Subnetting and CIDR Explained with Simple Examples

Subnetting looks like arithmetic on binary numbers, but a handful of facts and one trick cover almost everything you'll meet in practice.

IP address, mask, prefix

An IPv4 address has 32 bits, written as four bytes: 192.168.10.77. A subnet mask says which part is the network and which is the host:

192.168.10.77 / 24     (CIDR notation)
= address 192.168.10.77, mask 255.255.255.0

/24 means the first 24 bits are the network. The remaining 32 - 24 = 8 bits identify hosts inside it.

The cheat table

Formulas:

• Addresses = 2^(32 - prefix)
• Usable hosts = addresses - 2. One address is the network address (all host bits 0) and one is the broadcast (all host bits 1).

The fast method: block size

For prefixes between /24 and /32, only the last octet matters. Find the block size = 256 - mask value in that octet.

Example: which network is 192.168.10.77/26 in?

1. /26 → mask 255.255.255.192 → block size 256 - 192 = 64.
2. Networks start at multiples of 64 in the last octet: .0, .64, .128, .192.
3. 77 lies between 64 and 127, so the network is 192.168.10.64/26.
4. Broadcast = next network − 1 = 192.168.10.127.
5. Usable hosts: .65 to .126 (62 addresses).

Splitting a network

To split 10.0.0.0/24 into four equal subnets, borrow 2 bits (4 = 2²), so the new prefix is /26:

To size a subnet: take the number of hosts you need, add 2, and round up to the next power of two. For 50 hosts: 52 → 64 → /26. For 100 hosts: 102 → 128 → /25.

Private and special ranges

Private addresses aren't routed on the internet and need NAT to go out.

Check it with a tool

sudo apt install -y ipcalc
ipcalc 192.168.10.77/26

Or with Python, which is already installed on most systems:

python3 -c "import ipaddress as i; n=i.ip_network('192.168.10.77/26', strict=False); print(n, n.netmask, n.broadcast_address, n.num_addresses-2)"

Mistakes to avoid

• Overlapping subnets. Two networks that overlap (for example a VPN using 192.168.1.0/24 while your home LAN is also 192.168.1.0/24) cause traffic to go to the wrong place. Pick unusual ranges for VPNs, such as 10.8.0.0/24.
• Forgetting the 2 reserved addresses. A /29 has 6 usable hosts, not 8.
• Mixing up mask and wildcard. Cisco ACLs use wildcard masks, which are inverted (0.0.0.255 for a /24).
• Planning too tight. Leave room to grow; renumbering is painful.

IPv6 in one paragraph

IPv6 addresses are 128 bits. The standard subnet for a LAN is a /64, and you don't count hosts, because every /64 holds 2⁶⁴ addresses. Providers usually hand out a /56 or /48 so you can create many /64s.