How Subnetting Works

Subnetting splits one IP network into smaller ones. It keeps broadcast traffic contained, lets you separate departments or device types, and makes it possible to hand out address space without waste. The idea is simple once you see that an address is two parts glued together.

An address is a network part and a host part

An IPv4 address is 32 bits, usually written as four numbers (192.168.10.77). A Subnet mask says how many of the leading bits name the network; the rest name the host inside it. A mask of 255.255.255.192 has 26 leading one-bits, which CIDR writes as /26.

To find the network an address belongs to, take a bitwise AND of the address and the mask. Only the last octet matters here, because the first three octets of the mask are all ones:

So 192.168.10.77/26 lives in the network 192.168.10.64/26. The broadcast address sets every host bit to one: 192.168.10.127. The usable hosts are everything in between, 192.168.10.65 to 192.168.10.126, which is 62 addresses: 2⁶ minus the network and broadcast addresses.

Splitting a network

Each extra bit you borrow from the host part doubles the number of subnets and halves their size. Splitting 192.168.10.0/24 by two bits gives four /26 subnets of 64 addresses each:

Subnet boundaries always fall on multiples of the block size (here 64), which is the quick shortcut: block size = 256 minus the mask's value in the changing octet (256 - 192 = 64).

Choosing a prefix by the hosts you need

Pick the smallest block with enough usable addresses:

If subnets need different sizes, give each one the prefix it needs and allocate the largest first. This is variable-length subnet masking (VLSM). Leave room for growth: renumbering a network is more work than starting a size larger.

Talking between subnets

Devices in the same subnet reach each other directly. To reach another subnet, traffic goes to the default gateway, a router that connects them. A host decides "same subnet or not" by applying its own mask to the destination address, which is why a wrong mask causes odd, one-way connectivity problems.

IPv6

IPv6 subnetting is the same idea with 128 bits. A /64 is the standard size for a single network, leaving 64 bits for hosts, so you subnet by choosing which bits of the larger prefix to vary, not by squeezing for addresses.

Common mistakes

• Forgetting the two reserved addresses (network and broadcast) when counting hosts. A /30 has four addresses but only two usable ones.
• Overlapping subnets. 10.0.0.0/24 and 10.0.0.128/25 overlap; routers will misroute traffic.
• Mixing up a subnet mask and a wildcard mask. Router access lists use the wildcard (the inverted mask): 0.0.0.63 for a /26.
• Counting from the wrong boundary. Network addresses are multiples of the block size, so 192.168.10.100/26 is in 192.168.10.64/26, not 192.168.10.100/26.

Do the arithmetic with the IPv4 Subnet Calculator, or look at the table in CIDR and Subnet Mask Cheat Sheet.