Subnetting explained with simple examples (and the one calculation that makes it click)
Someone asks you to carve 192.168.1.0/24 into four networks. You stare at the slash, the mask, the binary, and something quietly shuts down in your brain.
I know that feeling. I put off learning subnetting for two years because every tutorial started with binary conversion tables and lost me by paragraph three. Then I had to design an addressing plan for a small office with eight separate teams, and I couldn't dodge it anymore. What finally unlocked it wasn't a chart. It was one question: how many bits do I need to borrow, and what does that do to my host range?
That's what this article covers. Real numbers, no hand-waving, and the exact mistakes I made so you don't repeat them.
Key Takeaways
- Subnetting splits one IP network into smaller logical networks so traffic stays local and addresses get used efficiently.
- The subnet mask tells you which bits identify the network and which identify the host.
- Borrowing n bits gives you 2^n subnets. Each subnet loses 2 usable host addresses (network and broadcast).
- CIDR notation (/24, /26, /27) and the dotted-decimal mask are two ways of writing the same thing.
- Most beginner errors come from borrowing too few bits, miscalculating the block size, or forgetting the broadcast address.
- You can verify every hand calculation in seconds with a subnet calculator — the point is to know what the answer should look like before you check.
What is subnetting with example? A single network, cut into four
Subnetting is the act of taking one IP network and dividing it into smaller networks that still route to each other. Nothing more mystical than that.
Let's use 192.168.1.0/24. The /24 means the first 24 bits are the network portion. In dotted decimal that's the mask 255.255.255.0. You have 8 bits left for hosts, which gives 2^8 = 256 addresses. Subtract the network address and the broadcast address, and you get 254 usable hosts.
Now say you want four subnets. Four is 2^2, so you borrow 2 bits.
The borrowing calculation, step by step
- New prefix length: 24 + 2 = /26.
- New mask in dotted decimal: 255.255.255.192. (The last octet is 11000000 in binary: 128 + 64 = 192.)
- Block size: 256 − 192 = 64. That's the gap between one subnet's network address and the next.
- Hosts per subnet: 2^6 − 2 = 62 usable addresses.
Here's the result, and notice how the block size of 64 does all the work:
| Subnet | Network address | Usable host range | Broadcast |
|---|---|---|---|
| 1 | 192.168.1.0/26 | .1 – .62 | .63 |
| 2 | 192.168.1.64/26 | .65 – .126 | .127 |
| 3 | 192.168.1.128/26 | .129 – .190 | .191 |
| 4 | 192.168.1.192/26 | .193 – .254 | .255 |
That table is the whole discipline in miniature. Once you can produce it by hand, you can subnet anything.
One detail that trips people up: the broadcast address of each subnet sits one below the next subnet's network address. .63 belongs to subnet 1, .64 belongs to subnet 2. Miss that and you'll hand out an address that doesn't work.
IP address and subnetting explained: why the mask is the real star
Most beginners fixate on the IP address. The mask is what actually decides where a packet goes.
An IP address is just 32 bits. The mask overlays those bits and says: this part is the neighborhood, that part is the house number. Two devices in the same subnet can talk directly, without a router. Two devices in different subnets must go through a gateway. That's the practical consequence, and it's the reason subnetting exists at all — broadcast traffic stays inside its own little neighborhood instead of flooding a 254-host network.
CIDR notation vs dotted decimal — same thing, different clothes
You'll see both written everywhere. They are not competing systems.
- /25 = 255.255.255.128 → 126 usable hosts
- /26 = 255.255.255.192 → 62 usable hosts
- /27 = 255.255.255.224 → 30 usable hosts
- /30 = 255.255.255.252 → 2 usable hosts, the classic point-to-point link
- /31 = 255.255.255.254 → 2 addresses, no network or broadcast reserved on modern gear
I keep that short list in a text file on my desktop. Not elegant, but I've used it hundreds of times.
The /30 case is worth pausing on. Two usable addresses sounds useless until you realize a link between two routers only needs exactly that. Every /30 you use for a WAN link instead of a /24 saves you 252 addresses. Do that across a dozen links and you've preserved a full subnet's worth of space.
Subnetting practice questions (with answers)
Reading doesn't teach this. Doing it does. Try these before scrolling to the answers.
Question 1
Split 10.0.0.0/24 into 8 subnets. What's the new mask, and what's the third subnet's usable range?
Show answer
8 subnets = 2^3, so borrow 3 bits. New prefix: /27, mask 255.255.255.224. Block size is 32. Third subnet is 10.0.0.64/27, usable range 10.0.0.65 – 10.0.0.94, broadcast 10.0.0.95.
Question 2
You need 50 hosts on a subnet. What's the smallest mask that fits, and how many addresses do you waste?
Show answer
2^6 − 2 = 62, which covers 50. So you need 6 host bits: /26, mask 255.255.255.192. You waste 12 addresses (62 − 50). A /27 gives only 30 usable, which is not enough.
Question 3 — the trap
Is 192.168.1.63 a valid host address on the /26 network 192.168.1.0/26?
Show answer
No. .63 is the broadcast address for that subnet. Valid hosts run from .1 to .62. This is the single most common mistake I see, and I made it myself when I first set up DHCP scopes.
The mistakes that actually cost me time
I once assigned a /27 to a team of 40 people because I eyeballed "30 hosts should be plenty" without doing the math. It wasn't plenty. I spent a Saturday morning re-addressing twelve machines.
Three errors worth naming:
- Borrowing too few bits. Always count the hosts you need first, then work backward to the mask. Not the other way around.
- Forgetting that the network and broadcast addresses are reserved. A "128-host" subnet only ever gives you 126.
- Overlapping ranges. If subnet 1 ends at .63 and subnet 2 starts at .63, you've created a conflict that will only surface when someone plugs in a device at exactly the wrong moment.
Subnet calculators catch all three in a fraction of a second, and I use one constantly for verification. But here's my honest opinion: reaching for the calculator before you understand the block size is like using a GPS before you can read a street sign. You'll get the answer and learn nothing. Do it by hand first, then check.
Where subnetting actually pays off
In office networks, the payoff is concrete: separating voice, guest Wi-Fi, and internal servers into different subnets means a misbehaving guest device can't flood your server traffic with broadcasts. In cloud environments, the same logic applies to VPC design — you plan address ranges up front precisely because changing them later is painful.
The last piece of advice I'd give: pick one private range and one prefix length, and practice until the table above takes you under two minutes to write out. That's the whole skill. Once that's automatic, every real-world addressing plan becomes a variation on the same theme — and you'll stop dreading the slash.
