Subnetting step by step

Dev's plan for the third Kettle & Crumb shop starts with a single block of addresses, 192.168.40.0/24, set aside in the bakery's address spreadsheet. The shop needs four separate networks: one for the point-of-sale terminals, one for staff tablets and the office laptop, one for the security cameras, and one for guest Wi-Fi. Each needs fewer than 60 addresses. Giving each its own /24 would work, but it would use four of the bakery's remaining ranges and leave the spreadsheet messy. Instead, Dev hands Jordan a pencil and asks how to split one /24 into four equal pieces.

Subnetting is the skill that the CCST Networking exam tests most directly with numbers, and it is the skill technicians use whenever they plan a new site, add a VLAN or read an unfamiliar configuration. This lesson builds a reliable method: borrowing bits, finding the block size, listing subnets, locating the subnet for any address, and choosing the right prefix for a given number of hosts or subnets. Practise each step until it is automatic; speed comes from repetition, not from tricks.

Why networks are subnetted

Dividing a network into smaller subnets has several benefits. Each subnet is its own broadcast domain, so broadcasts from the cameras do not reach the card terminals. Traffic between subnets passes through a router or firewall, where it can be filtered, so guests on Wi-Fi cannot reach the point-of-sale system. Faults are easier to isolate because each subnet has a clear purpose and a known range. And addresses are used more efficiently, which matters greatly with public IPv4 addresses and helps keep private address plans tidy.

Borrowing bits

A subnet is made by moving the boundary between the network and host portions to the right. Bits that were host bits become subnet bits. This is called borrowing bits. If you borrow n bits, you create 2 to the power n subnets, and each subnet keeps the remaining h host bits, giving 2 to the power h minus 2 usable hosts.

Starting from 192.168.40.0/24, there are 8 host bits. Borrowing 2 bits gives a /26: 2 squared is 4 subnets, each with 6 host bits, so 64 addresses and 62 usable hosts. Borrowing 3 bits gives a /27: 8 subnets of 30 usable hosts. Borrowing 1 bit gives a /25: 2 subnets of 126 hosts. Every bit borrowed doubles the number of subnets and roughly halves the hosts in each.

The block size

The quickest way to list subnets is the block size, sometimes called the magic number. Look at the octet where the mask changes from ones to zeros, the interesting octet. Subtract the mask's value in that octet from 256. The result is the size of each subnet's block of addresses, and every subnet's network address in that octet is a multiple of the block size.

For a /26, the mask is 255.255.255.192, the interesting octet is the fourth, and the block size is 256 minus 192, which is 64. The subnets of 192.168.40.0/24 therefore start at 0, 64, 128 and 192 in the last octet. Each subnet ends one address before the next one starts, so the broadcast address of each is the next network address minus one. The usable hosts lie between.

Dev assigns the subnets in that order: point of sale gets 192.168.40.0/26, staff devices 192.168.40.64/26, cameras 192.168.40.128/26 and guest Wi-Fi 192.168.40.192/26. By convention at Brightline, each subnet's gateway is its first usable address, so the point-of-sale gateway is 192.168.40.1 and the guest gateway is 192.168.40.193.

A five-step method for any address

Exam questions often give a single address and prefix and ask which subnet it belongs to, what its broadcast address is, or whether another address is on the same subnet. A reliable method works every time. Step one: write the mask in dotted decimal and find the interesting octet. Step two: find the block size, 256 minus the mask value in that octet. Step three: find the largest multiple of the block size that is less than or equal to the address's value in the interesting octet; that is the subnet's network address in that octet, and octets to its right become 0. Step four: add the block size and subtract one to find the broadcast address in that octet; octets to its right become 255. Step five: the first host is the network address plus one, and the last host is the broadcast address minus one.

Try it with 192.168.40.150/27. The mask is 255.255.255.224, so the interesting octet is the fourth and the block size is 32. Multiples of 32 are 0, 32, 64, 96, 128 and 160; the largest not above 150 is 128. The network address is 192.168.40.128, the broadcast is 128 + 32 − 1 = 159, giving 192.168.40.159, and the hosts run from .129 to .158. An address such as 192.168.40.161 is on a different subnet, because 161 is above 159.

import ipaddress

def describe(cidr):
    iface = ipaddress.ip_interface(cidr)
    net = iface.network
    hosts = list(net.hosts())
    print(f'{cidr:20} network {net.network_address}, broadcast {net.broadcast_address}, '
          f'hosts {hosts[0]} - {hosts[-1]} ({len(hosts)})')

describe('192.168.40.150/27')
describe('172.20.13.200/22')
describe('10.8.3.9/30')

print('Subnets of 192.168.40.0/24 at /26:')
for sub in ipaddress.ip_network('192.168.40.0/24').subnets(new_prefix=26):
    print('  ', sub)

192.168.40.150/27    network 192.168.40.128, broadcast 192.168.40.159, hosts 192.168.40.129 - 192.168.40.158 (30)
172.20.13.200/22     network 172.20.12.0, broadcast 172.20.15.255, hosts 172.20.12.1 - 172.20.15.254 (1022)
10.8.3.9/30          network 10.8.3.8, broadcast 10.8.3.11, hosts 10.8.3.9 - 10.8.3.10 (2)
Subnets of 192.168.40.0/24 at /26:
   192.168.40.0/26
   192.168.40.64/26
   192.168.40.128/26
   192.168.40.192/26

When the interesting octet is not the last one

The same method works when the mask changes in the third or second octet. Take 172.20.13.200/22. A /22 mask is 255.255.252.0: two full octets, then 252, which is 11111100, then 0. The interesting octet is the third, and the block size is 256 minus 252, which is 4. Multiples of 4 in the third octet are 0, 4, 8 and 12; the largest not above 13 is 12. The network address is 172.20.12.0. The broadcast is 12 + 4 − 1 = 15 in the third octet and 255 in the fourth, giving 172.20.15.255. The hosts run from 172.20.12.1 to 172.20.15.254, and there are 2 to the power 10 minus 2, or 1,022, of them.

The trap with larger subnets is forgetting that the octets to the right of the interesting octet belong to the host portion. In a /22, an address like 172.20.13.0 is a perfectly good host address, because its host bits are not all zero; only 172.20.12.0 is the network address. Likewise 172.20.14.255 is a host, not a broadcast. Writing out the full range, from network to broadcast, avoids these mistakes.

Choosing a prefix for a number of hosts

Planning usually starts from the other direction: you know how many devices a network needs and must choose the prefix. Find the smallest number of host bits h for which 2 to the power h minus 2 is at least the number of hosts needed, then the prefix is 32 minus h. A network of 50 hosts needs 6 host bits, because 2 to the 6th minus 2 is 62, while 5 bits would give only 30. The prefix is 32 minus 6, a /26.

Allow for growth. A subnet that is exactly full on day one will need to be renumbered within a year. Brightline's rule is to plan for at least the expected number of devices plus a third, then round up to the next prefix. For the bakery's cameras, eight cameras today and perhaps twelve later would fit in a /28 with 14 hosts, but Dev keeps the /26 because the block is already set aside and renumbering cameras later would mean a site visit.

def prefix_for(hosts):
    pass

print(prefix_for(50))

Choosing a prefix for a number of subnets

Sometimes the requirement is a number of subnets from a given block. Find the smallest number of borrowed bits n for which 2 to the power n is at least the number of subnets needed, and add n to the original prefix. To divide a /24 into six subnets, borrow 3 bits, because 2 squared is only 4 but 2 cubed is 8. The new prefix is /27, giving eight subnets of 30 hosts each, with two left for future use. Check that each subnet still has enough hosts; if it does not, the block is too small and you need a larger one.

Variable-length subnets

Real networks rarely need equal-sized subnets. Variable-length subnet masking, VLSM, means using different prefixes inside the same block. A router-to-router link needs only two addresses, a /30, while a user network might need a /25. The rule when planning VLSM by hand is to allocate the largest subnets first, each starting on a multiple of its own block size, then fit the smaller ones into the gaps. This keeps every subnet aligned and prevents overlaps.

For example, to fit a 100-host network, a 50-host network and two point-to-point links into 10.12.5.0/24: the 100-host network needs a /25, so it takes 10.12.5.0/25. The 50-host network needs a /26 and takes the next aligned block, 10.12.5.128/26. Each link needs a /30, so they take 10.12.5.192/30 and 10.12.5.196/30. The rest of the block, from 10.12.5.200 to 10.12.5.255, stays free. The exam expects you to recognize VLSM and check that subnets do not overlap rather than to design large VLSM plans.

Building speed

Accuracy comes first and speed follows. Begin by writing every step for every problem, including the binary form of the interesting octet if it helps. After a week, most learners find that they know the block sizes for /25 to /30 without thinking: 128, 64, 32, 16, 8 and 4. After two weeks, the multiples of those block sizes become familiar, and finding a subnet takes a few seconds. Practise with random addresses rather than the same few examples, check every answer with a calculator or the Python examples in this lesson, and keep a list of the mistakes you make most often. Many people find that their errors fall into one or two patterns, such as forgetting that the broadcast address is one less than the next network address, and that fixing those patterns is the fastest way to improve.

Jordan fills in the bakery's spreadsheet with four /26 rows and double-checks each range with the Python example. Dev reviews it, adds DHCP pools that leave the first twenty addresses of each subnet for static devices, and saves it. The next lesson leaves IPv4 behind and looks at the addressing system that is slowly replacing it.