Free lesson · Computer Networking

Subnetting Dividing Networks

Easy11 min readnetworkingcomputer-networkstcp-ip

Why Networks Need to Be Divided

Imagine a company with 1,000 employees all on a single network - one broadcast domain, one IP range, one flat space. Every ARP request from any device reaches all 999 other devices. Every DHCP discover, every mDNS query, every broadcast protocol message - all delivered to every machine. The broadcast overhead alone degrades performance, and from a security perspective, any device can directly communicate with any other device at Layer 2.

Subnetting solves this by dividing one large network into smaller, more manageable sub-networks (subnets). Each subnet is its own broadcast domain with its own IP address range. Devices in different subnets communicate through a router, which means traffic between subnets can be filtered, monitored, and controlled.

Subnetting serves three purposes in practice:

Organization: Different departments, services, or functions get their own subnets. Engineering on one subnet, databases on another, public-facing load balancers on a third. This logical separation mirrors the organizational structure.

Security: Subnets create boundaries where firewalls and access control lists (ACLs) can enforce policies. The database subnet can be configured to accept connections only from the application subnet, not from the public internet or from other internal subnets. Without subnets, every device on the network can reach every other device directly at Layer 2, and the only security controls available are host-based firewalls - a much weaker defense posture. Defense in depth requires network-level segmentation, and subnets are the primary mechanism for achieving it.

Efficiency: Instead of allocating a large contiguous block to every network, subnetting lets you allocate exactly the right number of addresses to each purpose. A subnet that needs 30 addresses gets a /27 (32 addresses). A subnet that needs 250 addresses gets a /24 (256 addresses). No waste. In cloud environments where you pay for resources and where private IP address space is shared across services, efficient subnetting directly affects how many services you can run and how flexible your infrastructure is for future growth.

Subnet Masks - The Key to Understanding Subnets

A subnet mask is a 32-bit number that defines the boundary between the network portion and the host portion of an IP address. The mask is a sequence of 1-bits followed by a sequence of 0-bits. The 1-bits mark the network portion; the 0-bits mark the host portion.

Consider the IP address 192.168.1.42 with subnet mask 255.255.255.0:

IP address:    11000000.10101000.00000001.00101010  (192.168.1.42)
Subnet mask:   11111111.11111111.11111111.00000000  (255.255.255.0)
               |------ network portion ------|host-|

The subnet mask has 24 consecutive 1-bits and 8 consecutive 0-bits. The first 24 bits of the IP address (192.168.1) are the network address - shared by all devices on this subnet. The last 8 bits (.42) are the host address - unique to this specific device.

To find the network address (the identifier for the subnet itself), you perform a bitwise AND between the IP address and the subnet mask:

IP address:    11000000.10101000.00000001.00101010  (192.168.1.42)
Subnet mask:   11111111.11111111.11111111.00000000  (255.255.255.0)
AND result:    11000000.10101000.00000001.00000000  (192.168.1.0)

The result - 192.168.1.0 - is the network address. All devices on this subnet share this network address and differ only in the host portion (the last 8 bits).

CIDR Notation - The Modern Way to Write Subnet Masks

Instead of writing subnet masks in dotted decimal (255.255.255.0), modern networking uses CIDR notation, which simply states the number of 1-bits in the mask as a suffix after the IP address.

192.168.1.0/24 means: the network address is 192.168.1.0, and the subnet mask has 24 consecutive 1-bits (255.255.255.0). The /24 tells you everything the full subnet mask does, in much less space.

Here are the most common subnet masks and their CIDR equivalents:

Why "usable hosts" is always 2 less than "total addresses": Two addresses in every subnet are reserved and cannot be assigned to devices. The network address (all host bits set to 0) identifies the subnet itself. The broadcast address (all host bits set to 1) is used to send a message to all devices on the subnet. Everything in between is available for hosts.

For example, in 192.168.1.0/24:

• Network address: 192.168.1.0 (reserved - identifies the subnet)
• First usable host: 192.168.1.1
• Last usable host: 192.168.1.254
• Broadcast address: 192.168.1.255 (reserved - broadcast to all hosts)
• Usable hosts: 254 (256 - 2)

graph TD
    subgraph Subnet["Subnet 192.168.1.0/24"]
        direction TB
        NETADDR["192.168.1.0<br/>Network Address<br/>(reserved)"]
        FIRST["192.168.1.1<br/>First Usable Host<br/>(often the gateway)"]
        DOTS1["192.168.1.2 – 192.168.1.253<br/>Usable Host Addresses"]
        LAST["192.168.1.254<br/>Last Usable Host"]
        BCAST["192.168.1.255<br/>Broadcast Address<br/>(reserved)"]
    end

    NETADDR --- FIRST
    FIRST --- DOTS1
    DOTS1 --- LAST
    LAST --- BCAST

    style NETADDR fill:#ef4444,stroke:#dc2626,color:#fff
    style FIRST fill:#4f46e5,stroke:#4338ca,color:#fff
    style DOTS1 fill:#7c3aed,stroke:#6d28d9,color:#fff
    style LAST fill:#4f46e5,stroke:#4338ca,color:#fff
    style BCAST fill:#ef4444,stroke:#dc2626,color:#fff

This diagram shows the address layout within the subnet 192.168.1.0/24. The first address, 192.168.1.0, is the network address and is reserved. The second address, 192.168.1.1, is the first usable host address, often assigned to the gateway router. Addresses 192.168.1.2 through 192.168.1.253 are usable host addresses. Address 192.168.1.254 is the last usable host. The final address, 192.168.1.255, is the broadcast address and is reserved. The two red reserved addresses reduce the usable host count from 256 to 254.

How Subnetting Works - Dividing a Network

Subnetting means borrowing bits from the host portion to create additional network bits, which divides the original network into smaller subnets with fewer hosts each.

Example: Splitting a /24 into Two /25 Subnets

Start with 192.168.1.0/24 - 256 addresses, 254 usable hosts. You need to divide this into two subnets.

Borrowing 1 bit from the host portion changes the mask from /24 to /25. This creates 2^1 = 2 subnets, each with 2^7 = 128 addresses (126 usable hosts).

Original:    192.168.1.0/24
             Network: 192.168.1.|Host portion: 8 bits|

After /25:   192.168.1.0/25     (hosts .1 to .126, broadcast .127)
             192.168.1.128/25   (hosts .129 to .254, broadcast .255)

The first subnet covers 192.168.1.0 to 192.168.1.127. The second covers 192.168.1.128 to 192.168.1.255. Each subnet has its own network address, broadcast address, and usable host range. They are separate broadcast domains that require a router to communicate between them.

Example: Splitting a /24 into Four /26 Subnets

Borrowing 2 bits from the host portion changes the mask from /24 to /26. This creates 2^2 = 4 subnets, each with 2^6 = 64 addresses (62 usable hosts).

192.168.1.0/26     Network: .0,    Hosts: .1 to .62,    Broadcast: .63
192.168.1.64/26    Network: .64,   Hosts: .65 to .126,  Broadcast: .127
192.168.1.128/26   Network: .128,  Hosts: .129 to .190, Broadcast: .191
192.168.1.192/26   Network: .192,  Hosts: .193 to .254, Broadcast: .255

Notice the pattern: each subnet starts at a multiple of the subnet size (64 in this case). The subnet boundaries are determined by the mask - they always align to powers of 2.

The General Formula

For any subnet:

• Number of subnets created by borrowing n bits = 2^n
• Number of addresses per subnet with h host bits = 2^h
• Number of usable hosts per subnet = 2^h - 2
• Host bits = 32 - prefix length

So for a /26: host bits = 32 - 26 = 6. Addresses per subnet = 2^6 = 64. Usable hosts = 64 - 2 = 62.

Important: The formula 2^h - 2 for usable hosts assumes you need to reserve the network and broadcast addresses. In some cloud environments (notably AWS VPCs), additional addresses are reserved - AWS reserves 5 addresses per subnet (network address, VPC router, DNS server, future use, and broadcast address). So a /24 in AWS provides 251 usable hosts, not 254. Always check your cloud provider's documentation for their specific reservation policy.

Variable-Length Subnet Masking (VLSM)

The examples above divided a network into subnets of equal size. But real networks rarely need uniform subnets. A point-to-point link between two routers needs only 2 addresses (/30). A server farm might need 500 addresses (/23). A management VLAN might need 14 addresses (/28). Allocating a uniform /24 to each wastes enormous address space on the small subnets and is insufficient for the large ones.

VLSM (Variable-Length Subnet Masking) allows you to create subnets of different sizes from the same parent network. Instead of dividing uniformly, you allocate subnets of the size you actually need.

Here is a practical example. You have 10.0.0.0/24 (256 addresses) and need:

• One subnet for 100 hosts (application servers)
• One subnet for 50 hosts (web servers)
• One subnet for 25 hosts (database servers)
• Two subnets for 2 hosts each (point-to-point router links)

Step 1: Start with the largest requirement. 100 hosts needs at least 7 host bits (2^7 = 128, minus 2 = 126 usable). That is a /25.

• 10.0.0.0/25 → 128 addresses (.0 to .127), 126 usable hosts ✓

Step 2: Next largest. 50 hosts needs at least 6 host bits (2^6 = 64, minus 2 = 62 usable). That is a /26.

• 10.0.0.128/26 → 64 addresses (.128 to .191), 62 usable hosts ✓

Step 3: 25 hosts needs at least 5 host bits (2^5 = 32, minus 2 = 30 usable). That is a /27.

• 10.0.0.192/27 → 32 addresses (.192 to .223), 30 usable hosts ✓

Step 4: Two point-to-point links need 2 usable hosts each. That is a /30 (4 addresses, 2 usable).

• 10.0.0.224/30 → 4 addresses (.224 to .227), 2 usable hosts ✓
• 10.0.0.228/30 → 4 addresses (.228 to .231), 2 usable hosts ✓

Result: The original /24 (256 addresses) is divided into 5 subnets of varying sizes, with addresses .232 to .255 remaining unused and available for future allocation. VLSM eliminates the waste that uniform subnetting would create - if we had used /25 for all five subnets, we would have needed 640 addresses (far more than the 256 available).

Tip: When designing VLSM schemes, always allocate the largest subnets first and work your way down to the smallest. This ensures that subnet boundaries align properly (each subnet must start at an address that is a multiple of its size) and avoids address space fragmentation.

Supernetting (Route Aggregation)

Subnetting divides networks into smaller pieces. Supernetting (also called route aggregation or route summarization) does the opposite - it combines multiple smaller networks into a single larger network for the purpose of simplifying routing tables.

If a router has routes to four /24 networks that are numerically contiguous:

• 10.0.0.0/24
• 10.0.1.0/24
• 10.0.2.0/24
• 10.0.3.0/24

It can advertise a single summarized route: 10.0.0.0/22. This single entry covers all four /24 networks (the first 22 bits are the same for all four) and reduces the routing table by four entries to one.

Supernetting is what keeps the global internet routing table manageable. Without route aggregation, the routing table would contain millions of individual /24 entries. With aggregation, ISPs advertise large blocks (sometimes /8 or /16) that encompass thousands of individual subnets, keeping the global table to roughly 950,000 entries.

Subnetting in the Cloud - A Practical Example

Here is how subnetting applies to a real AWS VPC design:

You create a VPC with CIDR block 10.0.0.0/16 - that gives you 65,536 addresses. You need to divide this into subnets across 2 availability zones (AZs), with public and private subnets in each AZ:

This uses 6 × 256 = 1,536 addresses out of the available 65,536. The remaining address space is available for future subnets - additional AZs, new service tiers, expansion.

The choice of /24 for each subnet is deliberate and common in practice: 251 usable hosts per subnet (after AWS reservations) is enough for most workloads, and /24 is the most intuitive subnet size to reason about - the last octet is entirely host bits, so addresses within the subnet always share the first three octets. This mental simplicity has real operational value when you are troubleshooting network issues at 3 AM. If a workload needed more addresses (say, a Kubernetes cluster with thousands of pods), you might use a /20 (4,091 usable hosts) or even a /18 (16,379 usable hosts) for that specific subnet.

Interview: Subnetting is one of the most directly applicable networking skills in System Design interviews:

"Design the network architecture for a multi-tier web application on AWS." - You need to specify a VPC CIDR, create subnets for each tier (web, app, database) across multiple AZs, and explain why each tier is on a separate subnet (security isolation, routing control).

"How many instances can you run in this subnet?" - Direct application of the usable hosts formula. A /24 provides 251 usable hosts in AWS. If you need more, you need a larger subnet or additional subnets.

"What happens when a subnet runs out of IP addresses?" - New instances cannot launch. This is a real production failure that happens when subnets are sized too small for their workload. Understanding how to calculate subnet capacity prevents this.

What Comes Next

graph TD
    subgraph SubnettingProcess["Subnetting Decision Process"]
        direction TB
        START["Original Network<br/>e.g., 10.0.0.0/16"] --> Q1["How many subnets<br/>do you need?"]
        Q1 --> CALC["Borrow bits from<br/>host portion"]
        CALC --> RESULT["New prefix length<br/>= original + borrowed bits"]
        RESULT --> VERIFY["Verify: enough hosts<br/>per subnet?"]
        VERIFY -->|"Yes"| DONE["Assign subnets<br/>to segments"]
        VERIFY -->|"No"| CALC
    end

    style START fill:#4f46e5,stroke:#4338ca,color:#fff
    style Q1 fill:#7c3aed,stroke:#6d28d9,color:#fff
    style CALC fill:#8b5cf6,stroke:#7c3aed,color:#fff
    style RESULT fill:#a78bfa,stroke:#8b5cf6,color:#fff
    style VERIFY fill:#c4b5fd,stroke:#a78bfa,color:#000
    style DONE fill:#22c55e,stroke:#16a34a,color:#fff

This flowchart shows the subnetting decision process. You start with the original network and its prefix length. You determine how many subnets you need, then borrow bits from the host portion to create the subnets. This gives you a new, longer prefix length. You then verify that each subnet still has enough host addresses. If yes, you assign subnets to your network segments. If not, you adjust the number of borrowed bits and try again.

The next topic - Subnetting Practice and Calculation - provides step-by-step exercises, mental math shortcuts, and additional worked examples to make subnetting second nature. Subnetting is a skill that improves with practice, and Topic 4 gives you that practice.

Exercise: Starter: Given the network 192.168.10.0/24, what is the network address? What is the broadcast address? What is the range of usable host addresses? How many usable hosts are there?

Intermediate: You need to divide the network 10.0.0.0/24 into 4 equal subnets. What prefix length do you need? List all 4 subnets with their network address, usable host range, and broadcast address. How many usable hosts does each subnet have?

Advanced: Design a subnet scheme for a company with the following requirements using the VPC CIDR 10.0.0.0/16: a public subnet with at most 30 hosts per AZ across 3 AZs, a private application subnet with at most 500 hosts per AZ across 3 AZs, and a database subnet with at most 14 hosts per AZ across 3 AZs. Choose the smallest appropriate prefix length for each subnet type. How much of the /16 address space remains unused for future growth?

Back to Computer Networking