Subnetting explained: how to split a network by hand

Subnetting has a reputation for being hard, and it is not. It is one idea — borrowing bits — plus one piece of arithmetic you can do in your head once you have seen it three times. What makes it feel hard is that most explanations start with binary conversion tables, which is the slowest possible route to an answer. This is the fast route, and it is the one people actually use in the exam room and on the job.

The only two questions subnetting asks

Every subnetting problem, however it is worded, is asking one of two things. How do I split this block into smaller pieces? Or: given this address, which piece does it belong to? Both are answered by the same number, the block size, and everything below is about finding it quickly.

An IPv4 address is 32 bits. The prefix — the /24 in 192.168.10.0/24 — says how many of those bits identify the network. The rest identify the machine. Split a network and you are taking bits from the host side and giving them to the network side. Every bit you borrow doubles the number of networks and halves the size of each one. That trade is the whole subject.

Why prefixes replaced classes

Older material talks about class A, B and C networks, where the split was fixed by the first octet. That system was abandoned in 1993 because it wasted enormous amounts of address space: an organisation needing 300 addresses had to take a class B block of 65,536. CIDR replaced it with the prefix notation used today, where any split is allowed. If a course still teaches classes, learn them for the exam and then forget them — no modern network is designed that way.

The block-size method

Here is the shortcut. Take the subnet mask octet that is neither 255 nor 0 — the interesting octet — and subtract it from 256. That is your block size, and your subnets start at multiples of it.

Split 192.168.10.0/24 into four. Four subnets needs two borrowed bits, so /24 becomes /26. A /26 mask is 255.255.255.192, and 256 − 192 = 64. So the subnets begin at .0, .64, .128 and .192:

No binary was written down. Each subnet holds 64 addresses, of which 62 are usable, because the first names the network and the last is the broadcast. That subtraction of two catches people out more than anything else in the topic.

To answer the second kind of question — which subnet is 192.168.10.100 in? — count multiples of the block size until you pass it. 64 is below 100, 128 is above, so the address sits in the 192.168.10.64/26 subnet. That is the entire method.

VLSM: when the departments are different sizes

Equal splits waste space when the things you are addressing are not equal. Variable-length subnet masking is the fix: subnet the block, then subnet the leftovers again, largest requirement first. Order matters — go smallest first and you will fragment the space and run out.

Say 192.168.1.0/24 has to serve 100 users, 50 users, 25 users and one router-to-router link:

Each block is the smallest that fits, and each starts where the last one ended. Note the 100-user network needs a /25 rather than a /26: 62 usable addresses is not enough, so you go up to the next size and accept 126. You cannot buy a half-sized block.

The three mistakes that cost marks

Forgetting the minus two. A /27 has 32 addresses and 30 usable. If a question asks for 30 hosts, a /27 is exactly right; if it asks for 32, you need a /26. Read carefully whether the number given is total or usable.

Subnetting the wrong octet. A /20 splits inside the third octet, not the fourth. The interesting octet is wherever the prefix lands: /9–/16 is the second, /17–/24 the third, /25–/30 the fourth. Get this right and the block-size method works everywhere.

Assuming the first and last subnets are unusable. Very old equipment reserved subnet zero and the all-ones subnet. Modern kit does not, and every current exam expects you to count them. If a question was written before about 2005, check its assumptions.

One genuine exception is worth knowing: a /31 has two addresses and, under RFC 3021, both are usable on a point-to-point link — a link with two ends has no need of a broadcast address. It is the only prefix where the minus-two rule does not apply.

Learning it properly

The bit-borrowing idea is much easier to trust once you have watched it happen rather than taken it on faith. Our subnet and CIDR visualiser shows the 32 bits directly: drag the prefix and you can see which bits move from host duty to network duty, and the parent block dividing underneath as they do. Work a few splits by hand with the method above, then check them against the tool — when your arithmetic and the bits agree, the topic is done.