IPv4 addressing and subnetting: the arithmetic you learn to do in your head

Subnetting has a reputation for being the hard part, and it is not. It is one idea — a line drawn through 32 bits, with network on the left and host on the right — plus a handful of numbers worth memorising so you never have to convert to binary again. Once the line is real to you, everything else in networking gets easier, because almost every routing decision, ACL, DHCP scope and firewall rule is written in terms of where that line sits.

The map

Read this first when short on time. Every branch is a section below.

An address is 32 bits pretending to be four numbers

An IPv4 address is a 32-bit number. Writing it as four decimal numbers separated by dots is purely a convenience for humans; the network never sees dots.

192.168.1.10 is really:

   192        168          1         10
11000000 . 10101000 . 00000001 . 00001010

Each of the four groups is an octet: eight bits, so 0 to 255. To convert either way you only ever need one row of numbers, the place values of eight bits:

128  64  32  16   8   4   2   1

To read binary to decimal, add the place values wherever there is a 1. 11000000 is 128 + 64 = 192. To go the other way, subtract greedily from the left: 168 minus 128 leaves 40, minus 32 leaves 8, minus 8 leaves 0, so bits at 128, 32 and 8 are set: 10101000. That is the entire binary skill this subject needs.

The crucial idea is that the 32 bits are split into two fields. The left part identifies which network the host is on; the right part identifies which host on that network. Routers care only about the left part — that is what makes routing tables small enough to exist.

Octet

One of the four 8-bit groups of an IPv4 address. Networking says "octet" rather than "byte" because early hardware did not agree that a byte was eight bits.

Prefix

The network part of an address, and the usual modern word for a network entry: "the 10.1.0.0/16 prefix".

Dotted decimal

The human notation, four decimal octets separated by dots. Purely presentational.

The mask: where the line is drawn

A subnet mask is another 32-bit value whose ones mark the network bits and whose zeros mark the host bits. The ones are always contiguous and always start from the left, so a mask is fully described by counting them — which is what CIDR notation does. 255.255.255.0 has 24 ones, so it is written /24.

Because the ones are contiguous, only nine values can ever appear in a mask octet, and knowing them by heart removes almost all the arithmetic:

The "block size" column is the one that does the real work later: it is 256 minus the mask value, and it tells you how far apart consecutive subnets are.

Getting the network address

The network address is the address with every host bit set to 0. Formally you AND the address with the mask; in practice you do it one octet at a time and only the octet where the line falls needs any thought.

For 192.168.1.10/24, the line falls on an octet boundary, so it is immediate: network 192.168.1.0, broadcast 192.168.1.255, usable hosts 192.168.1.1 to 192.168.1.254.

Three addresses always exist in a subnet and only one of them is usable by a host:

• Network address — all host bits 0. Names the subnet, cannot be assigned to a host.
• Broadcast address — all host bits 1. Reaches every host in the subnet, cannot be assigned.
• Everything in between — usable host addresses, hence the 2^h - 2 formula.

CIDR

Classless inter-domain routing. The scheme that replaced address classes with an explicit prefix length, letting networks be any size that is a power of two.

Wildcard mask

An inverted subnet mask used by Cisco ACLs and OSPF network statements: zeros mean "must match", ones mean "don't care".

Ranges that already mean something

Some parts of the address space carry rules, and recognising them at a glance saves a great deal of time.

Classes, and why they still get mentioned

Before CIDR, the first bits of an address fixed the mask. That system is gone — no modern device routes by class — but the letters survive as shorthand for the ranges.

127 is missing from class A on purpose: the whole 127.0.0.0/8 block is loopback, so 127.0.0.1 and 16 million of its neighbours all mean "this machine".

Private addresses

Three blocks are reserved for use inside organisations and are never routed on the public internet. Every network you have ever configured at home or in an office uses one.

The 172.16 block is the one people get wrong. It is a /12, not a /16, so it covers 172.16 through 172.31 — and 172.32.1.1 is a public address belonging to someone else.

Addresses with a job

• 127.0.0.0/8 — loopback. Never leaves the host.
• 169.254.0.0/16 — link-local, assigned automatically when DHCP fails. Seeing one on a client is a diagnosis, not a configuration: the host asked for an address and nobody answered.
• 224.0.0.0/4 — multicast. 224.0.0.5 and .6 are OSPF, 224.0.0.10 is EIGRP.
• 255.255.255.255 — limited broadcast, delivered to everyone on the local wire and never forwarded.
• 0.0.0.0/0 — as a route, "everything", the default route. As a source address, "I do not have one yet", which is how a DHCP client starts.

Subnetting: borrowing bits

Subnetting means taking a block and moving the network/host line to the right, converting host bits into network bits. Each bit you borrow doubles the number of subnets and halves the hosts in each.

Suppose you have 192.168.1.0/24 — one network, 254 usable hosts — and you need four separate networks for four departments. Borrow two bits (2^2 = 4) and the mask becomes /26.

Notice the shape of that table. The networks are 0, 64, 128, 192 — multiples of 64 — and 64 is the block size, which is 256 - 192, where 192 is the last octet of the mask 255.255.255.192. Every subnetting question reduces to finding this number.

The two formulas, and what they are counting:

• Subnets = 2^n where n is the number of bits borrowed. Two borrowed bits can be 00, 01, 10, 11 — four combinations, four subnets.
• Usable hosts = 2^h - 2 where h is the number of host bits left. Six host bits give 64 combinations, minus the network address and the broadcast address, so 62.

Worth memorising, because it turns most questions into recognition:

The /31 is the exception to the minus-two rule. On a point-to-point link there is nobody to broadcast to, so both addresses are usable and the two ends simply take one each. The /32 is the other exception: a single address, used for router loopback interfaces and for matching exactly one host in an access list.

VLSM: stop giving a two-host link 254 addresses

Variable-length subnet masking simply means using different mask lengths in the same network, sizing each subnet to what it actually needs. Without it, every subnet is the same size as the largest one, and a network of 254-address blocks spends most of its space on links that carry two routers.

The method is always the same: sort the requirements from largest to smallest, then carve each one off the front of the remaining space. Doing it in that order guarantees each subnet lands on a boundary its own block size allows.

Take 192.168.10.0/24 and these needs:

One /24 now serves six segments with room left over. Done the naive way — every subnet a /25 because Sales needs one — you would have run out after two.

flowchart TD
  S["List every segment<br/>with its host count"] --> T["Sort largest first"]
  T --> U["Pick the smallest prefix<br/>that fits the count"]
  U --> V["Assign it at the next<br/>free block boundary"]
  V --> W{"More left?"}
  W -->|Yes| U
  W -->|No| X["Write down network,<br/>range and broadcast for each"]

Doing it fast: the method

Here is the routine for answering "what network is 172.16.140.200/22 on, and what is its range?" in about ten seconds, without binary.

1. Find the interesting octet. That is the octet the prefix length lands in: /9–/16 is the second, /17–/24 the third, /25–/32 the fourth. A /22 lands in the third octet.
2. Write the mask value for that octet. A /22 is 255.255.252.0 — 22 ones is 8 + 8 + 6, and 6 bits is 252 from the table.
3. Block size = 256 minus that value. 256 − 252 = 4. Subnets in the third octet therefore start at 0, 4, 8, 12 … 140, 144.
4. Count up to the address. The third octet is 140, which is itself a multiple of 4, so the network is 172.16.140.0.
5. The next subnet starts one block later at 172.16.144.0, so the broadcast is one below it: 172.16.143.255.
6. Usable hosts are everything between: 172.16.140.1 to 172.16.143.254.

Every subnetting question you will ever be asked is one of those six steps. The only part worth drilling is step 2, and that is the nine-row table above.

The reverse: summarisation

Summarising means replacing several prefixes with one that covers them all, so a routing table stays small. The rule: the summary mask is the number of leading bits all the networks share.

Summarise 10.1.4.0/24, 10.1.5.0/24, 10.1.6.0/24 and 10.1.7.0/24. The first two octets are identical, so 16 bits are shared already. In the third octet: 4 is 00000100, 5 is 00000101, 6 is 00000110, 7 is 00000111. The first six bits are the same and the last two vary, giving 16 + 6 = 22 shared bits. The summary is 10.1.4.0/22.

Sanity check it with block size: a /22 has block size 4 in the third octet, so 10.1.4.0/22 covers 4, 5, 6 and 7. Exactly the four networks, nothing extra. If a summary covers ranges you do not own, you have summarised too aggressively and will attract traffic you cannot deliver.

VLSM

Using different prefix lengths within one address block so each subnet is sized to its need.

Supernetting

Summarisation: representing several contiguous networks with one shorter prefix.

Block size

256 minus the mask value in the interesting octet. The spacing between consecutive subnets, and the fastest route to every subnetting answer.

Recap