Subnetting in plain language

In Module 5, you saw IP addresses written with a slash and a number, like 192.168.1.0/24. That number is the CIDR prefix length. It tells you how many of the 32 bits in the address belong to the network portion.

A /24 means the first 24 bits are the network address, and the remaining 8 bits are available for host addresses. Eight bits give you 2^8 = 256 possible values, but two are reserved: the first (192.168.1.0) is the network address, and the last (192.168.1.255) is the broadcast address. That leaves 254 usable host addresses.

Here are the most common prefix lengths you will encounter:

/24 = 254 usable hosts. Standard for a small office or a single VLAN.
/25 = 126 usable hosts. Half of a /24.
/16 = 65,534 usable hosts. A building or campus.
/8 = 16,777,214 usable hosts. An entire large organisation.
/30 = 2 usable hosts. Point-to-point links between routers.
/32 = 1 host. Used for loopback addresses and host routes.

The old Class A/B/C system restricted networks to fixed sizes (/8, /16, or /24). CIDR (RFC 4632) removed that restriction, letting organisations use any prefix length. A company that needs 500 addresses can use a /23 (510 usable hosts) instead of wasting a /16 (65,534 hosts) or cramming into a /24 (254 hosts).

Every time your device sends a packet, it makes a critical decision: is the destination on the same subnet (local) or a different subnet (remote)? The answer determines whether it uses ARP directly or sends the packet to the default gateway.

The device performs a bitwise AND between the destination IP and its own subnet mask. Then it does the same with its own IP address and the mask. If the results match, the destination is local. If they differ, it is remote.

Example: local delivery. Your device is 192.168.1.50/24. You want to reach 192.168.1.100. Apply the /24 mask (255.255.255.0) to both addresses. Your network address is 192.168.1.0. The destination's network address is also 192.168.1.0. They match. The destination is local. Your device uses ARP to find the destination's MAC address and sends the frame directly.

Example: remote delivery. Same device, but you want to reach 192.168.2.10. Apply the mask. Your network is 192.168.1.0. The destination's network is 192.168.2.0. They do not match. The destination is remote. Your device ARPs for the default gateway's MAC address and sends the frame to the router. The router takes it from there.

This decision happens for every single packet your device sends. It is defined in RFC 1122, Section 3.3.1.1. Getting the subnet mask wrong means your device makes the wrong decision for every packet, which is why a misconfigured mask can make the entire network unreliable.

Use the subnetting calculator below to enter an IP address and prefix length. It will show you the network address, broadcast address, usable host range, and total number of hosts. Try a few different prefix lengths to see how the numbers change.

A common mistake is assuming that putting two groups of devices on different subnets isolates them. It does not. A router's entire purpose is to forward traffic between subnets. If no firewall rules or access control lists (ACLs) are in place, traffic flows freely between subnets through the router.

VLANs (which you saw in Module 4) create Layer 2 isolation. Devices on VLAN 10 cannot send Ethernet frames to VLAN 20. But inter-VLAN routing through a Layer 3 switch or router reconnects them at Layer 3 unless you add explicit access controls.

NIST SP 800-207 (Zero Trust Architecture) makes this point directly: network location alone should not grant trust. Even devices on the same subnet should authenticate and authorise connections. Segmentation without enforcement provides broadcast isolation, not security.

IPv6 eliminates most of the mental arithmetic. RFC 4291 standardises a /64 prefix for every subnet. The first 64 bits are the network prefix. The last 64 bits are the interface identifier (roughly 18.4 quintillion addresses per subnet).

You will never run out of addresses in an IPv6 subnet. The subnetting question shifts from "how many hosts fit?" to "how many subnets do I need?" A typical ISP allocation gives an organisation a /48, which provides 65,536 subnets (16 bits of subnet space between the /48 prefix and the /64 interface identifier).

IPv6 also removes the need for DHCP address assignment in many cases. SLAAC (Stateless Address Autoconfiguration, RFC 4862) lets devices generate their own address from the network prefix and their interface identifier. The router advertises the /64 prefix, and devices construct their full address automatically.