Subnetting: How IP Networks Are Divided
Subnetting is the practice of dividing a single IP network into smaller logical sub-networks, called subnets. This improves network performance by reducing broadcast traffic, enhances security by isolating groups of hosts, and enables more efficient use of the IP address space. Understanding subnetting is fundamental to network engineering, system administration, and anyone who configures routers, firewalls, or cloud networking resources.
IP Addresses and Dotted Decimal Notation
An IPv4 address is a 32-bit number, typically written in dotted decimal notation as four groups of decimal numbers from 0 to 255, separated by dots: for example, 192.168.1.100. Each group represents 8 bits (an octet). The address space spans from 0.0.0.0 to 255.255.255.255, for a total of about 4.3 billion addresses. In practice, many of these are reserved for special purposes: private networks, multicast, loopback, and broadcast.
CIDR Notation and Prefix Length
CIDR (Classless Inter-Domain Routing) notation expresses a network address and its mask together: 192.168.1.0/24. The number after the slash is the prefix length — the number of leading 1-bits in the subnet mask. A /24 prefix means the first 24 bits are the network portion and the remaining 8 bits are the host portion. The subnet mask is the prefix length written in dotted decimal: /24 corresponds to 255.255.255.0.
Key Subnet Concepts
The network address is the first address in the subnet — all host bits are 0. It identifies the network but cannot be assigned to a host. The broadcast address is the last address — all host bits are 1. It is used to send data to all hosts on the subnet simultaneously and also cannot be assigned to a host. The usable host range is everything in between: total addresses minus 2 (network and broadcast). For a /24 subnet, 256 − 2 = 254 usable hosts.
Wildcard Masks
A wildcard mask is the inverse of the subnet mask — each bit that is 0 in the subnet mask becomes 1 in the wildcard, and vice versa. The wildcard for 255.255.255.0 is 0.0.0.255. Wildcard masks are used in Cisco access control lists (ACLs) and OSPF configurations to specify which bits of an address must match. They work differently from subnet masks — a 1 bit in a wildcard means "any value," while a 0 bit means "must match exactly."
IP Classes
Before CIDR, IP addresses were assigned in fixed classes. Class A (1.0.0.0–126.255.255.255, default mask /8) for very large networks. Class B (128.0.0.0–191.255.255.255, default /16) for medium networks. Class C (192.0.0.0–223.255.255.255, default /24) for small networks. Class D (224.0.0.0–239.255.255.255) is reserved for multicast. Class E (240.0.0.0–255.255.255.255) is experimental. Today, CIDR has replaced classful addressing in routing, but understanding classes helps interpret address ranges and defaults in many tools and documentation.