11. Subnetting, CIDR, and VLSM with worked examples
11.1 The mask, three ways
/24 ⇔ 255.255.255.0 ⇔ 11111111 11111111 11111111 00000000.
Memorize the last-octet values:
| Prefix | Mask (last non-255 octet) | Block size | Usable hosts |
|---|---|---|---|
| /24 | 0 | 256 | 254 |
| /25 | 128 | 128 | 126 |
| /26 | 192 | 64 | 62 |
| /27 | 224 | 32 | 30 |
| /28 | 240 | 16 | 14 |
| /29 | 248 | 8 | 6 |
| /30 | 252 | 4 | 2 |
| /31 | 254 | 2 | 2 (point-to-point, RFC 3021) |
| /32 | 255 | 1 | 1 (host route) |
Larger blocks:
| Prefix | Mask | # of /24s | Addresses |
|---|---|---|---|
| /23 | 255.255.254.0 | 2 | 512 |
| /22 | 255.255.252.0 | 4 | 1024 |
| /20 | 255.255.240.0 | 16 | 4096 |
| /16 | 255.255.0.0 | 256 | 65536 |
| /8 | 255.0.0.0 | 65536 | 16.7 M |
11.2 The four questions for any address+mask
Given 172.16.20.100/22:
- Block size =
256 − 252 = 4in the third octet (because /22 borrows into octet 3). So subnets step by 4 in the third octet:172.16.0.0,172.16.4.0,172.16.8.0,172.16.12.0,172.16.16.0,172.16.20.0,172.16.24.0, … - Which subnet is
.20.100in?20falls in the20–23block → network172.16.20.0/22. - Broadcast = last address of the block =
172.16.23.255. - Usable range =
172.16.20.1–172.16.23.254(1022 hosts).
11.3 VLSM: carving a block to fit real needs
Scenario. You're given 10.10.0.0/24 for a small office and must serve:
| Segment | Hosts needed | Prefix that fits | Size |
|---|---|---|---|
| Staff LAN | 100 | /25 (126) | 128 |
| Wi-Fi guests | 50 | /26 (62) | 64 |
| Servers | 10 | /28 (14) | 16 |
| Management | 10 | /28 (14) | 16 |
| Router-to-router link | 2 | /30 (2) | 4 |
Allocate largest first (to avoid fragmentation), from 10.10.0.0:
10.10.0.0/25 Staff hosts .1 - .126 bcast .127
10.10.0.128/26 Wi-Fi hosts .129 - .190 bcast .191
10.10.0.192/28 Servers hosts .193 - .206 bcast .207
10.10.0.208/28 Management hosts .209 - .222 bcast .223
10.10.0.224/30 P2P link hosts .225 - .226 bcast .227
10.10.0.228 .. 10.10.0.255 free for growth
If you had allocated the /30 first at 10.10.0.0/30, the next /25 could not start
until 10.10.0.128 and you'd waste .4–.127. Order matters.
11.4 CIDR route aggregation (supernetting)
A router advertising four contiguous /24s —
203.0.112.0/24, 203.0.113.0/24, 203.0.114.0/24, 203.0.115.0/24 — can announce
them as a single 203.0.112.0/22. 112 = 01110000, 115 = 01110011; the
first 22 bits are common. Aggregation is why the global BGP table is ~1M routes
instead of 16M. Break aggregation (announce a /24 out of your /22 from a
different site) and you've done "more-specific" traffic engineering.
11.5 The /31 trick
For a point-to-point link (router↔router), a /30 wastes 2 of 4 addresses on
network+broadcast. RFC 3021 /31 gives you exactly the 2 host addresses you
need; there is no broadcast on a P2P link. Widely supported; halves address burn
on backbones.
11.6 War story
An ops team added a new rack on 10.20.5.0/24, gateway 10.20.5.1. Hosts could
reach the gateway but not each other's neighbors two racks over. Cause: the core
was configured with 10.20.4.0/23 for the old racks, and a stale summary route
10.20.4.0/22 on a different router black-holed part of the new range. Lesson:
subnet/summary boundaries must line up on bit boundaries and be consistent
across every device that routes them. Draw the bitmap.
Try it yourself
ipcalc 10.10.0.0/24 # overview
ipcalc -s 10.10.0.0/24 /25 /26 /28 /28 /30 # split into VLSM subnets (some versions)
sipcalc 172.16.20.100/22
python3 -c "import ipaddress as i; n=i.ip_network('172.16.20.100/22', strict=False); \
print(n, n.network_address, n.broadcast_address, n.num_addresses)"