What Is Subnetting and CIDR Notation?

Why Subnets Exist

Without subnetting, every device on the internet would be on one flat network. Every broadcast would reach every device. Every router would need a route to every individual IP address. The internet would have collapsed under its own weight before it reached a million hosts.

Subnetting divides a large network into smaller, manageable segments. Each subnet is its own broadcast domain. Routers forward traffic between subnets, but broadcasts stay contained within their subnet. This reduces broadcast traffic, improves security (you can apply different policies to different subnets), and makes networks easier to manage.

IP Addresses in Binary

An IPv4 address is 32 bits written as four decimal octets. To understand subnetting, you need to think in binary. The address 192.168.1.100 in binary is:

11000000.10101000.00000001.01100100

Each octet is 8 bits. The decimal value of each octet ranges from 0 (00000000) to 255 (11111111). The 32 bits are divided into two parts: the network portion (identifying which subnet) and the host portion (identifying which device on that subnet). The subnet mask determines where the division falls.

Subnet Masks

A subnet mask is a 32-bit value where all the network bits are set to 1 and all the host bits are set to 0. For example:

255.255.255.0 = 11111111.11111111.11111111.00000000

This mask says: the first 24 bits are the network portion, the last 8 bits are the host portion. Any two devices with the same first 24 bits are on the same subnet.

To determine which subnet an IP address belongs to, perform a bitwise AND between the IP address and the subnet mask:

192.168.1.100 AND 255.255.255.0 = 192.168.1.0

The result (192.168.1.0) is the network address - the identifier for the subnet. All devices with addresses 192.168.1.1 through 192.168.1.254 are on this subnet (192.168.1.0 is the network address and 192.168.1.255 is the broadcast address, neither available for hosts).

CIDR Notation

CIDR (Classless Inter-Domain Routing) notation is shorthand for expressing a subnet. Instead of writing the full subnet mask, you append a slash and the number of network bits to the IP address:

• 192.168.1.0/24 means the first 24 bits are the network portion (subnet mask 255.255.255.0)
• 10.0.0.0/8 means the first 8 bits are the network portion (subnet mask 255.0.0.0)
• 172.16.0.0/12 means the first 12 bits are the network portion (subnet mask 255.240.0.0)
• 192.168.1.0/28 means the first 28 bits are the network portion (subnet mask 255.255.255.240)

The higher the CIDR number, the more bits are used for the network and fewer for hosts - meaning smaller subnets with fewer addresses. A /24 has 254 usable host addresses. A /28 has 14. A /30 has 2 (commonly used for point-to-point links between routers).

Calculating Network and Host Ranges

For any CIDR block, you can calculate the number of usable host addresses with the formula: 2^(32 - prefix length) - 2. The minus 2 accounts for the network address (all host bits 0) and the broadcast address (all host bits 1), neither of which can be assigned to a device.

Examples:

CIDR	Subnet Mask	Total Addresses	Usable Hosts	Typical Use
/8	255.0.0.0	16,777,216	16,777,214	Large ISP or enterprise
/16	255.255.0.0	65,536	65,534	Large campus network
/24	255.255.255.0	256	254	Standard LAN subnet
/28	255.255.255.240	16	14	Small department or VLAN
/30	255.255.255.252	4	2	Point-to-point router link
/32	255.255.255.255	1	1	Single host route

graph TD
    NET["10.0.0.0/8
16.7 million addresses"] --> S1["10.1.0.0/16
65,534 hosts"]
    NET --> S2["10.2.0.0/16
65,534 hosts"]
    NET --> S3["10.3.0.0/16
65,534 hosts"]
    S1 --> SS1["10.1.1.0/24
254 hosts"]
    S1 --> SS2["10.1.2.0/24
254 hosts"]
    S2 --> SS3["10.2.1.0/24
254 hosts"]
    S2 --> SS4["10.2.2.0/24
254 hosts"]

Common Subnet Sizes

Three private address ranges are reserved for internal use (RFC 1918). These addresses are not routable on the public internet and are what NAT translates from:

• 10.0.0.0/8 - 16.7 million addresses. Used by large enterprises and cloud providers for internal networks.
• 172.16.0.0/12 - about 1 million addresses. Less commonly used but valid for medium-to-large private networks.
• 192.168.0.0/16 - 65,534 addresses. The most common range for home and small office networks. Your home router likely uses 192.168.0.0/24 or 192.168.1.0/24.

Most home networks use a /24, which provides 254 usable addresses. Enterprise networks might use /22 (1022 hosts) for a large floor, /28 (14 hosts) for a server VLAN, or /30 (2 hosts) for router interconnects.

Why Subnetting Matters for Security

Subnetting is the foundation of network segmentation, which is one of the most effective security controls. Placing IoT devices, guest WiFi, servers, and workstations on separate subnets with firewall rules between them limits lateral movement when a device is compromised.

During a security assessment, identifying the subnet structure is one of the first reconnaissance steps. The subnet mask tells you how many other devices are on the same segment, what the address range is, and where the boundaries are. The BLEShark Nano captures this information when it connects to a network - the DHCP response includes the subnet mask, revealing the subnet size and scope.

Get the BLEShark Nano