut to find subnet boundaries quickly, using base-10 arithmetic instead of binary.

The Requirements-First Method

Every subnetting problem starts with a requirement. Before you touch a mask or count a single bit, you must know what you are being asked to build. In FLSM, that requirement comes in one of two flavors, and the good news is that the method solves cleanly from either direction [Source: https://networkustad.com/2019/08/27/fixed-length-subnet-masking-flsm/].

Hosts Needed vs. Subnets Needed

The two ways a subnetting task is stated are:

• “I need N subnets.” For example, an organization has five departments and wants each on its own subnet. Here you are driven by the subnet count.
• “I need H hosts per subnet.” For example, a segment must hold up to 50 devices. Here you are driven by the host count.

Figure 7.1: Requirements-first decision flow (subnets-driven vs. hosts-driven)

flowchart TD
    A["Subnetting requirement"] --> B{"How is it stated?"}
    B -->|"I need N subnets"| C["Subnet-driven:<br/>find n where 2ⁿ ≥ N"]
    B -->|"I need H hosts per subnet"| D["Host-driven:<br/>find h where 2ʰ − 2 ≥ H"]
    C --> E["Borrow n subnet bits"]
    D --> F["Keep h host bits;<br/>leftover bits become borrowed bits"]
    E --> G["new prefix = old prefix + borrowed bits"]
    F --> G
    G --> H["Lay out subnets by block size"]

FLSM creates subnets by borrowing a fixed number of bits from the host portion of the address to form a new subnet field. The more bits you borrow, the more subnets you get — but the fewer host bits remain, so each subnet holds fewer devices. This is the fundamental subnetting trade-off: the borrowed subnet bits and the remaining host bits always add up to the total number of bits available below the parent prefix, which is 32 − parent prefix [Source: https://networkustad.com/2019/08/27/fixed-length-subnet-masking-flsm/].

Choosing the Prefix

Here is the repeatable seven-step procedure. Learn it once and it works for every FLSM problem [Source: https://networkustad.com/2019/08/27/fixed-length-subnet-masking-flsm/].

Step 1 — Identify the parent network and prefix. Write down the starting network address and its prefix length, such as 192.168.1.0/24 or 130.10.0.0/23.

Step 2 — Determine the requirement. Decide whether you are driven by subnets needed or hosts needed.

Step 3 — Apply the borrowing formula.

• If driven by subnets: find the smallest number of borrowed bits n such that 2ⁿ ≥ required subnets. In other words, round the required subnet count up to the next power of two. Example: 5 subnets needed → the next power of two is 8 → borrow 3 bits, because 2³ = 8.
• If driven by hosts: find the smallest number of host bits h such that 2ʰ − 2 ≥ required hosts. The − 2 removes the reserved network and broadcast addresses. Whatever bits are left over become the borrowed subnet bits.

Step 4 — Calculate the new prefix length. Add the borrowed bits to the original prefix: new prefix = old prefix + n. Example: /24 + 3 = /27, whose mask is 255.255.255.224 [Source: https://networkustad.com/2019/08/27/fixed-length-subnet-masking-flsm/].

Step 5 — Calculate hosts per subnet. The host bits are h = 32 − new prefix, and the usable hosts per subnet are 2ʰ − 2. Example: a /27 has 5 host bits → 2⁵ − 2 = 30 usable hosts.

Step 6 — Determine the block size (subnet increment). The total addresses per subnet are 2ʰ, and this same number is the spacing between consecutive subnet network addresses. Example: /27 → 2⁵ = 32.

Step 7 — List every subnet. Starting at the parent network address, step forward by the block size and, for each subnet, record its network address, first usable host, last usable host, and broadcast address. Repeat until the parent block is used up.

Figure 7.2: The seven-step FLSM procedure

flowchart TD
    S1["Step 1: Identify parent<br/>network and prefix"] --> S2["Step 2: Determine the<br/>requirement (subnets or hosts)"]
    S2 --> S3["Step 3: Apply borrowing formula<br/>2ⁿ ≥ subnets, or 2ʰ − 2 ≥ hosts"]
    S3 --> S4["Step 4: new prefix =<br/>old prefix + borrowed bits"]
    S4 --> S5["Step 5: hosts per subnet =<br/>2ʰ − 2 where h = 32 − new prefix"]
    S5 --> S6["Step 6: block size = 2ʰ<br/>(subnet increment)"]
    S6 --> S7["Step 7: List every subnet by<br/>stepping forward by block size"]

Rounding Up to Powers of Two

The single most important habit in Step 3 is rounding up to the next power of two. Because subnet bits can only be borrowed in whole units, and each borrowed bit doubles your subnet count, the number of subnets you can create is always one of: 2, 4, 8, 16, 32, 64, and so on. You cannot make exactly 5 or exactly 6 equal subnets — you make 8 and leave the extras unused.

The same logic applies to hosts. Usable host counts always follow the 2ʰ − 2 sequence: 2, 6, 14, 30, 62, 126, 254. If you need 50 hosts, you cannot use 2⁵ − 2 = 30 (too few), so you climb to 2⁶ − 2 = 62, which means keeping 6 host bits and using a /26. Always round up to a value that meets or exceeds the requirement; rounding down leaves you short of addresses.

A quick reference for the most common masks ties these numbers together [Source: https://computingforgeeks.com/subnetting-cheat-sheet/]:

Key Takeaway: Every FLSM problem begins with a requirement stated as either subnets needed or hosts needed. Borrow the smallest number of bits that satisfies it by rounding up to the next power of two — 2ⁿ ≥ subnets or 2ʰ − 2 ≥ hosts — then add the borrowed bits to the parent prefix to get your new mask. Rounding up guarantees you never come up short on address space.

The Magic Number Technique

Once you have chosen a prefix, you still need to actually lay out the subnets: where does each one start, where does it end, and which addresses are usable? You could do this in binary, but there is a far faster base-10 shortcut used on nearly every subnetting cheat sheet and taught as the standard exam-speed method for CompTIA Network+ [Source: https://www.professormesser.com/network-plus/n10-009/n10-009-video/magic-number-subnetting-n10-009/]. It is called the magic number method.

Block Size = 256 − Mask Octet

The rule is delightfully simple [Source: https://oneuptime.com/blog/post/2026-03-20-subnetting-magic-number-method/view]:

Magic Number = Block Size = 256 − (interesting mask octet)

The interesting octet is the first octet of the subnet mask that is neither 0 nor 255 — it is the octet where the network/host boundary falls. If the mask is 255.255.255.0, the boundary sits on a clean octet edge; for anything more specific, the interesting octet is the one being split.

Consider these calculations [Source: https://oneuptime.com/blog/post/2026-03-20-subnetting-magic-number-method/view]:

The magic number is doing the same job as 2ʰ from Step 6 — it is the block size — but it lets you read it straight off the mask without counting host bits.

Finding Subnet Boundaries

Once you have the block size, finding which subnet any given address belongs to is a three-step process [Source: https://oneuptime.com/blog/post/2026-03-20-subnetting-magic-number-method/view]:

1. Identify the interesting octet and compute the block size (256 − mask octet).
2. List the multiples of the block size in that octet: 0, block, 2×block, 3×block, … For a block of 32, that is 0, 32, 64, 96, 128, 160, 192, 224.
3. Locate the subnet start by finding the largest multiple that does not exceed the address’s value in that octet.

From that starting value, the four defining addresses of the subnet fall out mechanically [Source: https://oneuptime.com/blog/post/2026-03-20-subnetting-magic-number-method/view]:

• Network address = the subnet start value, with zeros in every octet to its right.
• Broadcast address = the next multiple minus one (equivalently, network + block size − 1), with 255s in every octet to the right.
• First usable host = network address + 1.
• Last usable host = broadcast address − 1.

Figure 7.3: Locating a subnet with the magic-number (block-size) method

flowchart TD
    A["Given: address + mask"] --> B["Find interesting octet<br/>(first mask octet not 0 or 255)"]
    B --> C["Block size = 256 − mask octet"]
    C --> D["List multiples in that octet:<br/>0, block, 2×block, 3×block, …"]
    D --> E["Subnet start = largest multiple<br/>≤ address value in that octet"]
    E --> F["Network = subnet start<br/>(zeros to the right)"]
    E --> G["Broadcast = next multiple − 1<br/>(255s to the right)"]
    F --> H["First host = network + 1"]
    G --> I["Last host = broadcast − 1"]

Worked example — 192.168.1.50/27. The /27 mask is 255.255.255.224, so the block size is 256 − 224 = 32. Rounding 50 down to the nearest multiple of 32 gives 32, so the network is 192.168.1.32, the broadcast is 32 + 32 − 1 = 192.168.1.63, and the usable range is 192.168.1.33 – 192.168.1.62 [Source: https://oneuptime.com/blog/post/2026-03-20-subnetting-magic-number-method/view].

Worked example — 172.20.50.100/21. The mask is 255.255.248.0, so the interesting octet is the third (248) and the block size is 256 − 248 = 8. The multiples of 8 near 50 are …40, 48, 56…; since 50 falls between 48 and 56, the network is 172.20.48.0/21 and the broadcast is 172.20.55.255. Notice that when the boundary sits in the third octet, the fourth octet runs its full 0–255 range inside every subnet [Source: https://oneuptime.com/blog/post/2026-03-20-subnetting-magic-number-method/view].

Enumerating All Subnets

To list every subnet in a block rather than locate a single address, you simply walk the multiples of the block size from 0 upward until you fill the parent octet. Each multiple is one subnet’s network address; add block size − 1 to reach its broadcast; the addresses in between (minus the two endpoints) are usable hosts. And there is a handy shortcut when the split happens in the last octet: usable hosts = block size − 2 [Source: https://oneuptime.com/blog/post/2026-03-20-subnetting-magic-number-method/view]. For a block of 32, that is 30 usable hosts — matching what 2⁵ − 2 gave us earlier, but with no exponents in sight.

Key Takeaway: The magic number equals 256 minus the interesting mask octet, and it is the same as the block size — the spacing between subnet network addresses. List the multiples of that number, pick the largest one at or below your address to find the network, and add block size − 1 to reach the broadcast. This turns subnetting into base-10 counting instead of binary math.

A Full Worked Example

Let’s put both halves of the chapter together and completely subnet a real network from start to finish: dividing 192.168.1.0/24 into /27 subnets [Source: https://www.freecodecamp.org/news/subnet-cheat-sheet-24-subnet-mask-30-26-27-29-and-other-ip-address-cidr-network-references/].

Splitting a /24 into /27s

We walk the seven steps.

Step 1 — Parent network and prefix. Our parent is 192.168.1.0/24.

Step 2 — Requirement. Suppose we have been told each subnet must support around 25 to 30 hosts, and we want as many equal subnets as that allows. A /27 is the natural fit.

Step 3 — Bits borrowed and subnet count. Going from /24 to /27 borrows 3 host bits: 24 + 3 = 27. The number of subnets is 2³ = 8 [Source: https://www.freecodecamp.org/news/subnet-cheat-sheet-24-subnet-mask-30-26-27-29-and-other-ip-address-cidr-network-references/].

Step 4 — Subnet mask. /27 = 255.255.255.224.

Step 5 — Host bits and hosts per subnet. Host bits = 32 − 27 = 5. Total addresses per subnet = 2⁵ = 32. Usable hosts = 2⁵ − 2 = 30 (one address reserved for the network, one for the broadcast) [Source: https://www.freecodecamp.org/news/subnet-cheat-sheet-24-subnet-mask-30-26-27-29-and-other-ip-address-cidr-network-references/].

Step 6 — Block size (magic number). 256 − 224 = 32. So the subnet network addresses increment by 32 in the last octet: 0, 32, 64, 96, 128, 160, 192, 224 [Source: https://www.freecodecamp.org/news/subnet-cheat-sheet-24-subnet-mask-30-26-27-29-and-other-ip-address-cidr-network-references/].

Step 7 — List every subnet. This is where the table below comes from.

Listing Ranges

Stepping through the eight block-size multiples and, for each, computing network + 1 (first host), next network − 1 (broadcast), and broadcast − 1 (last host) gives the complete enumeration of all eight /27 subnets [Source: https://www.freecodecamp.org/news/subnet-cheat-sheet-24-subnet-mask-30-26-27-29-and-other-ip-address-cidr-network-references/]:

Figure 7.4: Splitting 192.168.1.0/24 into eight /27 subnets

graph TD
    P["Parent: 192.168.1.0/24<br/>256 addresses"] --> S1["Subnet 1: 192.168.1.0/27"]
    P --> S2["Subnet 2: 192.168.1.32/27"]
    P --> S3["Subnet 3: 192.168.1.64/27"]
    P --> S4["Subnet 4: 192.168.1.96/27"]
    P --> S5["Subnet 5: 192.168.1.128/27"]
    P --> S6["Subnet 6: 192.168.1.160/27"]
    P --> S7["Subnet 7: 192.168.1.192/27"]
    P --> S8["Subnet 8: 192.168.1.224/27"]

How to read this table. Each network address is the previous one plus the block size of 32. Each broadcast address is the next network address minus one — which is also the current network plus 31. The first host is always network + 1, and the last host is always broadcast − 1. Notice the tidy staircase: 0, 32, 64, 96, 128, 160, 192, 224. If you can count by your block size, you can build this table for any prefix without ever writing binary [Source: https://www.freecodecamp.org/news/subnet-cheat-sheet-24-subnet-mask-30-26-27-29-and-other-ip-address-cidr-network-references/].

Verifying the Math

Always sanity-check your work with a quick multiplication. Eight subnets × 32 addresses each = 256 addresses, which exactly fills the /24 (which contains 256 total addresses). No addresses are left over and none overlap — a sign the subnetting is correct [Source: https://www.freecodecamp.org/news/subnet-cheat-sheet-24-subnet-mask-30-26-27-29-and-other-ip-address-cidr-network-references/].

There is a second, subtler check worth internalizing. The total usable hosts across the whole /24 after subnetting is 8 × 30 = 240, down from the 254 usable hosts in an un-subnetted /24. Those 14 “missing” addresses are the cost of creating subnet boundaries: every new subnet needs its own network address and its own broadcast address, and here we created seven extra subnet/broadcast pairs (14 addresses) beyond the single pair the original /24 already had [Source: https://www.freecodecamp.org/news/subnet-cheat-sheet-24-subnet-mask-30-26-27-29-and-other-ip-address-cidr-network-references/].

This overhead is a direct illustration of FLSM’s core limitation. Because every subnet is allocated an equal-sized block regardless of what it actually needs, address space gets wasted — a point-to-point WAN link that needs only 2 hosts would still receive a full 30-host /27, wasting 28 addresses [Source: https://networkustad.com/2019/08/27/fixed-length-subnet-masking-flsm/]. That inefficiency is precisely what motivates VLSM (Variable-Length Subnet Masking), where different subnets get different-sized masks matched to their real host counts — the subject of the next chapter.

Key Takeaway: A /24 splits cleanly into exactly eight /27 subnets, each with 30 usable hosts, incrementing by a block size of 32 (.0, .32, .64, .96, .128, .160, .192, .224). Verify by confirming 8 × 32 = 256 addresses fill the parent block, and note that 8 × 30 = 240 usable hosts — the 14-address gap versus a plain /24 is the built-in overhead of FLSM’s equal-size design.

Chapter Summary

Fixed-Length Subnet Masking divides a parent network into subnets that are all the same size, so one subnet mask applies to every subnet. Its uniformity makes routing and mental arithmetic simple, but it wastes addresses when host needs vary.

The requirements-first method drives every problem from either a subnet count or a host count. You borrow the smallest number of host bits that satisfies the requirement — 2ⁿ ≥ subnets or 2ʰ − 2 ≥ hosts — always rounding up to the next power of two, then add those borrowed bits to the parent prefix to get the new mask. From the new prefix, 2ʰ gives both the total addresses per subnet and the block size, and 2ʰ − 2 gives the usable hosts.

The magic number technique replaces binary math with base-10 counting: block size = 256 − the interesting mask octet. List multiples of that block size to find every subnet boundary; the network address is a multiple, the broadcast is the next multiple minus one, and the usable hosts sit in between. Our full worked example split 192.168.1.0/24 into eight /27 subnets of 30 hosts each, verified by 8 × 32 = 256, and exposed the 240-vs-254 host overhead that motivates the variable-length subnetting covered next.

Key Terms

Chapter 8: VLSM: Variable-Length Subnet Masking

Learning Objectives

By the end of this chapter, you will be able to:

• Explain how VLSM allocates different-sized subnets from a single block of addresses.
• Apply VLSM to minimize address waste by right-sizing each subnet to its actual host requirement.
• Order subnet requirements correctly (largest to smallest) so that VLSM allocation avoids fragmentation and overlap.

In the previous chapters you learned to slice a network into equal pieces using a single, uniform mask. That approach is clean and easy to reason about, but it has a serious weakness: it forces every subnet to be the same size, whether it holds 500 hosts or 2. This chapter introduces Variable-Length Subnet Masking (VLSM) — the technique that lets you carve a single address block into subnets of different sizes so that almost no address is wasted. VLSM is the workhorse of real-world IP address planning, and mastering it is what separates someone who “knows subnetting” from someone who can actually design a network.

Why VLSM

The Limits of Fixed-Length Subnetting

In traditional, or fixed-length, subnetting, a single subnet mask is applied uniformly to every subnet you create from a parent block. Every subnet therefore receives an identically sized block of addresses — regardless of how many hosts actually live on that segment [Source: https://eitca.org/cybersecurity/eitc-is-cnf-computer-networking-fundamentals/internet-protocols/ip-addressing-in-depth/examination-review-ip-addressing-in-depth/explain-the-concept-of-variable-length-subnet-mask-vlsm-and-how-it-enhances-ip-address-conservation-within-a-network/].

This uniformity is exactly the problem. Real networks are lumpy. A large user LAN might need 60 host addresses, while a router-to-router link between two buildings needs only 2. With a fixed-length scheme, you must pick one mask that satisfies your largest segment and then apply that same generous mask everywhere. The result is enormous waste on your small segments.

Consider a concrete case. Suppose you choose a /28 mask (255.255.255.240), which yields 14 usable host addresses per subnet. That is a perfectly reasonable size for a modest LAN. But now apply that same /28 to a WAN connection that needs only 2 usable IP addresses. You have just handed a 2-host link a 14-host block, wasting 12 addresses on a single link [Source: https://jumpcloud.com/it-index/what-is-vlsm-variable-length-subnet-masking]. Multiply that waste across dozens of point-to-point links in a large enterprise or service-provider network, and you have thrown away thousands of addresses for no reason.

Figure 8.1: Fixed /28 waste vs. right-sized /30 on a 2-host WAN link

graph TD
    N["WAN link needs 2 usable hosts"]
    N --> F["Fixed-length /28 block<br/>16 addresses, 14 usable"]
    N --> V["Right-sized /30 block<br/>4 addresses, 2 usable"]
    F --> FU["2 addresses used"]
    F --> FW["12 addresses WASTED"]
    V --> VU["2 addresses used"]
    V --> VW["0 addresses wasted"]
    style FW fill:#f8d7da,stroke:#c00
    style VW fill:#d4edda,stroke:#0a0

Real-world analogy: Fixed-length subnetting is like a moving company that only owns one size of truck — a 26-foot box truck. If all you need to move is a single armchair across town, you still get the giant truck. It works, but you are paying for (and driving around) a mountain of empty space. VLSM is the company that also owns cargo vans and pickup trucks, so it can match the vehicle to the job.

Right-Sizing Subnets

VLSM is the technique of dividing a single IP network into subnets of different sizes by using more than one subnet mask within the same parent block [Source: https://www.learnipsubnetting.com/module-4/variable-length-subnet-masking-vlsm/]. Instead of forcing every subnet into the same mold, VLSM lets you choose a mask per subnet, matching each segment to the number of devices it actually needs to support.

Returning to the earlier example: rather than giving the 2-host WAN link a wasteful /28, VLSM lets you assign it a /30 mask (255.255.255.252), which provides exactly 2 usable host addresses — precisely what a point-to-point link requires — while leaving the rest of the address space free for other subnets or future growth [Source: https://jumpcloud.com/it-index/what-is-vlsm-variable-length-subnet-masking]. This idea of matching the subnet size to the real requirement is called right-sizing, and it is the heart of good address design [Source: https://www.netmaker.io/resources/vlsm].

The mental model is straightforward: different segments have different appetites. A busy office LAN, a wireless guest network, a server farm, a management VLAN, and a router-to-router link are all different sizes, and VLSM lets each one get a mask cut to fit.

Real-world analogy: Think of tailoring a suit versus buying one off the rack in a single size. Off-the-rack “one size fits all” is fixed-length subnetting — most people end up with sleeves too long or too short. A tailor measures each customer and cuts the cloth to fit. VLSM is the tailor of IP addressing: every subnet gets a mask measured to its own dimensions.

Address Conservation

The payoff from right-sizing is address conservation: because each subnet closely fits the number of devices it serves, few or no addresses go unused, and the space you save stays available for other subnets or future expansion [Source: https://eitca.org/cybersecurity/eitc-is-cnf-computer-networking-fundamentals/internet-protocols/ip-addressing-in-depth/examination-review-ip-addressing-in-depth/explain-the-concept-of-variable-length-subnet-mask-vlsm-and-how-it-enhances-ip-address-conservation-within-a-network/].

This is not merely a tidiness concern. Address conservation was one of the primary reasons VLSM (alongside CIDR, covered earlier in this book) was introduced in the first place: to slow the exhaustion of the finite IPv4 address space [Source: https://eitca.org/cybersecurity/eitc-is-cnf-computer-networking-fundamentals/internet-protocols/ip-addressing-in-depth/examination-review-ip-addressing-in-depth/explain-the-concept-of-variable-length-subnet-mask-vlsm-and-how-it-enhances-ip-address-conservation-within-a-network/]. When public IPv4 addresses are scarce and expensive, wasting a dozen of them on every WAN link is a real cost. But conservation matters just as much inside private networks: a well-conserved plan leaves you clean, contiguous free space to grow into, rather than a patchwork of exhausted blocks that force a painful readdressing project later [Source: https://www.netmaker.io/resources/vlsm].

The table below shows why the /28-for-everything approach is so wasteful compared to right-sizing with VLSM.

Key Takeaway: Fixed-length subnetting applies one uniform mask to every subnet, forcing tiny segments to accept the same oversized block as large ones and wasting huge amounts of address space. VLSM removes that constraint by allowing more than one mask within a single parent block, letting you right-size each subnet to its actual host count. The result is address conservation — minimal waste today and clean, contiguous room to grow tomorrow.

The VLSM Procedure

VLSM gives you freedom, and freedom demands discipline. If you carve blocks out of a parent network carelessly, you will end up with overlapping subnets (two segments claiming the same addresses) or wasteful gaps. The procedure below prevents both.

The Core Rule: Sort Requirements Largest to Smallest

The single rule that prevents most VLSM mistakes is this: allocate the subnet with the most hosts first, then the next largest, and work down to the smallest links (/30 or /31 point-to-point connections) last [Source: https://computingforgeeks.com/subnetting-vlsm-explained/].

Why does order matter so much? A large subnet needs a large, contiguous block of addresses that is aligned to its own mask boundary — its network address must fall on a multiple of its block size. If you allocate the big blocks first, you place them at the start of the address space and leave a single, clean, contiguous free block at the end. If instead you allocated small subnets first, a later large subnet might not find a properly aligned contiguous block, forcing you to skip space and fragment the parent network into scattered, unusable gaps [Source: https://computingforgeeks.com/subnetting-vlsm-explained/].

Real-world analogy: This is exactly how you pack a suitcase. You lay the big, rigid items in first — shoes, a folded jacket, a hardcover book — and then tuck socks and chargers into the gaps that remain. Try it the other way around, scattering socks everywhere first, and the big items no longer fit; you are left with a jumble and wasted space. Large-blocks-first packing leaves the smallest, most flexible items to fill whatever room is left.

Step-by-Step Process

Here is the full procedure for allocating subnets with VLSM.

Step 1 — List and document your requirements. Write down every network segment along with its required number of usable hosts [Source: https://jumpcloud.com/it-index/what-is-vlsm-variable-length-subnet-masking].

Step 2 — Calculate the mask (prefix) for each segment. For each segment, take the required host count, add 2 (one address for the network/subnet ID and one for the broadcast address), then round up to the next power of two to find the block size. From the block size you read off the smallest prefix that fits [Source: https://jumpcloud.com/it-index/what-is-vlsm-variable-length-subnet-masking].

• Example: 60 hosts → 60 + 2 = 62 → next power of two is 64 → block size 64 → /26.
• Example: 74 hosts → 74 + 2 = 76 → next power of two is 128 → block size 128 → /25.

Step 3 — Sort from largest to smallest. Arrange the segments in descending order of block size, largest host requirement first [Source: https://computingforgeeks.com/subnetting-vlsm-explained/].

Step 4 — Allocate blocks sequentially. Assign address blocks in that descending order, each new subnet starting exactly where the previous one ended. Every subnet’s network address must be a multiple of (aligned to) its own block size — subnetting always proceeds from left to right, without skipping bits [Source: https://computingforgeeks.com/subnetting-vlsm-explained/].

Step 5 — Verify overlap and alignment. For each subnet, compute its network (subnet ID) address and its broadcast address, where broadcast = subnet ID + block size − 1. Then confirm two things [Source: https://computingforgeeks.com/subnetting-vlsm-explained/]:

• No overlap: each subnet’s broadcast address is lower than the next subnet’s network address (each broadcast < next network address).
• Alignment: each network address is evenly divisible by its own block size.

Figure 8.2: The five-step VLSM allocation procedure

flowchart TD
    S1["Step 1: List every segment<br/>with its usable host count"]
    S2["Step 2: Size each segment<br/>hosts + 2, round up to power of two<br/>read off the prefix"]
    S3["Step 3: Sort segments<br/>largest block to smallest"]
    S4["Step 4: Allocate sequentially<br/>each block starts where the last ended,<br/>aligned to its own block size"]
    S5{"Step 5: Verify"}
    OK["No overlap: each broadcast < next network address"]
    AL["Alignment: each network address<br/>divisible by its block size"]
    DONE["Plan is sound - deploy"]
    S1 --> S2 --> S3 --> S4 --> S5
    S5 --> OK
    S5 --> AL
    OK --> DONE
    AL --> DONE

The following reference table maps common prefixes to their block sizes and usable-host counts. Keep it close while you work.

Avoiding Overlap

Overlap — two subnets whose address ranges intersect — is the cardinal sin of subnet design. When subnets overlap, an address can belong to two segments at once, and routing becomes ambiguous and broken. The largest-first procedure, combined with the sequential allocation in Step 4, is specifically designed to make overlap impossible: because each new block begins precisely where the last one ended and every block is aligned to its own size, no two ranges can ever collide [Source: https://computingforgeeks.com/subnetting-vlsm-explained/].

The verification in Step 5 is your safety net. The overlap check (“each broadcast < next network address”) and the alignment check (“each network address divisible by its block size”) together prove mathematically that your plan is sound before you deploy it.

Figure 8.4: The Step 5 verification checks per subnet

flowchart TD
    START["For each subnet:<br/>compute network ID and<br/>broadcast = network ID + block size - 1"]
    START --> Q1{"Is broadcast address <<br/>next subnet's network ID?"}
    Q1 -->|No| FAIL["OVERLAP - subnets collide<br/>fix allocation"]
    Q1 -->|Yes| Q2{"Is network address<br/>divisible by its block size?"}
    Q2 -->|No| FAIL2["MISALIGNED - block off boundary<br/>fix allocation"]
    Q2 -->|Yes| PASS["Subnet verified"]
    style FAIL fill:#f8d7da,stroke:#c00
    style FAIL2 fill:#f8d7da,stroke:#c00
    style PASS fill:#d4edda,stroke:#0a0

Key Takeaway: The golden rule of VLSM is to allocate the largest subnet first and the smallest point-to-point links last. Size each subnet by adding 2 to its host count and rounding up to the next power of two, then allocate blocks sequentially with each one aligned to its own boundary. Finish by verifying that every broadcast address falls below the next subnet’s network address and that every network address is divisible by its block size — this guarantees no overlap and no wasted alignment gaps.

Worked VLSM Example

Let us apply the full procedure to a realistic scenario that mixes large LANs with tiny point-to-point WAN links. This is the classic case where VLSM shines.

The Scenario: Mixed LAN and Point-to-Point Links

You have been given the block 192.168.1.0/24 — a single Class C-sized network of 256 addresses — and asked to accommodate the following segments [Source: https://www.computernetworkingnotes.com/ccna-study-guide/vlsm-subnetting-explained-with-examples.html]:

• Development LAN: 74 hosts
• Production LAN: 52 hosts
• Administration LAN: 28 hosts
• WAN Link 1: 2 hosts (a router-to-router point-to-point link)
• WAN Link 2: 2 hosts (point-to-point link)
• WAN Link 3: 2 hosts (point-to-point link)

Six segments, wildly different sizes. A single uniform mask cannot serve them: any mask big enough for the 74-host Development LAN (a /25) would give each 2-host WAN link a 126-host block, and any mask small enough to be efficient for the WAN links could never hold 74 hosts. VLSM is the only sensible answer.

Step 1 and 2: Size Each Segment

For each segment, add 2 to the host requirement and round up to the next power of two to find the block size and prefix.

[Source: https://www.computernetworkingnotes.com/ccna-study-guide/vlsm-subnetting-explained-with-examples.html]

Notice how each point-to-point /30 link (255.255.255.252) gets exactly 4 addresses, 2 of them usable — the classic, minimal fit for a router-to-router connection [Source: https://www.computernetworkingnotes.com/ccna-study-guide/vlsm-subnetting-explained-with-examples.html].

Step 3 and 4: Sort and Allocate Sequentially

The segments are already listed largest to smallest, so we allocate in that order, each block starting where the previous one ended. Development takes the first 128 addresses; Production takes the next 64; Administration the next 32; and the three WAN links each take 4. The complete allocation, with network ID, host range, and broadcast for every subnet, is shown below.

[Source: https://www.computernetworkingnotes.com/ccna-study-guide/vlsm-subnetting-explained-with-examples.html]

Figure 8.3: Carving 192.168.1.0/24 into different-sized subnets, largest first

graph TD
    P["Parent block: 192.168.1.0/24<br/>256 addresses"]
    P --> A["Development /25<br/>192.168.1.0 - .127<br/>128 addresses"]
    P --> B["Production /26<br/>192.168.1.128 - .191<br/>64 addresses"]
    P --> C["Administration /27<br/>192.168.1.192 - .223<br/>32 addresses"]
    P --> D["WAN Link 1 /30<br/>192.168.1.224 - .227"]
    P --> E["WAN Link 2 /30<br/>192.168.1.228 - .231"]
    P --> F["WAN Link 3 /30<br/>192.168.1.232 - .235"]
    P --> G["Free space<br/>192.168.1.236 - .255<br/>20 addresses"]
    style G fill:#d4edda,stroke:#0a0

Step 5: Verifying No Overlap

Now confirm the plan is sound. Walk down the table and check that each subnet’s broadcast address is exactly one below the next subnet’s network ID:

• Development broadcast 192.168.1.127 → next network ID 192.168.1.128. ✔ (127 < 128)
• Production broadcast 192.168.1.191 → next network ID 192.168.1.192. ✔ (191 < 192)
• Administration broadcast 192.168.1.223 → next network ID 192.168.1.224. ✔ (223 < 224)
• WAN 1 broadcast 192.168.1.227 → next network ID 192.168.1.228. ✔ (227 < 228)
• WAN 2 broadcast 192.168.1.231 → next network ID 192.168.1.232. ✔ (231 < 232)

Every broadcast lands exactly one address below the next network ID, which confirms there is no overlap and no wasted gap between subnets [Source: https://www.computernetworkingnotes.com/ccna-study-guide/vlsm-subnetting-explained-with-examples.html]. The alignment check passes too: 0, 128, 192, 224, 228, and 232 are each divisible by their respective block sizes (128, 64, 32, 4, 4, 4).

The last WAN link ends at 192.168.1.235, which means addresses 192.168.1.236 through 192.168.1.255 — a clean block of 20 addresses — remain free for future growth [Source: https://www.computernetworkingnotes.com/ccna-study-guide/vlsm-subnetting-explained-with-examples.html]. Because we allocated largest-first, that free space is a single contiguous block at the end rather than scattered fragments, which is exactly what makes it usable later.

A Second Example: Efficiency on a Larger Block

To see how VLSM scales, consider the parent block 172.16.0.0/22 (1,024 addresses) serving five very different segments [Source: https://geeksubnet.com/guide-vlsm.html].

This plan uses 868 of the 1,024 available addresses — roughly 85% efficiency — while still leaving 172.16.3.100 through 172.16.3.255 free [Source: https://geeksubnet.com/guide-vlsm.html]. A fixed-length scheme covering the 400-host Office LAN would have forced every segment onto a /23, blowing through the entire block after just two subnets.

A Note on /30 Versus /31 for Point-to-Point Links

For point-to-point links, the traditional choice is the /30, which provides 4 total addresses and 2 usable ones, at the cost of 2 “wasted” addresses reserved for the network and broadcast [Source: https://geeksubnet.com/guide-vlsm.html]. On a link that only ever has two endpoints, those reserved addresses do nothing. That is why RFC 3021 permits a /31 mask on point-to-point links: a /31 gives 2 usable addresses with zero waste — no network or broadcast address is reserved — making it even more address-efficient when both routers support it [Source: https://geeksubnet.com/guide-vlsm.html]. Many designs still standardize on /30 for compatibility and troubleshooting familiarity, but the /31 is the maximally conservative option for a two-node link.

Key Takeaway: Given 192.168.1.0/24 and six mixed segments, sizing each requirement (+2, round up to a power of two) and allocating largest-first produces a /25, /26, /27, and three /30 links that pack perfectly — every broadcast landing exactly one below the next network ID, with a clean contiguous block left free at the end. The same method reaches about 85% efficiency on a /22 with five segments. For the smallest links, a /30 gives 2 usable addresses (2 wasted), while an RFC 3021 /31 gives 2 usable with zero waste.

Chapter Summary

VLSM (Variable-Length Subnet Masking) is the technique that lets you divide a single IP block into subnets of different sizes by using more than one subnet mask within the same parent network. It exists to solve the central weakness of fixed-length subnetting, which forces every subnet to share one uniform mask and therefore wastes enormous address space on small segments — most painfully on point-to-point links that need only 2 addresses but are handed blocks sized for a whole LAN.

The benefit of VLSM is address conservation: by right-sizing each subnet to its real host count, you leave few or no addresses unused and preserve clean, contiguous space for future growth. This was one of the founding motivations for VLSM and CIDR — slowing IPv4 exhaustion — and it matters equally inside private networks.

The procedure is disciplined and repeatable: list your requirements, size each one by adding 2 (for network ID and broadcast) and rounding up to the next power of two, sort largest to smallest, allocate blocks sequentially with each one aligned to its own boundary, and verify that no subnet’s range overlaps the next. The largest-first ordering is the golden rule — it prevents fragmentation and overlap by placing big blocks first and leaving a single contiguous free block at the end, exactly like packing the big items into a suitcase before the small ones.

The worked example on 192.168.1.0/24 demonstrated the whole flow, producing a /25, /26, /27, and three /30 point-to-point links whose broadcasts each land exactly one address below the next network ID — proof of no overlap — with 192.168.1.236–255 left free. On the smallest links, a /30 remains the traditional choice (2 usable, 2 wasted) while an RFC 3021 /31 achieves 2 usable with zero waste.

Key Terms

Chapter 9: Route Summarization and Supernetting

In earlier chapters you learned to carve a large block of addresses into many small subnets. This chapter reverses that lens. Instead of dividing address space, we combine it: taking many small, specific routes and folding them into one larger, general route. This process — route summarization — is what keeps the routing tables of the modern Internet from collapsing under their own weight. By the end of this chapter you will be able to look at a set of contiguous networks and calculate, bit by bit, the single summary route that represents them all.

Learning Objectives

By the end of this chapter, you will be able to:

• Aggregate multiple subnets into a single summary route.
• Explain how supernetting reduces routing table size.
• Identify the summary prefix for a set of contiguous networks.

The Case for Summarization

Before learning how to summarize, it helps to understand why the technique exists. Summarization is not a cosmetic convenience — it is a structural necessity for any network that grows beyond a handful of segments.

Let us define the central term. Route summarization is a method where a network creates one summary route that represents multiple networks or subnets. It is also called route aggregation, and when applied to entire classful blocks it is called supernetting [Source: https://jumpcloud.com/it-index/what-is-route-summarization-aggregation]. A summary route is that single, more general entry that stands in for a group of more specific routes.

Routing Table Growth

Every router maintains a routing table — a list of the destinations it knows how to reach and the next hop toward each. Without summarization, every individual subnet must appear as its own entry. A campus with 64 subnets produces 64 routing entries on every router that needs to reach that campus. Multiply this across a large enterprise, and routing tables balloon into thousands of entries.

Large routing tables carry real costs. They consume more memory on every router, and they slow route lookups: a router must search through more records to find a match. Supernetting shortens the routing table, and fewer records can be searched faster than long record lists, so router decision-making and packet forwarding happen much faster in supernet scenarios [Source: https://www.firewall.cx/networking/network-protocols/supernetting-and-cidr/supernetting.html]. Summarization saves both memory and processing resources because the device needs less space to store its table and less power to search through it [Source: https://www.manageengine.com/products/oputils/tech-topics/supernet.html].

The most dramatic example lives on the Internet backbone. Internet routers must know how to reach every network on the Internet. Given the enormous count of Class A, B, and C address blocks, backbone routing tables would grow impossibly large if every network were advertised individually. CIDR and supernetting let an ISP advertise a single aggregated block instead of many individual class-based networks, keeping backbone routing tables manageable [Source: https://www.firewall.cx/networking/network-protocols/supernetting-and-cidr/supernetting.html].

Advertisement Efficiency

Routing tables are not built by hand; routers exchange them using routing protocols. Every route a router knows is a route it may need to advertise to its neighbors, and every advertisement consumes bandwidth and processing time.

By advertising one summary route instead of many specific ones, a router sends fewer updates. This dramatically reduces routing table entries and minimizes the volume of routing update messages between routers, saving bandwidth because there are fewer routes to advertise [Source: https://www.visiontrainingsystems.com/blogs/how-to-implement-route-summarization-to-reduce-routing-table-size/].

Summarization also brings a subtler and equally valuable benefit: stability. When a summary route hides the internal detail of a block, a change inside that block — a link that fails and recovers repeatedly, a phenomenon called “flapping” — does not force every distant router to update. Summarization isolates topology changes, improving network stability by limiting the propagation of routing updates when a link fails [Source: https://networklessons.com/rip/introduction-route-summarization]. The summarizing router absorbs the churn; the rest of the network never sees it.

Analogy: The Postal Sorting Hierarchy Think of how mail is delivered. A sorting center in another country does not need to know the specific street address of every house in your city. It only needs to know “everything for this postal region goes on this truck.” The fine-grained detail — which street, which house — is resolved locally, near the destination. A summary route works the same way: distant routers hold one coarse entry (“everything in this block goes this direction”), and the precise path is figured out only once traffic arrives near the destination. Imagine if every international sorting center had to store the address of every individual house on Earth — that is a routing table without summarization.

Hierarchical Addressing

Summarization only works if addresses were assigned thoughtfully in the first place. Hierarchical addressing means allocating address blocks in a structured, contiguous way so that related networks share common high-order bits and can therefore be folded together cleanly.

Hierarchical (structured) IP addressing is a prerequisite for effective summarization: address blocks must be assigned contiguously so they can be aggregated cleanly [Source: https://networklessons.com/rip/introduction-route-summarization]. If a designer scatters subnets randomly across the address space — 10.1.5.0 here, 10.1.200.0 there, 10.1.12.0 somewhere else — no clean summary boundary exists, and every subnet must be advertised on its own. Good address design is what enables summarization; it is a decision made at the planning stage, not a trick applied afterward.

Figure 9.2: Hierarchical addressing collapsing a routing table into nested summaries

graph TD
    B["Backbone router sees: 10.0.0.0/8"]
    B --> C1["Region East: 10.1.0.0/16"]
    B --> C2["Region West: 10.2.0.0/16"]
    C1 --> S1["Campus A: 10.1.0.0/22"]
    C1 --> S2["Campus B: 10.1.4.0/22"]
    C2 --> S3["Campus C: 10.2.0.0/22"]
    S1 --> L1["10.1.0.0/24 ... 10.1.3.0/24"]
    S2 --> L2["10.1.4.0/24 ... 10.1.7.0/24"]
    S3 --> L3["10.2.0.0/24 ... 10.2.3.0/24"]

Key Takeaway: Route summarization replaces many specific routes with one general summary route, shrinking routing tables so routers use less memory and forward packets faster. It reduces advertisement traffic between routers and improves stability by hiding internal topology changes. All of this depends on hierarchical addressing — assigning blocks contiguously so they share common bits and can be aggregated.

How to Summarize

Summarization is fundamentally a binary operation. To combine a set of networks, you find the bits they all have in common and keep those as the summary; the bits where they differ become host space inside the summary. This section walks through the exact procedure.

Finding Common High-Order Bits

A router calculates a summary by finding the longest common bit pattern shared by all the networks in the set. The length of that common prefix becomes the length of the summary route [Source: https://techcommunity.microsoft.com/blog/fasttrackforazureblog/implementing-route-summarization-in-azure-vmware-solution/4248155].

Consider a small, clean example first. Suppose we want to summarize four contiguous /24 networks:

• 10.1.0.0/24
• 10.1.1.0/24
• 10.1.2.0/24
• 10.1.3.0/24

These four networks share the same first, second, and (mostly) third octet. Writing the third octet in binary makes the shared portion visible:

Reading left to right, the first six bits of the third octet (000000) are identical across all four networks; only the last two bits vary. The common prefix is therefore 8 (first octet) + 8 (second octet) + 6 (common bits of the third octet) = 22 bits. The summary route is 10.1.0.0/22 [Source: https://techcommunity.microsoft.com/blog/fasttrackforazureblog/implementing-route-summarization-in-azure-vmware-solution/4248155].

Figure 9.1: Four contiguous /24 networks aggregating into one summary route

graph TD
    S["Summary route: 10.1.0.0/22"]
    S --> N0["10.1.0.0/24"]
    S --> N1["10.1.1.0/24"]
    S --> N2["10.1.2.0/24"]
    S --> N3["10.1.3.0/24"]

Choosing the Summary Prefix — A Full Worked Example

Now let us work a larger, complete example step by step: summarizing eight contiguous /24 networks, from 172.16.0.0/24 through 172.16.7.0/24.

Step 1 — List the networks in binary, focusing on the octet that differs. The first two octets (172.16) are identical for all eight networks, so the action happens in the third octet [Source: https://networklessons.com/subnetting/route-summarization].

Step 2 — Find the common bits. Compare all eight values from left to right and identify the bits that match consecutively. In the third octet, the first five bits (00000) are identical across every network; the last three bits cycle through all eight combinations from 000 to 111 [Source: https://networklessons.com/subnetting/route-summarization].

Step 3 — Calculate the summary address and prefix. Add the common bits to the fixed network portion: 16 bits (first two octets) + 5 common bits of the third octet = 21 bits. The summary address is 172.16.0.0/21 [Source: https://networklessons.com/subnetting/route-summarization].

Step 4 — Express the summary mask. A /21 mask in binary is 11111111.11111111.11111000.00000000, which is 255.255.248.0 in dotted decimal [Source: https://networklessons.com/subnetting/route-summarization].

Figure 9.3: The common-high-order-bits summarization procedure

flowchart TD
    A["List all networks in binary"] --> B["Focus on the octet where they differ"]
    B --> C["Compare left to right; count consecutive matching bits"]
    C --> D["Summary prefix = fixed bits + common bits"]
    D --> E["Set varying (host) bits to 0 for the summary address"]
    E --> F["Convert prefix length to dotted-decimal mask"]
    F --> G["Summary: 172.16.0.0/21 (255.255.248.0)"]

This gives us a compact rule of thumb. The number of contiguous networks summarized is always a power of two, and summarizing 2ⁿ networks shortens the prefix by n bits:

Summarizing four networks reduces the prefix from /24 to /22; summarizing eight reduces it from /24 to /21, and so on [Source: https://networklessons.com/subnetting/route-summarization].

Contiguity Requirements

Two conditions must hold for a summary to be exact — meaning it covers precisely the intended networks and nothing else.

First, the block of networks must be contiguous. Contiguous blocks are networks that sit next to each other with no gaps in the address space, so they share a common high-order bit pattern.

Second, the summary boundary must fall on a power-of-two boundary. The starting network must be a multiple of the block size. For example, eight /24s summarize cleanly to a /21 only when they start on a /21 boundary (such as 172.16.0.0, 172.16.8.0, 172.16.16.0). A group of eight /24s starting at 172.16.3.0 would not align to a single /21 and could not be summarized exactly [Source: https://networklessons.com/subnetting/route-summarization].

The danger of ignoring these rules is that a summary can accidentally cover addresses you did not intend. Consider a summary of 192.168.100.0/22, which covers segments 192.168.100.0/24 through 192.168.103.0/24. If a network administrator later configures 192.168.104.0/24, that segment falls outside the /22 range and is therefore not covered by the summary — traffic to it would need a separate route [Source: https://pingmynetwork.com/academy/ccna-200-301/route-summarization/].

Analogy: Reading a Book by Its Table of Contents Finding common high-order bits is like grouping chapters under a single part heading. If chapters 1 through 8 all belong to “Part One,” you can reference the whole group with one heading instead of listing eight chapter titles. But this only works if the chapters are consecutive and the part starts in the right place. You cannot label chapters 3 through 10 as “Part One” if Part One is defined to begin at chapter 1 — the boundary is fixed. Summary boundaries are just as rigid: they must start on the right multiple.

Key Takeaway: To summarize, write the differing octet of each network in binary, count the bits that are identical from left to right, and add them to the fixed prefix bits — that count is your summary prefix length. Summarizing 2ⁿ contiguous networks shortens the prefix by n bits. The networks must be contiguous and start on a power-of-two boundary, or the summary will either miss networks or cover ones it should not.

Supernetting in Practice

The terms summarization, aggregation, and supernetting describe the same underlying operation, but “supernetting” carries a specific historical flavor: combining multiple classful networks into one larger block using a prefix shorter than the classful default. Supernetting is a technique that allows multiple smaller network blocks to be combined into a larger, more efficient network block [Source: https://www.websentra.com/intro-to-supernetting/]. It is precisely the inverse of subnetting — subnetting uses a longer prefix (more network bits) to create smaller networks, while supernetting uses a shorter prefix (fewer network bits) to create a larger one [Source: https://www.websentra.com/intro-to-supernetting/].

Aggregating Class C Blocks

The classic supernetting scenario combines contiguous Class C /24 blocks into a single, shorter-prefix route. Suppose an organization is allocated four consecutive Class C networks:

• 192.168.0.0/24
• 192.168.1.0/24
• 192.168.2.0/24
• 192.168.3.0/24

Applying the method from the previous section, the first six bits of the third octet are common, so these four /24s combine into the single supernet 192.168.0.0/22. This supernet covers every address from 192.168.0.0 through 192.168.3.255 in one routing entry [Source: https://www.websentra.com/intro-to-supernetting/].

Figure 9.4: Four Class C blocks combined into a single CIDR supernet

graph TD
    SN["Supernet: 192.168.0.0/22 (covers .0.0 through .3.255)"]
    SN --> B0["192.168.0.0/24"]
    SN --> B1["192.168.1.0/24"]
    SN --> B2["192.168.2.0/24"]
    SN --> B3["192.168.3.0/24"]

The payoff is concrete. Instead of a router holding four individual routes — all pointing to the same next hop — it holds one aggregated route representing all four [Source: https://www.firewall.cx/networking/network-protocols/supernetting-and-cidr/supernetting.html]:

CIDR Supernets

Supernetting is closely associated with CIDR (Classless Inter-Domain Routing), the addressing scheme that abandons rigid class boundaries in favor of arbitrary prefix lengths. A supernet is expressed in CIDR notation — for example, 192.168.0.0/22 — precisely because a /22 mask does not correspond to any traditional address class. CIDR is what makes the shorter-than-classful prefix legal and routable [Source: https://en.wikipedia.org/wiki/Supernetwork].

Routing protocols make aggregation practical in production. Protocols such as EIGRP, OSPF, RIP, and BGP support configuring summary or aggregate addresses on interfaces or at routing boundaries [Source: https://study-ccnp.com/bgp-route-summarization-explained-configured/]. By defining a summary address on a router interface, a protocol like EIGRP advertises the single aggregated prefix to its neighbors rather than the full list of specific networks [Source: https://techcommunity.microsoft.com/blog/fasttrackforazureblog/implementing-route-summarization-in-azure-vmware-solution/4248155]. On the Internet backbone, this is exactly the mechanism BGP uses to let an ISP announce one aggregated block on behalf of many customer networks.

Pitfalls of Over-Summarization

Summarization is powerful, but summarizing too aggressively creates its own problems. The core risk is that a summary route can advertise reachability to address space that does not actually exist behind the summarizing router, or that lives somewhere else entirely.

Recall the boundary example: a 192.168.100.0/22 summary covers 192.168.100.0 through 192.168.103.255. If someone attempts to fold in 192.168.104.0/24, that network is not inside the /22 and is not covered [Source: https://pingmynetwork.com/academy/ccna-200-301/route-summarization/]. Two failure modes follow from misjudging the boundary:

The disciplined practice is to summarize only truly contiguous, power-of-two-aligned blocks, and to reserve address ranges hierarchically so that future growth fits inside existing summary boundaries. This is why the address planning discussed earlier matters so much: over-summarization is almost always a symptom of address space that was not allocated with aggregation in mind.

Analogy: One Sign for a Whole Neighborhood A single highway sign reading “Downtown — Next Exit” is efficient only if everything it points to is genuinely reachable from that exit. If the sign covers a district that also includes a neighborhood on the far side of the river, drivers will follow it and hit a dead end. A summary route that is too broad is exactly that misleading sign: it directs traffic toward destinations it cannot actually deliver. The fix is to make the sign match the territory precisely — summarize only what truly lies behind you.

Key Takeaway: Supernetting combines contiguous classful blocks — such as four Class C /24s into a single 192.168.0.0/22 — using a shorter-than-classful prefix that CIDR makes routable. Routing protocols like BGP, OSPF, and EIGRP advertise these aggregates to shrink tables across the Internet. But over-summarizing a misaligned or non-contiguous block can black-hole traffic or leave networks unreachable, so summarize only clean, power-of-two-aligned ranges.

Chapter Summary

Route summarization — also called aggregation, and known as supernetting when applied to classful blocks — replaces many specific routes with a single, more general summary route. Its purpose is structural: smaller routing tables consume less memory and are searched faster, fewer advertisements save bandwidth, and hidden internal detail insulates the network from the churn of failing links. None of this is possible without hierarchical addressing, in which blocks are assigned contiguously so they share common high-order bits.

The mechanics are binary. To find a summary, write the differing octet of each network in binary, count the bits that match from left to right, and add that count to the fixed prefix. Summarizing 2ⁿ contiguous networks shortens the prefix by n bits — four /24s become a /22, eight /24s become a /21 with mask 255.255.248.0. Two rules govern correctness: the networks must be contiguous, and the summary must start on a power-of-two boundary. In practice, supernetting aggregates consecutive Class C blocks into CIDR supernets that routing protocols advertise across the Internet backbone. The chief danger is over-summarization: a summary that is too broad attracts traffic it cannot deliver, while one that is misaligned leaves networks stranded. Summarize only clean, aligned, contiguous ranges, and plan address space so future growth fits inside existing boundaries.

Key Terms

Chapter 10: Practical Design, Tools, and Troubleshooting

By this point in the book you have mastered the mechanics of subnetting: dividing address space with CIDR, right-sizing subnets with VLSM, and computing network and broadcast addresses in binary. This final chapter shifts from how the math works to how professionals use it. Real networks are not exam questions; they are living systems that must grow, be documented, and be fixed at 2 a.m. when something breaks. Here you will learn to build an addressing plan a colleague can read, verify your math with the same command-line tools network engineers rely on, and recognize the small handful of mistakes that cause the vast majority of subnetting outages.

Learning Objectives

By the end of this chapter, you will be able to:

• Design an addressing plan for a small-to-medium network that accommodates future growth, aligns to sites and VLANs, and is fully documented.
• Use subnet calculators and CLI tools such as ipcalc and sipcalc to independently verify your subnet math before and after deployment.
• Diagnose common subnetting mistakes — overlapping subnets, off-by-one host counts, and wrong masks on interfaces — using a repeatable troubleshooting workflow.

Designing an Addressing Plan

An addressing plan is the master document that says which IP subnet each part of your network uses, what each subnet is for, and how the whole scheme can expand. Think of it as the blueprint for a building: you would never pour a foundation without one, and you should never assign IP addresses without one either. Get it right at the start and you avoid the single most expensive networking task there is — renumbering a live network.

Start with private address space

Business networks are built on the private address ranges defined by RFC 1918. These ranges are reserved for internal use and are not routable on the public internet, which is exactly why they are safe to reuse behind NAT [Source: https://datatracker.ietf.org/doc/html/rfc1918]. There are three of them:

[Source: https://www.rfc-editor.org/rfc/rfc1918.html]

For a business that wants a clean growth path, it is generally best to base the plan on the large 10.0.0.0/8 block. Its enormous size lets you build a hierarchical, human-readable scheme with plenty of headroom, rather than squeezing everything into a single /24 and running out of room within a year [Source: https://medium.com/@bailey-hawker/how-to-design-the-perfect-rfc1918-subnet-scheme-abd685725566].

Analogy: RFC 1918 space is like the internal room-numbering system in a large building. Room “3-214” (floor 3, wing 2, room 14) means something to anyone inside, but it means nothing to the postal service, which needs your street address (your public IP). Because the numbers are only meaningful internally, every building in the city can reuse the same scheme without conflict.

Growth planning: design for readability, not conservation

Here is the mental shift that separates a home network from a professional one. On the public internet, IPv4 addresses are scarce and expensive, so you conserve them. Inside your own network, private address space is effectively free — so the goal flips. You optimize for a logical, admin-friendly numbering scheme with generous headroom, not for packing hosts as tightly as possible [Source: https://oneuptime.com/blog/post/2026-03-20-private-ipv4-scheme-rfc1918-ranges/view].

Four practical techniques follow from that principle:

1. Allocate top-level CIDRs per site and per function up front, and leave headroom. Give each location a large “super-subnet” that you can later carve into smaller subnets and VLANs as the site grows, instead of handing out tight /24s that fill up [Source: https://oneuptime.com/blog/post/2026-03-20-private-ipv4-scheme-rfc1918-ranges/view].

2. Encode meaning into the octets. Use, for example, the second octet for site or region and the third octet for VLAN or function. This makes addresses self-documenting and easy to summarize on routers. When you see 10.20.30.x, you can read it as “site 20, VLAN 30” at a glance [Source: https://medium.com/@bailey-hawker/how-to-design-the-perfect-rfc1918-subnet-scheme-abd685725566].

3. Right-size subnets with room to spare. A commonly recommended “sweet spot” for a VLAN is a /22, which provides 1,022 usable hosts — large enough that you rarely run out, small enough to stay manageable. Match subnet size to expected host count plus a growth margin [Source: https://medium.com/@bailey-hawker/how-to-design-the-perfect-rfc1918-subnet-scheme-abd685725566].

4. Group hosts with similar connectivity needs onto their own subnets. Put users, servers, printers, IoT/OT devices, and network management on distinct subnets. Segmenting sensibly avoids major disruptions and makes security policy easier to apply [Source: https://www.msp360.com/resources/blog/guide-to-subnets-and-ip-addressing/].

Warning — avoid the default consumer subnets. The two most popular home-router subnets are 192.168.0.0/24 and 192.168.1.0/24. Do not use these on a business LAN. Remote workers connecting over VPN from home networks that use the same range will experience subnet overlap and routing conflicts — their laptop cannot tell whether 192.168.1.50 is the office file server or their own living-room printer [Source: https://medium.com/@bailey-hawker/how-to-design-the-perfect-rfc1918-subnet-scheme-abd685725566].

Aligning subnets to sites and VLANs

A VLAN (Virtual Local Area Network) is a logical grouping of devices that behave as if they share one physical switch, even when they are spread across many switches. VLANs let you keep, say, all the accounting-department machines in one broadcast domain regardless of which floor they sit on.

The standard design is a one-to-one mapping of VLAN to IP subnet: every VLAN gets exactly one subnet, and every subnet serves exactly one VLAN. Assigning each location a large block that you then carve into per-VLAN subnets keeps Layer 2 broadcast domains small (fewer devices per VLAN means less broadcast noise) while keeping the Layer 3 plan tidy and summarizable [Source: https://medium.com/@bailey-hawker/how-to-design-the-perfect-rfc1918-subnet-scheme-abd685725566].

Worked example: an addressing plan for “Acme Corp”

Suppose Acme has a headquarters and a branch office, each needing separate VLANs for users, servers, printers, IoT devices, and network management. We base the plan on 10.0.0.0/8 and use the second octet for the site and the third octet for the VLAN. We give each subnet a /24 here for readability, but the site blocks are large enough to grow into /22s later.

Notice how self-documenting this is. Anyone reading 10.2.20.15 immediately knows: Branch site, Servers VLAN, host 15. The entire HQ site can be summarized on a WAN router as 10.1.0.0/16, and the branch as 10.2.0.0/16, which keeps routing tables small. There is enormous headroom left — sites 3 through 255 and dozens more VLAN IDs remain unallocated.

Figure 10.1: Acme Corp site-and-VLAN address hierarchy

graph TD
    ROOT["10.0.0.0/8 (private space)"]
    ROOT --> HQ["HQ site: 10.1.0.0/16"]
    ROOT --> BR["Branch site: 10.2.0.0/16"]

    HQ --> HQU["Users VLAN 10: 10.1.10.0/24"]
    HQ --> HQS["Servers VLAN 20: 10.1.20.0/24"]
    HQ --> HQP["Printers VLAN 30: 10.1.30.0/24"]
    HQ --> HQI["IoT VLAN 40: 10.1.40.0/24"]
    HQ --> HQM["Management VLAN 99: 10.1.99.0/24"]

    BR --> BRU["Users VLAN 10: 10.2.10.0/24"]
    BR --> BRS["Servers VLAN 20: 10.2.20.0/24"]
    BR --> BRM["Management VLAN 99: 10.2.99.0/24"]

Documenting allocations

An addressing plan is only as good as its documentation. The convention in professional networks is to maintain an IP Address Management (IPAM) record — which can be dedicated IPAM software or simply a well-maintained spreadsheet — that maps each subnet to its purpose, VLAN ID, gateway address, DHCP scope, and reserved static ranges [Source: https://www.msp360.com/resources/blog/guide-to-subnets-and-ip-addressing/].

Good documentation does three things at once: it prevents overlap (you can see at a glance whether a range is already taken), it speeds troubleshooting (when a host misbehaves you can check what it should be configured with), and it makes expansion predictable (the next free block is obvious). The table above is itself the core of such a document; a fuller version would add a “DHCP scope” column (e.g., 10.1.10.100–10.1.10.200) and a “static reservations” column for servers and gateways.

Key Takeaway: An addressing plan built on RFC 1918 space — ideally the large 10.0.0.0/8 block — should optimize for readability and headroom rather than conservation, encoding site and function into the octets and mapping VLANs one-to-one with subnets. Document every allocation (purpose, VLAN, gateway, DHCP scope) in an IPAM record or spreadsheet so overlap is prevented and future growth is predictable.

Tools of the Trade

You should never trust hand-done binary math on a production network without checking it. A single flipped bit can take down a subnet. Fortunately, a small set of tools lets you independently confirm the network address, broadcast address, mask, usable host range, and host count for any block — in seconds.

Subnet calculators

A subnet calculator is any tool — command-line, web-based, or spreadsheet-driven — that takes an address and mask and returns the derived facts about that subnet. Web calculators are convenient for quick VLSM planning during design; CLI calculators are ideal for scripting and for verifying a device’s live configuration. All of them serve the same purpose: to independently confirm your math before you commit a design or while you troubleshoot a mismatch [Source: https://www.cyberciti.biz/tips/perform-simple-manipulation-of-ip-addresse.html].

ipcalc and CLI utilities

ipcalc is a command-line calculator that takes an IP address and netmask and computes the resulting network address, broadcast address, Cisco wildcard mask, and host range. On Debian/Ubuntu it effectively combines the features of sipcalc and whatmask [Source: https://www.cyberciti.biz/faq/linux-subnet-calculator-cidr/].

Consider verifying a /27 subnet:

$ ipcalc 202.54.1.2/27

The output tells you everything you need to know about that block:

[Source: https://www.cyberciti.biz/faq/linux-subnet-calculator-cidr/]

A /27 borrows 3 host bits from the last octet, leaving 5 host bits — so 2⁵ = 32 addresses, minus the network (.0) and broadcast (.31), gives exactly 30 usable hosts. The calculator confirms the math you would otherwise do by hand. Helpfully, ipcalc also color-codes the address in binary, which makes it an excellent teaching aid for showing which bits are network bits and which are host bits.

sipcalc is a more advanced console calculator that supports both IPv4 and IPv6. Beyond the basics, it can retrieve address information directly from a live network interface, produce both classful and CIDR output, and accept masks in several formats — dotted quad (255.255.255.0), hexadecimal (0xffffff00), or bit count (/24) [Source: https://manpages.ubuntu.com/manpages/trusty/man1/sipcalc.1.html].

$ sipcalc 192.168.1.0/24

produces:

[Source: https://www.redhat.com/en/blog/how-use-sipcalc]

Widen the mask and the range expands accordingly. The recommended /22 “sweet spot” subnet demonstrates this well:

$ sipcalc 192.168.0.0/22

[Source: https://www.redhat.com/en/blog/how-use-sipcalc]

Notice the usable range spans four third-octet values (.0 through .3) — that is the 1,022 usable hosts (1,024 minus network and broadcast) that make the /22 such a comfortable VLAN size. Adding the -a flag prints “all possible information about an address or interface,” including binary bitmap representations that visualize the network/host boundary [Source: https://www.redhat.com/en/blog/how-use-sipcalc].

Installing the tools:

[Source: https://www.cyberciti.biz/faq/linux-subnet-calculator-cidr/]

Beyond calculators, administrators also lean on whatmask for quick mask conversions and the ip suite (ip addr, ip route get) to read live configuration — which becomes central to troubleshooting in the next section [Source: https://www.cyberciti.biz/tips/perform-simple-manipulation-of-ip-addresse.html].

Spreadsheet planning

For the design phase, a spreadsheet remains one of the most effective planning tools. It doubles as your IPAM documentation and lets you lay out every subnet, VLAN, gateway, and reserved range in one sortable view — exactly the Acme Corp table from earlier. The workflow that professionals follow is: plan the blocks in the spreadsheet, verify each block’s math with ipcalc or sipcalc, then record the confirmed values back in the spreadsheet as the source of truth.

Figure 10.2: The plan-verify-document workflow

flowchart TD
    A["Plan blocks in spreadsheet (subnet, VLAN, gateway, range)"] --> B["Verify each block with ipcalc / sipcalc"]
    B --> C{"Math matches the plan?"}
    C -->|"No"| D["Adjust mask or block boundary"]
    D --> B
    C -->|"Yes"| E["Record confirmed values in spreadsheet"]
    E --> F["Spreadsheet is the documented source of truth"]

Tool comparison

Key Takeaway: Never trust hand-done subnet math on a production network. ipcalc and sipcalc independently confirm the network address, broadcast, mask, usable range, and host count in seconds, and sipcalc can even read a device’s live configuration. Plan in a spreadsheet, verify with a CLI calculator, and record the confirmed values as your documented source of truth.

Common Mistakes and Fixes

Most subnetting problems trace back to the same short list of configuration errors. They are notoriously hard to diagnose because the symptoms all look like a generic “the network is broken” outage — yet each has a distinctive fingerprint once you know what to look for [Source: https://oneuptime.com/blog/post/2026-03-20-avoid-common-subnetting-mistakes/view].

Overlapping subnets

An overlap occurs when two or more subnets cover the same IP address ranges. This sends data to the wrong place, creates security risks, and is very hard to troubleshoot because the same address legitimately “belongs” to two different definitions [Source: https://oneuptime.com/blog/post/2026-03-20-avoid-common-subnetting-mistakes/view].

Worked example. Suppose someone defines both 192.168.1.0/24 and 192.168.1.128/25 on the same network. The /24 covers .0 through .255; the /25 covers .128 through .255. Every address from 192.168.1.128 to 192.168.1.255 now belongs to both subnets — an overlap of 128 addresses. Routers and hosts cannot consistently decide where those addresses live.

Overlap frequently appears in the VPN scenario described earlier: a remote worker’s home LAN uses the same range as the corporate LAN, and traffic that should reach the office instead gets delivered locally. Fix: plan non-overlapping blocks up front and document them in your IPAM record. A subnet calculator confirms exactly which addresses two blocks share, so you can spot the collision before it reaches production [Source: https://oneuptime.com/blog/post/2026-03-20-avoid-common-subnetting-mistakes/view].

Off-by-one host counts

Two addresses in every subnet can never be assigned to a host: the first (all host bits zero = the network address) and the last (all host bits one = the broadcast address). Forgetting this is the single most common source of off-by-one errors, both in exam answers and in real allocations [Source: https://learn.microsoft.com/en-us/troubleshoot/windows-client/networking/tcpip-addressing-and-subnetting].

Worked example. Divide 192.168.123.0 into four /26 subnets. Each /26 has 6 host bits (2⁶ = 64 addresses), so the four subnets and their unusable addresses are:

The addresses .0, .63, .64, .127, .128, .191, .192, and .255 are all invalid as host addresses. Each /26 yields 64 total but only 62 usable hosts. Assigning a device the .63 broadcast address, or expecting 64 usable hosts instead of 62, are classic off-by-one failures. Related mistakes include choosing a mask that yields too few or too many hosts and defining a subnet that does not start on a valid boundary for its mask [Source: https://learn.microsoft.com/en-us/troubleshoot/windows-client/networking/tcpip-addressing-and-subnetting] [Source: https://www.firmsuggest.com/blog/most-common-subnetting-errors-and-how-to-avoid-them/].

Wrong mask on interfaces

Setting the wrong subnet mask confuses routers and hosts about which addresses are local (reachable directly) versus remote (reachable only through a gateway). If a network uses a non-default mask but a client still has the default mask for its address class, communication fails to some nearby networks but not to distant ones [Source: https://learn.microsoft.com/en-us/troubleshoot/windows-client/networking/tcpip-addressing-and-subnetting].

The classic fingerprint: a host can reach devices on its own segment and can reach distant remote networks, but cannot reach nearby networks that share the same Class A/B/C address. Another symptom of a too-broad mask is being able to ping the gateway but not other hosts that are actually on a different physical subnet. Fix: enter the correct subnet mask in the host’s TCP/IP configuration [Source: https://learn.microsoft.com/en-us/troubleshoot/windows-client/networking/tcpip-addressing-and-subnetting].

Two closely related interface errors round out the list:

• Incorrect default gateway. The gateway is the router address a host uses to reach anything off its own subnet. A host with the wrong gateway can talk to its own segment but fails to reach some or all remote networks. This is common when an organization has more than one router (say, one for the internal network and one for the internet) and the wrong one is set as default. Fix: point the gateway at the router that links the host’s subnet to the destination networks [Source: https://learn.microsoft.com/en-us/troubleshoot/windows-client/networking/tcpip-addressing-and-subnetting].

• Incorrect IP address (wrong subnet). Placing a host whose address belongs on a different subnet onto a physical LAN means it can reach remote networks but not some or all machines on its own local segment. Fix: ensure every host on the same physical segment has an address within the same subnet [Source: https://learn.microsoft.com/en-us/troubleshoot/windows-client/networking/tcpip-addressing-and-subnetting].

Notice the complementary fingerprints, which are your fastest diagnostic shortcut:

[Source: https://learn.microsoft.com/en-us/troubleshoot/windows-client/networking/tcpip-addressing-and-subnetting]

Figure 10.3: Symptom-fingerprint decision tree for common mistakes

flowchart TD
    START["Host cannot communicate"] --> Q1{"Do two subnets claim the same addresses?"}
    Q1 -->|"Yes"| OVERLAP["Overlapping subnets"]
    Q1 -->|"No"| Q2{"Can it reach remote networks?"}
    Q2 -->|"No, only own segment"| GW["Wrong default gateway"]
    Q2 -->|"Yes"| Q3{"Can it reach all local hosts?"}
    Q3 -->|"No, missing some local hosts"| IP["Wrong IP (host on wrong subnet)"]
    Q3 -->|"Reaches own + distant, not nearby same-class"| MASK["Wrong subnet mask"]

When a host cannot communicate, work through these steps in order rather than guessing [Source: https://oneuptime.com/blog/post/2026-03-20-fix-incorrect-subnet-mask-errors/view]:

1. Check the local configuration with ipconfig (Windows) or ip addr (Linux) to confirm the IP, mask, and gateway match the plan.
2. Ping the default gateway. If the gateway responds but other on-LAN hosts don’t, suspect a wrong mask or a host on the wrong subnet.
3. Ping a known remote host. If the gateway is reachable but remote networks are not, suspect an incorrect default gateway.
4. Use ip route get <target-ip> (Linux) to see how the host would actually route a packet. If a host that should be on the same LAN is being sent to the gateway instead of delivered directly, the local mask is wrong [Source: https://oneuptime.com/blog/post/2026-03-20-fix-incorrect-subnet-mask-errors/view].
5. Run a traceroute (traceroute / tracert) to isolate which hop the traffic dies at, exposing misconfigured gateways or inter-subnet routing.
6. Verify the math with a calculator (ipcalc / sipcalc) to confirm the intended network, broadcast, and usable range, then compare against each device’s configuration.

Figure 10.4: The repeatable troubleshooting workflow

flowchart TD
    S1["1. Check local config (ip addr / ipconfig)"] --> S2["2. Ping the default gateway"]
    S2 --> D1{"Gateway responds?"}
    D1 -->|"No"| MASKHOST["Suspect wrong mask or host on wrong subnet"]
    D1 -->|"Yes"| S3["3. Ping a known remote host"]
    S3 --> D2{"Remote reachable?"}
    D2 -->|"No"| GWERR["Suspect incorrect default gateway"]
    D2 -->|"Yes"| S4["4. ip route get target-ip (check actual routing)"]
    S4 --> S5["5. traceroute to isolate the failing hop"]
    S5 --> S6["6. Verify math with ipcalc / sipcalc vs. each config"]

This is where the whole chapter comes together: your documentation tells you what each device should be, your CLI tools confirm the correct math, and the workflow’s symptom-matching tells you which of the common mistakes you are looking at.

Key Takeaway: Nearly all subnetting outages come from four mistakes — overlapping subnets, off-by-one host counts (the network and broadcast addresses are never usable), wrong masks, and wrong gateways — and each has a distinctive symptom fingerprint. Diagnose systematically: check the local config, ping the gateway then a remote host, use ip route get to see actual routing, traceroute to isolate the failing hop, and verify the math with a calculator against your documentation.

Chapter Summary

This chapter turned subnetting theory into professional practice. A good addressing plan starts with RFC 1918 private space — usually the large 10.0.0.0/8 block — and optimizes for readability and headroom rather than conservation, encoding site and function into the octets, mapping VLANs one-to-one with subnets, and documenting every allocation in an IPAM record or spreadsheet. The Acme Corp worked example showed how a self-documenting scheme like 10.<site>.<VLAN>.<host> stays clean and summarizable while leaving room to grow.

You then met the tools of the trade — ipcalc, sipcalc, web calculators, and planning spreadsheets — and saw how they independently confirm network address, broadcast, mask, usable range, and host count in seconds. The professional workflow is to plan in a spreadsheet, verify with a CLI calculator, and treat the confirmed values as your source of truth.

Finally, you learned that the vast majority of subnetting failures come from a short list of mistakes: overlapping subnets, off-by-one host counts, wrong masks, and wrong gateways. Each has a distinctive symptom fingerprint, and a repeatable troubleshooting workflow — check config, ping gateway then remote, ip route get, traceroute, verify the math — turns a mysterious outage into a solvable puzzle. With these three skills — design, verification, and diagnosis — you can carry subnetting from the whiteboard to a running network with confidence.

Key Terms

Chapter 11: Mastery, IPv6 Preview, and Next Steps

You have spent ten chapters learning what subnetting is, how CIDR notation compresses masks into a slash and a number, and how VLSM lets you right-size every subnet in a network. This final chapter is about turning that knowledge into a reflex. The goal here is not to learn a new concept so much as to change your relationship with the concepts you already have: to move from “I can work this out with a pencil and a few minutes” to “I can answer this in my head before the invigilator finishes reading the question.”

Along the way, we will take a short detour into IPv6, the addressing system that is steadily replacing IPv4. Seeing IPv6 side by side with everything you have learned does two things: it shows you which of your hard-won IPv4 skills carry over, and it reveals which ones become gloriously unnecessary. We close by mapping out the practice resources, certification paths, and real-world habits that turn exam-day speed into career-long fluency.

Learning Objectives

By the end of this chapter, you will be able to:

• Perform subnetting quickly under exam conditions using cheat-sheet tables and mental shortcuts.
• Contrast IPv4 subnetting with IPv6 addressing concepts, including hex, nibble boundaries, and the disappearance of VLSM-style waste.
• Build a practice regimen for lasting fluency and identify the resources and certifications that support it.

Speed Subnetting for Exams

On a certification exam, the difference between passing and failing is rarely whether you understand subnetting. It is whether you can finish. A candidate who takes four minutes per subnetting question and gets every one right will still run out of time and miss questions on other topics. The techniques in this section are designed to get your per-question time down toward a minute or less by removing binary conversion almost entirely.

The Magic Number Method

The single most important exam technique is the Magic Number method, also called the block-size method. It lets you find subnet boundaries, broadcast addresses, and host ranges almost entirely in your head, with minimal arithmetic and no binary conversion at all [Source: https://oneuptime.com/blog/post/2026-03-20-subnetting-magic-number-method/view].

The core formula is simple:

Magic Number (block size) = 256 − (interesting mask octet)

The interesting octet is the first octet in the subnet mask that is neither 0 nor 255. That is the octet where the boundary between the network portion and the host portion falls, and it is the only octet you actually need to do math on [Source: https://oneuptime.com/blog/post/2026-03-20-subnetting-magic-number-method/view].

The procedure has three steps:

1. Identify the interesting octet and calculate the block size (256 − octet value).
2. Generate the multiples of that block size within the octet: 0, block, 2×block, 3×block, and so on.
3. The subnet containing your IP address starts at the largest multiple that is less than or equal to the IP’s octet value.

Figure 11.1: The Magic Number method procedure

flowchart TD
    A["Start: IP address + mask"] --> B["Find interesting octet<br/>(first octet not 0 or 255)"]
    B --> C["Block size = 256 − interesting octet"]
    C --> D["List multiples of block size<br/>0, block, 2×block, 3×block, ..."]
    D --> E["Subnet start = largest multiple<br/>≤ IP's octet value"]
    E --> F["Broadcast = subnet start<br/>+ block size − 1"]
    F --> G["Read off subnet and host range"]

Two shortcut identities finish the job:

• Subnet start = largest multiple of the block size ≤ the IP’s octet value.
• Broadcast = subnet start + block size − 1.

Think of the block size as the stride of a staircase. Once you know each step is 8 wide (or 16, or 64), you can jump from step to step without counting individual stairs. Your IP address is standing somewhere on that staircase; you just need to name the step it is on and the step above it.

Worked Example 1: 172.20.50.100/21

Let us walk through a full problem the way you would on exam day.

• A /21 mask is 255.255.248.0. The interesting octet is 248, sitting in the third position.
• Block size = 256 − 248 = 8.
• Multiples of 8 in the third octet: 0, 8, 16, 24, 32, 40, 48, 56, … The IP’s third octet is 50, which falls in the 48–55 range.
• Subnet = 172.20.48.0/21.
• Broadcast = subnet start (48) + block (8) − 1 = 55, giving 172.20.55.255 [Source: https://oneuptime.com/blog/post/2026-03-20-subnetting-magic-number-method/view].

Notice that you never touched binary. You found one block size, listed a handful of multiples, and read off the answer.

Worked Example 2: A /26 Boundary

Suppose the interesting octet is 192.

• Block size = 256 − 192 = 64.
• Multiples: 0, 64, 128, 192.
• A mask octet of 192 corresponds to a /26 [Source: https://oneuptime.com/blog/post/2026-03-20-subnetting-magic-number-method/view].

So an address like 10.0.0.200/26 sits in the block that starts at 192 (the largest multiple of 64 not exceeding 200). Subnet = 10.0.0.192/26; broadcast = 192 + 64 − 1 = 255, so 10.0.0.255.

Cheat-Sheet Tables to Memorize

Speed comes from not calculating the things you can simply recall. Two tables belong in permanent memory.

The first is the mask-to-block-size table, which ties each meaningful mask octet to its block size and the CIDR value it represents in that octet [Source: https://oneuptime.com/blog/post/2026-03-20-subnetting-magic-number-method/view]:

The second is the bit-value chart for a single octet: 128, 64, 32, 16, 8, 4, 2, 1. Memorizing this one row of eight numbers is astonishingly powerful. It gives you the mask octet values, the block sizes, and the CIDR-to-mask conversions all at once, because a subnet mask is nothing more than the running (cumulative) sum of these bit values from left to right [Source: https://oneuptime.com/blog/post/2026-03-20-subnetting-magic-number-method/view].

Two more formulas round out your cheat sheet — a compact reference of the essential values needed to subnet in your head [Source: https://subnettingpractice.com/]:

• Usable hosts per subnet = 2ⁿ − 2, where n is the number of host bits. You subtract 2 to account for the network address and the broadcast address, which cannot be assigned to devices [Source: https://oneuptime.com/blog/post/2026-03-20-subnetting-magic-number-method/view].
• Number of subnets = 2ˢ, where s is the number of borrowed bits.

Timed Practice Strategy

Knowing the shortcuts is not the same as being fast at them; fluency is built through timed repetition. The strategy that works is deliberate and measurable:

• Set a per-question target. Aim for under a minute per subnetting problem. Use a stopwatch so speed is a number you can watch improve, not a vague feeling.
• Drill the interesting octet first. In every problem, your first move is to find the interesting octet and compute 256 minus it. Practice this until it is automatic, because everything else depends on it.
• Memorize before you calculate. Every value you can recall instantly (mask octets, block sizes, host counts) is a value you do not have to derive under pressure.

Professor Messer, a leading free CompTIA Network+ resource, teaches the Magic Number method explicitly as an exam technique in both the N10-008 and N10-009 objective sets, describing it as “a popular shortcut that requires a minimal amount of math” done “in your head” [Source: https://www.professormesser.com/network-plus/n10-008/n10-008-video/magic-number-subnetting-n10-008/] [Source: https://www.professormesser.com/network-plus/n10-009/n10-009-video/magic-number-subnetting-n10-009/]. Cisco Learning Network community threads and the “Subnetting Made Easy” chart method reinforce the same approach for CCNA candidates aiming to subnet in under a minute [Source: https://learningnetwork.cisco.com/s/question/0D56e0000DutwqeCQA/magic-number-table-and-decimal-method-of-doing-subnetting-for-purpose-of-ccna-exam] [Source: https://www.sunsetlearning.com/wp-content/uploads/2013/12/Subnetting-Made-Easy.pdf].

Key Takeaway: Speed subnetting rests on the Magic Number method — block size equals 256 minus the interesting mask octet, subnet start is the largest block multiple at or below the IP octet, and broadcast is that start plus block size minus one. Memorize the mask-to-block table and the bit-value chart (128 64 32 16 8 4 2 1) so recall replaces calculation, then build speed through stopwatch-timed drills aiming for under a minute per question.

A Glimpse of IPv6

Everything you have learned so far lives in the world of IPv4, where addresses are 32 bits long and, crucially, scarce. There are only about 4.3 billion IPv4 addresses, and they ran out years ago. Techniques like VLSM, NAT, and port sharing all exist because IPv4 addressing is a conservation game — you are always trying to avoid wasting a resource you do not have enough of. IPv6 changes the fundamental assumption, and understanding that shift makes the whole system click into place [Source: https://colossuscloud.com/en/articles/ipv6-subnets-explained/].

128-Bit Addresses and the End of Scarcity

An IPv6 address is 128 bits long, four times the size of an IPv4 address. That extra length is not a small upgrade; it is a change of category. IPv6 provides 2¹²⁸ addresses — roughly 3.4 × 10³⁸, a number so large it is essentially unlimited for any practical purpose [Source: https://colossuscloud.com/en/articles/ipv6-subnets-explained/].

Because addresses are no longer scarce, the entire philosophy of subnetting inverts. In IPv4, the prefix — the network portion of the address, indicated by the CIDR length — was about saving space: carve subnets as tightly as possible so no address goes unused. In IPv6, the prefix is about structure: organize the network so it scales cleanly without ever having to renumber. IPv6 was, in effect, “designed with intentional waste.” Abundance replaces scarcity, which is why IPv6 networks have no NAT and no address-exhaustion concern [Source: https://www.networkworld.com/article/742850/the-logic-of-bad-ipv6-address-management.html] [Source: https://colossuscloud.com/en/articles/ipv6-subnets-explained/].

A useful analogy: IPv4 addressing is like packing for a weekend in a carry-on bag, where you agonize over every item because space is tight. IPv6 addressing is like moving into a warehouse — you stop optimizing for space and start optimizing for organization, because running out of room is no longer a realistic worry.

Hexadecimal and Nibble Boundaries

IPv6 addresses are written in hexadecimal (base 16) rather than the dotted decimal of IPv4. Each hex digit represents exactly 4 bits, and a group of 4 bits is called a nibble — half of an 8-bit byte [Source: https://colossuscloud.com/en/articles/ipv6-subnets-explained/].

This matters because it changes the natural unit of subnetting. In IPv4, you thought in octets (8-bit boundaries). In IPv6, you think in nibbles (4-bit boundaries). Prefixes that land on a nibble boundary produce clean, readable hexadecimal ranges: /48, /52, /56, /60, and /64 all align on 4-bit boundaries. Prefixes that fall between nibbles — /50, /54, /58, /62 — create “messy” hex ranges that are hard to read and error-prone to manage. The best practice, therefore, is to adjust IPv6 prefixes in multiples of four bits [Source: https://colossuscloud.com/en/articles/ipv6-subnets-explained/].

An IPv6 address divides into three parts [Source: https://community.cisco.com/t5/ipv6/i-need-help-understanding-prefixes-on-ipv6-like-64-56-and-subnet/td-p/3928409]:

Figure 11.2: IPv6 128-bit address structure by segment

graph TD
    A["IPv6 Address: 128 bits total"] --> B["Global Routing Prefix<br/>First 48 bits<br/>Assigned by Provider / RIR"]
    A --> C["Subnet ID<br/>Bits 48–64<br/>Assigned by you"]
    A --> D["Interface ID<br/>Last 64 bits<br/>Host portion (SLAAC / EUI-64)"]
    B --> E["Locates your site on the internet"]
    C --> F["Identifies subnets within your site"]
    D --> G["Identifies a single host on a segment"]

The /64 Standard and Why VLSM-Style Waste Disappears

Here is the fact that surprises people coming from IPv4: in IPv6, every end-user subnet is a /64, no matter how many devices it holds. A /64 provides 2⁶⁴ addresses — about 18.4 quintillion (18,446,744,073,709,551,616) — for a single network segment [Source: https://oneuptime.com/blog/post/2026-03-20-ipv6-prefix-lengths-explained/view] [Source: https://colossuscloud.com/en/articles/ipv6-subnets-explained/].

Why /64 specifically? Because core IPv6 protocols require it. SLAAC (Stateless Address Autoconfiguration) lets a device generate its own 64-bit Interface ID — from its MAC address via EUI-64 or from a random value — and that mechanism needs exactly 64 bits of host space to work. This makes /64 the minimum recommended segment size, not just a convention [Source: https://colossuscloud.com/en/articles/ipv6-subnets-explained/].

Shorter prefixes simply determine how many /64 blocks you can carve out, and the hierarchy scales by 256× (8 bits) with each octet-sized change [Source: https://www.captaindns.com/en/blog/ipv6-subnet-sizes-48-vs-56-vs-64]:

Now compare this directly with the IPv4 VLSM skills from earlier chapters:

The most striking contrast is the disappearance of VLSM-style waste-avoidance. In IPv4 VLSM, you carve variable-size subnets down to the exact host count needed, always subtracting the network and broadcast addresses (the “−2”) from every subnet. IPv6 has no broadcast address at all — it uses multicast instead — so there is no “−2” subtraction, and the full range of a subnet is usable in principle. Rather than tightly right-sizing each segment, IPv6 design deliberately keeps every subnet at /64 regardless of how few hosts it holds, and varies only how many /64 blocks an organization receives [Source: https://colossuscloud.com/en/articles/ipv6-subnets-explained/] [Source: https://docs.netgate.com/pfsense/en/latest/network/ipv6/subnets.html]. The careful host-counting arithmetic that made VLSM challenging in IPv4 simply evaporates.

Key Takeaway: IPv6 uses 128-bit hexadecimal addresses subnetted on nibble (4-bit) boundaries, with the /64 as the universal end-user subnet because SLAAC requires exactly 64 host bits. Because addresses are effectively unlimited and there is no broadcast address, the “−2” host math and VLSM’s right-sizing discipline vanish — you keep every subnet at /64 and vary only how many /64s (a /48 holds 65,536; a /56 holds 256) you allocate.

Continuing to Mastery

Subnetting is a skill, not a fact, and skills fade without use. The candidates who keep their edge treat subnetting the way a musician treats scales: brief, regular, deliberate practice that keeps calculation automatic. This section maps out the resources, certifications, and real-world habits that carry you from exam-ready to genuinely fluent.

Practice Resources

Mastering subnetting is fundamentally about repetition until calculation becomes automatic. Because subnetting is one of the most challenging topics for CCNA candidates, randomized-problem generators are considered essential tools for building both speed and accuracy [Source: https://www.networkacademy.io/ccna/ip-subnetting]. The leading free resources include:

For hands-on reinforcement, pair these drills with labbing tools: Cisco Packet Tracer (free) for building and testing addressed networks, and GNS3 or EVE-NG for more advanced simulation on virtual or real Cisco equipment [Source: https://www.examlabs.com/certification/top-5-essential-ccna-study-resources-for-exam-success/].

A Recommended Practice Regimen

The research points to a consistent, repeatable practice routine [Source: https://learningnetwork.cisco.com/s/question/0D5Kd0000BfjMwfKQE/best-study-methods-for-ccna-these-are-my-suggestions-please-comment-and-ill-try-to-include-yours-as-well]:

• Drill randomized problems daily until subnetting becomes “second nature.” A short daily session beats a long weekly one.
• Practice the Magic Number method and memorize the powers of 2 until you can subnet in your head quickly and accurately.
• Use spaced-repetition flashcards alongside your primary study materials. Daily flashcard review significantly improves long-term retention of detail-oriented content like mask values, block sizes, and CIDR conversions.

Figure 11.3: The three-habit daily practice regimen

flowchart TD
    A["Daily practice session"] --> B["Drill randomized problems<br/>Builds general fluency"]
    A --> C["Practice Magic Number method<br/>Builds a reliable method"]
    A --> D["Review spaced-repetition flashcards<br/>Keeps memorized tables from fading"]
    B --> E["Subnetting becomes second nature"]
    C --> E
    D --> E

The underlying principle is that speed is not talent — it is the residue of repetition. Each of the three habits attacks a different weakness: randomized problems build general fluency, Magic Number drilling builds a reliable method, and flashcards keep the memorized tables from fading.

Certification Paths

Two industry certifications anchor most subnetting study, and they build on one another:

A common path is to start with Network+ to build vendor-neutral fundamentals, then move to CCNA where subnetting under time pressure becomes central. Complement either with video courses (CBT Nuggets, INE, Udemy) and official Cisco Press study guides [Source: https://www.examlabs.com/certification/top-5-essential-ccna-study-resources-for-exam-success/].

Figure 11.4: Certification path progression

flowchart LR
    A["CompTIA Network+<br/>Entry-level, vendor-neutral<br/>Magic Number subnetting"] --> B["Cisco CCNA<br/>Associate, Cisco-focused<br/>Subnetting under time pressure"]
    B --> C["Real-world networks<br/>Design & troubleshoot<br/>IPv4 VLSM + IPv6 /64 plans"]

Applying Skills in Real Networks

Certifications open the door, but subnetting proves its worth in production. On the job, the same skills reappear in higher-stakes forms: designing an IP addressing plan for a new office, carving a data-center network into VLSM subnets sized to each department, allocating a provider-issued IPv6 /48 into /64 segments for each site, and troubleshooting connectivity by quickly reasoning about which subnet an address belongs to. The engineer who can glance at 10.20.48.100/21 and immediately name its subnet and broadcast is the one who diagnoses a misconfigured gateway in seconds rather than minutes. Practicing in Packet Tracer, GNS3, or EVE-NG bridges the gap between exam questions and real equipment, letting you validate an addressing design before you deploy it [Source: https://www.examlabs.com/certification/top-5-essential-ccna-study-resources-for-exam-success/].

Key Takeaway: Fluency is built through daily, repetitive practice — randomized generators like SubnetIPv4.com and SubnettingPractice.com, Magic Number drilling, and spaced-repetition flashcards — until calculation is automatic. Anchor that practice to a certification path (CompTIA Network+ then Cisco CCNA), reinforce it with hands-on labs in Packet Tracer or GNS3/EVE-NG, and the skill will carry directly into designing and troubleshooting real networks.

Chapter Summary

This chapter transformed subnetting knowledge into subnetting speed and then looked ahead to where the skill is going. For exam performance, the Magic Number method is the essential shortcut: compute the block size as 256 minus the interesting mask octet, find the subnet start as the largest block multiple at or below the IP’s octet, and read the broadcast as start plus block minus one — all without binary conversion. Memorizing two small tables, the mask-to-block chart and the bit-value row (128 64 32 16 8 4 2 1), lets recall replace calculation, and stopwatch-timed drilling toward under a minute per question turns method into reflex.

Looking forward, IPv6 both preserves and simplifies what you have learned. It keeps the idea of a prefix and a network/host split, but its 128-bit hexadecimal addresses, nibble-aligned boundaries, and effectively unlimited supply eliminate the conservation math that defined IPv4. With no broadcast address and a universal /64 subnet, the “−2” host formula and VLSM’s careful right-sizing simply disappear; IPv6 varies how many /64 blocks you get rather than how big each subnet is. Finally, lasting mastery comes from a regimen — daily randomized practice, Magic Number drilling, and spaced-repetition flashcards — anchored to certifications (Network+, then CCNA) and reinforced by hands-on labs, so that the skill you sharpened for an exam becomes the skill you rely on in a real network.

Key Terms