Subnetting

What a subnet is

A subnet (short for subnetwork) is a smaller network carved out of a larger block of IP addresses. All devices in one subnet can reach each other directly. To reach a device in a different subnet, traffic has to go through a router.

Subnetting is the practice of dividing an address range into subnets of the size you need. It is used in every office network, every data centre and every cloud account.

Why split a network

• Less broadcast traffic. Some messages are sent to every device on a network. These are called broadcasts. In a smaller subnet, fewer devices receive them.
• Better security. You can place guest WiFi, security cameras and the finance team in separate subnets, then control exactly what is allowed to pass between them.
• Easier management. One subnet per floor, department or purpose is simple to document and to troubleshoot.

The subnet mask

Every IPv4 address has two parts: a network part that says which network the device is on, and a host part that says which device it is inside that network. The subnet mask marks where one part ends and the other begins.

IP address:   192.168.1.100
Subnet mask:  255.255.255.0

Where the mask has 255, that part of the address belongs to the network. Where it has 0, that part belongs to the host. With 255.255.255.0:

• network part: 192.168.1
• host part: 100

Every device whose address starts with 192.168.1 is on the same network.

CIDR notation

Writing out a long mask is slow, so we count the number of network bits and write that after a slash. This is CIDR notation (Classless Inter-Domain Routing), and the number after the slash is called the prefix length.

/8   =  255.0.0.0
/16  =  255.255.0.0
/24  =  255.255.255.0
/25  =  255.255.255.128
/30  =  255.255.255.252

So 192.168.1.100/24 means that the first 24 bits are the network part and the last 8 bits identify the device.

Reading the mask in binary

A subnet mask is a row of ones followed by a row of zeros. The ones mark the network part and the zeros mark the host part.

/24  11111111.11111111.11111111.00000000  = 255.255.255.0
/25  11111111.11111111.11111111.10000000  = 255.255.255.128
/26  11111111.11111111.11111111.11000000  = 255.255.255.192
/30  11111111.11111111.11111111.11111100  = 255.255.255.252

A /26 has 26 ones, which is two more than a /24. Those two extra bits are "borrowed" from the host part, and they are what lets you cut one network into several smaller ones.

It also explains why the number in a mask is always one of 0, 128, 192, 224, 240, 248, 252, 254 or 255. A row of ones followed by zeros can only add up to those values.

How many devices fit

To count the devices a subnet can hold: take the host bits (32 minus the prefix), raise 2 to that power, then subtract 2.

• /24: 8 host bits, 2⁸ = 256, minus 2 = 254 usable hosts
• /25: 7 host bits, 2⁷ = 128, minus 2 = 126 usable hosts
• /30: 2 host bits, 2² = 4, minus 2 = 2 usable hosts, which is exactly what a link between two routers needs

Why subtract 2

Two addresses in every subnet are reserved and cannot be given to a device:

• The first address is the network address. It names the subnet itself.
• The last address is the broadcast address. A packet sent to it reaches every device in the subnet.

Network:     192.168.1.0/24
First host:  192.168.1.1
Last host:   192.168.1.254
Broadcast:   192.168.1.255

Worked example: four subnets with /26

Say you own 192.168.1.0/24 and want four equal subnets, one per department.

A /26 borrows 2 bits from the host part, and 2 bits give 4 subnets. The host bits left are 32 minus 26, which is 6. Then 2⁶ = 64 addresses per subnet, of which 62 are usable.

Subnet            Usable hosts                  Broadcast
192.168.1.0/26    192.168.1.1   to .62          192.168.1.63
192.168.1.64/26   192.168.1.65  to .126         192.168.1.127
192.168.1.128/26  192.168.1.129 to .190         192.168.1.191
192.168.1.192/26  192.168.1.193 to .254         192.168.1.255

The subnets start every 64 addresses: 0, 64, 128 and 192. The block size is always 256 minus the last number of the mask. For 255.255.255.192 that is 256 - 192 = 64. This shortcut lets you subnet quickly without writing any binary.

Are two devices on the same subnet

Before a device sends anything, it compares the destination address with its own network.

PC A: 192.168.1.10/24
PC B: 192.168.1.77/24   same network (192.168.1), send directly
PC C: 192.168.2.10/24   different network (192.168.2), send to the gateway

If the destination is in the same subnet, the device delivers the packet directly, using ARP to find the MAC address. If it is not, the device hands the packet to its default gateway and the router takes over.

This explains a common mistake. If you give a PC the wrong mask, or an address from a different subnet, it can look healthy and still be unable to reach its neighbours.

Choosing a subnet size

Pick the smallest subnet that fits your devices, with some room to grow:

• 2 devices (a link between two routers): /30 gives 2 usable hosts
• Up to 14 devices: /28 gives 14
• Up to 62 devices: /26 gives 62
• Up to 254 devices: /24 gives 254

Suppose an office floor has 50 computers, a few printers and a team that is still growing. A /26 has 62 usable addresses, which leaves very little spare room. A /25 (126 hosts) or a /24 is the safer choice, because renumbering a network later is much more work than reserving extra addresses now.

Try it yourself

Take 10.0.0.0/16 and work out how many hosts it holds.

1. The prefix is 16, so there are 32 - 16 = 16 host bits.
2. 2¹⁶ = 65,536 addresses.
3. Subtract the network and broadcast addresses: 65,536 - 2 = 65,534 usable hosts.

That is far more devices than one department needs, which is why large organisations divide a /16 into smaller subnets, often one /24 per department or site.