Subnetting Made Simple: A Step-by-Step Guide to IPv4 and CIDR

Subnetting has a reputation as the part of networking that separates people who “get it” from people who do not. The truth is less dramatic. Subnetting is a small set of rules applied consistently, and once you see the pattern behind them you can solve most problems in your head in seconds. This guide takes you from IPv4 basics to CIDR, the block size method, fully worked examples, VLSM design and route summarization, with a reference table you can keep next to your keyboard.

Why subnetting still matters

It is tempting to think a calculator makes subnetting knowledge unnecessary. In practice, you use subnetting constantly, often without noticing. Every time you size a DHCP scope, write an access list, choose an address for a new VLAN interface, read a routing table or troubleshoot why two hosts cannot reach each other, you are applying subnetting logic.

Fluent subnetting gives you three practical advantages:

• Faster troubleshooting. You can spot a wrong mask or a gateway outside the host’s subnet at a glance.
• Better design. You can build addressing plans that are efficient, easy to summarize and easy to understand.
• Exam and interview confidence. Subnetting appears in nearly every networking certification and technical interview, and it is usually timed.

Calculators are great for checking your work, and we have one on our network tools page. But the goal of this guide is to make you independent of them.

IPv4 address basics in five minutes

An IPv4 address is a 32-bit number. For human convenience, we split it into four 8-bit groups called octets and write each as a decimal number from 0 to 255, separated by dots. The address 192.168.10.25 is really this binary value:

Each bit position in an octet has a fixed value. From left to right they are 128, 64, 32, 16, 8, 4, 2 and 1. To convert binary to decimal, add the values of the bits that are set to 1. For 00011001, that is 16 + 8 + 1 = 25. Memorize those eight values; everything else in subnetting builds on them.

Network portion and host portion

Every IPv4 address is divided into two parts. The network portion identifies which subnet the address belongs to, and the host portion identifies the individual interface within that subnet. The subnet mask tells you where the dividing line sits.

A subnet mask is also 32 bits long. It is a continuous run of 1s followed by a continuous run of 0s. The 1s mark the network bits and the 0s mark the host bits. The mask 255.255.255.0 is 24 ones followed by 8 zeros, so the first three octets are the network and the last octet is the host portion.

Network, broadcast and usable hosts

Within any traditional subnet, two addresses are special:

• The network address has all host bits set to 0. It identifies the subnet itself.
• The broadcast address has all host bits set to 1. Packets sent to it reach every host in the subnet.

Everything in between is usable for hosts. That gives us the two formulas you will use constantly:

• Total addresses in a subnet = 2^h, where h is the number of host bits.
• Usable hosts = 2^h − 2.

When you borrow bits from the host portion to create subnets, the number of subnets you get is 2^s, where s is the number of borrowed bits.

CIDR notation and private address space

Originally, IPv4 used fixed classes. Class A networks had an 8-bit network portion, Class B had 16 bits and Class C had 24 bits. That was simple but wasteful: an organization needing 300 addresses was too big for a Class C and wasted most of a Class B.

Classless Inter-Domain Routing (CIDR), introduced in RFC 1519 and updated by RFC 4632, removed the fixed boundaries. A network can now have any prefix length from /0 to /32. CIDR notation writes the prefix length after a slash, counting the 1 bits in the mask. These two forms mean exactly the same thing:

• 192.168.10.0 with mask 255.255.255.192
• 192.168.10.0/26

Because 255.255.255.192 contains 26 leading ones (8 + 8 + 8 + 2), the prefix is /26. You will see both forms in the real world. Cisco IOS interface configuration uses dotted-decimal masks, while routing tables, documentation and most other platforms favor CIDR.

Address ranges you should recognize

Subnet reference table: /24 to /30

Most day-to-day subnetting in enterprise networks happens in the last octet. This table covers the prefixes you will meet most often. The wildcard mask column is useful for ACLs and OSPF network statements; it is simply the subnet mask inverted.

Two more prefixes are worth knowing. A /31 contains two addresses and, under RFC 3021, both can be used on point-to-point links because a broadcast address is not needed there. A /32 identifies a single host and is commonly used for loopback interfaces and host routes.

The block size method: subnetting without binary

Binary is the foundation, but you do not want to convert every address to ones and zeros under exam pressure. The block size method, sometimes called the “magic number” method, gets you the answer with simple arithmetic.

1. Find the interesting octet. This is the octet where the subnet mask is neither 255 nor 0. For /26 (255.255.255.192) it is the fourth octet. For /20 (255.255.240.0) it is the third.
2. Calculate the block size. Subtract the mask value in the interesting octet from 256. For /26 that is 256 − 192 = 64.
3. List the multiples. Subnets start at 0 and increase by the block size: 0, 64, 128, 192.
4. Find the network. The network address is the multiple equal to or just below the address’s value in the interesting octet.
5. Find the broadcast. The broadcast is the next multiple minus 1.
6. Find the host range. First usable is network + 1; last usable is broadcast − 1.

Octets to the left of the interesting octet are copied unchanged. Octets to the right are 0 in the network address and 255 in the broadcast address. That one rule handles every prefix length.

Worked examples, step by step

Work through these with a pen before reading the answers. Repetition is what makes subnetting fast.

Example 1: Split 192.168.10.0/24 into four equal subnets

You need four subnets. Because 2² = 4, you borrow 2 host bits, turning /24 into /26. The mask is 255.255.255.192, the block size is 64, and each subnet has 2⁶ − 2 = 62 usable hosts.

Example 2: Which subnet does 192.168.1.130/26 belong to? (binary method)

To see what the block size method is really doing, solve this one in binary. A router finds the network address by performing a bitwise AND between the address and the mask: a result bit is 1 only if both input bits are 1. Only the fourth octet is interesting here.

The network is 192.168.1.128/26. Setting the six host bits to 1 gives 10111111, which is 191, so the broadcast is 192.168.1.191. The usable range is 192.168.1.129 to 192.168.1.190. Check it with the block size method: multiples of 64 are 0, 64, 128 and 192, and 130 falls between 128 and 191. Same answer, much faster.

Example 3: Find the network for 172.16.45.200/20

This one catches people because the interesting octet is not the last one.

1. A /20 mask is 255.255.240.0, so the interesting octet is the third.
2. Block size is 256 − 240 = 16.
3. Multiples of 16 in the third octet: 0, 16, 32, 48, 64 and so on.
4. The third octet of the address is 45, which falls between 32 and 47. The network starts at 32.
5. The fourth octet is to the right of the interesting octet, so it is 0 for the network and 255 for the broadcast.

Result: network 172.16.32.0/20, broadcast 172.16.47.255, usable hosts 172.16.32.1 to 172.16.47.254. With 12 host bits, the subnet holds 2¹² − 2 = 4,094 usable hosts. Notice that addresses such as 172.16.40.0 and 172.16.39.255 are perfectly valid host addresses inside this subnet; only the very first and very last addresses are reserved.

Example 4: Size a subnet for 500 hosts

Here you work backward from a requirement. Find the smallest number of host bits where 2^h − 2 is at least 500.

• 8 host bits: 256 − 2 = 254. Too small.
• 9 host bits: 512 − 2 = 510. Big enough.

Nine host bits leaves 32 − 9 = 23 network bits, so you need a /23 with mask 255.255.254.0. If you allocate 10.20.0.0/23, the subnet runs from 10.20.0.0 to 10.20.1.255, with usable hosts from 10.20.0.1 to 10.20.1.254. A /23 must start on an even third octet, because the block size in that octet is 2.

Check your answers with Python

Python’s built-in ipaddress module is a handy way to verify practice problems or generate address plans. This short script reproduces the examples above.

import ipaddress

# Example 1: split a /24 into four /26 subnets
for subnet in ipaddress.ip_network("192.168.10.0/24").subnets(new_prefix=26):
    hosts = list(subnet.hosts())
    print(subnet, hosts[0], hosts[-1], subnet.broadcast_address)

# Examples 2 and 3: find the network an address belongs to
print(ipaddress.ip_interface("192.168.1.130/26").network)   # 192.168.1.128/26
print(ipaddress.ip_interface("172.16.45.200/20").network)   # 172.16.32.0/20

# Example 4: broadcast of a /23
print(ipaddress.ip_network("10.20.0.0/23").broadcast_address)  # 10.20.1.255

VLSM: sizing subnets to real needs

Splitting a network into equal pieces is easy, but real networks rarely need equal pieces. A user VLAN may need 100 addresses while a router-to-router link needs two. Variable Length Subnet Masking (VLSM) lets you use different prefix lengths inside one block so nothing is wasted.

The golden rule of VLSM is simple: allocate the largest subnets first. Doing so keeps every subnet aligned on a valid boundary for its size and prevents overlaps.

VLSM example: carve up 10.10.0.0/24

You have been given 10.10.0.0/24 for a small site with these requirements:

• Staff VLAN: 100 hosts
• Engineering VLAN: 50 hosts
• Management VLAN: 20 hosts
• Two point-to-point router links: 2 hosts each

Pick the smallest prefix that fits each requirement, then allocate from largest to smallest:

The remaining space, 10.10.0.232 to 10.10.0.255, is still free and can be used as a /29 (10.10.0.232/29) and a /28 (10.10.0.240/28) for future needs. Applying one of these subnets on a Cisco router interface looks like this:

interface GigabitEthernet0/0/1
 description Link A to BRANCH-RTR
 ip address 10.10.0.225 255.255.255.252
 no shutdown

Route summarization (supernetting)

Summarization is subnetting in reverse. Instead of splitting a block into smaller pieces, you combine several contiguous networks into one shorter prefix. Summaries shrink routing tables, reduce the impact of individual link flaps and make ACLs and firewall policies easier to read. They are a core design technique in protocols such as OSPF, where summarization happens at area boundaries.

How to find a summary

1. Write the networks in binary, at least the octet where they differ.
2. Count the number of leading bits they share.
3. The summary is the first network with a prefix length equal to the shared bits.

Take 192.168.0.0/24 through 192.168.3.0/24. The third octets are 0, 1, 2 and 3, which in binary are 00000000, 00000001, 00000010 and 00000011. The first six bits are identical, so the summary keeps 16 + 6 = 22 bits: 192.168.0.0/22.

Similarly, 172.16.8.0/24 through 172.16.15.0/24 share the bits 00001 in the third octet (8 is 00001000 and 15 is 00001111), so they summarize to 172.16.8.0/21.

This is why good addressing plans assign contiguous, aligned blocks to each site or function from the start. If you document your allocations as you go, which our network documentation guide covers in detail, summarization becomes almost automatic.

Common subnetting mistakes and how to avoid them

• Forgetting the minus 2. A /27 has 32 addresses but only 30 usable hosts. Size DHCP scopes and VLANs on usable hosts.
• Using the wrong interesting octet. For prefixes between /17 and /23, the action is in the third octet. Always identify the octet before you start counting.
• Treating x.x.x.0 or x.x.x.255 as always invalid. In larger subnets such as a /23 or /20, many addresses ending in .0 or .255 are ordinary host addresses.
• Misaligned subnets. A /26 cannot start at .32. Network addresses must be multiples of the block size.
• Overlapping allocations. Two subnets that overlap cause intermittent, confusing reachability problems. Track every allocation in a spreadsheet or IPAM tool.
• Gateway outside the subnet. If a host’s default gateway is not inside its own subnet, it cannot ARP for it, and off-subnet traffic fails.

Once you are comfortable with IPv4, apply the same thinking to IPv6. The address is longer, but prefix logic is the same, and standard /64 subnets make many decisions simpler. Our IPv6 guide for network admins is a natural next step, and subnetting practice fits neatly into week two of our 90-day CCNA study plan.

Key takeaways

• An IPv4 address is 32 bits; the mask or CIDR prefix tells you which bits are network and which are host.
• Total addresses equal 2^h and usable hosts equal 2^h − 2, except on /31 point-to-point links (RFC 3021).
• The block size method (256 minus the mask value in the interesting octet) lets you find network, broadcast and host range without binary.
• Network addresses are always multiples of the block size in the interesting octet.
• With VLSM, size each subnet to its real needs and allocate the largest subnets first.
• Summarization combines contiguous, aligned networks into one shorter prefix and depends on a well-planned addressing scheme.
• Practice daily for a couple of weeks and subnetting becomes automatic.

Practice is what turns these rules into instinct, so try a handful of problems every day and check your answers with our subnet calculator. If your organization’s addressing has grown messy over the years, with overlapping ranges, undocumented subnets or no room to summarize, our Network Health Assessment can map what you have and propose a clean plan.