Subnetting and CIDR

Full CIDR table

The prefix length is how many leading bits are network. Everything else follows from it. Usable hosts are total minus 2 for the network and broadcast addresses.

Total addresses = 2^(32 − prefix). Usable = that minus 2, except /31 point-to-point links (both addresses usable) and /32 single-host routes.

The two numbers to memorize

Everything in subnetting comes from the mask octet values and the block size.

Block size = 256 − mask octet. Subnets start at multiples of the block size, so a /26 (block 64) always starts at .0, .64, .128, .192.

Worked example: split 192.168.1.0/24 into /26 subnets

1. Prefix goes 24 → 26, so you borrow 2 host bits, giving 2² = 4 subnets.
2. Mask becomes 255.255.255.192. Interesting octet is the fourth.
3. Block size = 256 − 192 = 64.
4. Networks step by 64. Broadcast is the next network minus 1.

Worked example: which subnet holds 10.20.130.77/19?

1. /19 = 16 network bits + 3 borrowed, interesting octet is the third. 2. Mask = 255.255.224.0, block size = 256 − 224 = 32. 3. Third octet 130 ÷ 32 = 4 remainder 2, so it falls in the block starting at 4 × 32 = 128.

network    10.20.128.0/19
first host 10.20.128.1
last host  10.20.159.254
broadcast  10.20.159.255
next net   10.20.160.0
usable     8190 hosts

The bitwise way, always correct: AND the address with the mask for the network, OR it with the wildcard for the broadcast.

VLSM, sizing subnets to the hosts they hold

Variable Length Subnet Masking allocates different prefix lengths out of one block instead of splitting it evenly. Always allocate largest first, or you fragment the space and cannot fit the big subnets later.

Given 172.16.0.0/22 (1024 addresses) and these needs:

Pick the prefix where usable hosts ≥ requirement: 400 needs 512 total, so /23. Leave gaps on purpose, renumbering later is far more painful.

Supernetting and route summarization

The reverse operation. Contiguous blocks that share leading bits collapse into one shorter prefix, which shrinks routing tables.

192.168.4.0/24  → 11000000.10101000.00000100.00000000
192.168.5.0/24  → 11000000.10101000.00000101.00000000
192.168.6.0/24  → 11000000.10101000.00000110.00000000
192.168.7.0/24  → 11000000.10101000.00000111.00000000
                  ^^^^^^^^^^^^^^^^^^^^^^ 22 bits identical
summary: 192.168.4.0/22

Blocks must be contiguous and the summary must start on a boundary that is a multiple of its own size. 192.168.5.0/22 is invalid, because 5 is not a multiple of 4.

Command-line subnet math

ipcalc 192.168.1.0/26              # network, broadcast, host range
ipcalc -b 10.20.130.77/19
sipcalc 172.16.0.0/22              # deb: sipcalc, includes splitting
python3 -c 'import ipaddress as i; \
  n=i.ip_network("192.168.1.0/24"); \
  print([str(s) for s in n.subnets(new_prefix=26)])'
python3 -c 'import ipaddress as i; \
  print(i.ip_address("10.20.130.77") in i.ip_network("10.20.128.0/19"))'
nmap -sn 192.168.1.0/24            # who answers in the range