Slicing the IP Pie

An IPv4 address (like 192.168.1.15) is a 32-bit number, usually represented as 4 octets separated by dots. Every IP address has two parts: the Network Portion (identifies the neighborhood) and the Host Portion (identifies the specific house).

Subnetting is the process of taking a large network and slicing it into smaller, manageable, and secure sub-networks.

Why Subnet?

  1. Security: You can place web servers in one subnet and databases in another, and put a firewall between them.
  2. Performance: Subnets reduce Broadcast traffic. A broadcast packet sent in a massive network of 10,000 computers will choke the network.
  3. Organization: Grouping IPs logically by department (HR, Engineering, Guest WiFi).

The Subnet Mask

How does a computer know which part of the IP is the Network and which is the Host? It looks at the Subnet Mask. A mask of 255.255.255.0 (which is twenty-four 1s followed by eight 0s in binary) tells the computer: "The first 3 octets are the Network, the last octet is the Host."

CIDR Notation (Classless Inter-Domain Routing)

Writing out 255.255.255.0 is tedious. CIDR notation simplifies this by just appending a slash and the number of 1 bits in the mask. - 192.168.1.0/24 means the first 24 bits are the network. The remaining 8 bits are for hosts ($2^8 = 256$ IPs. Minus the network and broadcast address, that's 254 usable IPs).

Doing the Math

With a /N prefix, the number of addresses in the block is 2^(32-N).

  • /30 → 4 addresses, 2 usable (typical point-to-point links).
  • /24 → 256 addresses, 254 usable.
  • /16 → 65,536 addresses.
  • /8 → 16,777,216 addresses.

The network address is the lowest address in the block (all host bits zero) and the broadcast address is the highest (all host bits one). Neither can be assigned to a machine. To check whether two IPs are in the same subnet, apply the mask to both and compare the network portions.

VLSM

Variable Length Subnet Masking (VLSM) lets you allocate differently sized subnets to match actual demand. A /24 for the office, a /29 for a two-router link, a /22 for a sprawling Wi-Fi. This conserves address space and keeps routing tables smaller. Cloud VPC designers use VLSM logic constantly when carving a /16 into many public and private subnets.

Common CIDR Blocks for Cloud Architects (AWS/GCP):

  • /16 (e.g., 10.0.0.0/16): A massive VPC. $2^{16}$ = 65,536 IPs.
  • /24 (e.g., 10.0.1.0/24): A standard subnet. 256 IPs.
  • /32 (e.g., 10.0.1.55/32): Represents a single specific computer. Used heavily in firewall rules (Security Groups) to whitelist exactly one IP address.
  • /0 (e.g., 0.0.0.0/0): Represents the entire internet. "Allow all traffic."

IPv6 Subnetting

Because IPv6 addresses are 128 bits, the arithmetic is easier for machines and harder for humans. Standard practice is to allocate a /64 to every individual subnet—a single /64 contains 2^64 addresses, far more than anyone needs, but it keeps SLAAC working (stateless autoconfiguration requires a 64-bit interface identifier). A typical allocation gives a site a /48, carved into thousands of /64 subnets.

Public vs. Private IPs

Because IPv4 only has 4.3 billion addresses, we ran out years ago. NAT (Network Address Translation) saved the internet. Specific IP blocks were designated as strictly Private: - 10.0.0.0/8 - 172.16.0.0/12 - 192.168.0.0/16 These IPs can never route across the public internet. Millions of corporate networks use 10.x.x.x internally. When internal computers access the internet, a NAT Router translates their private IP into one single Public IP assigned by the ISP.