Free lesson · Computer Networking

Linux/macOS - using ipcalc

Easy11 min readnetworkingcomputer-networkstcp-ip

Subnetting Is a Skill That Gets Faster with Practice

The previous topic introduced the theory of subnetting - subnet masks, CIDR notation, the formula for calculating hosts and subnets, and the concept of VLSM. This topic is pure practice. You will work through progressively harder subnetting problems, learn mental math shortcuts that eliminate the need for binary conversion in most cases, and build the fluency that makes subnetting second nature.

The goal is not to memorize every possible subnet - it is to internalize the patterns so deeply that you can answer subnetting questions in seconds rather than minutes. In an interview setting, spending three minutes on binary math for a subnetting question signals unfamiliarity with networking fundamentals. Answering in ten seconds signals genuine fluency and real-world experience with network design.

The Subnet Cheat Sheet - Memorize This

The fastest path to subnetting fluency is memorizing the relationships between prefix lengths, subnet sizes, and usable hosts for the most common subnets. Everything else can be derived from this table:

*Note: /31 is a special case (RFC 3021) used for point-to-point links where no broadcast address is needed. Both addresses in the /31 are usable.

The pattern is straightforward: Each step from /24 toward /32 halves the block size and doubles the number of subnets. Each step from /24 toward /16 doubles the block size. This doubling/halving pattern is the key to fast mental math.

Mental Math Shortcut #1: The "256 Minus" Rule

For any prefix length /25 through /32, the subnet mask's last octet equals:

Subnet mask last octet = 256 - block size

For /26: block size = 64, so the mask is 256 - 64 = 192. Full mask: 255.255.255.192. ✓

For /27: block size = 32, so the mask is 256 - 32 = 224. Full mask: 255.255.255.224. ✓

Mental Math Shortcut #2: Finding Subnet Boundaries

Given an IP address and prefix length, you can find which subnet it belongs to by finding the largest multiple of the block size that is less than or equal to the last relevant octet.

Example: Which subnet does 192.168.1.137/26 belong to?

1. /26 has a block size of 64
2. Subnets start at: .0, .64, .128, .192
3. 137 falls between 128 and 192
4. Therefore 192.168.1.137 is in subnet 192.168.1.128/26
5. Network address: 192.168.1.128, Broadcast: 192.168.1.191, Usable range: .129 to .190

You can do this in your head in seconds once you memorize the block sizes.

Mental Math Shortcut #3: "How Many Hosts Do I Need?"

When designing subnets, you start with the number of hosts you need and work backward to the prefix length:

1. Add 2 to your host requirement (for network and broadcast addresses)
2. Find the next power of 2 that is ≥ that number
3. The exponent tells you the number of host bits
4. Prefix length = 32 - host bits

Example: You need 100 hosts.

1. 100 + 2 = 102
2. Next power of 2 ≥ 102 is 128 (2^7)
3. Host bits = 7
4. Prefix length = 32 - 7 = /25

A /25 subnet provides 126 usable hosts - enough for 100 with room for growth.

Worked Examples

Example 1: Basic Subnet Identification

Problem: Given the address 10.0.5.200/20, find the network address, broadcast address, first usable host, last usable host, and number of usable hosts.

Solution:

A /20 means 20 network bits and 12 host bits. The block size is 2^12 = 4,096 addresses. But since the boundary falls within the third octet (bits 17-20 are in the third octet), we need to think about the third octet's contribution.

Step 1: The /20 mask in the third octet is 255.255.240.0. The third octet mask value is 240, which means the block size in the third octet is 256 - 240 = 16.

Step 2: The third octet is 5. Which multiple of 16 is ≤ 5? It is 0. So the network starts at 10.0.0.0/20.

Step 3: The next subnet starts at 10.0.16.0/20. So this subnet covers 10.0.0.0 to 10.0.15.255.

Answers:

• Network address: 10.0.0.0
• First usable host: 10.0.0.1
• Last usable host: 10.0.15.254
• Broadcast address: 10.0.15.255
• Usable hosts: 4,094

Example 2: Designing Subnets for a VPC

Problem: You have the CIDR block 172.16.0.0/16. Design subnets for:

• 3 public subnets (each needs at most 60 hosts)
• 3 private subnets (each needs at most 500 hosts)
• 3 database subnets (each needs at most 10 hosts)

Solution:

Public subnets: 60 hosts → need 62 addresses (60 + 2) → next power of 2 is 64 → /26 (62 usable hosts) ✓

Private subnets: 500 hosts → need 502 addresses → next power of 2 is 512 → but 512 gives only 510 usable, need to verify: 510 ≥ 500 ✓ → /23 (510 usable hosts)

Wait - let us double-check. 2^9 = 512. Prefix length = 32 - 9 = /23. Usable hosts = 512 - 2 = 510 ≥ 500. ✓

Database subnets: 10 hosts → need 12 addresses → next power of 2 is 16 → /28 (14 usable hosts) ✓

Now allocate, starting with the largest:

Total used: 3 × 512 + 3 × 64 + 3 × 48 = 1,536 + 192 + 48 = 1,776 addresses out of 65,536 available. Plenty of room for growth.

graph TD
    subgraph VPC["VPC 172.16.0.0/16 - 65,536 addresses"]
        direction TB
        PRI["Private Subnets<br/>3 × /23<br/>510 hosts each"]
        PUB["Public Subnets<br/>3 × /26<br/>62 hosts each"]
        DB["Database Subnets<br/>3 × /28<br/>14 hosts each"]
        FREE["Remaining Space<br/>~63,760 addresses<br/>Available for growth"]
    end

    style PRI fill:#4f46e5,stroke:#4338ca,color:#fff
    style PUB fill:#7c3aed,stroke:#6d28d9,color:#fff
    style DB fill:#8b5cf6,stroke:#7c3aed,color:#fff
    style FREE fill:#22c55e,stroke:#16a34a,color:#fff

This diagram shows the VPC subnet design for 172.16.0.0/16 with 65,536 total addresses. Three private subnets use /23 prefix lengths with 510 hosts each. Three public subnets use /26 prefix lengths with 62 hosts each. Three database subnets use /28 prefix lengths with 14 hosts each. The remaining space of approximately 63,760 addresses is available for future growth, shown in green.

Example 3: Finding the Subnet from an IP Address

Problem: A server has the IP address 10.42.137.68/21. What subnet is it on? What is the broadcast address?

Solution:

/21 means the third octet is partially in the network portion. The mask for the third octet: /21 leaves 3 bits in the network portion of the third octet (21 - 16 = 5 bits from the third octet are network bits... actually, let me recalculate).

/21: 21 network bits. First 16 bits cover octets 1 and 2 fully. That leaves 5 more network bits in the third octet. So the third octet mask = 11111000 = 248. Block size in third octet = 256 - 248 = 8.

Third octet value = 137. Largest multiple of 8 ≤ 137: 136 (17 × 8 = 136). So the network starts at 10.42.136.0/21.

Host bits = 32 - 21 = 11. Total addresses = 2^11 = 2,048.

Network address: 10.42.136.0 The subnet spans from 10.42.136.0 to 10.42.143.255 (136 + 8 - 1 = 143 for the third octet, .255 for the fourth). Broadcast address: 10.42.143.255

Common Mistakes to Avoid

Mistake 1: Forgetting to subtract 2 for usable hosts. The network address and broadcast address are not assignable. A /24 has 254 usable hosts, not 256. In cloud environments, subtract even more for provider reservations.

Mistake 2: Non-aligned subnet boundaries. A /26 subnet cannot start at any arbitrary address - it must start at a multiple of 64 (.0, .64, .128, .192). Starting a /26 at .50 is invalid. Subnets always align to their block size. A quick way to verify alignment: divide the starting address (the relevant octet) by the block size. If it divides evenly, the boundary is valid.

Mistake 3: Overlapping subnets. When designing a VPC, ensure no two subnets share any address. 10.0.0.0/24 and 10.0.0.128/25 overlap - the second subnet's addresses are entirely contained within the first. This is a configuration error that most cloud platforms will reject, but it is a common mistake when manually designing subnet schemes. To check for overlap, verify that each subnet's address range does not intersect any other subnet's range.

Mistake 4: Undersizing subnets. A /28 with 14 usable hosts seems fine for "a few database servers," but if each RDS instance uses an IP and each read replica uses another IP, and you add a few Redis cache nodes, you can exhaust the subnet faster than expected. Always add a growth buffer - if you need 10 addresses today, allocate a subnet that supports 30. Expanding a subnet after deployment is disruptive in most cloud environments because it requires creating a new larger subnet, migrating resources, and updating routing rules.

Mistake 5: Using the same CIDR range in multiple VPCs that need to communicate. If your production VPC uses 10.0.0.0/16 and your staging VPC also uses 10.0.0.0/16, you cannot establish VPC peering or VPN connections between them because the routing tables cannot distinguish which 10.0.x.x destination belongs to which VPC. Always use non-overlapping CIDR ranges for VPCs that will be interconnected.

Important: AWS VPC Subnet Sizing - Lessons from Production

When designing VPC subnets for Kubernetes workloads, the most common mistake is sizing based on the number of EC2 instances rather than the number of pods. With the AWS VPC CNI plugin, each pod gets its own IP address from the subnet. A cluster with 50 nodes running 30 pods each needs 1,500 IP addresses for pods alone, plus 50 for nodes, plus addresses for load balancers, NAT gateways, and other infrastructure. A /24 (251 usable addresses in AWS) is completely insufficient - you need at least a /21 (2,046 usable addresses) to handle this workload with room for growth.

This is a real production failure that teams encounter when they design subnets based on instance counts and then adopt Kubernetes with pod-level networking. Right-sizing subnets at VPC creation time saves significant operational pain later, because resizing subnets in a running VPC is disruptive and sometimes impossible without rebuilding the entire network.

Verifying Your Subnetting with Tools

While mental math is important for interviews and quick calculations, you should always verify your subnet designs with tools before deploying them to production:

# Linux/macOS - using ipcalc
ipcalc 192.168.1.0/26

# Output shows: network address, broadcast, host range, host count
# Install with: apt install ipcalc (Ubuntu) or brew install ipcalc (Mac)

# Python - quick subnet calculation
python3 -c "
import ipaddress
net = ipaddress.ip_network('10.0.0.0/22')
print(f'Network:   {net.network_address}')
print(f'Broadcast: {net.broadcast_address}')
print(f'Hosts:     {net.num_addresses - 2}')
print(f'First:     {list(net.hosts())[0]}')
print(f'Last:      {list(net.hosts())[-1]}')
"

# AWS CLI - verify a subnet can be created in a VPC
aws ec2 create-subnet \
  --vpc-id vpc-abc123 \
  --cidr-block 10.0.1.0/24 \
  --availability-zone us-east-1a \
  --dry-run  # dry-run validates without creating

Python's ipaddress module is particularly useful for scripting subnet designs and checking for overlaps between planned subnets. Use it to validate your mental math before committing to a network architecture.

Interview: Subnetting questions in interviews test practical fluency, not academic knowledge:

"Given a /16, how would you divide it for a three-tier application across three availability zones?" - Demonstrate that you can quickly calculate the right prefix lengths for each tier, allocate non-overlapping ranges, and leave room for growth. The VPC example above is exactly this type of question.

"How many instances can run in a /24 subnet on AWS?" - 251 (256 - 5 AWS-reserved addresses). Knowing this specific number shows cloud networking familiarity.

"What prefix length gives you exactly 1,000 usable hosts?" - 1,000 + 2 = 1,002. Next power of 2 ≥ 1,002 is 1,024 (2^10). Prefix = 32 - 10 = /22. Usable hosts = 1,022. Answer in 5 seconds, not 5 minutes.

Quick Reference - Powers of 2

Commit these to memory for instant recall. Every subnetting calculation reduces to these numbers:

What Comes Next

graph LR
    subgraph MentalMath["Subnetting Mental Math Shortcut"]
        direction LR
        PREFIX["/24"] -->|"Borrow 1 bit"| S25["/25<br/>2 subnets<br/>126 hosts"]
        S25 -->|"Borrow 1 more"| S26["/26<br/>4 subnets<br/>62 hosts"]
        S26 -->|"Borrow 1 more"| S27["/27<br/>8 subnets<br/>30 hosts"]
        S27 -->|"Borrow 1 more"| S28["/28<br/>16 subnets<br/>14 hosts"]
    end

    style PREFIX fill:#4f46e5,stroke:#4338ca,color:#fff
    style S25 fill:#7c3aed,stroke:#6d28d9,color:#fff
    style S26 fill:#8b5cf6,stroke:#7c3aed,color:#fff
    style S27 fill:#a78bfa,stroke:#8b5cf6,color:#fff
    style S28 fill:#c4b5fd,stroke:#a78bfa,color:#000

This diagram shows the subnetting mental math shortcut. Starting from a /24, each additional borrowed bit doubles the number of subnets and roughly halves the hosts. A /25 gives 2 subnets with 126 hosts each. A /26 gives 4 subnets with 62 hosts. A /27 gives 8 subnets with 30 hosts. A /28 gives 16 subnets with 14 hosts. Memorizing this progression lets you answer subnetting questions instantly.

You now have the tools to design and calculate subnets with confidence. The next topic covers IPv6 - the next-generation IP addressing system that eliminates the address exhaustion problem entirely with its 128-bit addresses, while introducing new concepts and notation that you need to understand for modern network infrastructure.

Exercise: Starter: For each of these CIDR blocks, state the number of total addresses and usable hosts: /24, /27, /30, /20, /16. Check your answers against the tables above.

Intermediate: Given the IP address 172.16.45.200/22, find: (a) the network address, (b) the broadcast address, (c) the first and last usable host addresses, (d) the total number of usable hosts. Show your work using the block-size method from this topic.

Advanced: You are designing the network for a Kubernetes cluster on AWS. Each node runs 30 pods, and each pod needs its own IP address (using the AWS VPC CNI plugin). You expect to run 50 nodes. How many IP addresses do you need? What is the minimum prefix length for the subnet? Now factor in 100% growth capacity. What prefix length would you choose, and why? Consider the trade-off between right-sizing (saving IP space) and over-provisioning (avoiding the disruption of expanding a subnet later).

Back to Computer Networking