Networking · Fundamentals
Subnetting & CIDR
Dividing IP address space into right sized networks using prefix length notation, so that routing, segmentation and growth all remain manageable.
IntermediateUpdated 2026-09-01
Overview
A subnet is a contiguous block of addresses sharing a common prefix. CIDR notation writes the prefix length after the address, 10.20.30.0/24 means the first 24 bits identify the network and the remaining 8 bits identify hosts.
Subnet design is an architecture decision, not arithmetic trivia. Prefix boundaries determine broadcast domain size, where routing and firewalling occur, and how cleanly address space can be summarised in route tables and firewall rules.
How it works
- 01The network address has all host bits set to zero and the broadcast address has them all set to one; neither is assignable to a host in IPv4.
- 02Variable length subnet masking allows different prefix lengths inside one supernet, so point to point links do not waste a /24.
- 03Route summarisation advertises one shorter prefix in place of many longer ones, shrinking route tables and improving convergence.
- 04RFC 1918 reserves 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16 for private use; cloud providers also reserve several addresses per subnet for platform services.
Why it matters
- Well planned space allows firewall and routing policy to be written against summaries rather than sprawling host lists.
- Overlapping address space is the single most common blocker for mergers, VPNs and cloud connectivity.
- Right sized broadcast domains limit both broadcast noise and lateral movement.
Reference table
| Prefix | Mask | Total addresses | Usable hosts | Typical use |
|---|---|---|---|---|
| /30 | 255.255.255.252 | 4 | 2 | Point to point links |
| /29 | 255.255.255.248 | 8 | 6 | Small device blocks |
| /28 | 255.255.255.240 | 16 | 14 | Small server segments |
| /26 | 255.255.255.192 | 64 | 62 | Small office VLAN |
| /24 | 255.255.255.0 | 256 | 254 | Standard access VLAN |
| /22 | 255.255.252.0 | 1024 | 1022 | Large campus VLAN or cloud subnet |
| /16 | 255.255.0.0 | 65536 | 65534 | Site or region supernet |
Security considerations
- Segment by trust and function, not by convenience, servers, user devices, management interfaces, guest and printers all warrant separation.
- Reserve dedicated management ranges and permit access to them only from privileged access workstations or a jump host.
- Document what each prefix contains so detection rules and firewall reviews stay meaningful.
Common misconfigurations
- Using 192.168.0.0/24 or 192.168.1.0/24 at every site, guaranteeing overlap when sites are later connected.
- Allocating /24s everywhere, then running out of contiguous space for summarisation.
- Placing cloud virtual networks inside ranges already used on premises.