N10-009 · Networking Concepts · Updated July 29, 2026

Subnetting Explained: How IPv4 Subnets Actually Work

Subnetting is the practice of carving one IPv4 address block into smaller blocks by taking bits away from the host portion of the address and handing them to the network portion. A 32-bit IPv4 address contains no built-in dividing line between “which network” and “which machine” — the subnet mask supplies that line, and sliding it is the entire operation. Push the line right and you get more networks with fewer hosts in each; that trade is what lets an organization size address blocks to the actual size of its broadcast domains.

Why address blocks get divided

A single flat IPv4 network is technically legal and operationally miserable. Four pressures push engineers to divide:

Broadcast containment. Every device in one IPv4 network shares a broadcast domain. ARP requests, DHCP discovers, and chatty legacy protocols reach every host in that domain. Put 4,000 machines in one broadcast domain and each one burns CPU discarding traffic meant for someone else. Split them into sixteen 250-host segments and each device hears roughly a sixteenth of the noise.

Security boundaries. Traffic that crosses between subnets passes through a router, and a router is where you can apply an access control list (ACL), inspect flows, or enforce a policy. Traffic inside a subnet never touches a router and cannot be filtered by one. If badge readers and finance workstations share a subnet, no firewall rule in the world separates them.

Address efficiency. A point-to-point link between two routers needs two addresses. Giving it a full /24 — 254 usable addresses — wastes 252 of them. Right-sizing blocks is the whole point of variable length subnet masking (VLSM).

Routing hierarchy. Contiguous, hierarchically assigned blocks can be summarized into a single advertisement, which keeps routing tables small and convergence fast.

The two halves of every IPv4 address

An IPv4 address is 32 bits, written as four 8-bit octets in dotted decimal. Those 32 bits split into a network portion (identical for every device on the segment) and a host portion (unique to each device). The subnet mask marks the split: mask bits set to 1 line up with network bits, mask bits set to 0 line up with host bits.

Historically the split was implied by the first octet — the old Class A/B/C system fixed it at 8, 16, or 24 bits. That system is dead in practice; the mask is now carried explicitly with the address, either in dotted decimal or as a prefix length such as /26. The conversion between the two forms is covered in CIDR notation and subnet masks.

A legal subnet mask is always a run of 1s followed by a run of 0s, with no gaps. That constraint is why only nine values ever appear in a mask octet:

0   = 00000000      248 = 11111000
128 = 10000000      252 = 11111100
192 = 11000000      254 = 11111110
224 = 11100000      255 = 11111111
240 = 11110000

Any octet value outside that list — 255.255.255.100, say — is not a valid mask.

Borrowing bits: what subnetting physically does

Start with 10.30.0.0/16. Sixteen network bits, sixteen host bits, so one enormous segment with 65,534 usable addresses. Now change the mask to /24. You have taken eight bits out of the host field and moved them into the network field. Those eight borrowed bits can hold 2^8 = 256 distinct patterns, so the single /16 becomes 256 separate /24 networks — 10.30.0.0/24, 10.30.1.0/24, on through 10.30.255.0/24 — each with 2^8 − 2 = 254 usable host addresses.

That is the fundamental trade, and it is exact arithmetic, not a rule of thumb:

Subnets created by borrowing b bits: 2^b
Total addresses in a prefix of length n: 2^(32−n)
Usable host addresses: 2^(32−n) − 2

The subtraction of 2 removes the two addresses in every block that cannot be assigned to an interface: the all-zeros host pattern (the network address) and the all-ones host pattern (the directed broadcast). Two prefix lengths break that rule. A /31 has only two addresses total and, per RFC 3021 (Request for Comments 3021), both are usable on a point-to-point link because a two-node link needs no broadcast address. A /32 identifies exactly one address and is used for loopback interfaces and host routes.

Working a subnet by hand

Take the host address 192.168.120.213 with the mask 255.255.255.192, and find the network it belongs to. The formal method is a bitwise AND — a bit in the result is 1 only when both input bits are 1:

address   11000000.10101000.01111000.11010101   192.168.120.213
mask      11111111.11111111.11111111.11000000   255.255.255.192
--------  ---------------------------------------------------
network   11000000.10101000.01111000.11000000   192.168.120.192

Nobody does that under exam time pressure. The shortcut is the block size. Find the octet where the mask is neither 255 nor 0 — the interesting octet, here the fourth, with mask value 192 — and compute 256 − 192 = 64. Subnets in that octet start at every multiple of 64: 0, 64, 128, 192. The host’s fourth octet is 213, which sits between 192 and 255, so the network is 192.168.120.192. The next block would begin at 192.168.121.0, so the broadcast is one address below that: 192.168.120.255. Usable addresses run 192.168.120.193 through 192.168.120.254 — 62 of them, matching 2^6 − 2.

The full mechanics of that calculation, including the traps, are worked through in finding network and broadcast addresses.

Now apply the same logic to divide 172.18.8.0/24 into four equal pieces. Two borrowed bits give four subnets, mask 255.255.255.192, block size 64:

Subnet	Network	Usable range	Broadcast
1	172.18.8.0/26	172.18.8.1 – 172.18.8.62	172.18.8.63
2	172.18.8.64/26	172.18.8.65 – 172.18.8.126	172.18.8.127
3	172.18.8.128/26	172.18.8.129 – 172.18.8.190	172.18.8.191
4	172.18.8.192/26	172.18.8.193 – 172.18.8.254	172.18.8.255

Four subnets, 62 usable hosts each, 248 assignable addresses where the unsubnetted /24 offered 254. Six addresses vanished into the extra network and broadcast pairs. That overhead is real and it is the price of segmentation.

Sizing a subnet to a requirement

Design questions usually run the other way: you are told a segment needs N hosts and asked for the smallest mask that fits. Walk the powers of two until 2^h − 2 ≥ N, where h is the number of host bits, then set the prefix to 32 − h.

A segment needing 90 usable addresses needs h = 7 (2^7 − 2 = 126), because h = 6 yields only 62. Prefix = 32 − 7 = /25, mask 255.255.255.128. A segment needing 1,000 usable addresses needs h = 10 (1,022), giving /22 or 255.255.252.0. The trap in both cases is the −2: a requirement for exactly 62 hosts fits a /26, but a requirement for 63 does not and forces you up to a /25.

Blocks you don’t get to use freely

Not every IPv4 range is available for local addressing. The exam leans hard on these reservations.

RFC 1918 private space — the addresses used inside organizations and translated at the internet edge by NAT (Network Address Translation). There are exactly three blocks:

10.0.0.0/8        10.0.0.0     - 10.255.255.255
172.16.0.0/12     172.16.0.0   - 172.31.255.255
192.168.0.0/16    192.168.0.0  - 192.168.255.255

The 172.16.0.0/12 range is where candidates lose points. It stops at 172.31.255.255, so 172.32.x.x and 172.15.x.x are public addresses, as is anything in 192.169.x.x or 11.x.x.x. A single-octet slip changes the answer.

127.0.0.0/8 — loopback. The whole /8 is reserved, not just 127.0.0.1. Traffic to any 127.x.x.x address is handed back to the local stack and never reaches a network interface, so a router will never forward it and you will never see it in a capture off the wire.

0.0.0.0 — the unspecified address. As a route entry, 0.0.0.0/0 matches everything and is the default route. As a host configuration it means “this host, address not yet known,” which is why a DHCP client sources its initial request from it.

169.254.0.0/16 — link-local (APIPA). Self-assigned when DHCP fails. Link-local traffic is not routed, so a host stuck on 169.254.x.x can reach only its own segment — the classic symptom of a dead DHCP server.

100.64.0.0/10 — shared address space for carrier-grade NAT. Defined in RFC 6598, spanning 100.64.0.0 through 100.127.255.255. Providers assign it to customer-facing equipment when they lack enough public IPv4. It is not RFC 1918 space, and it is not routable across the public internet, which makes it a favorite distractor.

192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24 — documentation. RFC 5737 set these aside so that manuals and training material can print example addresses that will never collide with a live device.

224.0.0.0/4 — multicast. Formerly Class D, running 224.0.0.0 through 239.255.255.255. These are group destinations, never assigned to an interface. The 224.0.0.0/24 slice within it is link-local control traffic that routers never forward: 224.0.0.1 (all hosts), 224.0.0.2 (all routers), 224.0.0.5 and 224.0.0.6 (OSPF neighbors and designated routers). Seeing 224.0.0.5 in a capture means routing-protocol control traffic on that segment, not a misconfigured host.

240.0.0.0/4 — reserved. The old Class E space, still unallocated, plus 255.255.255.255 as the limited broadcast address.

Where subnetting goes from here

Equal-sized subnets are only the starting point. Real designs mix a /24 for a user VLAN with a /30 or /31 for a WAN link, applying a different mask to each piece of the same parent block — that is VLSM, and it is only possible because modern routing protocols carry the mask with every route. The same hierarchy read in reverse becomes route summarization: several contiguous small prefixes advertised as one larger prefix. If the arithmetic still feels slow, the fastest way to fix that is repetition on worked subnetting problems.

How the N10-009 exam tests this

Host address plus a non-obvious mask, asking for the network. The trap is restating the host’s own address, or answering with a boundary from the wrong block size. Always locate the interesting octet first.
A host-count requirement with four candidate masks. Two of the four will be arithmetically sufficient but wasteful. “Smallest subnet that satisfies the requirement” means the tightest mask that still clears the −2 threshold.
Identify which addresses are private. Expect one address just outside 172.16.0.0/12 or a 100.64.x.x CGNAT address planted among genuine RFC 1918 entries.
A capture or routing-table snippet containing a special-use address. You are being asked to recognize the block’s purpose — loopback, link-local, multicast control, documentation — rather than to compute anything.

Reading about subnetting builds understanding; only timed practice questions build speed.

Quick reference

The subnet mask, not the address, decides where the network portion ends; borrowing b host bits yields 2^b subnets.
Usable hosts = 2^(32−n) − 2, with /31 = 2 usable (RFC 3021) and /32 = 1 as the exceptions.
Block size = 256 − (mask value in the interesting octet); networks begin at every multiple of that block size.
Mask octets are only ever 0, 128, 192, 224, 240, 248, 252, 254, or 255.
RFC 1918 private space is 10.0.0.0/8, 172.16.0.0/12 (ends at 172.31.255.255), and 192.168.0.0/16.
127.0.0.0/8 is loopback in its entirety; 169.254.0.0/16 is link-local; 100.64.0.0/10 is carrier-grade NAT, not private space.
224.0.0.0/4 is multicast, and 224.0.0.0/24 within it is link-local control traffic that routers never forward.
Every additional subnet costs two addresses to its own network and broadcast pair.