IP Addresses, Subnets, and Why /24 Isn't Magic

Somewhere in every networking course, subnetting is taught as a table to memorize. That is a mistake. A subnet mask is a boundary, and the boundary is chosen by whoever designs the network. Once you can see the boundary, the tables become unnecessary.

This article covers IPv4 only, because that is what almost every school district, camera system, and HVAC controller still speaks. IPv6 gets its own piece later.

An address is two numbers wearing one coat

10.40.12.57 is 32 bits. The mask, 255.255.248.0, is also 32 bits. Line them up and the mask tells you where the address stops being a network and starts being a host.

address  10  .  40  .  12  .  57
binary   00001010 00101000 00001100 00111001
mask     11111111 11111111 11111000 00000000   (/21)
network  00001010 00101000 00001000 00000000   = 10.40.8.0

The mask's 1s are the network portion. The 0s are the host portion. Everything the mask covers is shared by every device on the subnet; everything it leaves open is free to vary.

That is the whole idea. The rest is counting.

CIDR is just the number of 1s

Writing 255.255.248.0 is tedious, so we count the 1s instead: 21 of them. /21.

Two addresses per subnet are not usable as hosts: the first is the network address (all host bits zero) and the last is the broadcast address (all host bits one). That is why every row is minus two.

Why /24 feels like the default

/24 is popular because it is the easiest boundary to see: the first three octets are the network and the last is the host. It is also, in a school district, frequently the wrong size.

A /24 holds 254 devices. One campus with 900 student Chromebooks cannot fit in 254 addresses. The usual fix is a /21 or /22, and the usual mistake is to build the larger subnet but keep handing out routers and documentation that assume /24.

Reading a boundary without a calculator

For any prefix between /16 and /32, the interesting octet is the one where the mask stops being 255.

• /21 means the third octet is masked with 248, and the block size is 8.
• The network address is the largest multiple of 8 at or below the octet value.

So 10.40.12.57 with /21: 12 is between 8 and 16, so the network is 10.40.8.0, the range is 10.40.8.0 to 10.40.15.255, and the broadcast is 10.40.15.255. The host is in the second of eight equal slices.

That is the entire trick. Block size = 256 minus the mask octet. Count in blocks. Done.

Private addresses, and why they exist

RFC 1918 reserves three ranges for internal use. They are not routable on the public internet, which is precisely why every organization can use them at once:

When a private address needs to reach the internet, NAT rewrites it to a public address at the edge and keeps a table so replies can find their way back. The internal address never appears on the wire outside your network.

Names to avoid

Every subnet has three addresses you should recognize on sight:

• Network address — the first, all host bits zero. Not assignable.
• Broadcast address — the last, all host bits one. Reaches every host on the subnet.
• Gateway — not special to IP, but by convention the first usable address. It is only special because every host is configured to send off-subnet traffic there.

Everything else is available for hosts, which is why documentation should record the range, not just the network.

What breaks in production

• Mask mismatch. A host with /24 on a /21 network believes its neighbors are remote. It sends local traffic to the gateway, which routes it straight back. Everything works, slowly, and pings look fine.
• Overlapping subnets. Two sites both using 10.10.40.0/24 cannot be routed to each other without NAT. This is the most common consequence of building networks one at a time.
• Gateway outside the subnet. A host with 10.40.12.57/24 and gateway 10.40.8.1 cannot ARP for its gateway, because the gateway is not local. The host reports "no route to host" while the gateway is perfectly healthy.
• Pool too small. A /24 with 300 devices works until the 255th device arrives, and then the failures look random because DHCP leases expire at different times.

Checklist

1. Given an address and a prefix, can you state network, broadcast, and usable range in under 30 seconds?
2. Do you know which private range your organization uses, and why?
3. Can you explain the difference between "not assignable" and "not routable"?
4. Is your DHCP pool sized for peak devices plus 20%?
5. Does your documentation record the prefix, not just the network address?

Next

A subnet is a broadcast domain, and a VLAN is how you build several of them on one switch. Continue with VLANs: One Switch, Many Networks.