Subnetting and CIDR

A subnet is a contiguous block of IP addresses that share a common prefix. CIDR notation — the /24 after an address — says exactly how long that prefix is: /24 means the first 24 bits are the network and the remaining 8 are the host part. Everything you do with addresses, from sizing a VPC to writing a firewall rule to reading a routing table, reduces to splitting a block at the right bit boundary and counting what's left.

This is the one networking skill you will use by hand, on a whiteboard, for the rest of your career. The math is small — it is all powers of two — but the consequences of getting it wrong are large and sometimes permanent. Size a subnet too tight and you renumber under pressure later; overlap two blocks you later want to connect and the connection simply refuses to come up. The rest of this page is the math, worked end to end.

/16

10.0.0.0/16 — 65,534 hosts

/24

10.0.5.0/24 — 254 hosts

/27

10.0.5.32/27 — 30 hosts

Network Bits versus Host Bits

An IPv4 address is 32 bits. A subnet mask splits those 32 bits into a network part (the high bits, all ones) and a host part (the low bits, all zeros). The prefix length /n is just the count of leading one-bits: /24 is a mask of 255.255.255.0, because 24 ones followed by 8 zeros, grouped into octets, is 11111111.11111111.11111111.00000000.

Two addresses are on the same subnet if their network bits are identical. A host computes this on every single packet: it ANDs the destination address with its own mask and compares to its own network. Match, and the destination is on-link — send the frame directly. No match, and it is off-link — send the frame to the default gateway. That one bitwise comparison is the basis of every forwarding decision a host makes.

# ip addr shows the prefix length right on the address
ip -br addr show eth0
# eth0  UP  10.0.5.37/24
# /24 mask = 255.255.255.0
# network = 10.0.5.0   host part = .37
# 10.0.5.37 and 10.0.5.200 share 10.0.5.0 -> same subnet, direct send
# 10.0.5.37 and 10.0.6.4   differ in bit 24  -> off-link, via gateway

CIDR Notation and Block Sizes

The host part determines the block size, and it is pure powers of two. With h host bits a block holds 2^h addresses. A /24 leaves 8 host bits, so 2^8 = 256 addresses. A /16 leaves 16 host bits, 2^16 = 65 536 addresses. A /8 leaves 24 host bits, 2^24 = 16 777 216 addresses. Every step of one in the prefix halves or doubles the block: a /25 is exactly half a /24, 128 addresses.

The shortcut worth memorizing: the block size of any prefix is 2^(32 − n). A /27 has 32 − 27 = 5 host bits, so 2^5 = 32 addresses. The block also tells you the address boundaries — a /27 starts only on multiples of 32 in the last octet (.0, .32, .64, .96 …), which is why 10.0.0.40/27 actually belongs to the block starting at 10.0.0.32.

Prefix	Mask	Host bits	Addresses	Usable hosts
/30	255.255.255.252	2	4	2
/29	255.255.255.248	3	8	6
/27	255.255.255.224	5	32	30
/24	255.255.255.0	8	256	254
/16	255.255.0.0	16	65 536	65 534
/8	255.0.0.0	24	16 777 216	16 777 214

Network, Broadcast, and Usable Addresses

Two addresses in every block are not assignable to a host. The first — all host bits zero — is the network address, the name of the subnet itself. The last — all host bits one — is the broadcast address, which reaches every host on the segment at once. Usable host addresses are everything between, so a block of 2^h addresses gives 2^h − 2 usable hosts. This is the off-by-one that bites everyone: a /24 is 256 addresses but only 254 hosts.

Work a /27 end to end. Take 10.0.0.40/27. Host bits = 32 − 27 = 5, so the block is 2^5 = 32 addresses and aligns to multiples of 32. The 40 falls in the .32–.63 block. Network address is 10.0.0.32, broadcast is 10.0.0.63, and the usable range is 10.0.0.33 through 10.0.0.62 — 30 hosts, exactly 2^5 − 2.

# let the tool confirm the hand math for 10.0.0.40/27
ipcalc 10.0.0.40/27
# Network:    10.0.0.32/27
# HostMin:    10.0.0.33
# HostMax:    10.0.0.62
# Broadcast:  10.0.0.63
# Hosts/Net:  30

The exception is a /31. On point-to-point links — a single cable between two routers — there are only two addresses and no need for a broadcast, so /31 is defined to give both addresses to the two ends. A /32 is a single host route, one address, used for loopbacks and individual firewall entries.

Subdividing and Supernetting

Splitting works by borrowing host bits for the network part. Take a 10.1.0.0/16 and you want per-team /24s: each added prefix bit doubles the number of subnets, and going from /16 to /24 borrows 8 bits, yielding 2^8 = 256 subnets of 254 hosts each — 10.1.0.0/24, 10.1.1.0/24, on up to 10.1.255.0/24. This is variable-length subnet masking: you can carve different-sized blocks out of the same parent as long as none overlap.

Supernetting is the reverse — aggregating contiguous blocks into one shorter prefix to shrink a routing table. Four adjacent /24s that align on a 4-block boundary (10.1.0.0/24 through 10.1.3.0/24) summarize to a single 10.1.0.0/22, advertised as one route instead of four. Route aggregation is what keeps the internet's backbone tables from exploding — a provider announces one supernet, not the thousands of customer subnets inside it.