Subnetting and Network Math

The one idea underneath everything

Subnetting has a reputation for being hard, and the reason is that it is usually taught as a set of procedures to memorize. It is really one idea: an address is 32 bits, and a line is drawn through them. Everything to the left of the line identifies the network. Everything to the right identifies a host inside it.

Move the line right and you get more networks with fewer hosts each. Move it left and you get fewer, larger networks. Every question in this subject is asking where the line is or what follows from where it sits.

• 1. CIDR notation
• 2. Subnet masks and binary
• 3. Network, broadcast and usable hosts
• 4. A worked example
• 5. Splitting unevenly with VLSM
• 6. The special cases: /31, /30 and /32
• 7. The cheat sheet

CIDR, Classless Inter-Domain Routing, writes the line's position as a number after a slash. 10.0.0.0/24 means the first 24 bits are network, leaving 8 for hosts.

CIDR replaced the old class system in 1993, where a network could only be one of three fixed sizes. An organization with 300 machines was too big for a Class C's 254 and got a Class B's 65,534 instead, wasting 65,000 addresses. CIDR lets a block be any power of two, so that same organization takes a /23 and wastes about 200.

A subnet mask says the same thing as a CIDR prefix, in the older dotted-decimal form. /24 and 255.255.255.0 are two spellings of one fact.

Because a mask is always ones followed by zeros, only nine values can appear in any octet, and knowing them by sight removes most of the arithmetic.

128  10000000     248  11111000
192  11000000     252  11111100
224  11100000     254  11111110
240  11110000     255  11111111

Every block reserves two addresses. The lowest is the network address, naming the block itself. The highest is the broadcast address, reaching every host at once. Neither can be assigned to a device, which is where the "minus two" in every formula comes from.

usable hosts = 2 ^ (32 - prefix) - 2

/24  ->  2^8  - 2 = 254
/26  ->  2^6  - 2 = 62
/30  ->  2^2  - 2 = 2

4. A worked example

Given 192.168.1.130/26, find the network, broadcast, and usable range. This is the exam question, and it takes about fifteen seconds once you see the shape.

1. Block size. A /26 leaves 6 host bits, so the block holds 2⁶ = 64 addresses.
2. Where the blocks start. They begin at multiples of 64: .0, .64, .128, .192.
3. Which one holds .130? It falls between 128 and 191, so the network is 192.168.1.128.
4. Broadcast. The last address in the block, 192.168.1.191.
5. Usable. Everything between, .129 through .190. That is 62 addresses.

The trick worth keeping is step 2. Once you know the block size, the boundaries are just multiples of it, and the rest is reading off which interval your address lands in.

5. Splitting unevenly with VLSM

Real networks are not made of equal pieces. Variable Length Subnet Masking just means using different prefix lengths for different subnets inside one block, rather than cutting everything the same size.

The method is to sort your requirements largest first and allocate in that order, because a large block can only start on a boundary that is a multiple of its own size. Allocating small pieces first strands the space a big one needed.

Splitting 10.0.0.0/24 for 100 users, 50 phones, 20 printers and a 2-address router link:

Note that 100 users needs a /25 and not a /26, because 62 usable is not enough. Always round up to the next power of two, then subtract two.

6. The special cases

/30, the classic point-to-point link

Four addresses, two usable, one at each end of a link between two routers. Two of four wasted, which used to be simply accepted.

/31, which breaks the rule

RFC 3021 allows a /31 on point-to-point links, where there is no network or broadcast address and both addresses are usable. The formula's "minus two" does not apply. This is the case most calculators get wrong, and it is standard practice on modern router links.

/32, a single host

One address, no block around it. You see these on loopback interfaces, in routing tables for a single destination, and throughout firewall rules.

Every IPv4 prefix, its mask, block size, and usable host count, on one page worth bookmarking.

The full sheet covers /8 through /32, plus the reserved ranges and the wildcard masks used in access lists. There is a one-page PDF as well, for printing.