Subnetting Without Tears

I once watched a tech spend two hours on a ladder, in full sun, convinced an IP camera was dead on arrival. The camera was at 192.168.1.130, the NVR at 192.168.1.10, ping wouldn't cross, and the verdict was "send it back." The camera was fine: the NVR had a /24 mask and the camera a /26. They lived on the same street — they just disagreed about where the street ended.

That's the whole point: the subnet mask is not a decorative field you fill with 255.255.255.0 "because that's what goes there." It's half of the address. And the good news is that all of subnetting — masks, CIDR, VLSM — boils down to one idea that fits in a row of 32 boxes.

Inside an IP: 32 switches

An IPv4 address is 32 bits: 32 switches that can only be 0 or 1. Since nobody wants to dictate 32 ones and zeros over the phone, we group them into 4 octets of 8 bits and write each octet in decimal: 192.168.1.0. Thirty-two bits give you 2³² combinations — about 4.29 billion addresses — which felt infinite in the eighties and get rationed out with an eyedropper today.

The mask draws a vertical line across those 32 boxes and splits the address in two, like a postal address: the network part is the street name (shared by every neighbor) and the host part is the house number (unique to each device). The mask is a run of contiguous ones from the left — "this is street" — followed by zeros — "this is house." In binary, 255.255.255.0 is 24 ones followed by 8 zeros: the boundary lands exactly on the third dot.

If you want to see any address taken apart bit by bit, the IP converter shows it in decimal, binary and hex side by side. Seeing it in binary once beats reading ten definitions.

CIDR and the jump trick

Typing 255.255.255.192 every time is cruel and unusual, so CIDR notation compresses the mask into one number: how many network bits it has. /24 means "24 ones," /26 means "26 ones." The bigger the number after the slash, the smaller the subnet — yes, it's backwards, and yes, everyone trips over it the first time.

To read a prefix at a glance, anchor yourself on the multiples of 8: /8 cuts after the first octet, /16 after the second, /24 after the third. Everything in between yields to the jump trick: take the "interesting" octet of the mask (the one that's neither 255 nor 0) and compute 256 minus that value. The result is the block size, and subnets start at multiples of that jump.

With /26 the mask is 255.255.255.192, so the jump is 256 − 192 = 64: subnets start at .0, .64, .128 and .192. Someone asks where 192.168.1.135/26 lives? Count multiples of 64 — 0, 64, 128… — and 135 lands past 128: its network is 192.168.1.128, its broadcast 192.168.1.191. No calculator, no binary, done before the other guy finds the app.

Network and broadcast: the two reserved seats

Every subnet loses two addresses before it does any work. The first one — all host bits set to 0 — is the network address: the street name itself, assigned to nobody. The last one — all host bits set to 1 — is the broadcast: the megaphone for yelling at the whole block. That's why usable hosts are 2ⁿ − 2, where n is the number of host bits.

And watch out — in practice you lose a third one: the gateway also eats a usable address. A /26 has 62 hosts on paper, but 61 free chairs once the router sits down. Here's the table worth tattooing on the inside of your eyelids (the full version, /0 through /32, lives in the CIDR table):

A note for the purists: /31 exists (RFC 3021) for point-to-point links with no network or broadcast address, but not every device embraces it warmly; /30 is still the de facto standard in the field. To play with any network-and-prefix combination, the subnet calculator hands you network, broadcast, range and binary instantly.

VLSM: slicing the cake with nothing wasted

Now the real-world case. You're handed 192.168.1.0/24 for an office with Sales (50 devices), Support (20), IT (10) and a point-to-point link (2) to the branch router. The lazy option is cutting it into 4 equal pieces with the FLSM splitter: four /26 blocks of 62 hosts each. It works… but the 2-host link ends up holding 64 addresses — a luxury penthouse for two people.

VLSM (variable-length subnet masking) tailors the fit: each area gets the smallest block that covers it. The one sacred rule is allocate largest to smallest, so every block lands aligned on a multiple of its own size. Here's how it goes:

1. Sort the requirements, largest first: Sales 50, Support 20, IT 10, link 2. Always. Start with the small one and the big ones won't land aligned later.
2. Sales, 50 hosts: 5 host bits give 2⁵ − 2 = 30 (not enough); 6 bits give 2⁶ − 2 = 62 ✓. Prefix: 32 − 6 = /26. Block: 192.168.1.0/26 → hosts .1 to .62, broadcast .63.
3. Support, 20 hosts: 2⁵ − 2 = 30 ✓ → /27. The next free block starts right where Sales ended: 192.168.1.64/27 → hosts .65 to .94, broadcast .95.
4. IT, 10 hosts: 2⁴ − 2 = 14 ✓ → /28. Block: 192.168.1.96/28 → hosts .97 to .110, broadcast .111.
5. Link, 2 hosts: 2² − 2 = 2, a perfect fit → /30. Block: 192.168.1.112/30 → hosts .113 and .114, broadcast .115.
6. Run the balance: you used 64 + 32 + 16 + 4 = 116 addresses, leaving .116 through .255 free — 140 addresses for the growth the client swears will never happen (and will).

The full plan, ready for the project folder:

Sales    192.168.1.0/26    hosts .1–.62     bcast .63   (62 usable)
Support  192.168.1.64/27   hosts .65–.94    bcast .95   (30 usable)
IT       192.168.1.96/28   hosts .97–.110   bcast .111  (14 usable)
Link     192.168.1.112/30  hosts .113–.114  bcast .115  (2 usable)
Free     192.168.1.116 – .255                            (140 addrs)

Want to check my math (or rerun it with your own numbers)? Feed the same requirements into the VLSM planner and compare: it should hand you exactly these ranges.

Wildcard: the mask wearing its jacket inside out

The wildcard is the mask with every bit flipped: where the mask says "this part is fixed," the wildcard says "I don't care about this part." A /26 (255.255.255.192) has wildcard 0.0.0.63, so permit 192.168.1.0 0.0.0.63 in an ACL means "any address in the Sales block."

The three mistakes that cost real money

1. Overlapping subnets. Two blocks that step on each other — a 192.168.1.0/24 here, a 192.168.1.64/26 there — coexist in silence until you bring up the VPN to the other site and routing turns into roulette. Renumbering a production network is paid for in sleepless nights. Before adding any new block, run it through the overlap checker: ten seconds versus a lost weekend.

2. Counting hosts as if they were people. "Sales has 50 people" does not mean 50 addresses: you're missing the gateway, the printer, the AP, the camera, the sensor somebody plugged in without telling anyone, and the slack the DHCP pool needs. Size with headroom and carve out reservations with the DHCP calculator before the pool runs dry on a Monday at 9:00.

3. Misaligning blocks. A subnet can only start on a multiple of its own size: a /27 starts at .0, .32, .64, .96… — 192.168.1.80/27 does not exist, no matter how confident the spreadsheet looks. That's why VLSM allocates largest to smallest: the blocks fall into alignment on their own. Bonus: well-aligned, contiguous blocks can later be summarized into a single route with the CIDR aggregator (two adjacent, aligned /27s = one /26).

Your move

Grab a network you run today and give it an autopsy: how many addresses are assigned versus actually in use? Then build the plan properly — requirements sorted largest to smallest in the VLSM planner, collision check in the overlap checker — and file the table in the project folder. The next camera that won't ping gets solved from the ground, no ladder required.