Subnetting Tutorial: CIDR Notation, Subnet Masks & IP Addressing Explained
Learn subnetting from scratch with this complete guide. Understand CIDR notation, subnet masks, wildcard masks, IP address classes, VLSM, and practice with step-by-step examples.
Subnetting Tutorial: CIDR Notation, Subnet Masks & IP Addressing Explained
Subnetting is the practice of dividing a single IP network into smaller, more manageable segments called subnets. Every network engineer, system administrator, and cloud architect needs to understand subnetting because it controls how devices communicate, how traffic is isolated, and how efficiently IP address space is allocated.
Whether you are studying for the CompTIA Network+ or Cisco CCNA certification, designing a corporate LAN, or configuring a cloud VPC, subnetting is a foundational skill you will use daily. The concepts may seem intimidating at first glance, especially the binary math, but once you understand the underlying logic, subnet calculations become straightforward.
This guide walks through everything from IP address structure and CIDR notation to VLSM design and cloud networking best practices. Each section includes worked examples so you can follow along. If you want to verify your calculations or experiment with different network sizes, try our free Subnet Calculator as you read.
What Is Subnetting?
Subnetting is the process of taking a single network address block and splitting it into multiple smaller network segments. Each resulting segment, called a subnet, operates as an independent network with its own range of IP addresses, its own network address, and its own broadcast address.
Think of it like dividing a large office building into separate floors. The entire building has one street address (the network address), but each floor has its own suite numbers (host addresses), its own reception desk (gateway), and its own access controls. People on the same floor can talk to each other directly, but to reach someone on a different floor, they must go through the elevator (the router). This separation gives you control over who can communicate with whom, reduces unnecessary traffic on each floor, and makes the building easier to manage.
Why Subnetting Matters
Subnetting provides three critical benefits:
Security and isolation. By placing devices into separate subnets, you can use firewalls and access control lists (ACLs) to restrict traffic between segments. A compromised device in the guest Wi-Fi subnet cannot directly reach servers in the database subnet.
Performance and reduced broadcast traffic. Every device in a subnet receives all broadcast packets sent within that subnet. A single flat /16 network with 65,000 hosts generates enormous broadcast traffic. Breaking it into /24 subnets confines broadcasts to 254 hosts each, dramatically reducing noise.
Efficient IP address allocation. Without subnetting, you would need to request a separate network block from your ISP or regional internet registry (RIR) for every network segment. Subnetting lets you take a single allocated block and carve it into precisely the sizes you need, wasting fewer addresses.
Organizations of every size rely on subnetting. A home network might use a single /24 subnet, while a multinational enterprise might manage thousands of subnets across hundreds of sites. The principles are the same regardless of scale.
How IP Addresses Work
Before you can subnet, you need to understand the structure of an IP address. This section covers IPv4, which remains the dominant protocol for subnetting discussions and certification exams.
The Binary Foundation
An IPv4 address is a 32-bit binary number. Humans write it in dotted-decimal notation for readability, splitting the 32 bits into four groups of 8 bits called octets, separated by dots:
Dotted-decimal: 192.168.1.100
Binary: 11000000.10101000.00000001.01100100
Each octet can represent a value from 0 (all 8 bits are 0) to 255 (all 8 bits are 1). If you need to convert between binary and decimal, our Binary to Decimal Converter handles it instantly.
Network Portion vs. Host Portion
Every IP address is divided into two logical parts:
- Network portion (the leftmost bits): Identifies which network the device belongs to. All devices on the same subnet share the same network portion.
- Host portion (the remaining rightmost bits): Identifies a specific device within that network.
The subnet mask (covered in detail below) is what tells a device where the network portion ends and the host portion begins. For example, in the address 192.168.1.100 with a /24 mask, the first 24 bits (192.168.1) are the network portion and the last 8 bits (.100) are the host portion.
Quick Binary Conversion
To subnet by hand, you need to be comfortable converting between decimal and binary for values 0 to 255. Here are the bit position values for a single octet:
Bit position: 7 6 5 4 3 2 1 0
Bit value: 128 64 32 16 8 4 2 1
To convert decimal 200 to binary: 200 = 128 + 64 + 8 = 11001000. To convert binary 10110010 to decimal: 128 + 32 + 16 + 2 = 178. You can also use our Binary to Decimal Converter or Hex to Decimal Converter for quick lookups.
Understanding CIDR Notation
CIDR (Classless Inter-Domain Routing) notation is the standard way to express an IP address and its associated subnet mask in a single compact format. It was introduced in 1993 through RFC 1518 and RFC 1519 to replace the rigid classful addressing system that was rapidly exhausting the IPv4 address space.
How CIDR Notation Works
CIDR notation appends a forward slash and a number to an IP address. The number after the slash, called the prefix length, indicates how many of the 32 bits in the address are the network portion:
192.168.1.0/24
In this example, /24 means the first 24 bits are the network portion and the remaining 8 bits are the host portion.
Common CIDR Prefix Lengths
| CIDR | Network Bits | Host Bits | Total Addresses | Usable Hosts |
|---|---|---|---|---|
| /8 | 8 | 24 | 16,777,216 | 16,777,214 |
| /16 | 16 | 16 | 65,536 | 65,534 |
| /24 | 24 | 8 | 256 | 254 |
| /25 | 25 | 7 | 128 | 126 |
| /26 | 26 | 6 | 64 | 62 |
| /27 | 27 | 5 | 32 | 30 |
| /28 | 28 | 4 | 16 | 14 |
| /30 | 30 | 2 | 4 | 2 |
| /32 | 32 | 0 | 1 | 1 |
The "usable hosts" column is always the total addresses minus 2, because every subnet reserves one address for the network address (all host bits set to 0) and one for the broadcast address (all host bits set to 1). The exception is /31 (used on point-to-point links per RFC 3021) and /32 (a single host route).
Why CIDR Replaced Classful Addressing
Before CIDR, IP addresses were assigned in fixed-size classes. If an organization needed 300 addresses, it could not get a /24 (256 addresses) because that was too small. It had to receive a Class B (/16) with 65,536 addresses, wasting over 65,000 addresses. This inefficiency was draining the IPv4 pool at an alarming rate.
CIDR eliminated these fixed boundaries. Under CIDR, an ISP can allocate a /23 (512 addresses) or a /22 (1,024 addresses) or any prefix length that fits the actual need. This flexibility, combined with NAT, extended the useful life of IPv4 by decades. Today, all modern routing protocols (BGP, OSPF, EIGRP) use CIDR, and classful addressing is functionally obsolete.
Use our Subnet Calculator to experiment with different CIDR prefix lengths and see exactly how many hosts each one provides.
Subnet Masks Explained
A subnet mask is a 32-bit number that separates the network portion of an IP address from the host portion. It works in lockstep with the IP address: every bit position where the subnet mask has a 1 belongs to the network portion, and every bit position where the mask has a 0 belongs to the host portion.
Binary Representation
A subnet mask always consists of a contiguous block of 1s followed by a contiguous block of 0s. There are no gaps. Here are three common subnet masks in both dotted-decimal and binary:
/24 = 255.255.255.0 = 11111111.11111111.11111111.00000000
/25 = 255.255.255.128 = 11111111.11111111.11111111.10000000
/26 = 255.255.255.192 = 11111111.11111111.11111111.11000000
The CIDR prefix length is simply the count of contiguous 1-bits. A /24 mask has 24 ones and 8 zeros. A /26 mask has 26 ones and 6 zeros.
The AND Operation
To determine which network a given IP address belongs to, a device performs a bitwise AND between the IP address and the subnet mask. The result is the network address:
IP Address: 192.168.1.100 = 11000000.10101000.00000001.01100100
Subnet Mask: 255.255.255.0 = 11111111.11111111.11111111.00000000
────────────────────────────────────
Network Addr: 192.168.1.0 = 11000000.10101000.00000001.00000000
Any bit in the IP address that lines up with a 1 in the mask is preserved; any bit that lines up with a 0 is zeroed out. The result tells the device: "This IP belongs to the 192.168.1.0 network."
Two devices are on the same subnet if and only if the AND operation on both of their IP addresses with the same subnet mask produces the same network address. If the results differ, traffic must be forwarded through a router.
Wildcard Masks
A wildcard mask is the bitwise inverse of a subnet mask. Where the subnet mask has a 1, the wildcard mask has a 0, and vice versa. Wildcard masks are used in Cisco ACLs and OSPF configurations to specify which bits of an address to match and which to ignore.
Subnet Mask: 255.255.255.192 → Wildcard Mask: 0.0.0.63
Subnet Mask: 255.255.255.0 → Wildcard Mask: 0.0.0.255
Subnet Mask: 255.255.0.0 → Wildcard Mask: 0.0.255.255
To calculate a wildcard mask, subtract each octet of the subnet mask from 255. For example, 255 - 192 = 63.
Subnet Mask vs. Wildcard Mask Comparison
| CIDR | Subnet Mask | Wildcard Mask | Purpose of Subnet Mask | Purpose of Wildcard Mask |
|---|---|---|---|---|
| /24 | 255.255.255.0 | 0.0.0.255 | Defines network boundary | Matches all hosts in the /24 |
| /26 | 255.255.255.192 | 0.0.0.63 | Defines network boundary | Matches 64 addresses in ACL/OSPF |
| /28 | 255.255.255.240 | 0.0.0.15 | Defines network boundary | Matches 16 addresses in ACL/OSPF |
| /30 | 255.255.255.252 | 0.0.0.3 | Defines network boundary | Matches 4 addresses (point-to-point) |
| /16 | 255.255.0.0 | 0.0.255.255 | Defines network boundary | Matches entire Class B-sized block |
The subnet mask answers the question "What is the network address?" while the wildcard mask answers "Which bits do I care about when matching?"
IP Address Classes
Before CIDR, IPv4 addresses were organized into five classes. Although classful addressing is obsolete in practice, understanding the classes remains important for certification exams, interpreting legacy documentation, and recognizing default subnet masks that operating systems and devices still apply.
| Class | First Octet Range | Default Mask | CIDR | Number of Networks | Hosts per Network | Purpose |
|---|---|---|---|---|---|---|
| A | 1 - 126 | 255.0.0.0 | /8 | 126 | 16,777,214 | Large organizations |
| B | 128 - 191 | 255.255.0.0 | /16 | 16,384 | 65,534 | Medium organizations |
| C | 192 - 223 | 255.255.255.0 | /24 | 2,097,152 | 254 | Small organizations |
| D | 224 - 239 | N/A | N/A | N/A | N/A | Multicast |
| E | 240 - 255 | N/A | N/A | N/A | N/A | Experimental/Reserved |
Notable Ranges
- 0.0.0.0/8: "This network" -- used by hosts during bootstrapping (DHCP discovery).
- 127.0.0.0/8: Loopback. Any address in this range (most commonly
127.0.0.1) refers to the local device itself. Traffic sent to a loopback address never reaches the network. - 169.254.0.0/16: Link-local (APIPA). Assigned automatically when DHCP is unavailable.
Why Classful Is Obsolete
The rigid class system wasted enormous amounts of address space. A company with 500 hosts could not use a Class C (/24, max 254 hosts) and had to receive a Class B (/16, max 65,534 hosts), leaving over 65,000 addresses unused. CIDR solved this by allowing any prefix length, so that same company could receive a /23 (510 usable hosts) with minimal waste. Modern networks universally use CIDR-based subnetting.
Private IP Address Ranges
RFC 1918 defines three IP address ranges reserved for private use. These addresses are not routable on the public internet, meaning routers on the internet backbone will drop any packets with these source or destination addresses. To access the internet, devices with private addresses use Network Address Translation (NAT), where a router replaces the private source address with a public one before forwarding the packet.
| RFC 1918 Range | CIDR Block | Number of Addresses | Typical Use |
|---|---|---|---|
| 10.0.0.0 - 10.255.255.255 | 10.0.0.0/8 | 16,777,216 | Enterprise networks, cloud VPCs |
| 172.16.0.0 - 172.31.255.255 | 172.16.0.0/12 | 1,048,576 | Medium enterprise, branch offices |
| 192.168.0.0 - 192.168.255.255 | 192.168.0.0/16 | 65,536 | Home and small office networks |
Common Usage Patterns
Enterprise networks typically use the 10.0.0.0/8 space because it provides over 16 million addresses, enough to subnet into thousands of segments for departments, sites, and services. A common scheme is 10.{site}.{vlan}.{host}.
Home networks almost universally use 192.168.0.0/24 or 192.168.1.0/24, assigned by the consumer router's DHCP server. The router performs NAT to share a single public IP address among all home devices.
Cloud environments (AWS, Azure, GCP) default to the 10.0.0.0/8 or 172.16.0.0/12 ranges for virtual private clouds and virtual networks, giving architects plenty of room to design multi-tier subnet architectures.
Step-by-Step Subnetting Examples
The best way to internalize subnetting is to work through examples by hand. Here are three progressively complex scenarios.
Example 1: Split 192.168.1.0/24 Into 4 Equal Subnets
Goal: Divide a single /24 network (256 addresses) into 4 equal subnets.
Step 1: Determine how many bits to borrow. To create 4 subnets, you need 2 additional network bits because 2^2 = 4. The original prefix is /24, so the new prefix is /24 + 2 = /26.
Step 2: Calculate addresses per subnet. A /26 has 32 - 26 = 6 host bits, giving 2^6 = 64 total addresses per subnet, with 62 usable hosts (subtracting the network and broadcast addresses).
Step 3: List the subnets.
| Subnet | Network Address | First Usable | Last Usable | Broadcast Address |
|---|---|---|---|---|
| 1 | 192.168.1.0/26 | 192.168.1.1 | 192.168.1.62 | 192.168.1.63 |
| 2 | 192.168.1.64/26 | 192.168.1.65 | 192.168.1.126 | 192.168.1.127 |
| 3 | 192.168.1.128/26 | 192.168.1.129 | 192.168.1.190 | 192.168.1.191 |
| 4 | 192.168.1.192/26 | 192.168.1.193 | 192.168.1.254 | 192.168.1.255 |
Each subnet increments by 64 (the block size, which is 2^host_bits = 2^6 = 64). You can verify these results with our Subnet Calculator.
Example 2: How Many Hosts in a /27?
Given: A /27 subnet.
Step 1: Calculate host bits. 32 - 27 = 5 host bits.
Step 2: Calculate total addresses. 2^5 = 32 total addresses.
Step 3: Calculate usable hosts. 32 - 2 = 30 usable host addresses.
The network address uses the first address (all host bits = 0) and the broadcast address uses the last address (all host bits = 1). The remaining 30 can be assigned to devices.
Example 3: Find the Network Address for 10.45.67.89/20
Given: IP address 10.45.67.89 with a /20 subnet mask.
Step 1: Convert the relevant octets to binary. The /20 mask spans the first two full octets (16 bits) plus 4 more bits into the third octet. We need to focus on the third octet where the mask boundary falls.
Third octet (67): 01000011
Fourth octet (89): 01011001
Step 2: Write the subnet mask for /20. The mask has 20 ones: the first two octets are all 1s (255.255), then the third octet has 4 ones followed by 4 zeros:
Mask third octet: 11110000 (decimal 240)
Mask fourth octet: 00000000 (decimal 0)
Subnet mask: 255.255.240.0
Step 3: Perform the AND operation on the third octet.
67 in binary: 01000011
Mask: 11110000
AND result: 01000000 = 64
Step 4: Assemble the network address. The first two octets pass through unchanged (10.45). The third octet becomes 64. The fourth octet becomes 0. The network address is:
10.45.64.0/20
This means 10.45.67.89 belongs to the 10.45.64.0/20 network, which spans from 10.45.64.0 to 10.45.79.255 (4,096 addresses, 4,094 usable hosts).
VLSM -- Variable Length Subnet Masking
In the examples above, we divided a network into equal-sized subnets. In the real world, however, different segments have vastly different requirements. A server VLAN might need 14 addresses while a user LAN needs 200. Assigning equally-sized /24 subnets to both wastes hundreds of addresses on the server segment.
Variable Length Subnet Masking (VLSM) solves this problem by allowing each subnet to have a different prefix length, tailored to the number of hosts it actually needs.
VLSM vs. FLSM
| Feature | FLSM (Fixed Length) | VLSM (Variable Length) |
|---|---|---|
| Subnet sizes | All subnets are the same size | Each subnet can be a different size |
| Address efficiency | Poor for mixed requirements | High -- sized to actual need |
| Routing protocol support | RIPv1 (legacy) | RIPv2, OSPF, EIGRP, BGP |
| Design complexity | Simple | Requires planning |
VLSM Design Example
Scenario: You have been allocated 172.16.10.0/24 (256 addresses) and need to create subnets for:
- User LAN: 100 hosts
- Server VLAN: 12 hosts
- Management VLAN: 25 hosts
- Two point-to-point router links: 2 hosts each
Step 1: Sort requirements from largest to smallest.
- User LAN: 100 hosts -> needs at least 128 addresses -> /25 (126 usable)
- Management VLAN: 25 hosts -> needs at least 32 addresses -> /27 (30 usable)
- Server VLAN: 12 hosts -> needs at least 16 addresses -> /28 (14 usable)
- Point-to-point link 1: 2 hosts -> needs 4 addresses -> /30 (2 usable)
- Point-to-point link 2: 2 hosts -> needs 4 addresses -> /30 (2 usable)
Step 2: Allocate from the beginning of the address block, largest subnet first.
| Subnet | CIDR | Range | Usable Hosts |
|---|---|---|---|
| User LAN | 172.16.10.0/25 | 172.16.10.0 - 172.16.10.127 | 126 |
| Management VLAN | 172.16.10.128/27 | 172.16.10.128 - 172.16.10.159 | 30 |
| Server VLAN | 172.16.10.160/28 | 172.16.10.160 - 172.16.10.175 | 14 |
| Point-to-point link 1 | 172.16.10.176/30 | 172.16.10.176 - 172.16.10.179 | 2 |
| Point-to-point link 2 | 172.16.10.180/30 | 172.16.10.180 - 172.16.10.183 | 2 |
Total used: 128 + 32 + 16 + 4 + 4 = 184 addresses out of 256. The remaining 72 addresses (172.16.10.184 - 172.16.10.255) are available for future growth.
If we had used FLSM with equal /27 subnets, we could only create 8 subnets of 30 hosts each, and the User LAN with its 100 hosts would not fit into any single subnet. VLSM makes the design possible.
Key VLSM Rules
- Always allocate the largest subnet first to maintain contiguous address space and avoid overlap.
- Each subnet must start on a boundary that is a multiple of its block size. A /28 (block size 16) must start at .0, .16, .32, .48, etc.
- Subnets must not overlap. After allocating a range, the next subnet starts at the first address after the previous subnet's broadcast address.
- Use /30 or /31 for point-to-point links. A /30 provides 2 usable addresses (one per router interface). RFC 3021 allows /31 on point-to-point links, eliminating the network and broadcast addresses to save the extra 2 addresses.
Subnetting for Cloud Networks
Cloud providers have adopted subnetting as a core building block of virtual networking, but the implementation differs from traditional on-premises environments in several important ways.
Cloud VPC Subnetting
AWS VPC: When you create a VPC, you define a CIDR block (e.g., 10.0.0.0/16). Within that VPC, you create subnets, each with its own CIDR range that must be a subset of the VPC CIDR. AWS reserves 5 addresses in every subnet: the network address, the VPC router (first usable address), the DNS server (second usable address), a reserved-for-future-use address, and the broadcast address. So a /24 in AWS has 251 usable addresses, not 254.
Azure VNet: Azure Virtual Networks work similarly. You define an address space and create subnets within it. Azure reserves 5 addresses per subnet: the network address, the default gateway, two DNS-mapped addresses, and the broadcast address.
GCP VPC: Google Cloud uses a globally distributed VPC model. Subnets are regional (not per-availability-zone like AWS). GCP reserves 4 addresses per subnet: the network address, the default gateway, the second-to-last address, and the broadcast address.
Cloud Subnetting Best Practices
Plan for growth. Expanding a VPC CIDR block after deployment is possible on some providers but can be complex. Start with a larger block (e.g., /16) even if you only need a few subnets today.
Use consistent addressing schemes. Assign meaning to octets. For example: 10.{environment}.{tier}.{host} where environment 1 = production, 2 = staging, and tier 1 = web, 2 = app, 3 = database.
Separate public and private subnets. Place internet-facing resources (load balancers, bastion hosts) in public subnets with an internet gateway. Place application servers and databases in private subnets with no direct internet access, using NAT gateways for outbound traffic only.
Avoid overlapping CIDRs. If you plan to peer VPCs, connect via VPN to on-premises networks, or use transit gateways, ensure no two connected networks share the same CIDR range. Overlapping ranges make routing ambiguous and peering impossible.
Account for reserved addresses. Remember that cloud providers reserve more addresses per subnet than traditional networks. Factor this into your capacity planning.
Subnet Cheat Sheet
This quick-reference table covers every common CIDR prefix length from /8 to /32. Print it, bookmark it, or keep it open alongside our Subnet Calculator when designing networks.
| CIDR | Subnet Mask | Wildcard Mask | Total IPs | Usable Hosts |
|---|---|---|---|---|
| /8 | 255.0.0.0 | 0.255.255.255 | 16,777,216 | 16,777,214 |
| /9 | 255.128.0.0 | 0.127.255.255 | 8,388,608 | 8,388,606 |
| /10 | 255.192.0.0 | 0.63.255.255 | 4,194,304 | 4,194,302 |
| /11 | 255.224.0.0 | 0.31.255.255 | 2,097,152 | 2,097,150 |
| /12 | 255.240.0.0 | 0.15.255.255 | 1,048,576 | 1,048,574 |
| /13 | 255.248.0.0 | 0.7.255.255 | 524,288 | 524,286 |
| /14 | 255.252.0.0 | 0.3.255.255 | 262,144 | 262,142 |
| /15 | 255.254.0.0 | 0.1.255.255 | 131,072 | 131,070 |
| /16 | 255.255.0.0 | 0.0.255.255 | 65,536 | 65,534 |
| /17 | 255.255.128.0 | 0.0.127.255 | 32,768 | 32,766 |
| /18 | 255.255.192.0 | 0.0.63.255 | 16,384 | 16,382 |
| /19 | 255.255.224.0 | 0.0.31.255 | 8,192 | 8,190 |
| /20 | 255.255.240.0 | 0.0.15.255 | 4,096 | 4,094 |
| /21 | 255.255.248.0 | 0.0.7.255 | 2,048 | 2,046 |
| /22 | 255.255.252.0 | 0.0.3.255 | 1,024 | 1,022 |
| /23 | 255.255.254.0 | 0.0.1.255 | 512 | 510 |
| /24 | 255.255.255.0 | 0.0.0.255 | 256 | 254 |
| /25 | 255.255.255.128 | 0.0.0.127 | 128 | 126 |
| /26 | 255.255.255.192 | 0.0.0.63 | 64 | 62 |
| /27 | 255.255.255.224 | 0.0.0.31 | 32 | 30 |
| /28 | 255.255.255.240 | 0.0.0.15 | 16 | 14 |
| /29 | 255.255.255.248 | 0.0.0.7 | 8 | 6 |
| /30 | 255.255.255.252 | 0.0.0.3 | 4 | 2 |
| /31 | 255.255.255.254 | 0.0.0.1 | 2 | 2* |
| /32 | 255.255.255.255 | 0.0.0.0 | 1 | 1 |
*Per RFC 3021, /31 subnets on point-to-point links use both addresses for hosts (no network or broadcast address).
How to use this table: Find the number of hosts you need in the "Usable Hosts" column, then read across to get the CIDR prefix, subnet mask, and wildcard mask. For example, if you need 50 hosts, the smallest subnet that fits is /26 (62 usable hosts).
Frequently Asked Questions
What is the difference between a subnet and a VLAN?
A subnet is a Layer 3 (network layer) concept. It defines a range of IP addresses that share a common network prefix. A VLAN (Virtual LAN) is a Layer 2 (data link layer) concept. It logically groups switch ports so that devices in the same VLAN share a broadcast domain, regardless of their physical location.
In practice, there is almost always a one-to-one mapping between a VLAN and a subnet. VLAN 10 might correspond to subnet 10.1.10.0/24, and VLAN 20 to 10.1.20.0/24. Traffic between VLANs (and therefore between subnets) requires a Layer 3 device such as a router or a Layer 3 switch performing inter-VLAN routing.
How do I know what subnet mask to use?
Start by determining the number of host addresses you need in the subnet. Then find the smallest CIDR prefix that accommodates that number using the formula: usable hosts = 2^(32 - prefix) - 2. Add a growth buffer of 20-50% to account for future expansion. For example, if you need 45 hosts today and expect moderate growth, target about 60 usable hosts, which means a /26 (62 usable) is the right choice.
Can I subnet a subnet?
Yes. This is exactly what VLSM does. You take a subnet and divide it into smaller subnets. For example, you could take a /24 and split it into a /25 and two /26s. The only rule is that the sub-subnets must fit within the parent subnet's address range and must not overlap.
What is supernetting?
Supernetting (also called route aggregation or summarization) is the opposite of subnetting. Instead of dividing a network into smaller parts, you combine multiple contiguous networks into a single larger network. For example, four contiguous /24 networks (192.168.0.0/24 through 192.168.3.0/24) can be summarized as a single /22 route (192.168.0.0/22). This reduces the number of entries in routing tables, improving router performance and convergence time.
How many subnets can I create from a /16?
It depends on the subnet size you choose. If you subnet a /16 into /24s, you get 2^(24-16) = 256 subnets, each with 254 usable hosts. If you subnet into /20s, you get 2^(20-16) = 16 subnets, each with 4,094 usable hosts. If you use /28s, you get 2^(28-16) = 4,096 subnets, each with 14 usable hosts. With VLSM, you can mix sizes to match your actual requirements.
What is the smallest usable subnet?
For standard networks, a /30 is the smallest practical subnet. It provides 4 total addresses: 1 network address, 2 usable host addresses, and 1 broadcast address. This is the traditional choice for point-to-point links between two routers. RFC 3021 also allows /31 subnets on point-to-point links, which provide exactly 2 addresses with no network or broadcast address reserved. A /32 represents a single host and is used for loopback interfaces and host routes, not as a subnet in the traditional sense.
Conclusion
Subnetting is a skill that bridges theory and daily practice. From calculating the number of usable hosts in a /27 to designing a VLSM scheme for a multi-site enterprise or architecting subnets in a cloud VPC, the concepts covered in this guide form the foundation of every IP network.
The key takeaways are: IP addresses have a network portion and a host portion separated by the subnet mask; CIDR notation replaced wasteful classful addressing; the AND operation reveals the network address; VLSM lets you size each subnet to its actual need; and cloud networks add their own reserved-address quirks that you must account for.
If you want to practice without the manual binary math, use our Subnet Calculator to instantly compute network addresses, broadcast addresses, usable host ranges, and wildcard masks for any CIDR block. The more you practice, the faster these calculations become second nature.