Subnetting, by hand

Your home network is one street: 192.168.1.0 with mask 255.255.255.0, room for 254 devices, and everything on it can talk to everything else directly. For a house that's perfect. For a business it isn't. You don't want the guest Wi-Fi on the same street as the accounts computers, or the security cameras next to the laptops.

Subnetting means cutting one network into several smaller ones. Each piece is a subnet: its own street, with its own range of house numbers. A router joins the streets back together, and the router is where you get to decide what may cross from one to another.

There are three reasons to do it, and you'll hear all three:

• Security. Devices on different subnets can only reach each other through a router, and the router can have rules. Guests can reach the Internet but not your file server.
• Less noise. Some messages go to everyone on a street (the ARP question “who is 192.168.1.1?” from the Introduction is one). On a street with 1,000 devices that chatter adds up. Smaller streets, less shouting.
• Not wasting addresses. A link between two routers needs 2 addresses, not 254. Subnetting lets you hand out exactly as much as each place needs.

The tool that does the cutting is the mask. Make it longer and the street gets shorter. To see why, you need ten minutes of binary.

Each of the four numbers in an IP address is called an octet, because a computer stores it as eight bits, eight switches that are each either 0 or 1. Each switch has a fixed value. From left to right they're worth 128, 64, 32, 16, 8, 4, 2 and 1, each one half of the one before. The octet's value is the total of the switches that are on:

Decimal to binary: take the biggest value that fits

To write 77 in binary, walk the row from the left. Does 128 fit in 77? No, write 0. Does 64 fit? Yes, write 1 and 13 is left. 32? No, 0. 16? No, 0. 8 fits into 13: 1, 5 left. 4 fits: 1, 1 left. 2? No, 0. 1 fits: 1, nothing left. Result: 01001101.

Binary to decimal: add up the ones

11000000 has the 128 and the 64 switched on: 128 + 64 = 192. 11111111 is every switch: 128+64+32+16+8+4+2+1 = 255, the biggest an octet can hold, which is why no IP address ever has a number above 255.

Try two before moving on: write 168 and 10 in binary. (Answers: 10101000 is 128+32+8; 00001010 is 8+2.)

An IP address is 32 bits: four octets of eight. The mask is also 32 bits, and it's simple: a run of 1s followed by a run of 0s. Where the mask has a 1, that bit of the address belongs to the network (the street). Where the mask has a 0, that bit belongs to the host (the house).

The slash number is just how many 1s the mask has. /24 is 24 ones then 8 zeros, which written out in octets is 255.255.255.0. /26 is 26 ones then 6 zeros: three octets of 255, and the fourth is 11000000, which is 192. So /26 = 255.255.255.192. Here's 192.168.10.77/26 with every bit on show:

Six host bits means the house number can be anything from 000000 to 111111, which is 64 combinations (2 × 2 × 2 × 2 × 2 × 2 = 2⁶ = 64). So a /26 street is 64 addresses long. A /24 has 8 host bits, 2⁸ = 256 addresses. Every bit you add to the mask halves the street; every bit you take away doubles it.

Every subnet question is really asking for the same four things. Look at the bottom two rows of the diagram in Step 03: they're the first two.

The router for a subnet takes one of the usable addresses, by convention usually the first. On the 192.168.10.64/26 street that would be 192.168.10.65, and it's what every device on the street has as its default gateway.

Writing out 32 bits every time works, but nobody does it. There's a shortcut that gives the same answer with one subtraction. It works because subnets always start on a multiple of their own size.

1. Find the interesting octet: the first mask octet that isn't 255. For 255.255.255.192 it's the fourth.
2. Block size = 256 − that number. 256 − 192 = 64. Every subnet is 64 addresses long.
3. Count up in blocks from 0: 0, 64, 128, 192. Those are the network addresses of every possible subnet.
4. Find the block your address sits in. 77 is between 64 and 128, so it's in the block that starts at 64.
5. Read off the four numbers. Network is the block start (.64). Broadcast is one below the next block (.127). Usable is everything in between (.65–.126). Hosts: block size − 2 = 62.

One more, start to finish. 10.0.0.45/28: a /28 is 28 ones, so the fourth mask octet has four ones, 128+64+32+16 = 240, and the mask is 255.255.255.240. Block size 256 − 240 = 16. Count in 16s: 0, 16, 32, 48. 45 sits in the block starting at 32. Network 10.0.0.32, usable .33–.46, broadcast 10.0.0.47, 16 − 2 = 14 hosts.

Now reverse the question. Instead of “which subnet is this address in?”, it's “I have 192.168.10.0/24; how do I cut it up?” This is the part you'll actually do in real life. Every bit you borrow from the host part doubles the number of subnets and halves their size:

The subnets don't all have to be the same size. Say a small business needs a guest Wi-Fi for up to 100 phones, an office network for 50 computers, and a lab with 20 machines. Pick the smallest block that fits each (remember the −2):

• Guest Wi-Fi, 100 → a /26 (62) is too small, so /25 (126).
• Office, 50 → /26 (62).
• Lab, 20 → /27 (30).

Then lay them out largest first, each starting right after the one before. Because the blocks shrink in halves, each one automatically lands on a multiple of its own size, which is the rule every subnet must follow:

This is called VLSM (variable-length subnet masking), which is a long name for “not every subnet has to be the same size”. The spare .224–.255 could later become another /27, or two /28s, or eight /30s for links between routers.

Everything so far used masks longer than /24, where only the last octet changes. Bigger networks, the kind companies and cloud providers use, have masks shorter than /24, and then the interesting octet is the third one. The method doesn't change. You just apply it one octet to the left.

10.20.37.200/20:

1. /20 = 8 + 8 + 4, so two octets of 255 and four ones in the third: 128+64+32+16 = 240. Mask 255.255.240.0.
2. Interesting octet: the third. Block size 256 − 240 = 16.
3. Count in 16s in the third octet: 0, 16, 32, 48… The address's third octet is 37, which is in the block starting at 32.
4. Network: third octet 32, and everything after it 0: 10.20.32.0.
5. Broadcast: third octet one below the next block (47), everything after it 255: 10.20.47.255.
6. Usable: 10.20.32.1 to 10.20.47.254. Hosts: 4 + 8 = 12 host bits, 2¹² − 2 = 4,094.

The only new thing is that the fourth octet comes along for the ride: all 0s at the network end and all 255s at the broadcast end.

Do it by hand first; that's how you learn it. Then let a computer confirm you're right. Python (installed on every Mac and Linux machine, and a free download for Windows) has subnetting built in:

python3 -c "import ipaddress as i; n=i.ip_interface('192.168.10.77/26').network; print(n.network_address, n.broadcast_address, n.num_addresses-2)"

Network, broadcast, usable hosts: the same three numbers you worked out in Step 05. On Windows, if python3 isn't found, try py in its place. Many Linux distributions also have ipcalc (sudo apt install ipcalc), which prints the whole breakdown including the binary.

Now subnet your own network

Run ipconfig (Windows) or ip addr (Linux) as you did in the Introduction, and take your own address and mask. Work out your network address, broadcast and usable range by hand. For almost every home network the mask is 255.255.255.0, so the answer is quick: network is your first three octets with .0, broadcast ends in .255, and there are 254 usable. Then check it with the Python line.

Work each one on paper with the block-size method before you open the answer. The first four are the everyday kind; the last three are the questions you'll actually be asked on the job.

1. What are the network, usable range, broadcast and host count of 192.168.1.130/25?

   Show the answer

   Mask 255.255.255.128, block 256 − 128 = 128. Blocks start at 0 and 128; 130 is in the 128 block. Network 192.168.1.128, usable .129–.254, broadcast 192.168.1.255, 126 hosts.

2. Same four numbers for 172.16.5.200/27.

   Show the answer

   /27 leaves 32 − 27 = 5 host bits. The fourth mask octet has three ones, 128+64+32 = 224: mask 255.255.255.224, block 32. Count in 32s: 160, 192, 224; 200 is in the 192 block. Network 172.16.5.192, usable .193–.222, broadcast 172.16.5.223, 30 hosts.

3. And 192.168.50.9/30. What is special about this size?

   Show the answer

   Mask 255.255.255.252, block 4. Count in 4s: 0, 4, 8, 12; 9 is in the 8 block. Network 192.168.50.8, usable .9 and .10, broadcast 192.168.50.11, 2 hosts. Exactly two usable addresses is why a /30 is the classic choice for a cable between two routers: one address for each end.

4. How many usable hosts does a /22 have, and what is its mask?

   Show the answer

   32 − 22 = 10 host bits, 2¹⁰ − 2 = 1,022 hosts. /22 = 16 + 6, so the third mask octet has six ones: 128+64+32+16+8+4 = 252. Mask 255.255.252.0.

5. A laptop is 192.168.1.60/26 and a printer is 192.168.1.70/26. Can they talk to each other directly?

   Show the answer

   No. Block size 64: the laptop is in the 0–63 block and the printer is in the 64–127 block. Different subnets, different streets. Their traffic has to go through a router, and if there isn't one, they can't reach each other at all, even plugged into the same switch. This exact mistake, a wrong mask on one device, is one of the most common “it's plugged in but can't see it” faults there is.

6. A department needs addresses for 500 devices. What's the smallest subnet that fits?

   Show the answer

   Try host bits until 2^h − 2 is at least 500: 8 bits gives 254 (too small), 9 bits gives 510. 32 − 9 = /23, mask 255.255.254.0.

7. You're given 10.0.0.0/24 and need subnets for 60 staff, 25 servers, and 3 point-to-point router links. Plan it.

   Show the answer

   Sizes: staff 60 → /26 (62). Servers 25 → /27 (30). Each router link → /30 (2). Largest first: staff 10.0.0.0/26 (.1–.62), servers 10.0.0.64/27 (.65–.94), then the links 10.0.0.96/30, 10.0.0.100/30 and 10.0.0.104/30. Everything from 10.0.0.108 up is still free. Other valid layouts exist; what matters is that each subnet starts on a multiple of its block size and none overlap.

Once the method is in your head you won't need this, but everyone keeps a copy anyway. The block size is in the octet that the mask changes: the third for /17–/23, the fourth for /25–/30.

Two you'll see in the wild without the −2: a /32 is a single address, used to mean exactly one device in routing tables and access lists (the L lines in show ip route from the Cisco guides are /32s). A /31 has two addresses and, on router-to-router links only, uses both, because a cable with two ends has no need for a broadcast.

Check yourself

• You can write any number from 0 to 255 in binary and back
• You know the nine possible mask octets, 0 through 255, and why there are only nine
• You can convert between slash and dotted masks (/26 ↔ 255.255.255.192)
• Given any address and mask, you can find the network, broadcast, usable range and host count
• You can explain why every subnet loses two addresses
• You can split a /24 into subnets of different sizes without any overlapping

You can now read any address and mask and say exactly which street it's on, how long the street is, and where it ends. That is most of what “knowing IP addressing” means. The next step is typing it into a real router.