Subnetting basics: the binary you actually need

Most people who "can't do subnetting" are really just uncomfortable with binary. The good news: you only need a tiny slice of it, and once it clicks you can subnet anything without a reference card. This guide builds that slice from scratch and ends with a /24 split entirely by hand.

An IP address is 32 switches

An IPv4 address such as 192.168.1.42 looks like four numbers, but to the computer it is one row of 32 bits — 32 on/off switches — grouped into four octets of 8 bits each. Each octet can hold 0–255 because 8 bits count from 00000000 (0) to 11111111 (255).

Within an octet, each bit has a fixed value, halving from left to right:

bit value:  128  64  32  16   8   4   2   1
            ─────────────────────────────────
  192   =    1    1   0   0    0   0   0   0   (128 + 64)
  168   =    1    0   1   0    1   0   0   0   (128 + 32 + 8)
    1   =    0    0   0   0    0   0   0   1   (1)
   42   =    0    0   1   0    1   0   1   0   (32 + 8 + 2)

That is the entire binary you need. To convert any octet to binary, subtract the bit values from left to right whenever they fit. To go back, add up the columns that are on.

The mask draws a line through the 32 bits

A subnet mask decides where the network part of the address ends and the host part begins. In CIDR notation, /24 means "the first 24 bits are network, the last 8 are host." Written out, a /24 mask is 24 ones followed by 8 zeros:

/24 mask = 11111111.11111111.11111111.00000000
         = 255      .255      .255      .0

Everywhere the mask has a 1, that bit of the address belongs to the network. Everywhere it has a 0, that bit identifies a host inside the network. The slash number is simply how many leading ones the mask has.

Finding the network address: the AND operation

To find which network an address belongs to, line the address up against the mask and keep a bit only where both are 1. This is a bitwise AND. Take 192.168.1.42/24:

address  192.168.1.42  = 11000000.10101000.00000001.00101010
mask     /24           = 11111111.11111111.11111111.00000000
                          ───────────────────────────────────
network                = 11000000.10101000.00000001.00000000
                        = 192.168.1.0

The mask zeroes out the entire last octet, so every address from 192.168.1.0 to 192.168.1.255 shares the same network: 192.168.1.0/24. The network address has all host bits 0; the broadcast address has all host bits 1 (192.168.1.255). Neither is assignable to a device, which is why a /24 has 256 addresses but only 254 usable hosts.

Counting hosts

The host part has 32 − prefix bits. A /24 leaves 8 host bits, so 2⁸ = 256 addresses, minus 2 for network and broadcast = 254 usable. The pattern:

Worked example: split a /24 into four /26s

You have 192.168.1.0/24 and want four equal subnets. Four subnets need 2 extra network bits (2² = 4), so the new prefix is /24 + 2 = /26. A /26 has 6 host bits = 64 addresses each. The subnets step in blocks of 64:

192.168.1.0/26     hosts .1   – .62    (broadcast .63)
192.168.1.64/26    hosts .65  – .126   (broadcast .127)
192.168.1.128/26   hosts .129 – .190   (broadcast .191)
192.168.1.192/26   hosts .193 – .254   (broadcast .255)

The "magic number" is the block size, 64 here: each network address is a multiple of it, the broadcast is one below the next network, and the usable range sits in between. Change the split to /27 and the block size becomes 32, giving eight subnets; /28 gives sixteen blocks of 16. That single number — 256 minus the mask's last non-zero octet — is the whole trick.

Practice, then check

Try these in your head, then confirm with the IPv4 calculator: what is the network and broadcast of 10.20.30.200/27? How many usable hosts in a /22? What block size does a /29 step in? When the by-hand answer and the calculator agree every time, you have it.