Same Subnet Mask Doesn't Mean Same Subnet
Before TCP, before UDP, before any of the port stuff — there’s addresses. And before addresses make sense at any real scale, there’s subnetting.
I went into this thinking it would be the easy topic. Four calculations, a bit of binary, done in an afternoon. Then I got quizzed on it, scenario by scenario, out loud, no multiple choice — and it turned out I could recite the formulas fine while still getting the actual answer wrong. I called a raw bit count a “block size.” I guessed a subnet mask from memory instead of building it, and landed on a completely different network by accident. I answered “what’s the subnet ID” by handing back the subnet mask itself, which is a bit like answering “what’s your house number” with “houses have numbers.”
None of these are hard mistakes to fix once you actually see them. That’s the point of writing this the long way — plain English, every step shown, nothing skipped, mistakes included.
What Even Is Subnetting?
Here’s the plain-English version before any of the jargon shows up.
Imagine one company gets handed one big block of IP addresses — think of it as one giant pizza. If you just hand that whole pizza to everyone in the building and say “figure it out,” you get chaos. Every device is shouting on the same shared space, there’s no way to separate the accounting floor from the guest Wi-Fi, and there’s no clean way to plug in a router to control traffic between groups.
Subnetting is the process of cutting that one big pizza into smaller pizzas — smaller networks, each with its own clean boundary. Each smaller network still comes out of the same original address block, but now it’s its own separate space with its own starting address, its own ending address, and its own set of devices that belong to it.
That’s it. That’s the whole idea. Everything else in this post is just “how do you actually do the cutting, and how do you describe the pieces once you’ve cut them.”
Why Do We Even Need This?
Here’s the deeper reason, and it’s less about tidiness and more about something physically impossible.
No single device on Earth could ever know the exact location of every other device on Earth. There are billions of them. So instead of one giant flat space where everyone needs to know everyone, we build lots of small networks and connect them with routers.
Think of the postal system. Your local post office doesn’t need to know exactly which house on which street in which city your letter is going to. It just needs to know “this goes toward that regional hub.” The regional hub passes it to the next hub. Eventually it lands on the right street, and the local carrier — who does know that street — delivers it to the exact door.
That’s exactly what routers do with subnets. Each router only needs to know roughly which direction a packet should go, not the location of every device in the world. Small networks, connected by routers, is the only way this actually scales.
Inside a single company, subnetting also gives you:
- Separation — a compromised device in the guest Wi-Fi subnet can’t just wander onto the finance subnet.
- Less noise — broadcast messages (the “shout so everyone hears” kind) stay contained to one small subnet instead of blasting the entire company.
- No wasted addresses — instead of handing 254 addresses to a closet with 6 printers in it, you hand out only as many as each group actually needs.
The Words You Need Before Any of This Makes Sense
Every one of these gets explained in full later. This is just so none of the later sections use a word you haven’t seen yet.
| Word | Plain-English meaning |
|---|---|
| Bit | A single switch. Only two positions: 1 (on) or 0 (off). |
| Byte / Octet | A group of 8 bits. An IP address is made of 4 of these groups. |
| IP address | A 32-bit address for a device, written as 4 numbers (0–255) separated by dots, like 192.168.1.10. |
| Binary | Numbers written using only 1s and 0s — the actual language switches and computers use. |
| Subnet mask | A second 32-bit number, same shape as an IP address, that says which bits of the address are “locked” (shared by the whole network) and which are “free” (unique to one device). |
| Network ID | The address that names the subnet itself — not a device, just the subnet’s label. |
| Broadcast address | The address that means “send this to every device on this subnet at once.” Also not a real device. |
| Host | An actual device — a laptop, a phone, a printer — that can be assigned a real, usable address. |
| CIDR notation | The short way to write a subnet mask, like /24, instead of writing out 255.255.255.0 every time. |
Binary, Explained Like You’ve Never Seen a 1 or 0 Before
Skip this section only if you can already convert 192 into 11000000 in your head. Everyone else, stay here for two minutes.
Normal (decimal) numbers use 10 digits, 0 through 9, and each position is worth 10 times the position to its right: ones, tens, hundreds.
Binary only has 2 digits, 0 and 1, and each position doubles instead of multiplying by 10:
Position value: 128 64 32 16 8 4 2 1To read a binary number, you add up the position values wherever there’s a 1, and ignore the positions with a 0.
Example: what is 11000000 in decimal?
128 64 32 16 8 4 2 1
1 1 0 0 0 0 0 0
128 + 64 = 19211000000 = 192. That single conversion — 192 in binary is 11000000 — comes up constantly in subnetting, so it’s worth being able to do it without a calculator.
One more, going the other direction: what is 26 in binary, across a full 32-bit address split into 4 boxes of 8?
You’re not converting the number 26 itself here — in subnetting, this specific question means “write 26 ones, then fill the rest with zeros, 8 bits per box”:
11111111 . 11111111 . 11111111 . 11000000
(8) (8) (8) (2 ones, 6 zeros)
= 8 + 8 + 8 + 2 = 26 ones totalThat row of boxes, read back in decimal, is 255.255.255.192 — which is exactly the subnet mask for a /26. This is the single most useful trick in this entire post: build the mask by filling in ones, 8 at a time, instead of trying to remember it.
CIDR Notation: The Slash Number
CIDR stands for Classless Inter-Domain Routing — don’t worry about memorizing that name, just remember what the notation does.
The number after the slash is simply a count of how many bits are locked (set to 1) in the subnet mask, read left to right.
/24 → 24 ones, then zeros → 255.255.255.0
/26 → 26 ones, then zeros → 255.255.255.192
/16 → 16 ones, then zeros → 255.255.0.0Here’s the full cheat sheet for every mask that lands inside the last octet — the range you’ll use constantly:
| CIDR | Subnet mask | Free bits (last octet) | Total addresses | Usable hosts | Block size |
|---|---|---|---|---|---|
| /24 | 255.255.255.0 | 8 | 256 | 254 | 256 |
| /25 | 255.255.255.128 | 7 | 128 | 126 | 128 |
| /26 | 255.255.255.192 | 6 | 64 | 62 | 64 |
| /27 | 255.255.255.224 | 5 | 32 | 30 | 32 |
| /28 | 255.255.255.240 | 4 | 16 | 14 | 16 |
| /29 | 255.255.255.248 | 3 | 8 | 6 | 8 |
| /30 | 255.255.255.252 | 2 | 4 | 2 | 4 |
| /31 | 255.255.255.254 | 1 | 2 | 0* | 2 |
| /32 | 255.255.255.255 | 0 | 1 | 0** | 1 |
*A /31 technically has “0 usable hosts” by the classic formula, but there’s a special exception (RFC 3021): on a point-to-point link with exactly 2 devices — like two routers wired directly to each other — both addresses are allowed to be used, because there’s no room, and no need, for a network ID or broadcast address on a 2-device link.
**A /32 is a single, specific address with no room for anything else — used for things like a route to one exact device, not for assigning to a group of hosts.
Notice the pattern across every row: usable hosts = total addresses − 2, except right at the very bottom where there’s no room left to lose 2 addresses from.
How Subnetting Actually Works, Conceptually
Every IP address has two parts glued together: a network part and a host part. The subnet mask is the thing that draws the line between them.
Picture 32 light switches in a row — that’s the IP address. The subnet mask is a second row of 32 switches, and wherever the mask switch is 1, that address switch is locked — it belongs to the network as a whole, like a street name. Wherever the mask switch is 0, that address switch is free — it’s what actually makes one device different from another on the same street, like a house number.
IP: 11000000.10101000.00001010.10000010 (192.168.10.130)
Mask: 11111111.11111111.11111111.11000000 (255.255.255.192, a /26)
↑ locked (network) ↑ ↑ free (host) ↑Everything you’ll calculate — network ID, broadcast, usable range, number of subnets — comes out of nothing more than “where exactly does that lock/free line sit, and what’s on each side of it.”
The Step-by-Step Process
This is the recipe. Every worked example later in this post is just this list, applied to different numbers.
- Find the CIDR / count the locked bits. Convert the mask to binary if needed, count the
1s. - Find the free bits.
32 − CIDR. - Find the block size (total addresses per subnet).
2^(free bits). - Subtract 2 for usable hosts.
2^(free bits) − 2. - Find the network ID. Lock the network bits as they are, force every free bit to
0. - Find the broadcast address. Same idea, but force every free bit to
1. - Find first/last usable host. Network ID
+ 1, and broadcast− 1.
Finding All Six Numbers: One Full Worked Example
Let’s use 192.168.10.130 with mask 255.255.255.192 (a /26) and get every number, showing every line.
Step 1 — CIDR: 255.255.255.192 → 11111111.11111111.11111111.11000000 → 26 ones → /26.
Step 2 — free bits: 32 − 26 = 6 free bits.
Step 3 — block size: 2^6 = 64 total addresses per subnet.
Step 4 — usable hosts: 64 − 2 = 62.
Step 5 — network ID. Only the last octet has free bits here, so that’s the only one we touch:
IP's last octet, 130 = 10000010
Mask's last octet = 11000000
Keep the locked bits, force the free bits to 0:
10000000 = 128Network ID: 192.168.10.128
Step 6 — broadcast address. Same idea, force the free bits to 1 instead:
10000010 (IP, for reference)
11 111111 ← force the free 6 bits to 1, keep the locked 2 as-is
= 10111111 = 191Broadcast: 192.168.10.191
Step 7 — first/last usable host:
First usable = network ID + 1 = 192.168.10.129
Last usable = broadcast − 1 = 192.168.10.190| Value | Result |
|---|---|
| Network ID | 192.168.10.128 |
| Broadcast | 192.168.10.191 |
| First usable host | 192.168.10.129 |
| Last usable host | 192.168.10.190 |
| Total addresses | 64 |
| Usable hosts | 62 |
Every subnetting question, no matter how it’s dressed up, is asking for some slice of this exact table.
The Magic Number Method (The Shortcut)
The binary method above always works, but it’s slow if you’re doing it live, under time pressure. The magic number method gets you the same six numbers using nothing but subtraction and addition.
Step 1 — find the interesting octet.
Scan the mask’s 4 boxes left to right. Any box that’s a full 255 is fully locked — copy it straight down later, no thinking needed. Any box that’s a flat 0 is fully free — also no thinking needed. The one box that’s neither 0 nor 255 is the interesting octet — the only box that actually needs a calculation.
Step 2 — the magic number.
Magic number = 256 − (mask value in the interesting octet)
This number is the block size for that octet — identical to 2^(free bits), just reached without doing binary.
Step 3 — subnet ID. Lay out blocks of size “magic number,” starting at 0. Find which block the IP’s value (in that same octet) falls into. The start of that block becomes the subnet ID’s interesting octet.
- Boxes before the interesting octet: copy straight from the IP.
- Boxes after the interesting octet: write
0.
Step 4 — broadcast address.
Broadcast (interesting octet) = subnet ID (interesting octet) + magic number − 1
- Boxes before: copy from the subnet ID.
- Boxes after: write
255this time, not0— this is the single easiest thing to mix up in the whole method.
Step 5 — first/last usable host. Same as always: subnet ID +1, broadcast −1.
Worked example: interesting octet in the usual spot
IP 165.245.77.14, mask 255.255.240.0.
- First two boxes are
255→ copy:165,245. - Third box,
240, is neither 0 nor 255 → interesting octet. - Fourth box is
0→ copy0. - Magic number:
256 − 240 = 16. - Blocks of 16 in that third box:
0–15, 16–31, 32–47, 48–63, 64–79, 80–95.... The IP’s third box is77, which lands in64–79. Block start =64. - Subnet ID:
165.245.64.0 - Broadcast (third box):
64 + 16 − 1 = 79. Fourth box (after interesting) →255. - Broadcast:
165.245.79.255 - First usable:
165.245.64.1. Last usable:165.245.79.254.
Worked example: interesting octet is NOT the last box
This is the case that trips people up, so it’s worth its own full pass.
IP 10.55.200.77, mask 255.240.0.0.
Mask: 255 . 240 . 0 . 0
↓ ↓ ↓ ↓
locked interesting free free- Magic number:
256 − 240 = 16. - Blocks of 16 in the second box:
0–15, 16–31, 32–47, 48–63.... The IP’s second box is55, landing in48–63. Block start =48. - Subnet ID: first box copies from IP (
10), second box is48, and — this is the part to watch — the third and fourth boxes come after the interesting octet, so they’re automatically0, regardless of what the original IP said there (200and77are completely ignored for this step). - Subnet ID:
10.48.0.0 - Broadcast, second box:
48 + 16 − 1 = 63. Third and fourth boxes, after the interesting octet, become255this time. - Broadcast:
10.63.255.255 - First usable:
10.48.0.1. Last usable:10.63.255.254.
Same method, same five steps — the only thing that changes is which boxes get the automatic fill, and what that fill is.
Block Size Method
Quick note so this doesn’t feel like a separate topic bolted on: “block size” and “magic number” are the same number, just two names for it depending on which teacher or textbook you learned from.
Block size = 2^(free bits) = 256 − (mask value in that octet)Both formulas always agree, because they’re describing the exact same thing: how many addresses are in one subnet, in the octet where the boundary falls. Use whichever one is faster for you in the moment — binary powers-of-2 if that’s memorized cold, or the 256 − mask subtraction if that’s quicker for you.
Here’s the compact version worth memorizing, since it comes up constantly:
| Mask value in the octet | Block size |
|---|---|
| 128 | 64 |
| 192 | 32 |
| 224 | 16 |
| 240 | 8 |
| 248 | 4 |
| 252 | 2 |
Wait — actually let’s double check that table line by line, because getting this backwards is exactly the kind of mistake that’s easy to make while going fast:
256 − 128 = 128 256 − 192 = 64 256 − 224 = 32
256 − 240 = 16 256 − 248 = 8 256 − 252 = 4| Mask value in the octet | Block size |
|---|---|
| 128 | 128 |
| 192 | 64 |
| 224 | 32 |
| 240 | 16 |
| 248 | 8 |
| 252 | 4 |
That’s the correct version — leaving the wrong one above uncorrected would be exactly the “guessed instead of calculated” mistake this whole post is about avoiding.
Borrowing Bits: Where New Subnets Come From
“Borrowing” just means taking bits that used to be free (host bits) and locking them instead, to create more, smaller subnets out of one starting network.
Subnets gained = 2^(borrowed bits)
borrowed bits = new prefix − starting prefixHere’s the classic progression, starting from 192.168.1.0/24 and looking for a subnet size that fits 40 devices:
| Mask | CIDR | Bits borrowed from /24 | Subnets created | Usable hosts per subnet | Fits 40 hosts? |
|---|---|---|---|---|---|
| 255.255.255.0 | /24 | 0 | 1 | 254 | Yes, but wastes almost everything |
| 255.255.255.128 | /25 | 1 | 2 | 126 | Yes, still wasteful |
| 255.255.255.192 | /26 | 2 | 4 | 62 | Yes — closest fit above 40 |
| 255.255.255.224 | /27 | 3 | 8 | 30 | No — too small, only 30 hosts |
Every extra bit borrowed doubles the number of subnets and cuts the hosts-per-subnet roughly in half. /26 is the answer here because it’s the smallest subnet (most subnets, least waste) that still comfortably holds 40 devices — /27 looks tempting because it makes even more subnets, but it physically can’t fit 40 hosts, only 30.
VLSM: Variable-Length Subnet Masks
Everything above assumed every subnet in the network is the same size. Real networks almost never work that way — one department needs 100 devices, another needs 5, and a router-to-router link only ever needs 2. VLSM (Variable-Length Subnet Mask) is what lets every one of those subnets have its own, differently sized mask, cut from the same original address block.
Back to the pizza: instead of cutting one pizza into 8 identical slices for 8 people who all want different amounts, VLSM lets you cut exactly the slice each person actually needs — one giant slice, a couple of medium ones, and a sliver for the person who’s not that hungry.
One /24 pizza, cut with VLSM instead of equal slices:
[################][########][####][##]
100-host dept 30-host 10 2-host
dept -host router
dept linkWorked VLSM example
You’re handed 10.0.0.0/24 and asked to fit these departments, largest first:
| Department | Hosts needed | Smallest CIDR that fits | Mask | Usable hosts |
|---|---|---|---|---|
| Sales | 100 | /25 (126 usable) | 255.255.255.128 | 126 |
| Support | 50 | /26 (62 usable) | 255.255.255.192 | 62 |
| IT | 25 | /27 (30 usable) | 255.255.255.224 | 30 |
| Router link | 2 | /30 (2 usable) | 255.255.255.252 | 2 |
To lay these out without overlapping, always allocate the biggest subnet first, starting at the bottom of the address block, then keep stacking:
| Department | Subnet | Range |
|---|---|---|
| Sales | 10.0.0.0/25 | 10.0.0.0 – 10.0.0.127 |
| Support | 10.0.0.128/26 | 10.0.0.128 – 10.0.0.191 |
| IT | 10.0.0.192/27 | 10.0.0.192 – 10.0.0.223 |
| Router link | 10.0.0.224/30 | 10.0.0.224 – 10.0.0.227 |
Each subnet starts exactly where the last one’s block ended — that’s not a coincidence, it’s the same block-size math from every earlier section, just applied four times in a row with a different block size each time.
Classless Addressing
Before CIDR existed, IP addresses were split into rigid “classes” based purely on the first number:
| First octet range | Class | Default mask |
|---|---|---|
| 1–126 | A | /8 |
| 128–191 | B | /16 |
| 192–223 | C | /24 |
The problem: these defaults were fixed and enormous. A single Class A network defaulted to over 16 million addresses, whether you needed 10 or 10 million. There was no in-between size.
Classless addressing — the CIDR system this entire post has been using — throws that rigid class system out. The mask itself tells you exactly where the network/host line sits, on any boundary you choose, regardless of what the first number happens to be. That’s what makes VLSM even possible: without classless addressing, every subnet on a network would be forced to the same fixed size, every time.
One place this shows up directly: the private range 172.16.0.0/12. People often memorize “172.16 through 172.31” as a flat list, but it’s really just 12 locked bits — the whole first box (172) plus 4 locked bits of the second box — leaving 4 free bits, and 2^4 = 16 possible values (16 through 31). Nothing about “16” or “31” is special on its own; it’s a direct result of counting free bits, the exact same skill from every section above.
Real-World Example: Designing a Small Office Network
You’ve been handed 192.168.20.0/24 for a small office with three physical rooms and one router link to the internet provider:
- Main office (35 devices)
- Server closet (6 devices)
- Guest Wi-Fi (14 devices)
- ISP router link (2 devices)
Step 1 — find the smallest CIDR for each group.
| Group | Needed | Smallest fitting CIDR | Usable hosts |
|---|---|---|---|
| Main office | 35 | /26 (62 usable) | 62 |
| Guest Wi-Fi | 14 | /28 (14 usable) | 14 |
| Server closet | 6 | /29 (6 usable) | 6 |
| Router link | 2 | /30 (2 usable) | 2 |
Step 2 — allocate biggest first.
| Group | Subnet | Range |
|---|---|---|
| Main office | 192.168.20.0/26 | .0 – .63 |
| Guest Wi-Fi | 192.168.20.64/28 | .64 – .79 |
| Server closet | 192.168.20.80/29 | .80 – .87 |
| Router link | 192.168.20.88/30 | .88 – .91 |
That leaves 192.168.20.92 through .255 completely untouched — room to grow later without redesigning anything that already exists. That “room to grow” isn’t an accident either; it’s exactly why you allocate the biggest subnets first, so the small leftover pieces stay open at the end instead of scattered awkwardly through the middle.
Three Things Beginners Get Wrong
Myth 1: “Same subnet mask means same subnet.”
Not true. A mask only tells you the size of the street — how many houses it can hold. It says nothing about whether two addresses are on the same street. 192.168.1.50/24 and 192.168.2.50/24 share the exact same mask and still aren’t on the same subnet, because their locked (network) portions — 192.168.1 versus 192.168.2 — don’t match. The only real test is computing and comparing the actual network ID for each address, every time, no shortcuts.
Myth 2: “A /26 gives you 64 usable hosts.”
64 is the total addresses in the block. Two of those 64 are never real devices — one is the network ID (the street sign), one is the broadcast address (the shared mailbox). Usable hosts is always total − 2. This single subtraction is the most common way to get every other step right and still land on the wrong final number.
Myth 3: “The subnet ID is basically the subnet mask.”
The mask is a fixed rule — it describes the block size for every subnet on that network, and it never changes based on which device you’re looking at. The subnet ID is a specific, calculated address — it changes depending on exactly where a given IP address falls. Handing over the mask when someone asks for the subnet ID answers a completely different question, even though the two numbers can look similar in shape if you’re moving fast.
Other Mistakes I Actually Made
Beyond the three above, a few more worth naming directly, since I made every single one of these out loud during my own practice:
- Called a bit count the “block size.” Block size is always
2^(bits), never the raw number of bits itself. Saying “block size is 6” when there are 6 free bits is mixing up two different numbers. - Guessed a mask from memory instead of building it. Answered
255.255.0.0for a/26by pattern-matching instead of actually filling in 26 ones, 8 at a time. Building it is slower the first few times and never wrong — guessing from memory sometimes is. - Copied the original IP forward as the “network ID” on a /28, instead of forcing every free bit to
0. The network ID is a calculation, not a copy. - Called leftover bits “subnet bits” with no starting prefix given. “Subnet bits” only means something relative to a starting/classful prefix you’re borrowing from. If a question just gives you a target host count and asks for the smallest mask, there’s nothing being borrowed from — those bits are just host bits.
- Said “leftmost 4 digits” instead of “leftmost 4 bits.” Thinking in decimal digits instead of binary bits is the root cause of most counting mistakes in this entire topic.
Tips for Solving This Fast
- Memorize powers of 2 up to 2^8 (
1, 2, 4, 8, 16, 32, 64, 128, 256) cold. Every single formula in this post reduces to one of these. - Memorize the block-size cheat sheet (
128→128, 192→64, 224→32, 240→16, 248→8, 252→4) instead of recalculating256 − maskevery single time. - Find the interesting octet first, before doing any other math. It tells you instantly which box actually needs work and which boxes are free copies.
- Write down free bits and locked bits before touching the formulas. Most mistakes happen from skipping straight to arithmetic without first confirming which number is which.
- Sanity-check with a second method when unsure — if binary AND and the magic number method don’t agree, one of them was rushed.
- Allocate VLSM subnets biggest-first, always. Smallest-first almost always causes overlaps or wasted gaps you have to redo.
Practice Round: Test Yourself
Question 1: You’re given 172.16.55.0/21. How many subnet bits, how many host bits, how many subnets, and how many usable hosts per subnet?
Answer: Default Class B boundary is /16, so
21 − 16 = 5subnet bits. Host bits =32 − 21 = 11. Subnets =2^5 = 32. Usable hosts =2^11 − 2 = 2046.
Question 2: IP 192.168.11.0/26. Find the number of subnets (relative to a /24) and usable hosts per subnet.
Answer: Subnet bits =
26 − 24 = 2→2^2 = 4subnets. Host bits =32 − 26 = 6→2^6 − 2 = 62usable hosts.
Question 3: Mask 255.255.255.224, IP 10.10.10.50. Find the subnet ID and broadcast address using the magic number method.
Answer: Interesting octet: 4th (
224). Magic number:256 − 224 = 32. Blocks of 32:0–31, 32–63....50falls in32–63, so subnet ID =10.10.10.32. Broadcast =32 + 32 − 1 = 63→10.10.10.63.
Question 4: You need at least 100 usable hosts on one subnet. What’s the smallest CIDR that fits, and what’s the mask?
Answer:
2^6 − 2 = 62(too small).2^7 − 2 = 126(fits). So 7 host bits → CIDR =32 − 7 = /25, mask =255.255.255.128.
Question 5: Two devices, 10.5.9.20/27 and 10.5.9.40/27. Same subnet or different?
Answer: Block size for /27 = 32.
20falls in block0–31→ network ID10.5.9.0.40falls in block32–63→ network ID10.5.9.32. Different network IDs → different subnets, even with the identical mask.
Advanced Tricks and Interview Tips
- Know both methods, and say so out loud. Interviewers sometimes specifically want to see the binary AND proof, not just the shortcut answer. Being able to say “I’ll get there fast with the magic number method, but here’s the binary underneath it” reads as real understanding, not memorized steps.
- The “subnet zero” question. Older textbooks sometimes treat the very first and very last subnet in a block as unusable “subnet zero” and “all-ones subnet.” Modern networking (and the CIDR standard) treats them as perfectly valid, and virtually every real device and exam today allows them — but knowing the older convention exists is worth a sentence if it comes up.
- /31 as a real exception. Don’t default to “0 usable hosts” without qualifying it — RFC 3021 explicitly allows /31 for point-to-point links, which is a common design choice specifically because it saves addresses on links that only ever need exactly 2 devices.
- Biggest-subnet-first is the VLSM tell. If you’re ever asked to lay out several differently sized subnets from one block, allocating from largest to smallest is the detail that separates a clean design from one full of accidental overlaps.
- “172.20 isn’t in the private range” is a trap, not a fact. If you ever see someone flag an address as invalid based on a memorized range, check whether they actually counted the free bits, or just recognized a number that looked unfamiliar. The range is a result of the bit count, not a list to memorize.
Why Any of This Actually Matters
None of this is trivia for its own sake. Every firewall rule, every VLAN, every cloud network you’ll ever touch — an AWS VPC, an Azure virtual network, a home router’s Wi-Fi vs. guest network split — is subnetting, wearing a different UI. A router’s routing table is just a list of network IDs and which direction to send traffic for each one. A firewall rule that says “allow traffic from the finance subnet” is only meaningful because someone already drew that exact line with a mask.
You can’t design, secure, or troubleshoot any of that if the core move — draw a line across 32 bits, and read off whatever falls on each side of it — isn’t automatic yet.
A subnet mask isn’t a label to memorize. It’s a line you draw across 32 bits, and everything else — the network address, the broadcast, the hosts, the subnets — falls out of exactly where that line sits.
Next up: TCP, UDP, and why blocking a port doesn’t actually block anything.