Subnets Without the Scary Maths

Right at the end of Networking 101 I promised to come back for the scariest-looking rung on the ladder — subnets — and show it’s far tamer than the notation makes it look. The VLANs post pointed here too. So let’s cash both cheques. By the end of this you’ll look at something like 192.168.1.0/24 and see not a cryptic incantation but a simple line drawn through an address, marking where one network ends and the next begins.

Every address has two halves

Here’s the one idea everything else hangs off: an IP address is really two things stuck together — a network part and a host part. Think of it exactly like a postal address: a street name and a house number.

flowchart LR
  N["192.168.1 (network = the street)"] --- H["42 (host = the house)"]

In 192.168.1.42, the 192.168.1 is the street — the network everyone on it shares — and the .42 is your particular house on it. Every device that shares your street can talk to you directly. To reach a house on a different street, your message has to go via the junction at the end of the road — which, as 101 put it, is your default gateway. Hold that image; the whole point of a subnet is deciding where your street ends.

The subnet mask: where’s the line?

So where does the street end and the house number begin? That’s the subnet mask’s only job: it marks the dividing line. Written the old-fashioned way it looks like another IP address — 255.255.255.0 — and it reads as “the first three chunks are the street, the last chunk is the house.” The modern shorthand for exactly the same thing is CIDR: /24, meaning “the first 24 bits are the network.”

Why 24? Because each of those four numbers in an address is 8 bits, and three of them (8 + 8 + 8) makes 24. A 255 means “all 8 bits here belong to the network”; a 0 means “all 8 belong to the host.” The mask is simply a run of network-ones followed by host-zeros, and the slash number just counts the ones. That’s the whole trick — the scary slash is a tally, nothing more.

$ ip -brief address
lo     UNKNOWN  127.0.0.1/8
eth0   UP       192.168.1.42/24

# 192.168.1.42/24  ->  street = 192.168.1.0, your house = .42
# gateway usually .1, broadcast = .255, 254 usable houses

You’ve almost certainly seen this already without clocking it — that /24 hanging off your own address is the mask, quietly telling your machine where its street ends.

The one decision it all exists for

Here’s why any of this matters, and it’s the single most useful thing to take away. Every time your device sends a packet, it asks one question first: is the destination on my street, or not? It answers by using the mask to compare the network half of the destination address against its own.

flowchart TD
  A["Packet for 192.168.1.42"] --> B{"Same network as me? (checked via the mask)"}
  B -->|"yes - same street"| C["Deliver directly on the LAN (switch / ARP)"]
  B -->|"no - different street"| D["Hand to the default gateway (router)"]

If the network halves match, the destination is local — deliver it straight across the LAN, switch to switch, no router required. If they don’t match, the destination is on some other network entirely, so the packet goes to the default gateway and becomes the router’s problem. That’s the entire job. That quiet comparison, happening on every single packet, is the whole reason the subnet mask exists — and it’s why 101’s troubleshooting trick works: ping the gateway to prove your street is fine, then ping something out on the internet to prove the junction is doing its job.

Two addresses you never get to keep

There’s a small catch worth knowing, because it explains why the numbers never come out round. In every subnet, two addresses are spoken for and can’t be handed to a device:

• The network address — all the host bits set to zero (192.168.1.0 for our street). It’s the name of the street itself, not a house.
• The broadcast address — all the host bits set to one (192.168.1.255). Shout at this one and every house on the street hears you at once.

The maths, made tame

This is the part people brace for, and it really is just counting in twos. The host bits — the zeros in the mask — decide how many addresses a subnet holds: two to the power of however many host bits you have. A /24 leaves 8 host bits, and two-to-the-eight is 256 (minus our two reserved, so 254 usable). Borrow a bit for the network and you halve the houses but double the number of streets.

That’s the whole ladder. Every step down the prefix (/24 → /25 → /26) cuts the address block in half. Split our 192.168.1.0/24 once and you get two /25 streets — 192.168.1.0–127 and 192.168.1.128–255 — each its own little network. No arcane maths, just repeatedly halving.

Why carve networks up at all?

The same reasons the rest of this series keeps circling back to:

• Smaller broadcast domains. A broadcast only reaches its own subnet, so — exactly as with VLANs and spanning-tree — you shrink the blast radius of the noisy stuff.
• Security segmentation. Each subnet is a network the router sits between, which makes it the natural place to enforce “these houses may talk to those, and no further” — the Layer 3 partner to the VLAN walls from last post.
• Sane organisation, no waste. Give each site, floor or function its own right-sized block, instead of one enormous flat network where everything can see everything.

And that’s the tidy join between the last two posts: a VLAN gives you a separate network at Layer 2; a subnet is the Layer 3 addressing that makes that network routable and tells every device where its edges are. Two halves of the same “divide it up on purpose” idea.

A quick history: why we ration addresses at all

None of this careful carving would be necessary if addresses were infinite — and the reason they aren’t is a lesson in optimism. An IPv4 address is 32 bits, which works out to about 4.3 billion of them. In the 1970s that felt limitless; a planet later, with a phone in every pocket and a chip in every doorbell, it very much isn’t.

It was made worse by how they were first handed out. Under the old classful scheme, organisations were given enormous fixed blocks — a single “Class A” was 16 million addresses — and most of them sat mostly empty, reserved by universities and corporations that would never fill them. By the early 1990s it was plain the pool would run dry. CIDR was one of the rescues: hand out right-sized blocks instead of giant classes, and route them efficiently. Subnetting is that same instinct applied at your end — take your slice and divide it sensibly rather than sprawling.

It bought years, not forever. The very top of the IPv4 pool ran out in 2011, and the regional registries have been scraping the barrel ever since. Which brings us to the actual fix.

The real fix: IPv6

You can only ration a scarce thing so cleverly. The genuine solution to running out of addresses is to simply have vastly more of them, and that’s the whole point of IPv6: it swaps IPv4’s 32-bit addresses for 128-bit ones. The resulting count is so large it stops being meaningful — enough to give every grain of sand on Earth billions of its own. Running out is no longer on the table.

They look different, too: eight groups of hexadecimal rather than four decimal numbers, like 2001:db8:85a3::8a2e:370:7334, where the :: is shorthand for “a run of zeros”. But here’s the reassuring part — everything you just learned still applies. An IPv6 address is still a network prefix plus a host part, still divided by a slash. The near-universal convention is that every subnet is a /64: the first 64 bits name the network, the last 64 identify the device. The “where’s the line?” question is usually answered for you before you start.

The one thing that flips is the scarcity mindset. A single /64 holds more addresses than the entire IPv4 internet, so IPv6 subnetting was never about scrimping hosts — it’s about organising prefixes. An ISP might hand you a /48, which is 65,536 /64 subnets to arrange however suits you. The maths stops being “how few addresses can I get away with” and becomes “how shall I lay all this space out.” The mask idea carries straight over; only the penny-pinching gets left behind.

The one-sentence version

An IP address is a street and a house stuck together; the subnet mask (that /24) marks the line between them; and on every packet your device uses that line to decide “local delivery, or hand it to the gateway?” Everything else — the prefixes, the host counts — is just halving and counting in twos.

And that rounds out the arc I started with a single click loading a web page: how data is wrapped, how the switches stay sane, how we carve the network up, and now how it’s all addressed — in both the cramped world of IPv4 and the roomy one of IPv6. There’s one loose thread I’ve deliberately left dangling: how a whole house or office full of devices shares a single public address, and where those private 192.168 numbers actually come from. That’s a trick called NAT, and it’s genuinely a story for another day.