Subnetting is one of those skills that feels impossible until it suddenly clicks, and then you can’t understand why it ever felt hard. I’ve spent enough years explaining CIDR notation on whiteboards and debugging “why can’t these two devices see each other” tickets that I finally put everything into one reference — the tables I actually use, the commands I actually run, and the mental math shortcuts that make subnetting fast instead of painful.
This is built for quick scanning. Whether you’re studying for a certification, configuring a router at 2am, or just trying to remember what a /27 gives you, everything you need is below.
Table of Contents
- IPv4 Address Structure Basics
- IPv4 Address Classes (Legacy Reference)
- CIDR Notation and Subnet Mask Reference Table
- Binary-to-Decimal Conversion Reference
- Subnetting Step-by-Step Method
- VLSM (Variable Length Subnet Masking) Explained
- Private, Public, and Reserved Address Ranges
- Special and Reserved IPv4 Addresses
- Essential IP Configuration Commands by Platform
- Network Troubleshooting Commands
- IPv4 Troubleshooting Playbook
- Security Best Practices for IPv4 Networks
- Real-World Subnetting Workflows
- Common Subnetting Mistakes to Avoid
- FAQs
- Interview Questions and Answers
- Printable Quick-Reference Summary
- Official Documentation Links
1. IPv4 Address Structure Basics
An IPv4 address is a 32-bit number, written as four 8-bit octets separated by dots — what’s called dotted-decimal notation.
192 . 168 . 1 . 10
11000000.10101000.00000001.00001010
Each octet ranges from 0 to 255 (since 8 bits gives you 2^8 = 256 possible values). The address is split conceptually into a network portion and a host portion, and where that split happens is exactly what subnetting controls.
2. IPv4 Address Classes (Legacy Reference)
Classful addressing is mostly obsolete now that CIDR is standard, but it still shows up in exams, legacy documentation, and default subnet mask assumptions — so it’s worth keeping straight.
| Class | Leading Bits | First Octet Range | Default Mask | Default CIDR | Typical Use |
|---|---|---|---|---|---|
| A | 0 | 1 – 126 | 255.0.0.0 | /8 | Very large networks |
| B | 10 | 128 – 191 | 255.255.0.0 | /16 | Medium-large networks |
| C | 110 | 192 – 223 | 255.255.255.0 | /24 | Small networks |
| D | 1110 | 224 – 239 | N/A | N/A | Multicast |
| E | 1111 | 240 – 255 | N/A | N/A | Experimental/reserved |
Note that 127.x.x.x is technically inside the Class A range but is reserved entirely for loopback, so it’s excluded from usable Class A assignments.
3. CIDR Notation and Subnet Mask Reference Table
This is the table worth memorizing, or at minimum bookmarking. It covers every practical prefix length.
| CIDR | Subnet Mask | Wildcard Mask | Total Addresses | Usable Hosts |
|---|---|---|---|---|
| /24 | 255.255.255.0 | 0.0.0.255 | 256 | 254 |
| /25 | 255.255.255.128 | 0.0.0.127 | 128 | 126 |
| /26 | 255.255.255.192 | 0.0.0.63 | 64 | 62 |
| /27 | 255.255.255.224 | 0.0.0.31 | 32 | 30 |
| /28 | 255.255.255.240 | 0.0.0.15 | 16 | 14 |
| /29 | 255.255.255.248 | 0.0.0.7 | 8 | 6 |
| /30 | 255.255.255.252 | 0.0.0.3 | 4 | 2 |
| /31 | 255.255.255.254 | 0.0.0.1 | 2 | 2 (point-to-point, RFC 3021) |
| /32 | 255.255.255.255 | 0.0.0.0 | 1 | 1 (host route) |
| /23 | 255.255.254.0 | 0.0.1.255 | 512 | 510 |
| /22 | 255.255.252.0 | 0.0.3.255 | 1024 | 1022 |
| /21 | 255.255.248.0 | 0.0.7.255 | 2048 | 2046 |
| /20 | 255.255.240.0 | 0.0.15.255 | 4096 | 4094 |
| /16 | 255.255.0.0 | 0.0.255.255 | 65536 | 65534 |
| /8 | 255.0.0.0 | 0.255.255.255 | 16777216 | 16777214 |
Usable hosts is always total addresses minus 2 (network address and broadcast address reserved) — except at /31 and /32, which have special-case rules for point-to-point links and host routes.
4. Binary-to-Decimal Conversion Reference
Subnetting fundamentally comes down to binary math, so having the octet bit values memorized speeds everything up:
| Bit Position | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 |
|---|---|---|---|---|---|---|---|---|
| Value | 128 | 64 | 32 | 16 | 8 | 4 | 2 | 1 |
Any subnet mask octet is just a sum of these values from left to right, with no gaps:
128 = 10000000 -> /1 in that octet
128+64 = 11000000 -> /2
128+64+32 = 11100000 -> /3
128+64+32+16 = 11110000 -> /4
... and so on up to /8 = 11111111 = 255
That’s why valid subnet mask octets are only ever: 0, 128, 192, 224, 240, 248, 252, 254, 255 — nothing else is possible in a contiguous mask.
5. Subnetting Step-by-Step Method
Here’s the method I actually use when subnetting on the fly, using an example: Subnet 192.168.10.0/24 into blocks of at least 30 usable hosts each.
- Find the required host bits. 30 usable hosts needs 2^n – 2 ≥ 30, so n = 5 (2^5 – 2 = 30). That means 5 host bits, leaving 3 bits borrowed from the network portion.
- Determine the new prefix. /24 + 3 borrowed bits = /27.
- Find the block size (increment). With 5 host bits remaining, block size = 2^5 = 32.
- List the subnets by counting up in that increment from the original network address:
| Subnet | Network Address | Usable Range | Broadcast Address |
|---|---|---|---|
| 1 | 192.168.10.0 | .1 – .30 | 192.168.10.31 |
| 2 | 192.168.10.32 | .33 – .62 | 192.168.10.63 |
| 3 | 192.168.10.64 | .65 – .94 | 192.168.10.95 |
| 4 | 192.168.10.96 | .97 – .126 | 192.168.10.127 |
| 5 | 192.168.10.128 | .129 – .158 | 192.168.10.159 |
| 6 | 192.168.10.160 | .161 – .190 | 192.168.10.191 |
| 7 | 192.168.10.192 | .193 – .222 | 192.168.10.223 |
| 8 | 192.168.10.224 | .225 – .254 | 192.168.10.255 |
That single /24 becomes eight usable /27 subnets, each supporting 30 hosts.
6. VLSM (Variable Length Subnet Masking) Explained
VLSM lets you subnet a network into unequal-sized blocks, matching each subnet to its actual host requirement instead of wasting addresses on a uniform size. This is standard practice in any real-world network design.
Example scenario: You have 192.168.20.0/24 and need to support:
- Sales department: 60 hosts
- Engineering department: 28 hosts
- Point-to-point router link: 2 hosts
Work from largest requirement to smallest:
| Segment | Hosts Needed | Prefix Used | Network | Usable Range | Broadcast |
|---|---|---|---|---|---|
| Sales | 60 | /26 (62 usable) | 192.168.20.0/26 | .1 – .62 | 192.168.20.63 |
| Engineering | 28 | /27 (30 usable) | 192.168.20.64/27 | .65 – .94 | 192.168.20.95 |
| Router link | 2 | /30 (2 usable) | 192.168.20.96/30 | .97 – .98 | 192.168.20.99 |
This is the efficient, professional way to allocate address space — always sort requirements largest to smallest before assigning, so you don’t fragment your available block prematurely.
7. Private, Public, and Reserved Address Ranges
| Range | CIDR | Type | Notes |
|---|---|---|---|
| 10.0.0.0 – 10.255.255.255 | 10.0.0.0/8 | Private | Common in large enterprise networks |
| 172.16.0.0 – 172.31.255.255 | 172.16.0.0/12 | Private | Common in mid-size networks, Docker defaults |
| 192.168.0.0 – 192.168.255.255 | 192.168.0.0/16 | Private | Most common in home/small office routers |
| 100.64.0.0 – 100.127.255.255 | 100.64.0.0/10 | Shared/CGNAT | Used by ISPs for carrier-grade NAT |
| All other unicast ranges | — | Public | Globally routable on the internet |
These private ranges are defined in RFC 1918 and are never routed on the public internet — devices using them reach the internet through NAT.
8. Special and Reserved IPv4 Addresses
| Address / Range | Purpose |
|---|---|
| 127.0.0.0/8 | Loopback (localhost) |
| 169.254.0.0/16 | APIPA — auto-assigned when DHCP fails |
| 0.0.0.0 | “This network” / default route in routing tables |
| 255.255.255.255 | Limited broadcast |
| 224.0.0.0/4 | Multicast range |
| 192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24 | TEST-NET ranges reserved for documentation/examples |
| 198.18.0.0/15 | Reserved for network benchmarking |
I use the TEST-NET ranges constantly when writing documentation or examples specifically so I don’t accidentally reference a real, live IP address.
9. Essential IP Configuration Commands by Platform
| Task | Windows | Linux | macOS |
|---|---|---|---|
| Show IP configuration | ipconfig /all | ip addr show or ifconfig | ifconfig or ipconfig getifaddr en0 |
| Release DHCP lease | ipconfig /release | sudo dhclient -r | sudo ipconfig set en0 DHCP |
| Renew DHCP lease | ipconfig /renew | sudo dhclient | sudo ipconfig set en0 DHCP |
| Set static IP | via Network Settings / netsh | sudo ip addr add 192.168.1.50/24 dev eth0 | via System Settings / networksetup |
| Show routing table | route print | ip route or route -n | netstat -rn |
| Add a static route | route add | sudo ip route add | sudo route add |
| Flush DNS cache | ipconfig /flushdns | sudo systemd-resolve --flush-caches | sudo dscacheutil -flushcache |
| Show ARP table | arp -a | ip neigh or arp -a | arp -a |
10. Network Troubleshooting Commands
| Task | Command | What It Tells You |
|---|---|---|
| Test reachability | ping <ip> | Basic connectivity and latency |
| Trace the path | tracert <ip> (Windows) / traceroute <ip> (Linux/macOS) | Every hop between you and the destination |
| Check open connections | netstat -an | Active connections and listening ports |
| Modern netstat replacement | ss -tulnp (Linux) | Faster, more detailed socket info |
| Check a specific port | telnet <ip> <port> or nc -zv <ip> <port> | Whether a port is open/reachable |
| Continuous ping stats | ping -t (Windows) / ping (Linux, runs continuously by default) | Ongoing packet loss/latency monitoring |
| Path MTU discovery | ping -f -l <size> (Windows) / ping -M do -s <size> (Linux) | Finding the maximum packet size that isn’t fragmented |
11. IPv4 Troubleshooting Playbook
When a device can’t reach something, I work outward in layers rather than guessing:
- Check local IP configuration. Confirm the device actually has a valid IP, correct subnet mask, and default gateway — not a 169.254.x.x APIPA address, which signals a failed DHCP request.
ipconfig /all (or) ip addr show - Ping the default gateway. If this fails, the problem is local — cabling, switch port, Wi-Fi association, or VLAN misconfiguration.
- Ping a known external IP (like 1.1.1.1). If the gateway works but this doesn’t, it’s a routing or ISP-side issue.
- Ping a domain name. If the IP ping works but the domain doesn’t, that isolates the issue to DNS rather than connectivity.
- Check the subnet math. A device with an IP correctly assigned but the wrong subnet mask will “see” other devices as being on a different network than they actually are, causing intermittent or one-directional connectivity issues.
- Trace the route to see exactly where packets stop or start showing high latency.
- Check for IP conflicts. Two devices with the same static IP on one network cause sporadic, hard-to-reproduce connectivity issues — the ARP table (
arp -a) can reveal duplicate entries. - Verify firewall/ACL rules aren’t silently dropping traffic on a specific port, especially after a recent change.
12. Security Best Practices for IPv4 Networks
- Segment networks with VLANs and subnets so a compromised device on one segment can’t freely reach sensitive systems on another.
- Use NAT and private addressing for internal devices so they’re never directly exposed to the public internet.
- Apply the principle of least privilege in ACLs — default deny, then explicitly allow only what’s needed, rather than default allow with exceptions.
- Avoid overly broad subnet allocations. A /16 for a department that needs 50 hosts isn’t just wasteful — it also expands the blast radius of anything that goes wrong on that segment.
- Disable unused switch ports and apply port security to limit MAC address flooding and rogue device connections.
- Monitor for ARP spoofing on flat, unsegmented networks — it’s one of the simplest and most effective attacks on IPv4 LANs.
- Use DHCP snooping on managed switches to prevent rogue DHCP servers from handing out malicious gateway/DNS settings.
- Log and audit static IP assignments separately from DHCP pools to avoid silent conflicts and to track exactly what’s supposed to be where.
13. Real-World Subnetting Workflows
Designing subnets for a small office (3 departments, 1 router link): Start with the total address block you’ve been given (say, a /24), sort departments by host count, and assign VLSM subnets from largest to smallest — exactly as shown in Section 6. This avoids the common beginner mistake of dividing everything into equal-sized chunks regardless of actual need.
Migrating a network from a flat /24 to segmented VLANs:
- Inventory current device count per functional group (workstations, servers, printers, guest Wi-Fi, VoIP).
- Calculate required host bits per group with headroom for growth — I typically double the current count before calculating.
- Assign VLSM subnets and matching VLAN IDs.
- Update DHCP scopes and gateway addresses per VLAN.
- Update firewall rules to reflect new subnet boundaries before decommissioning the old flat network.
Troubleshooting “can’t reach a device on the same subnet”: Check the subnet mask on both devices first — a mismatched mask is the single most common cause of this exact symptom, since one device may calculate a different network boundary than the other even with IPs that look like they’re close together.
14. Common Subnetting Mistakes to Avoid
- Forgetting to reserve the network and broadcast addresses when counting usable hosts.
- Assuming a “slash” number without converting it to actual usable host count, then running out of room after allocation.
- Using equal-sized subnets everywhere instead of VLSM, wasting large amounts of address space.
- Mismatched subnet masks between two devices that are supposed to be on the same network, causing one-directional or intermittent connectivity.
- Assigning static IPs from inside an active DHCP pool, causing conflicts.
- Confusing wildcard masks (used in ACLs) with subnet masks — they’re inverses of each other, and mixing them up breaks firewall rules silently.
- Overlapping subnet ranges when connecting two previously separate networks via VPN, causing routing conflicts that are painful to diagnose after the fact.
15. FAQs
Q: What’s the difference between a subnet mask and a wildcard mask? A subnet mask defines the network/host boundary and its octets increase from the left (255.255.255.0). A wildcard mask, used in ACLs and OSPF, is essentially its inverse (0.0.0.255) and defines which bits are allowed to vary.
Q: Why do we lose 2 addresses per subnet? The first address in any subnet is reserved as the network address (identifies the subnet itself), and the last is reserved as the broadcast address (used to reach every host on that subnet at once). Neither can be assigned to a device.
Q: What is CIDR and why did it replace classful addressing? CIDR (Classless Inter-Domain Routing) allows arbitrary prefix lengths instead of rigid class-based boundaries, which drastically reduced address waste and slowed the exhaustion of the IPv4 address space.
Q: Can two devices on different subnets communicate directly? No — they need a router (or a Layer 3 switch) to route traffic between subnets. Devices only communicate directly at Layer 2 when they’re on the same subnet.
Q: What’s a /31 actually used for if it only has 2 addresses? RFC 3021 specifically allows /31 for point-to-point links (like router-to-router WAN links), where you don’t need a separate network and broadcast address since there are only ever two devices involved.
Q: How do I quickly tell if two IPs are on the same subnet? Convert both to binary along with the subnet mask, and compare the network portion (the bits covered by the mask). If those bits match, they’re on the same subnet regardless of how different the host portion looks.
Q: Is IPv4 address exhaustion still a real problem? Yes — the global pool of available public IPv4 addresses has effectively been fully allocated for years, which is exactly why CGNAT, IPv6 adoption, and efficient VLSM subnetting all matter as much as they do today.
16. Interview Questions and Answers
Q: How many usable hosts are in a /27 subnet, and how do you calculate it? A: 30 usable hosts. A /27 leaves 5 host bits (32 – 27 = 5), so 2^5 = 32 total addresses, minus 2 for network and broadcast = 30 usable.
Q: What’s the difference between a public and private IP address? A: Public IPs are globally unique and routable across the internet. Private IPs (from ranges like 10.0.0.0/8 or 192.168.0.0/16) are only valid within a local network and require NAT to reach the internet.
Q: Explain VLSM and why it’s preferred over fixed-length subnetting. A: VLSM allows different subnet sizes within the same address block, matched to actual host requirements, which avoids the address waste that comes from forcing every subnet to the same size regardless of need.
Q: What happens if two devices have mismatched subnet masks? A: They may calculate different network boundaries for the same IP range, leading to devices believing they’re on different networks even when they’re physically on the same segment — causing intermittent or one-way connectivity issues.
Q: What’s the purpose of the default gateway? A: It’s the router address a device sends traffic to when the destination isn’t on its own local subnet — effectively the exit point to reach other networks, including the internet.
Q: What is APIPA and when does it appear? A: Automatic Private IP Addressing — a 169.254.x.x address a Windows device self-assigns when it can’t reach a DHCP server, letting local link communication continue but signaling no valid network configuration was obtained.
Q: How would you subnet a /24 to support 6 subnets with at least 25 hosts each? A: 25 hosts needs 5 host bits (2^5 – 2 = 30 usable), giving a /27, which yields 8 possible subnets from a /24 — comfortably covering the requirement for 6.
17. Printable Quick-Reference Summary
CIDR QUICK TABLE
/24 = 255.255.255.0 = 254 hosts
/25 = 255.255.255.128 = 126 hosts
/26 = 255.255.255.192 = 62 hosts
/27 = 255.255.255.224 = 30 hosts
/28 = 255.255.255.240 = 14 hosts
/29 = 255.255.255.248 = 6 hosts
/30 = 255.255.255.252 = 2 hosts
/31 = 255.255.255.254 = 2 hosts (point-to-point)
/32 = 255.255.255.255 = 1 host
PRIVATE RANGES (RFC 1918)
10.0.0.0/8
172.16.0.0/12
192.168.0.0/16
SPECIAL ADDRESSES
127.0.0.0/8 loopback
169.254.0.0/16 APIPA
0.0.0.0 default route
255.255.255.255 limited broadcast
CORE COMMANDS
ipconfig /all Windows IP config
ip addr show Linux IP config
ifconfig macOS/legacy IP config
ping <ip> connectivity test
tracert / traceroute <ip> path trace
arp -a ARP table
netstat -an / ss -tulnp connection state
SUBNETTING METHOD
1. Determine host bits needed (2^n - 2 >= required hosts)
2. New prefix = 32 - host bits
3. Block size = 2^(host bits)
4. Count subnets in that increment from the base network
18. Official Documentation Links
- IETF RFC 791 (Internet Protocol): https://www.rfc-editor.org/rfc/rfc791
- IETF RFC 1918 (Private Address Space): https://www.rfc-editor.org/rfc/rfc1918
- IETF RFC 3021 (/31 Point-to-Point Links): https://www.rfc-editor.org/rfc/rfc3021
- IANA IPv4 Address Space Registry: https://www.iana.org/assignments/ipv4-address-space/ipv4-address-space.xhtml
- IANA Special-Purpose Address Registry: https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml
- Cisco Subnetting Reference Guide: https://www.cisco.com/c/en/us/support/docs/ip/routing-information-protocol-rip/13788-3.html
Subnetting stops being intimidating the moment the binary math becomes muscle memory instead of a lookup exercise. Work through the step-by-step method a few times with real numbers, keep the CIDR table nearby until you don’t need it anymore, and the rest falls into place. Save this page — between the tables and the troubleshooting playbook, it covers the situations that come up again and again.