Subnetting: Splitting an Address Space

10.0.0.0/24 says: the first 24 bits are fixed (10.0.0), the last 8 vary. 2^8 = 256 addresses, from 10.0.0.0 to 10.0.0.255. Two are reserved — all host bits zero is the network address 10.0.0.0, all host bits one is the broadcast address 10.0.0.255 — leaving 254 usable host addresses, 10.0.0.1 through 10.0.0.254. By convention the router takes .1 (or .254); nothing enforces it.

The general formulas: a /n has 2^(32−n) addresses and 2^(32−n) − 2 usable hosts. The mask in dotted form is n ones followed by zeros: /24 = 255.255.255.0, /25 = 255.255.255.128, /26 = 255.255.255.192, /27 = 255.255.255.224, /28 = 255.255.255.240, /30 = 255.255.255.252 (4 addresses, 2 usable — a point-to-point link), /31 (2 addresses, both usable on point-to-point links per RFC 3021), /32 (one host). Network address = addr AND mask; broadcast = addr OR NOT mask. Everything else in subnetting is this arithmetic.

To split 10.0.0.0/24 into two, extend the mask by one bit: the 25th bit becomes part of the network, and its two values name two subnets — 10.0.0.0/25 (bit is 0, addresses .0–.127) and 10.0.0.128/25 (bit is 1, addresses .128–.255). Each has 128 addresses and 126 usable, because each now pays its own network and broadcast address. Split again to /26 and you have four subnets of 64 (62 usable) at .0, .64, .128, .192. Every bit borrowed doubles the number of subnets, halves their size, and costs two more reserved addresses in total.

The intuition that makes this fast in an interview: the size of a /n subnet in the last octet is 256 ÷ 2^(n−24), and subnets start at multiples of that size. /26 → 64, so boundaries are .0, .64, .128, .192. /27 → 32, boundaries every 32. /28 → 16. To find which /26 contains 10.0.0.150: 150 ÷ 64 = 2 remainder 22, so it is in the third block, 10.0.0.128/26, with broadcast .191. No binary needed once the block size is known.

Nothing says the pieces must be equal. Variable-length subnet masking lets you carve 10.0.0.0/24 into one /25 for 100 workstations (.0–.127), one /26 for 50 servers (.128–.191), one /27 for 20 printers (.192–.223), and a handful of /30s for router links (.224–.227, .228–.231, …), leaving the rest free. The rule is only that each subnet starts on a multiple of its own size and none overlap. Allocate the largest first, from the bottom, so that the leftover is contiguous and can itself be aggregated later.

Cloud VPCs are VLSM in practice: a /16 VPC (10.0.0.0/16) split into /20 or /24 subnets per availability zone and tier. Kubernetes does the same one level down — a pod CIDR of 10.244.0.0/16 from which each node takes a /24 — which is why a cluster’s maximum size is set by prefix arithmetic (256 nodes × 254 pods) before anything else runs out. The reverse operation, aggregation (supernetting), is what routers do: 10.0.0.0/25 and 10.0.0.128/25 are advertised upstream as one 10.0.0.0/24, and the whole of a company’s 10.0.0.0/8 is one line in someone else’s table.

The first reason is the broadcast domain. Every ARP request, DHCP discover and mDNS announcement reaches every host in a subnet; at a few hundred hosts the background chatter is measurable, at a few thousand it is a problem, and a single misbehaving NIC can take the whole segment with it. Subnets bound the blast radius. The second is security and policy: a router or firewall between subnets is a place to say "the guest network may reach the internet and nothing else", "only the bastion may reach the database subnet". Without a subnet boundary there is no place to put the rule — hosts on one segment talk to each other directly, past any firewall. The third is route aggregation: a subnet is one line in a routing table, and a hierarchy of subnets is one line per level, which is the only reason the internet’s core table (~1 million IPv4 prefixes) is not four billion entries.

The cost is address waste — every subnet burns two addresses and rounds up to a power of two — and the operational friction of moving a host between subnets (new address, new gateway, firewall rules). IPv6 removes the first cost entirely by giving every subnet a /64 with 2^64 addresses: subnetting there is purely about topology and policy, never about running out.