An IP address without a prefix is incomplete network configuration. The address identifies one interface, while the prefix defines the block that the interface treats as its local network.

That distinction affects nearly every connectivity decision. A host configured as 192.168.10.77/26 considers a different set of destinations local than the same host configured as 192.168.10.77/24. Both addresses are syntactically valid, but only one prefix can match the intended network design.

Subnetting divides an address block into smaller blocks. Classless Inter-Domain Routing, or CIDR, expresses those blocks with arbitrary prefix lengths such as /20, /26, and /31. Together they let engineers allocate addresses according to actual need, isolate local traffic, avoid overlapping networks, and summarize related blocks.

This chapter develops the calculations from the bits upward and then applies them to address planning, VLSM, aggregation, IPv6, and practical troubleshooting.

A large organization could place every interface in one enormous IP network, but the design would create several problems.

Local broadcast and discovery traffic would reach a large set of devices. Address ownership would be harder to organize. A failure or duplicate address would affect a wider scope. Different buildings, environments, tenants, or workload types would have no clear Layer 3 boundary for policy and operations.

Subnets divide that address space into manageable units. An organization can assign separate blocks to a production environment, a test environment, an office, and a server network while retaining one larger allocation.

The example leaves some of 10.20.0.0/16 unallocated. A sound plan does not need to fill every address immediately; contiguous reserve space makes later growth easier.

A subnet creates an addressing and forwarding boundary, not a security guarantee. Traffic crossing that boundary can be filtered, but the subnet itself provides no authentication, encryption, or access control.

CIDR writes a prefix length after an address:

IPv4 has 32 address bits. The /26 fixes the first 26 bits as the network prefix and leaves 6 bits for values inside the block:

The valid IPv4 prefix lengths range from /0 to /32.

CIDR is classless because the prefix can end at any bit position. Modern software does not infer an 8-, 16-, or 24-bit boundary from historical Class A, B, or C rules.

The address before the slash also needs interpretation. 192.168.10.77/26 describes an interface address with its prefix. The canonical name of the containing block is:

The block name uses the value in which every bit after the prefix is zero. Tools often normalize 192.168.10.77/26 to 192.168.10.64/26 when asked for the network.

An IPv4 subnet mask is another representation of the prefix. It contains consecutive 1 bits for the network portion followed by consecutive 0 bits for the remaining portion.

For /26:

The two forms carry the same information:

Common prefixes are worth recognizing because they appear in interface configuration, cloud networks, VPNs, and packet captures.

The conventional usable counts shown for /8 through /30 subtract the network and broadcast values. /31 and /32 have special roles described below.

A mask with separated runs of ones and zeroes, such as 255.0.255.0, is not a valid CIDR mask. The prefix must be one uninterrupted run of leading 1 bits.

For an IPv4 prefix length p, the number of remaining bits is:

The block contains:

For a conventional broadcast-capable subnet:

The bitwise AND keeps the prefix bits and clears every bit outside the prefix. The inverted mask has 1 bits in every position after the prefix, so OR sets those positions to produce the final value in the block.

These formulas work at any bit boundary. Decimal shortcuts make routine calculations faster, but the bit operations define the correct result.

The prefix /26 leaves six bits:

Its subnet mask is:

Only the last octet changes in this example. Convert that octet and the corresponding mask octet to binary:

The network address is therefore:

The final six bits can vary from all zeroes to all ones. Setting them all to one gives:

The complete result is:

192.168.10.77 falls inside the host range, so it is an ordinary address in this block.

The next /26 begins at 192.168.10.128. Two hosts can share the first three octets and still belong to different subnets:

The final decimal octet alone does not determine locality; the prefix sets the boundary.

Binary calculation is authoritative, but a decimal shortcut works well for hand calculations.

Find the first subnet-mask octet that is less than 255. The block increment in that octet is:

For /26, the mask is 255.255.255.192:

The last-octet boundaries are therefore:

Address 77 lies between boundaries 64 and 127, producing network 64 and broadcast 127.

The shortcut also works when the prefix ends in another octet. Consider:

The /20 mask is 255.255.240.0. The changing octet is the third one:

Third-octet blocks begin at:

The value 37 falls in the block from 32 through 47. The result is:

This example crosses many values in the final octet. Looking only at the last octet would miss the actual boundary.

Subnetting creates smaller blocks by increasing the prefix length.

Starting with 192.168.50.0/24, suppose each new subnet needs at most 30 ordinary IPv4 addresses. A /27 provides 32 total values and 30 usable addresses.

Changing /24 to /27 moves three bits from the address-within-the-block portion into the subnet prefix:

The /27 mask is 255.255.255.224, so the increment is 32. The eight subnet blocks are:

Every block begins on a multiple of 32 and ends immediately before the next boundary. The first block spans .0 through .31; the second spans .32 through .63; the final block spans .224 through .255.

The subnets cover the original /24 exactly. They neither overlap nor leave gaps.

When a conventional IPv4 subnet needs N usable addresses, find the smallest number of remaining bits h satisfying:

Then convert the remaining-bit count to a prefix:

A subnet that needs 50 usable addresses requires:

A /26 is the smallest conventional subnet that satisfies the requirement.

The requested host count should include more than application servers. Gateway addresses, network appliances, load balancers, cluster nodes, and planned growth can consume positions in the block. Allocating exactly today's count often forces an avoidable renumbering later.

Choosing a much larger block also has a cost. It consumes address-planning space, increases the chance of overlap with networks owned by another environment or partner, and makes future aggregation harder. The objective is a block sized for the operational requirement with a deliberate growth margin.

The 2ʰ - 2 formula describes conventional broadcast-capable IPv4 subnets. It should not be applied blindly to /31 and /32.

A /31 contains two values. On a point-to-point link with exactly two endpoints, both values can identify the endpoints. There is no need for a separate network address and broadcast address on that link:

This use preserves two addresses compared with a /30, which has four total values but only two conventional host positions.

A /32 fixes every bit and names one address:

It is useful for representing one interface, endpoint, or exact route. It is not a one-host broadcast subnet with a network and broadcast value to subtract.

These exceptions explain why calculators need prefix-aware rules rather than one universal “subtract two” operation.

Equal-size subnets are easy to manage but can waste addresses when groups have different requirements. Variable-Length Subnet Masking, or VLSM, allocates different prefix lengths from one parent block.

Consider 10.20.30.0/24 with these requirements:

The plan fills the /24 without overlap:

Allocate the largest requirement first. Large blocks have fewer valid aligned starting positions, while small blocks fit into more remaining gaps.

Every allocated subnet must begin on a boundary valid for its prefix. A /26 can begin at .0, .64, .128, or .192 within a /24; it cannot begin at .100.

VLSM improves utilization, but a tightly packed plan can become fragmented when requirements change. Keeping related allocations together and reserving aligned growth blocks reduces that risk.

Subnetting splits one block into smaller prefixes. Aggregation, also called route summarization or supernetting, combines adjacent prefixes into a shorter prefix.

These four /24 blocks are contiguous:

Together they contain:

Ten remaining bits produce a /22:

The /22 mask is 255.255.252.0, so it covers third-octet values 0 through 3.

Valid aggregation requires:

For example, four /24s starting at 10.40.1.0 cannot become one /22. A /22 boundary occurs every four values in the third octet, so valid starts include 0, 4, 8, and 12.

An aggregate must not include address space owned by an unrelated network. An overly broad summary can direct traffic toward a system that has no valid path to part of the advertised range.

CIDR aggregation reduces the number of prefixes that other systems need to store and exchange. The benefit depends on disciplined, contiguous address allocation; scattered blocks cannot be summarized without also covering the gaps.

An IPv4 address belongs to a CIDR block when masking the address produces the block's network address:

For 10.40.0.0/22, the range is:

Therefore:

CIDR blocks can be nested. 10.40.3.77 belongs to all of these:

When several network prefixes match one destination, the most specific match has the longest prefix. A /24 match is more specific than a /16 match because it fixes more destination bits. This rule allows broad aggregate prefixes and narrow exceptions to coexist.

Two CIDR blocks overlap when they share at least one address.

Consider:

Every address in Network B already lies inside Network A, so the blocks overlap completely.

Overlap is harmless when the smaller prefix intentionally subdivides the larger block under one coordinated design. It becomes a problem when two independently managed networks need to connect.

For example, a company network and a cloud environment might both use 10.0.0.0/16. After a VPN connects them, the destination 10.0.5.20 is ambiguous: it could refer to an office system or a cloud workload. Routes and address translation workarounds become more complex because the address no longer identifies one unique location across the combined network.

A reliable overlap test converts each block to its first and last address. Two ranges overlap when:

Address plans should therefore be coordinated before networks are connected. The private IPv4 space is reusable across isolated networks, but reuse becomes a constraint as soon as those networks must communicate.

IPv6 uses the same prefix principle with a 128-bit address. Increasing the prefix length creates smaller subnets; decreasing it creates a larger aggregate.

Suppose an organization receives:

Using /64 LAN prefixes leaves 16 bits for subnet selection:

Example subnets include:

The fourth hexadecimal group selects the subnet. Each group contains 16 bits, so it can range from 0000 through ffff.

IPv6 has no broadcast address and does not reserve a network address in the IPv4 sense. IPv4's 2ʰ - 2 host formula therefore does not apply. IPv6 still defines special address roles, but capacity planning normally focuses on the number of available subnet prefixes rather than packing individual interface addresses tightly.

Subnet boundaries should remain aligned and hierarchical even with abundant address space. Regular /64 assignments make configuration predictable and allow a shorter organizational prefix to summarize many LANs.

Linux displays each interface address with its prefix:

An entry can resemble:

The address, prefix, and broadcast value agree with the worked /26 calculation.

On macOS, ifconfig commonly displays the mask in hexadecimal:

0xffffffc0 represents 255.255.255.192, which is /26.

Windows displays a decimal subnet mask with:

An ipcalc utility can verify manual IPv4 calculations:

The exact output varies by implementation, but it should identify network 192.168.10.64, broadcast 192.168.10.127, and 62 usable addresses. Treat the tool as verification; understanding the boundary calculation remains necessary when reviewing configurations or diagnosing two hosts with different prefixes.

Two hosts on the same switch disagree about direct delivery. One may use /24 while the other uses /26. Their local-network decisions differ even when their addresses share the first three decimal octets, producing asymmetric traffic or failed communication.

A cloud network cannot connect cleanly to an office or partner. The CIDR ranges may overlap. A tunnel can connect the infrastructure without resolving address ambiguity.

A configured block begins at an invalid boundary. 192.168.10.100/26 is a valid interface address, but it is not the canonical block name. The containing block begins at 192.168.10.64.

The final host count is two lower than expected. A conventional IPv4 subnet reserves its all-zero network value and all-one broadcast value. /31 point-to-point links and /32 exact addresses use different rules.

A subnet ran out earlier than its size suggested. Gateways, appliances, reserved platform addresses, and growth allocations consume positions alongside application hosts.

An aggregate sends traffic toward the wrong network. The summary may cover a gap or unrelated block that the summarizing network does not own.

A service works by local address but fails from another subnet. Correct subnet calculation establishes the boundary, but communication across it still requires a valid forwarding path and policy.

An address alone does not define its subnet. 192.168.10.77 can belong to different blocks under /24, /26, or another prefix.

The last octet does not always contain all host bits. A /20 boundary occurs in the third octet, and other prefixes can end at any bit.

.0 is not always a network address, and .255 is not always a broadcast. Their roles depend on the complete prefix.

A larger prefix number means a smaller block. /27 fixes more bits and contains fewer values than /24.

CIDR masks contain consecutive leading ones. A noncontiguous mask cannot be represented by one prefix length.

The block name must be aligned. 192.168.10.77/26 is an interface configuration; its network is 192.168.10.64/26.

The usable-host formula has exceptions. Subtracting two is conventional for broadcast-capable IPv4 subnets, not for /31, /32, or IPv6.

Private ranges can overlap. Their addresses are reusable only while the networks remain in separate scopes.

Subnetting does not create security by itself. Filtering and access controls must enforce policy at the boundary.

Aggregation cannot combine arbitrary neighboring-looking blocks. Size, contiguity, and binary alignment must all be correct.

Subnetting divides address space into aligned blocks, and CIDR describes them with prefix lengths. In IPv4, /p fixes p bits and leaves 32 - p, producing 2^(32-p) values. A subnet mask is the equivalent run of leading ones followed by zeroes.

The network address is address AND mask, and the broadcast address is the block's final value. Ordinary host ranges exclude both, with /31 point-to-point links and /32 exact addresses as exceptions. Longer prefixes create smaller subnets; VLSM allocates different-sized blocks, usually largest first.

Aggregation combines contiguous, equal-sized, correctly aligned blocks under a shorter prefix. Overlapping private blocks become ambiguous when networks connect. IPv6 uses the same prefix arithmetic without broadcast subtraction and commonly counts /64 subnets within a larger allocation.

Reliable subnetting comes from bit boundaries, not visual patterns in decimal notation.