How does Subnetting Work, and How do you do it by hand or in your head? Can someone explain both conceptually and with several examples? Server Fault gets lots of subnetting homework questions, so we could use an answer to point them to on Server Fault itself.

  • What is classless routing and why is class-based routing obsolete?
  • If I have a network, how do I figure out how to split it up?
  • If I am given a netmask, how do I know what its network range is?
  • Sometimes there is a slash followed by a number; what is that number?
  • Sometimes there is a subnet mask, but also a wildcard mask. They seem like the same thing but they are different?
  • Someone mentioned something about knowing binary for this?
  • What is NAT (Network Address Translation)?

Notes about this question

In the last few years I have pointed quite a few questions about subnetting to this question on Server Fault. It is their canonical question on IPv4 and subnetting.

Sadly, I cannot VTC questions on Super User as duplicates of that question, since it is technically another site.

As an [interim] solution I am copying that question/answer here, hoping it will become the canonical question/answer on Super User.

If you can improve on it, please it post an answer or leave comments.

  • 4
    Shouldn't community-faq questions be CWs? Jul 27, 2016 at 16:52
  • 2
    It is ridiculous to include what is NAT and what is IPv4 subnetting, in the same question. They are both big subjects and shouldn't really be addressed in the same answer
    – barlop
    Jul 27, 2016 at 17:01
  • 1
    Look at this excellent answer on Network Engineering.
    – Ron Maupin
    Jul 27, 2016 at 17:06
  • 3
    A couple of thoughts: 1) You've put a lot of effort into this, so thanks for that. 2) You attribute the two part answer within the question, but the answers should each begin with attribution to the author. 3) If this is going to be a canonical thread it has to be a little broad, but the question seems extremely broad for SU. Covering everything related to a subject in one question and "one" answer is a textbook of general knowledge on the subject, which isn't a great fit with the site's model. (I didn't downvote, BTW)
    – fixer1234
    Jul 27, 2016 at 17:08
  • 3
    Copy-pasta from another site in the network almost feels worse to me than the sites that leech SE content wholesale... As a minimum everything here needs a disclaimer mentioning the source and providing solid attribution of the original authors, but better would be the original authors posting themselves and getting the respect they deserve for what is an epic Q&A. I've asked whether this sort of Copy-Paste is acceptable and what we should do on meta.
    – Mokubai
    Jul 27, 2016 at 17:32

3 Answers 3


IP subnets exist to allow routers to choose appropriate destinations for packets. You can use IP subnets to break up larger networks for logical reasons (firewalling, etc), or physical need (smaller broadcast domains, etc).

Simply put, though, IP routers use your IP subnets to make routing decisions. Understand how those decisions work, and you can understand how to plan IP subnets.

Counting to 1

If you are already fluent in binary (base 2) notation you can skip this section.

For those of you who are left: Shame on you for not being fluent in binary notation!

Yeah-- that may be a bit harsh. It's really, really easy to learn to count in binary, and to learn shortcuts to convert binary to decimal and back. You really should know how to do it.

Counting in binary is so simple because you only have to know how to count to 1!

Think of a car's "odometer", except that unlike a traditional odometer each digit can only count up to 1 from 0. When the car is fresh from the factory the odometer reads "00000000".

When you've driven your first mile the odometer reads "00000001". So far, so good.

When you've driven your second mile the first digit of the odometer rolls back over to "0" (since it's maximum value is "1") and the second digit of the odometer rolls over to "1", making the odometer read "00000010". This looks like the number 10 in decimal notation, but it's actually 2 (the number of miles you've driven the car so far) in binary notation.

When you've driven the third mile the odometer reads "00000011", since the first digit of the odometer turns again. The number "11", in binary notation, is the same as the decimal number 3.

Finally, when you've driven your fourth mile both digits (which were reading "1" at the end of the third mile) roll back over to zero position, and the 3rd digit rolls up to the "1" position, giving us "00000100". That's the binary representation of the decimal number 4.

You can memorize all of that if you want, but you really only need to understand how the little odometer "rolls over" as the number it's counting gets bigger. It's exactly the same as a traditional decimal odometer's operation, except that each digit can only be "0" or "1" on our fictional "binary odometer".

To convert a decimal number to binary you could roll the odometer forward, tick by tick, counting aloud until you've rolled it a number of times equal to the decimal number you want to convert to binary. Whatever is displayed on the odometer after all that couting and rolling would be the binary representation of the decimal number you counted up to.

Since you understand how the odometer rolls forward you'll also understand how it rolls backward, too. To convert a binary number displayed on the odometer back to decimal you could roll the odometer back one tick at a time, counting aloud until the odometer reads "00000000". When all that counting and rolling is done, the last number you say aloud would be the decimal representation of the binary number the odometer started with.

Converting values between binary and decimal this way would be very tedious. You could do it, but it wouldn't be very efficient. It's easier to learn a little algorithm to do it faster.

A quick aside: Each digit in a binary number is known as a "bit". That's "b" from "binary" and "it" from "digit". A bit is a binary digit.

Converting a binary number like, say, "1101011" to decimal is a simple process with a handy little algorithm.

Start by counting the number of bits in the binary number. In this case, there are 7. Make 7 divisions on a sheet of paper (in your mind, in a text file, etc) and begin filling them in from right to left. In the rightmost slot, enter the number "1", because we'll always start with "1". In the next slot to the left enter double the value in the slot to the right (so, "2" in the next one, "4" in the next one) and continue until all the slots are full. (You'll end up memorizing these numbers, which are the powers of 2, as you do this more and more. I'm alright up to 131,072 in my head but I usually need a calculator or paper after that).

So, you should have the following on your paper in your little slots.

 64    |    32    |    16    |    8    |    4    |    2    |    1    |

Transcribe the bits from the binary number below the slots, like so:

 64    |    32    |    16    |    8    |    4    |    2    |    1    |
  1          1          0         1         0         1         1

Now, add some symbols and compute the answer to the problem:

 64    |    32    |    16    |    8    |    4    |    2    |    1    |
x 1        x 1        x 0       x 1       x 0       x 1       x 1
---        ---        ---       ---       ---       ---       ---
       +          +          +         +         +         +         =

Doing all the math, you should come up with:

 64    |    32    |    16    |    8    |    4    |    2    |    1    |
x 1        x 1        x 0       x 1       x 0       x 1       x 1
---        ---        ---       ---       ---       ---       ---
 64    +    32    +     0    +    8    +    0    +    2    +    1    =   107

That's got it. "1101011" in decimal is 107. It's just simple steps and easy math.

Converting decimal to binary is just as easy and is the same basic algorithm, run in reverse.

Say that we want to convert the number 218 to binary. Starting on the right of a sheet of paper, write the number "1". To the left, double that value (so, "2") and continue moving toward the left of the paper doubling the last value. If the number you are about to write is greater than the number being converted stop writing. otherwise, continue doubling the prior number and writing. (Converting a big number, like 34,157,216,092, to binary using this algorithm can be a bit tedious but it's certainly possible.)

So, you should have on your paper:

 128    |    64    |    32    |    16    |    8    |    4    |    2    |    1    |

You stopped writing numbers at 128 because doubling 128, which would give you 256, would be large than the number being converted (218).

Beginning from the leftmost number, write "218" above it (128) and ask yourself: "Is 218 larger than or equal to 128?" If the answer is yes, scratch a "1" below "128". Above "64", write the result of 218 minus 128 (90).

Looking at "64", ask yourself: "Is 90 larger than or equal to 64?" It is, so you'd write a "1" below "64", then subtract 64 from 90 and write that above "32" (26).

When you get to "32", though, you find that 32 is not greater than or equal to 26. In this case, write a "0" below "32", copy the number (26) from above 32" to above "16" and then continue asking yourself the same question with the rest of the numbers.

When you're all done, you should have:

 218         90         26         26        10         2         2         0
 128    |    64    |    32    |    16    |    8    |    4    |    2    |    1    |
   1          1          0          1         1         0         1         0

The numbers at the top are just notes used in computation and don't mean much to us. At the bottom, though, you see a binary number "11011010". Sure enough, 218, converted to binary, is "11011010".

Following these very simple procedures you can convert binary to decimal and back again w/o a calculator. The math is all very simple and the rules can be memorized with just a bit of practice.

Splitting Up Addresses

Think of IP routing like pizza delivery.

When you're asked to deliver a pizza to "123 Main Street" it's very clear to you, as a human, that you want to go to the building numbered "123" on the street named "Main Street". It's easy to know that you need to go to the 100-block of Main Street because the building number is between 100 and 199 and most city blocks are numbered in hundreds. You "just know" how to split the address up.

Routers deliver packets, not pizza. Their job is the same as a pizza driver: To get the cargo (packets) as close to the destination as possible. A router is connected to two or more IP subnets (to be at all useful). A router must examine destination IP addresses of packets and break those destination addresses up into their "street name" and "building number" components, just like the pizza driver, to make decisions about delivery.

Each computer (or "host") on an IP network is configured with a unique IP address and subnet mask. That IP address can be divided up into a "building number" component (like "123" in the example above) called the "host ID" and a "street name" component (like "Main Street" in the example above) called the "network ID". For our human eyes, it's easy to see where the building number and the street name are in "123 Main Street", but harder to see that division in " with a subnet mask of".

IP routers "just know" how to split up IP addresses into these component parts to make routing decisions. Since understanding how IP packets are routed hinges on understanding this process we need to know how to break up IP addresses, too. Fortunately, extracting the host ID and the network ID out of an IP address and subnet mask is actually pretty easy.

Start by writing out the IP address in binary (use a calculator if you haven't learned to do this in your head just yet, but make a note learn how to do it-- it's really, really easy and impresses the opposite sex at parties):

      10.      13.     216.      41

Write out the subnet mask in binary, too:

     255.     255.     192.       0

Written side-by-side, you can see that the point in the subnet mask where the "1's" stop "lines up" to a point in the IP address. That's the point that the network ID and the host ID split. So, in this case:

      10.      13.     216.      41
00001010.00001101.11011000.00101001 - IP address
11111111.11111111.11000000.00000000 - subnet mask
00001010.00001101.11000000.00000000 - Portion of IP address covered by 1's in subnet mask, remaining bits set to 0
00000000.00000000.00011000.00101001 - Portion of IP address covered by 0's in subnet mask, remaining bits set to 0

Routers use the subnet mask to "mask out" the bits covered by 1's in the IP address (replacing the bits that are not "masked out" with 0's) to extract the network ID:

      10.      13.     192.       0
00001010.00001101.11000000.00000000 - Network ID

Likewise, by using the subnet mask to "mask out" the bits covered by 0's in the IP address (replacing the bits that are not "masked out" with 0's again) a router can extract the host ID:

       0.       0.      24.      41
00000000.00000000.00011000.00101001 - Portion of IP address covered by 0's in subnet mask, remaining bits set to 0

It's not as easy for our human eyes to see the "break" between the network ID and the host ID as it is between the "building number" and the "street name" in physical addresses during pizza delivery, but the ultimate effect is the same.

Now that you can split up IP addresses and subnet masks into host ID's and network ID's you can route IP just like a router does.

More Terminology

You're going to see subnet masks written all over the Internet and throughout the rest of this answer as (IP/number). This notation is known as "Classless Inter-Domain Routing" (CIDR) notation. "" is made up of 24 bits of 1's at the beginning, and it's faster to write that as "/24" than as "". To convert a CIDR number (like "/16") to a dotted-decimal subnet mask just write out that number of 1's, split it into groups of 8 bits, and convert it to decimal. (A "/16" is "", for instance.)

Back in the "old days", subnet masks weren't specified, but rather were derived by looking at certain bits of the IP address. An IP address starting with 0 - 127, for example, had an implied subnet mask of (called a "class A" IP address).

These implied subnet masks aren't used today and I don't recommend learning about them anymore unless you have the misfortune of dealing with very old equipment or old protocols (like RIPv1) that don't support classless IP addressing. I'm not going to mention these "classes" of addresses further because it's inapplicable today and can be confusing.

Some devices use a notation called "wildcard masks". A "wildcard mask" is nothing more than a subnet mask with all 0's where there would be 1's, and 1's where there would be 0's. The "wildcard mask" of a /26 is:

 11111111.11111111.11111111.11000000 - /26 subnet mask
 00000000.00000000.00000000.00111111 - /26 "wildcard mask"

Typically you see "wildcard masks" used to match host IDs in access-control lists or firewall rules. We won't discuss them any further here.

How a Router Works

As I've said before, IP routers have a similar job to a pizza delivery driver in that they need to get their cargo (packets) to its destination. When presented with a packet bound for address, an IP router needs to determine which of its network interfaces will best get that packet closer to its destination.

Let's say that you are an IP router, and you have interfaces connected to you numbered:

  • Ethernet0 -, subnet mask /24
  • Ethernet1 -, subnet mask /24

If you receive a packet to deliver with a destination address of "", it's pretty easy to tell (with your human eyes) that the packet should be sent out the interface Ethernet1, because the Ethernet1 interface address corresponds to the packet's destination address. All the computers attached to the Ethernet1 interface will have IP addresses starting with "192.168.10.", because the network ID of the IP address assigned to your interface Ethernet1 is "".

For a router, this route selection process is done by building a routing table and consulting the table each time a packet is to be delivered. A routing table contains network ID and destination interface names. You already know how to obtain a network ID from an IP address and subnet mask, so you're on your way to building a routing table. Here's our routing table for this router:

  • Network ID: (11000000.10101000.00010100.00000000) - 24 bit subnet mask - Interface Ethernet0
  • Network ID: (11000000.10101000.00001010.00000000) - 24 bit subnet mask - Interface Ethernet1

For our incoming packet bound for "", we need only convert that packet's address to binary (as humans-- the router gets it as binary off the wire to begin with) and attempt to match it to each address in our routing table (up to the number of bits in the subnet mask) until we match an entry.

  • Incoming packet destination: 11000000.10101000.00001010.00000010

Comparing that to the entries in our routing table:

11000000.10101000.00001010.00000010 - Destination address for packet
11000000.10101000.00010100.00000000 - Interface Ethernet0
!!!!!!!!.!!!!!!!!.!!!????!.xxxxxxxx - ! indicates matched digits, ? indicates no match, x indicates not checked (beyond subnet mask)

11000000.10101000.00001010.00000010 - Destination address for packet
11000000.10101000.00001010.00000000 - Interface Ethernet1, 24 bit subnet mask
!!!!!!!!.!!!!!!!!.!!!!!!!!.xxxxxxxx - ! indicates matched digits, ? indicates no match, x indicates not checked (beyond subnet mask)

The entry for Ethernet0 matches the first 19 bits fine, but then stops matching. That means it's not the proper destination interface. You can see that the interface Ethernet1 matches 24 bits of the destination address. Ah, ha! The packet is bound for interface Ethernet1.

In a real-life router, the routing table is sorted in such a manner that the longest subnet masks are checked for matches first (i.e. the most specific routes), and numerically so that as soon as a match is found the packet can be routed and no further matching attempts are necessary (meaning that would be listed first and would never have been checked). Here, we're simplifying that a bit. Fancy data structures and algorithms make faster IP routers, but simple algorithms will produce the same results.

Static Routes

Up to this point, we've talked about our hypothetical router as having networks directly connected to it. That's not, obviously, how the world really works. In the pizza-driving analogy, sometimes the driver isn't allowed any further into the building than the front desk, and has to hand-off the pizza to somebody else for delivery to the final recipient (suspend your disbelief and bear with me while I stretch my analogy, please).

Let's start by calling our router from the earlier examples "Router A". You already know RouterA's routing table as:

  • Network ID: (11000000.10101000.00010100.00000000) - subnet mask /24 - Interface RouterA-Ethernet0
  • Network ID: (11000000.10101000.00001010.00000000) - subnet mask /24 - Interface RouterA-Ethernet1

Suppose that there's another router, "Router B", with the IP addresses and assigned to its Ethernet0 and Ethernet1 interfaces. It has the following routing table:

  • Network ID: (11000000.10101000.00001010.00000000) - subnet mask /24 - Interface RouterB-Ethernet0
  • Network ID: (11000000.10101000.00011110.00000000) - subnet mask /24 - Interface RouterB-Ethernet1

In pretty ASCII art, the network looks like this:

               Interface                      Interface
               Ethernet1                      Ethernet1
     __________  V                  __________  V
    |          | V                 |          | V
----| ROUTER A |------- /// -------| ROUTER B |----
  ^ |__________|                 ^ |__________|
  ^                              ^
Interface                      Interface
Ethernet0                      Ethernet0      

You can see that Router B knows how to "get to" a network,, that Router A knows nothing about.

Suppose that a PC with the IP address attached to the network connected to router A's Ethernet0 interface sends a packet to Router A for delivery. Our hypothetical packet is destined for the IP address, which is a device attached to the network connected to the Ethernet1 interface of Router B.

With the routing table shown above, neither entry in Router A's routing table matches the destination, so Router A will return the packet to the sending PC with the message "Destination network unreachable".

To make Router A "aware" of the existence of the network, we add the following entry to the routing table on Router A:

  • Network ID: (11000000.10101000.00011110.00000000) - subnet mask /24 - Accessible via

In this way, Router A has a routing table entry that matches the destination of our example packet. This routing table entry effectively says "If you get a packet bound for, send it on to because he knows how to deal with it." This is the analogous "hand-off the pizza at the front desk" action that I mentioned earlier-- passing the packet on to somebody else who knows how to get it closer to its destination.

Adding an entry to a routing table "by hand" is known as adding a "static route".

If Router B wants to deliver packets to the subnet mask network, it will need an entry in its routing table, too:

  • Network ID: (11000000.10101000.00010100.00000000) - subnet mask /24 - Accessible via: (Router A's IP address in the network)

This would create a path for delivery between the network and the network across the network between these routers.

You always want to be sure that routers on both sides of such an "interstitial network" have a routing table entry for the "far end" network. If router B in our example didn't have a routing table entry for "far end" network attached to router A our hypothetical packet from the PC at would get to the destination device at, but any reply that tried to send back would be returned by router B as "Destination network unreachable." One-way communication is generally not desirable. Always be sure you think about traffic flowing in both directions when you think about communication in computer networks.

You can get a lot of mileage out of static routes. Dynamic routing protocols like EIGRP, RIP, etc, are really nothing more than a way for routers to exchange routing information between each other that could, in fact, be configured with static routes. One large advantage to using dynamic routing protocols over static routes, though, is that dynamic routing protocols can dynamically change the routing table based on network conditions (bandwidth utilization, an interface "going down", etc) and, as such, using a dynamic routing protocol can result in a configuration that "routes around" failures or bottlenecks in the network infrastructure. (Dynamic routing protocols are WAY outside the scope of this answer, though.)

You Can't Get There From Here

In the case of our example Router A, what happens when a packet bound for "" comes in?

Looking at the Router A routing table, neither destination interface or static route matches the first 24 bits of (which is 10101100.00010000.00011111.01011100, BTW).

As we already know, Router A would return the packet to the sender via a "Destination network unreachable" message.

Say that there's another router (Router C) sitting at the address "". Router C has a connection to the Internet!

                              Interface                      Interface                      Interface
                              Ethernet1                      Ethernet1                      Ethernet1
                    __________  V                  __________  V                  __________  V
((  heap o  ))     |          | V                 |          | V                 |          | V
(( internet )) ----| ROUTER C |------- /// -------| ROUTER A |------- /// -------| ROUTER B |----
((   w00t!  ))   ^ |__________|                 ^ |__________|                 ^ |__________|
                 ^                              ^                              ^
               Interface                      Interface                      Interface
               Ethernet0                      Ethernet0                      Ethernet0

It would be nice if Router A could route packets that do not match any local interface up to Router C such that Router C can send them on to the Internet. Enter the "default gateway" route.

Add an entry at the end of our routing table like this:

  • Network ID: (00000000.00000000.00000000.00000000) - subnet mask /0 - Destination router:

When we attempt to match "" to each entry in the routing table we end up hitting this new entry. It's a bit perplexing, at first. We're looking to match zero bits of the destination address with... wait... what? Matching zero bits? So, we're not looking for a match at all. This routing table entry is saying, basically, "If you get here, rather than giving up on delivery, send the packet on to the router at and let him handle it". is a destination we DO know how to deliver a packet to. When confronted with a packet bound for a destination for which we have no specific routing table entry this "default gateway" entry will always match (since it matches zero bits of the destination address) and gives us a "last resort" place that we can send packets for delivery. You'll sometimes hear the default gateway called the "gateway of last resort."

In order for a default gateway route to be effective it must refer to a router that is reachable using the other entries in the routing table. If you tried to specify a default gateway of in Router A, for example, delivery to such a default gateway would fail. isn't an address that Router A knows how to deliver packets to using any of the other routes in its routing table, so such an address would be ineffective as a default gateway. This can be stated concisely: The default gateway must be set to an address already reachable by using another route in the routing table.

Real routers typically store the default gateway as the last route in their routing table such that it matches packets after they've failed to match all other entries in the table.

Urban Planning and IP Routing

Breaking up a IP subnet into smaller IP subnets is lke urban planning. In urban planning, zoning is used to adapt to natural features of the landscape (rivers, lakes, etc), to influence traffic flows between different parts of the city, and to segregate different types of land-use (industrial, residential, etc). IP subnetting is really much the same.

There are three main reasons why you would subnet a network:

  • You may want to communicate across different unlike communication media. If you have a T1 WAN connection between two buildings IP routers could be placed on the ends of these connections to facilitate communication across the T1. The networks on each end (and possibly the "interstitial" network on the T1 itself) would be assigned to unique IP subnets so that the routers can make decisions about which traffic should be sent across the T1 line.

  • In an Ethernet network, you might use subnetting to limit the amount of broadcast traffic in a given portion of the network. Application-layer protocols use the broadcast capability of Ethernet for very useful purposes. As you get more and more hosts packed into the same Ethernet network, though, the percentage of broadcast traffic on the wire (or air, in wireless Ethernet) can increase to such a point as to create problems for delivery of non-broadcast traffic. (In the olden days, broadcast traffic could overwhelm the CPU of hosts by forcing them to examine each broadcast packet. That's less likely today.) Excessive traffic on switched Ethernet can also come in form of "flooding of frames to unknown destinations". This condition is caused by an Ethernet switch being unable to keep track of every destination on the network and is the reason why switched Ethernet networks can't scale to an infinite number of hosts. The effect of flooding of frames to unknown destinations is similar to the the effect of excess broadcast traffic, for the purposes of subnetting.

  • You may want to "police" the types of traffic flowing between different groups of hosts. Perhaps you have print server devices and you only want authorized print queuing server computers to send jobs to them. By limiting the traffic allowed to flow to the print server device subnet users can't configure their PCs to talk directly to the print server devices to bypass print accounting. You might put the print server devices into a subnet all to themselves and create a rule in the router or firewall attached to that subnet to control the list of hosts permitted to send traffic to the print server devices. (Both routers and firewalls can typically make decisions about how or whether to deliver a packet based on the source and destination addresses of the packet. Firewalls are typically a sub-species of router with an obsessive personality. They can be very, very concerned about the payload of packets, whereas routers typically disregard payloads and just deliver the packets.)

In planning a city, you can plan how streets intersect with each other, and can use turn-only, one-way, and dead-end streets to influence traffic flows. You might want Main Street to be 30 blocks long, with each block having up to 99 buildings each. It's pretty easy to plan your street numbering such that each block in Main Street has a range of street numbers increasing by 100 for each block. It's very easy to know what the "starting number" in each subsequent block should be.

In planning IP subnets, you're concerned with building the right number of subnets (streets) with the right number of available host ID's (building numbers), and using routers to connect the subnets to each other (intersections). Rules about allowed source and destination addresses specified in the routers can further control the flow of traffic. Firewalls can act like obsessive traffic cops.

For the purposes of this answer, building our subnets is our only major concern. Instead of working in decimal, as you would with urban planning, you work in binary to describe the bounds of each subnet.

Continued on: https://serverfault.com/questions/49765/how-does-subnetting-work/226445#226445

(Yes ... we reached the maximum size of an answer (30000 characters).)

  • 1
    You write "(Yes ... we reached the maximum size of an answer (30000 characters).)" <--- And that does suggest that maybe the question asked, and that you thus tried to address, too many subjects. Teaching subnetting to somebody that doesn't know binary.. so squeezing in a lesson on binary, ridiculous
    – barlop
    Jul 27, 2016 at 17:07

Here's an extremely simple way of looking at it, that those new to Subnetting found it very easy to follow.

So you're given your networks, and are told to break them up into smaller networks.

Lets says that we have the /16 network, and we want to break it up into smaller networks. To do that, we need to borrow some host bits from our given network. Right now, our network bits are the 172.18 octets, and our host bits are in the 0.0 octets. In binary this would be a bunch of 1's and 0's but to help you visually see this, I'm going to use N for network, and H for host bits.

We would have nnnnnnnn.nnnnnnnn.hhhhhhhh.hhhhhhhh. To make our network smaller we need to take some of those "h" bits and make them "n" bits. The formula for this is 2^n. Then this will tell you how many networks you can make. So if we just borrow one "h" bit, we would take 2^1=2. So now out octets would look like nnnnnnnn.nnnnnnnn.nhhhhhhh.hhhhhhhh. Since the bit values of the octets go 128 16 32 16 8 4 2 1, our new network bit is using the .128. So our networks will be /17 and /17.

If we were given the task to break our network into 8 smaller networks we just need to find 2^n = 8. Since 2^3 = 8 we're going to borrow three host bits. So now our bits would look like nnnnnnnn.nnnnnnnn.nnnhhhhh.hhhhhhhh. Since our network bit is now using the 32 bit, our networks will go by 32. So your four networks would be /19, /19, /19 and so on until you get to your last network of

In another example, lets divide the /8 into four subnets. Again, our bits would look like nnnnnnnn.hhhhhhhh.hhhhhhhh.hhhhhhhh. The now we need to find out 2^n = 4. Since 2^2 = 4, we'll borrow two host bits, and use them as network bits. So our octet would now look like nnnnnnnn.nnhhhhhh.hhhhhhhh.hhhhhhhh. And our networks would be the /10 and the /10.

Now that we know our network addresses, finding the broadcast address and number of nodes per subnet is easy. For example our first network is the /17 and the next network would be /17. The broadcast address is always the last address of the subnet, so for the network it would be For the network, it would be

To find out the number of nodes, the long/hard way is to take 2^h. H being the number of hosts bits that you have. So for the /17 network, we have 15 host bits, so we would take 2^15 = 32768.

I'm not sure on how everyone is with subnetting overall, but here are some shortcuts. If you're wanting to find out the number of subnets, just take your bit value of either 128 64 32 16 8 4 2 1 and divide it by 256. In the example above, we needed eight subnets. All you would have to do is take 256/32 = 8. Then you would count your networks by 32, since you're using the 32 valued bit.

For finding the number of nodes per network, you just start doubling numbers. A /30 can have 4 hosts totals, 2 usable. a /29 has 8, /28 has 16 and so on. The last octet really goes by bit values so it would just go 128 64 32 16 8 4 2 1. That's the number of total hosts, if you minus 2, that would be the number of usable hosts.

Then once you get to the /23, you start doubling from the previous octect. A /24 is 256, /23 is 512, /22 1024. Then just double each time you increase one bit value.

  • I can easily follow it. But then again, I know how subnetting works.
    – Hennes
    Jul 27, 2016 at 16:49
  • -1 you haven't used the word classless, so you clearly haven't clearly addressed his question
    – barlop
    Jul 27, 2016 at 16:58
  • @Hennes I easily follow too because of understanding subnetting lol. But I've used the explanation for people who were completely confused, and then were able to pick up on it after the explanation above.
    – DrZoo
    Jul 27, 2016 at 17:11
  • 1
    @barlop the question was also edited 10 minutes after I posted my answer. I can't know to address a question that didn't exist when I post an answer. Now the question is also asking multiple questions which is technically against the guidelines for questions.
    – DrZoo
    Jul 27, 2016 at 17:14
  • @DrZoo fine, downvote removed from your answer
    – barlop
    Jul 27, 2016 at 17:23

Continued from: https://serverfault.com/questions/49765/how-does-subnetting-work/49836#49836

Your ISP gives you the range the network ID (11000000.10101000.00101000.00000000). You know that you'd like to use a firewall / router device to limit communication between different parts of your network (servers, client computers, network equipment) and, as such,you'd like to break these various parts of your network up into IP subnets (which the firewall / router device can then route between).

You have:

  • 12 server computers, but you might get up to 50% more
  • 9 switches
  • 97 client computers, but you might get more

What's a good way to break up into these pieces?

Thinking in even powers of two, and working with the larger numbers of possible devices, you can come up with:

  • 18 server computers - Next largest power of two is 32
  • 9 switches - Next largest power of two is 16
  • 97 client computers - Next largest power of two is 128

In a given IP subnet, there are two addresses reserved that can't be used as valid device IP addresses-- the address with all zeros in the host ID portion and the address with all ones in the host ID portion. As such, for any given IP subnet, the number of host addresses available is two to the power of the quantity of 32 minus the number of bits in the subnet mask, minus 2. So, in the case of we can see that the subnet mask has 24 bits. That leaves 8 bits available for host IDs. We know that 2 to the 8th power is 256-- meaning that 256 possible combinations of bits fit into a slot 8 bits wide. Since the "11111111" and "00000000" combinations of those 8 bits aren't allowable for host IDs, that leaves us with 254 possible hosts that can be assigned in the network.

Of those 254 hosts, it looks like we can fit the client computers, switches, and server computers into that space, right? Let's try.

You have 8 bits of subnet mask to "play with" (the remaining 8 bits of the IP address not covered by the subnet mask provided by your ISP). We have to work out a way to use those 8 bits to create a number of unique network IDs that can accommodate the devices above.

Start with the largest network - the client computers. You know that the next larger power of two from the number of possible devices is 128. The number 128, in binary, is "10000000". Fortunately for us, that fits into the 8 bit slot we have free (if it didn't, that would be an indication that our starting subnet is too small to accommodate all our devices).

Let's take our network ID, as provided by our ISP, and add a single bit of subnet mask to it, breaking it up into two networks:

11000000.10101000.00101000.00000000 - network ID
11111111.11111111.11111111.00000000 - Old subnet mask (/24)

11000000.10101000.00101000.00000000 - network ID
11111111.11111111.11111111.10000000 - New subnet mask (/25)

11000000.10101000.00101000.10000000 - network ID
11111111.11111111.11111111.10000000 - New subnet mask (/25)

Look over that until it makes sense. We increased the subnet mask by one bit in length, causing the network ID to cover one bit that would have been used for host ID. Since that one bit can be either zero or one, we've effectively split our network into two networks. The first valid IP address in the network will be the first host ID with a "1" in the right-most bit:

11000000.10101000.00101000.00000001 - - First valid host in the network

The first valid host in the network will, likewise, be the first host ID with a "1' in the right-most bit:

11000000.10101000.00101000.10000001 - - First valid host in the network

The last valid host in each network will be the host ID with every bit except the right-most bit set to "1":

11000000.10101000.00101000.01111110 - - Last valid host in the network
11000000.10101000.00101000.11111110 - - Last valid host in the network

So, in this way, we've created a network large enough to hold our client computers, and a second network that we can then apply the same principle to break down into yet smaller networks. Let's make a note:

  • Client computers - - Valid IPs: -

Now, to break down the second network for our servers and switches, we do the same thing.

We have 12 server computers, but we might buy up to 6 more. Let's plan on 18, which leaves us the next highest power of 2 as 32. In binary, 32 is "100000", which is 6 bits long. We have 7 bits of subnet mask left in, so we have enough bits to continue "playing". Adding one more bit of subnet mask gives us two more networks:

11000000.10101000.00101000.10000000 - network ID
11111111.11111111.11111111.10000000 - Old subnet mask (/25)

11000000.10101000.00101000.10000000 - network ID
11111111.11111111.11111111.11000000 - New subnet mask (/26)
11000000.10101000.00101000.10000001 - - First valid host in the network
11000000.10101000.00101000.10111110 - - Last valid host in the network

11000000.10101000.00101000.11000000 - network ID
11111111.11111111.11111111.11000000 - New subnet mask (/26)
11000000.10101000.00101000.11000001 - - First valid host in the network
11000000.10101000.00101000.11111110 - - Last valid host in the network

So, now we've broken up into two more networks, each of which has 26 bits of subnet mask, or a total of 62 possible host IDs-- 2 ^ (32 - 26) - 2.

That means that both of those networks have enough addresses for our servers and switches! Let's make notes:

  • Servers - - Valid IPs: -
  • Switches - - Valid IPs: -

This technique is called variable-length subnet masking (VLSM) and, if properly applied, causes "core routers" to have smaller routing tables (through a process called "route summarization"). In the case of our ISP in this example, they can be totally unaware of how we've subnetted If their router has a packet bound for (one of our switches), they need only know to pass it to our router (since matches the network id and subnet mask in their router's routing table) and our router will get it to the destination. This keeps our subnet routes out of their routing tables. (I'm simplifying here, but you get the idea.)

You can plan very geographically large networks in this same way. As long as you do the right "urban planning" up front (anticipating the number of hosts in each sub-network with some accuracy and an eye to the future) you can create a large routing hierarchy that, at the core routers, "summarizes" to a very small number of routes. As we saw above, the more routes that are in a router's routing table the slower it performs its job. Designing an IP network with VLSM and keeping routing tables small is a Good Thing(tm).

The Unrealism of Examples

The fictional world in this answer is, obviously, fictional. Typically you can make subnets on modern switched Ethernet with more hosts than 254 (traffic profile dependent). As has been pointed out in comments, using /24 networks between routers isn't consistent with Real Life(tm). It makes for cute examples, but is a waste of address space. Typically, a /30 or a /31 (see http://www.faqs.org/rfcs/rfc3021.html for details on how /31's work-- they are beyond the scope of this answer for sure) network is used on links that are strictly point-to-point between two routers.

Not the answer you're looking for? Browse other questions tagged .