Subnetting

The previous lesson showed that the 192.168.10.0/24 block is numerically sufficient for the organization’s 182 hosts, but that the sections cannot be gathered into a single broadcast domain. The block has to be cut.

The cutting operation is called subnetting, and it rests on a single mechanism: borrowing bits from the host portion and adding them to the network portion. This lesson’s question is the arithmetic of that borrowing.

The Netmask

A netmask is a 32-bit pattern showing which bits of an address belong to the network portion: network bits are 1, host bits are 0. In a mask, the 1s are always on the left and unbroken; a pattern like 255.255.0.255 is not a valid mask.

The prefix length and the mask carry the same information in two separate forms:

Prefix	Mask	Host bits	Addresses per block
/24	255.255.255.0	8	256
/25	255.255.255.128	7	128
/26	255.255.255.192	6	64
/27	255.255.255.224	5	32
/28	255.255.255.240	4	16
/29	255.255.255.248	3	8
/30	255.255.255.252	2	4

The last column is computed with $2^{32 - \text{prefix}}$. When the prefix grows by one bit, the block halves — this binary relationship makes computing each case individually unnecessary when planning.

Network and Broadcast Addresses

The network an address belongs to is found by putting the address and the mask through a bitwise AND operation. This is a direct application of the masking pattern introduced in the Bit-Level Operations lesson of the How Computers Work course: bits where the mask is 0 are cleared, bits where it is 1 are kept.

The broadcast address is found by setting all the host bits to 1. This uses the wildcard mask, the inverse of the netmask, put through an OR operation.

$$\text{network} = \text{address} \mathbin{\&} \text{mask}, \qquad \text{broadcast} = \text{network} \mathbin{|} \lnot\text{mask}$$

For address 192.168.10.196 and mask 255.255.255.192:

import ipaddress

address = ipaddress.ip_address("192.168.10.196")
mask = ipaddress.ip_address("255.255.255.192")
network = ipaddress.ip_address(int(address) & int(mask))
wildcard = ipaddress.ip_address(int(mask) ^ 0xFFFFFFFF)
broadcast = ipaddress.ip_address(int(network) | int(wildcard))

print("address   :", format(int(address), "032b"), address)
print("mask      :", format(int(mask), "032b"), mask)
print("network   :", format(int(network), "032b"), network)
print("wildcard  :", format(int(wildcard), "032b"), wildcard)
print("broadcast :", format(int(broadcast), "032b"), broadcast)

address   : 11000000101010000000101011000100 192.168.10.196
mask      : 11111111111111111111111111000000 255.255.255.192
network   : 11000000101010000000101011000000 192.168.10.192
wildcard  : 00000000000000000000000000111111 0.0.0.63
broadcast : 11000000101010000000101011111111 192.168.10.255

Except for the last two bits, the network portion is preserved: the 11000100 byte’s upper six bits are 110001, and its host bits are 00. The network address is 192.168.10.192, the broadcast address is 192.168.10.255, and the 62 addresses in between are usable host addresses.

The Number of Usable Hosts

Every network has two addresses reserved: the address with all host bits 0 denotes the network itself, the one with all host bits 1 denotes the broadcast address. Neither can be assigned to an interface. The number of usable hosts:

$$N = 2^{32 - p} - 2$$

Prefix	Total addresses	Usable hosts
/24	256	254
/25	128	126
/26	64	62
/27	32	30
/28	16	14
/29	8	6
/30	4	2

On point-to-point links, the /31 prefix can also be used: since a link where two devices connect directly has no need for a broadcast address, both addresses can be assigned. This course uses the more common /30 choice in its example plan.

The reverse calculation is the one used when planning: the prefix length needed for $N$ hosts is the largest $p$ that satisfies the inequality $2^{32-p} - 2 \ge N$.

Hosts needed	Smallest sufficient block	Usable	Wasted
2	/30	2	0
10	/28	14	4
20	/27	30	10
50	/26	62	12
100	/25	126	26

Borrowing Bits

Splitting a block means borrowing bits from the host portion and adding them to the network portion. Every bit borrowed doubles the number of subnets and halves the block size:

Bits borrowed	New prefix	Number of subnets	Hosts per subnet
0	/24	1	254
1	/25	2	126
2	/26	4	62
3	/27	8	30
4	/28	16	14

The number of subnets is $2^k$, hosts per subnet is $2^{8-k} - 2$; their product never reaches 254, because every subnet spends its own network and broadcast address. Splitting trades address loss for separation.

Subnets’ starting addresses are multiples of the block size. In a /26 split, the block size is 64, so the starting points are 0, 64, 128, 192. This increment is called the block size (increment) and is read from the mask’s last byte that is not zero: for mask 255.255.255.192, $256 - 192 = 64$.

Splitting the Example Block in Four

The organization has four sections and one point-to-point link. The first attempt is to split the block into four equal parts.

import ipaddress

block = ipaddress.ip_network("192.168.10.0/24")
for subnet in block.subnets(new_prefix=26):
    hosts = list(subnet.hosts())
    print(f"{str(subnet):18s} mask={subnet.netmask:15s} network={str(subnet.network_address):15s} "
          f"first={str(hosts[0]):15s} last={str(hosts[-1]):15s} "
          f"broadcast={str(subnet.broadcast_address):15s} n={len(hosts)}")

192.168.10.0/26    mask=255.255.255.192 network=192.168.10.0    first=192.168.10.1    last=192.168.10.62   broadcast=192.168.10.63   n=62
192.168.10.64/26   mask=255.255.255.192 network=192.168.10.64   first=192.168.10.65   last=192.168.10.126  broadcast=192.168.10.127  n=62
192.168.10.128/26  mask=255.255.255.192 network=192.168.10.128  first=192.168.10.129  last=192.168.10.190  broadcast=192.168.10.191  n=62
192.168.10.192/26  mask=255.255.255.192 network=192.168.10.192  first=192.168.10.193  last=192.168.10.254  broadcast=192.168.10.255  n=62

This table is a check on the hand calculation. The same result can be derived on paper: block increment 64, starting points 0/64/128/192, every block’s broadcast address is one less than the next starting point.

The plan compares against the requirements as follows:

Section	Hosts needed	Block assigned	Usable	Result
Guest wireless	100	192.168.10.0/26	62	Insufficient
Lab	50	192.168.10.64/26	62	Sufficient, 12 spare
Administration	20	192.168.10.128/26	62	Sufficient, 42 spare
Server room	10	192.168.10.192/26	62	Sufficient, 52 spare
Point-to-point link	2	—	—	No block left

The plan fails at two points. The guest network needs 100 hosts, gets 62 addresses. No block is left to give the point-to-point link. Meanwhile, 52 addresses sit unused in the server room network.

The Inherent Flaw of Equal Splitting

The reason for the failure is not a calculation error but the method itself. In equal splitting, every subnet has to be sized for the largest requirement. If the largest section needs 100 hosts, every subnet must be at least /25; and only two /25 blocks fit inside a /24.

The total addresses needed under equal splitting is $5 \times 128 = 640$. There are 256 addresses on hand. Yet the sections’ real total requirement is 182. The gap comes entirely from the method.

The source of the problem is a single assumption: that every subnet must carry the same mask. This assumption disappeared with CIDR, and once it is removed, the plan fits.

Which Subnet an Address Falls Into

After a subnet plan is set up, a frequently asked question is which subnet a given address belongs to. The answer is found by ANDing the address with each mask in the plan and comparing the result against the network address.

The same address falls into different networks with different masks:

Address	Mask	Network address	Broadcast address
192.168.10.196	/24	192.168.10.0	192.168.10.255
192.168.10.196	/25	192.168.10.128	192.168.10.255
192.168.10.196	/26	192.168.10.192	192.168.10.255
192.168.10.196	/27	192.168.10.192	192.168.10.223
192.168.10.196	/28	192.168.10.192	192.168.10.207

The table is the numeric counterpart of the observation made in the previous lesson: an address alone is incomplete information. If a client’s mask is misconfigured, it mistakes local destinations for remote ones, or remote destinations for local ones. In the first case it sends traffic to the gateway needlessly; in the second it broadcasts an ARP request for an address it can never reach and gets no reply.

Summary

• A netmask is a 32-bit pattern marking an address’s network bits with 1; the 1s are on the left and unbroken.
• The network address is found by ANDing the address with the mask, the broadcast address by ORing the network with the wildcard mask.
• Every subnet has two addresses reserved; the number of usable hosts is $2^{32-p} - 2$.
• Every bit borrowed doubles the number of subnets and halves the subnet size; the block increment is the difference between 256 and the mask’s last significant byte.
• Splitting the 192.168.10.0/24 block into four equal /26 parts does not cover the guest network and leaves no room for the link network; equal splitting needs 640 addresses in total.
• The flaw of equal splitting is that every subnet has to be sized for the largest requirement.

Next Step

Every subnet carrying the same mask is not a requirement. If each section is given a mask sized to its own requirement, the same 192.168.10.0/24 block covers all five networks and still leaves addresses to spare. The next lesson builds this plan step by step, computes each section’s network and broadcast addresses, and tests that the plan is free of overlap.