Subnetting Explained: CIDR Notation, Subnet Masks, and Calculating Network Ranges

The Historical Necessity and Evolution of CIDR

In the early days of the internet, the IPv4 address space was divided into rigid "Classes"—A, B, and C. A Class A address could host over 16 million devices, a Class B could host 65,000, and a Class C could host only 254. This system was incredibly wasteful. If an organization needed 500 IP addresses, they couldn't use a Class C, so they were given a full Class B block. This resulted in over 64,000 addresses being wasted for a single company. By the early 1990s, the global pool of IPv4 addresses was depleting at an unsustainable rate.

Classless Inter-Domain Routing (CIDR) was introduced in 1993 to solve this fragmentation. It abandoned the fixed class boundaries and allowed for "Variable-Length Subnet Masking." This meant an organization needing 500 addresses could be given exactly the space they required (a /23 block), rather than a massive Class B block. CIDR allowed the internet to scale for another three decades despite the theoretical limit of only 4.3 billion IPv4 addresses.

Beyond address conservation, subnetting serves critical organizational purposes. It creates security boundaries, prevents broadcast storms from crashing a network, and allows for more efficient routing of traffic. In a modern cloud environment like AWS or Azure, you are constantly using CIDR blocks to define your Virtual Private Clouds (VPCs) and the subnets within them.

The transition from "Classful" to "Classless" networking changed the internet's skeletal structure. It enabled route aggregation, where an ISP can announce one single "Supernet" to the global internet instead of thousands of individual routes. This keeps the global BGP routing tables manageable and ensures that your traffic reaches its destination with the fewest possible hops through the global backbone.

Binary Foundations: Network Bits vs. Host Bits

To understand subnetting, you must look at an IP address in binary. Every IPv4 address is exactly 32 bits long, divided into four octets of 8 bits each. When you see an address like 192.168.1.1, your computer sees 11000000.10101000.00000001.00000001. A subnet mask is a 32-bit filter applied to this address to determine which bits identify the Network and which bits identify the Host.

In a subnet mask, the "1s" identify the network and the "0s" identify the host. For example, in a standard home network with a mask of 255.255.255.0, the first 24 bits are all set to 1. This means the first three numbers of your IP address define your network, and only the last number defines your specific computer. If you change even one bit in the network portion, you are on an entirely different subnet.

The boundary between network and host bits is fluid in the CIDR era. By "borrowing" bits from the host portion, an administrator can create more, smaller subnets. This is the essence of subnetting. The more bits you assign to the network (the prefix), the fewer bits remain for hosts. This is why a /24 has 254 hosts, but a /25—which adds one more network bit—has only 126.

This binary logic is what allows routers to work at lightning speed. When a packet arrives, the router performs a bitwise "AND" operation between the destination IP and its routing table mask. If the result matches a known network address, the packet is forwarded. This operation happens billions of times per second across the global internet, relying entirely on the rigid binary structure of the CIDR prefix.

CIDR Notation and Subnet Mask Conversion

CIDR notation is a shorthand that replaces the bulky dotted-decimal subnet mask with a single number. Instead of writing 192.168.1.0 with a mask of 255.255.255.0, you simply write 192.168.1.0/24. The number after the slash represents the quantity of "1" bits in the subnet mask. This notation is the standard for modern cloud dashboards, CLI tools like ip route, and firewall configurations.

Converting between the two requires understanding the "Magic Numbers" of binary octets. Each bit in an 8-bit octet has a decimal value (128, 64, 32, 16, 8, 4, 2, 1). To find the decimal mask for a /26, you add the first two bits (128 + 64 = 192). Thus, a /26 mask is 255.255.255.192.

As the table demonstrates, the "Usable Hosts" count is always the total number of addresses minus two. These two reserved addresses are the Network Address (the very first address, used to identify the subnet) and the Broadcast Address (the very last address, used to communicate with all devices on the segment). You cannot assign these two addresses to a server or workstation interface.

One special case is the /32 prefix. This represents a single, specific IP address. In routing tables, a /32 is known as a "Host Route." If you want your firewall to allow traffic from only one specific server, you would use CIDR /32. Conversely, a /0 prefix represents all bits as host bits, which in networking terms means "the entire internet." This is commonly used in the "Default Gateway" route (0.0.0.0/0).

Step-by-Step Methodology: Calculating Subnet Ranges

Calculating a subnet range manually is a required skill for many networking certifications and is invaluable for debugging connectivity issues. The process involves identifying the "Block Size" based on the prefix. Once you know the block size, you can find the network boundaries within the octet that is being subnetted.

Example: Calculate the range for 10.0.0.128/26

1. Find the Host Bits: 32 (total) - 26 (prefix) = 6 bits.
2. Calculate Block Size: 2^6 = 64. Each subnet will span 64 addresses.
3. Find the Base: Subnets start at multiples of the block size: 0, 64, 128, 192.
4. Identify Boundaries: The network starts at .128. The next network starts at .192.
5. Set the Range: The network address is .128. The broadcast address is the one right before the next network (.191). The usable hosts are everything in between (.129 through .190).

This "Multiples" method is much faster than converting everything to binary. As long as you know your powers of two (2, 4, 8, 16, 32, 64, 128, 256), you can quickly determine if a specific IP address falls within a given CIDR block. If you are given 10.0.0.150 and asked if it's in the /26 starting at .128, you can instantly see that 150 is between 128 and 191.

In production environments, always use a Subnet Calculator to verify your math before applying changes to a production firewall or router. A single digit error in a CIDR prefix can accidentally block access to millions of addresses or expose a private segment to the public internet. Calculating by hand is for understanding; using tools is for implementation safety.

💡 Tip: Most cloud providers like AWS reserve an additional 3-5 addresses in every subnet for their own internal infrastructure (DNS, Gateway, and DHCP). This means your "Usable" count in the cloud is slightly lower than the standard theoretical calculation.

Private IP Space and RFC 1918 Special Ranges

Not all IP addresses are valid on the public internet. Most internal networks use Private IP Space, defined by the RFC 1918 standard. These addresses are reserved for local use and are never routed over the public backbone. This allows billions of devices to connect to the internet using a single shared public IP address via a process called Network Address Translation (NAT).

There are three primary blocks reserved for private use. Each serves a different scale of networking. The 10.0.0.0/8 block is the largest, offering over 16 million addresses. It is typically used by large enterprises and cloud providers. The 192.168.0.0/16 block is the smallest and is found in almost every home router across the globe.

A common issue in private networking is Address Overlap. If your home network uses 192.168.1.0/24 and you try to connect to an office VPN that also uses 192.168.1.0/24, your computer won't know which "192.168.1.5" to talk to. It will prioritize the local one, making the office resources unreachable. For this reason, savvy network admins often choose "unusual" private subnets inside the 10.x block (like 10.42.17.0/24) to minimize the chance of home-network collisions.

Beyond private space, there are other "Special Use" ranges. For example, 169.254.0.0/16 is used for "Link-Local" addressing. If your computer shows an IP starting with 169.254, it means it was unable to reach a DHCP server and gave itself a temporary "emergency" address. This is a tell-tale sign of a physical network failure or a crashed DHCP service.

Strategic Design: VLSM and Cloud Network Partitioning

In advanced network design, you don't use the same prefix for every subnet. This is called Variable-Length Subnet Masking (VLSM). It allows you to "carve" a large block into pieces of many different sizes. You might take a /24 and split it into one /25 (126 hosts) for the main office and two /26s (62 hosts each) for the Guest Wi-Fi and the Server Room.

This strategy is foundational to Infrastructure as Code (IaC) and cloud architecture. When building a VPC, you start with a large "Supernet" (like a /16) and then define specific CIDR blocks for each Availability Zone. You might create "Public" subnets with /24 prefixes for your web servers and "Private" subnets with /28 prefixes for your database clusters, where fewer IPs are needed but higher security is required.

• Isolation: Use different subnets for different "trust levels" (Tier 1 Web, Tier 2 App, Tier 3 Data).
• Redundancy: Mirror your CIDR blocks across multiple geographic zones to prevent single points of failure.
• Scalability: Leave "Gaps" in your CIDR allocations. Don't pack subnets tightly together, or you won't have room to expand a specific segment later.

When planning your cloud network, always calculate your "Worst Case" growth first. It is extremely difficult to resize a CIDR block once it is filled with live virtual machines and database instances. Most experts recommend starting with at least a /20 for a production cloud environment, giving you enough space to partition for years of global growth without ever needing a complex network migration.

Proper partitioning also aids in Cost Management. Many cloud providers charge for data transfer between different subnets if they are in different regions. By understanding CIDR boundaries, you can ensure that high-bandwidth applications live within the same "local" CIDR block, minimizing unnecessary intra-cloud data taxes while maintaining a highly professional, organized infrastructure.

Frequently Asked Questions

Next Steps

Use our Subnet Calculator to double-check your manual calculations and view the binary breakdown of any CIDR prefix. For larger network designs, use our IP Audit Tool to see how your prefixes are currently routed across the global internet.

For a deeper dive into how these blocks are globally managed, see our ASN Lookup guide and our guide on BGP Routing and Autonomous Systems.

Browse all IP guides on DNSnexus for related documentation on network architecture and security.

Related Guides

• ASN Lookup Explained: What Autonomous System Numbers Tell You
• How BGP Routing Works: The Skeletal System of the Internet
• IP Geolocation Explained: How It Works and Why It's Never 100% Accurate
• Reverse DNS Lookup Explained: PTR Records and Why Email Needs It