Subnetting in plain language

In Module 5, you saw IP addresses written with a slash and a number, like 192.168.1.0/24. That number is the CIDR prefix length. It tells you how many of the 32 bits in the address belong to the network portion.

A /24 means the first 24 bits are the network address, and the remaining 8 bits are available for host addresses. Eight bits give you 2^8 = 256 possible values, but two are reserved: the first (192.168.1.0) is the network address, and the last (192.168.1.255) is the broadcast address. That leaves 254 usable host addresses.

Here are the most common prefix lengths you will encounter:

/24 = 254 usable hosts. Standard for a small office or a single VLAN.
/25 = 126 usable hosts. Half of a /24.
/16 = 65,534 usable hosts. A building or campus.
/8 = 16,777,214 usable hosts. An entire large organisation.
/30 = 2 usable hosts. Point-to-point links between routers.
/32 = 1 host. Used for loopback addresses and host routes.

The old Class A/B/C system restricted networks to fixed sizes (/8, /16, or /24). CIDR (RFC 4632) removed that restriction, letting organisations use any prefix length. A company that needs 500 addresses can use a /23 (510 usable hosts) instead of wasting a /16 (65,534 hosts) or cramming into a /24 (254 hosts).

Choosing between a /23 and a /24 is not only an accounting decision about how many hosts fit. The prefix length you configure is the same number every host on that segment consults before it sends anything, and it produces a yes or no answer about whether the destination can be reached directly.

Every time your device sends a packet, it makes a critical decision: is the destination on the same subnet (local) or a different subnet (remote)? The answer determines whether it uses ARP directly or sends the packet to the default gateway.

The device performs a bitwise AND between the destination IP and its own subnet mask. Then it does the same with its own IP address and the mask. If the results match, the destination is local. If they differ, it is remote.

Example: local delivery.Your device is 192.168.1.50/24. You want to reach 192.168.1.100. Apply the /24 mask (255.255.255.0) to both addresses. Your network address is 192.168.1.0. The destination's network address is also 192.168.1.0. They match. The destination is local. Your device uses ARP to find the destination's MAC address and sends the frame directly.

Example: remote delivery.Same device, but you want to reach 192.168.2.10. Apply the mask. Your network is 192.168.1.0. The destination's network is 192.168.2.0. They do not match. The destination is remote. Your device ARPs for the default gateway's MAC address and sends the frame to the router. The router takes it from there.

This decision happens for every single packet your device sends. It is defined in RFC 1122, Section 3.3.1.1. Getting the subnet mask wrong means your device makes the wrong decision for every packet, which is why a misconfigured mask can make the entire network unreliable.

Use the subnetting calculator below to enter an IP address and prefix length. It will show you the network address, broadcast address, usable host range, and total number of hosts. Try a few different prefix lengths to see how the numbers change.

Notice what the calculator answers and what it does not. It tells you exactly where one range stops and the next begins. It has nothing to say about whether a packet is allowed to cross that line, which is a separate design decision that a great many networks quietly get wrong.

A common mistake is assuming that putting two groups of devices on different subnets isolates them. It does not. A router's entire purpose is to forward traffic between subnets. If no firewall rules or access control lists (ACLs) are in place, traffic flows freely between subnets through the router.

VLANs (which you saw in Module 4) create Layer 2 isolation. Devices on VLAN 10 cannot send Ethernet frames to VLAN 20. But inter-VLAN routing through a Layer 3 switch or router reconnects them at Layer 3 unless you add explicit access controls.

NIST SP 800-207 (Zero Trust Architecture) makes this point directly: network location alone should not grant trust. Even devices on the same subnet should authenticate and authorise connections. Segmentation without enforcement gives you a smaller broadcast domain, not security.

That is a question about who may cross a boundary. How much address space sits on either side of it is a different question, and it is one that IPv6 mostly stops anyone having to ask.

IPv6 eliminates most of the mental arithmetic for ordinary LANs. Most IPv6 unicast subnets use a 64-bit interface identifier, which gives the familiar /64 subnet boundary: the first 64 bits are the network prefix and the last 64 bits identify the interface. RFC 7421 describes this 64-bit boundary as the de facto length for almost all IPv6 interface identifiers.

You will never run out of addresses in an IPv6 subnet. The subnetting question shifts from "how many hosts fit?" to "how many subnets do I need?" A typical ISP allocation gives an organisation a /48, which provides 65,536 subnets (16 bits of subnet space between the /48 prefix and the /64 interface identifier).

There are real exceptions. RFC 6164 standardises /127 prefixes for inter-router point-to-point links, and /128 is used for a single interface, loopback, or host route. The practical rule is: use /64 for normal IPv6 LAN segments and SLAAC, use the specialist prefixes when the link type or routing design calls for them.

IPv6 also removes the need for DHCP address assignment in many cases. SLAAC (Stateless Address Autoconfiguration, RFC 4862) lets devices generate their own address from the network prefix and their interface identifier. The router advertises the /64 prefix, and devices construct their full address automatically.

None of the arithmetic in this module is going away. Private ranges, VPN address pools, container networks, branch office LANs and every vendor lab exam still run on IPv4, and the mask configured on an interface still decides, packet by packet, whether the host ARPs for a neighbour or hands the frame to the router. Subnetting is daily work and will stay daily work.

What has changed is that an IPv4 plan is now half a plan. On 28 March 2026, Google measured 50.10 percent of its worldwide users reaching it over IPv6, so most of the people any addressing scheme serves already have a working IPv6 path alongside the IPv4 one. In practice that means each /24 you allocate has a twin: a /64 on the same segment, populated by router advertisement rather than by a DHCP scope, with no broadcast address to subtract and no argument about host counts.

The next module, IPv6 in plain language, is where that twin gets taught properly. It takes the local-versus-remote decision you have just worked through and shows what replaces each IPv4 part: neighbour discovery instead of ARP, a router advertisement instead of a DHCP lease, and prefix planning instead of host counting. Treat it as the other half of one addressing plan rather than as an upgrade you will schedule later.