w5isp.com/content/blog/subnetting-ipv4.md

+++ title = "Subnetting IPv4: what the slash actually means" date = 2026-06-05 draft = true +++

An IPv4 address is 32 bits. That is the whole of it. Everything else you ever hear about subnets, masks, supernets, CIDR, and the /24 that turns up in every man page on Earth is just an elaborate argument about where to draw a line in those 32 bits and what the two halves mean.

The address gets dressed up in dotted decimal for the benefit of humans who do not like reading binary, and it is easy to forget there are only ever bits underneath. The prefix length (the number after the slash) is the scoreboard: everything to the left is the network, everything to the right is a host within that network. Move the line, change the number of networks, change the number of hosts per network. The math is not complicated. It only feels that way because it is usually taught by somebody reading out a subnet mask table instead of letting you see the bits.

Below, the same territory in four scenes. Start with the address and the mask, then carve a block into a mix of smaller blocks, then roll a few blocks back up into a single supernet, then do the one routing decision every host makes on every outbound packet: am I talking to you directly, or do I need to hand this to my gateway?

The address, the mask, and the slash

Drag the prefix slider. The bits on the left are the network portion and will match across every address in the subnet. The bits on the right are the host portion and are free to be anything. The subnet mask is just a second 32-bit number with ones in the network portion and zeros in the host portion. There is no third thing. If you understand the bits and the mask, you understand CIDR.

Two host values are reserved in each subnet. The all-zeros host is the network address itself, used as a label for the subnet and legal nowhere else. The all-ones host is the directed broadcast address. Everything in between is usable for actual hosts, which is why a /24 holds 254 usable addresses even though it technically contains 256. The two you cannot use are not a waste so much as a tax, and the tax is fixed regardless of subnet size, which is why small subnets feel expensive. A /30 (two usable hosts out of four) is half overhead. A /31 is a special case that RFC 3021 legalized for point-to-point links because losing half your addresses to ceremony on every link between two routers was getting embarrassing.

A /32 is a single address with no room for anyone else, which is useful for loopbacks and host routes. A /0 is the whole internet, which is useful as a default route and for almost nothing else.

Carving a block into mixed sizes

Early IPv4 had exactly three network sizes: /8, /16, /24, called Class A, B, and C. If you needed 500 addresses you got a /16 with 65,534 of them and threw 65,034 in the bin. CIDR arrived in 1993 to stop doing that. Under CIDR any block can be split into smaller blocks of whatever sizes you actually need, and those in turn into smaller blocks, until the parent has nothing left to give.

The parent block above is a /22: four /24s, 1022 usable hosts. The slider picks an allocation strategy that hands out the largest subnet first, then the next, and so on until the parent is full or the remaining space is too small to honor the request. Each subnet gets drawn at its correct size, which makes it visible how fast the address space disappears when you start asking for /24s, and how much further you can stretch the block when the things on it actually fit in /27s.

The allocator is greedy: largest first, then walk down. The rule is that every subnet must be aligned to its own size. A /24 has to start on a multiple of 256. A /26 has to start on a multiple of 64. You cannot hand out a /26 that starts at offset 32 any more than you can hand out a 64-byte block of memory that starts at a 32-byte boundary. If this feels familiar it is because IP address allocation and memory allocation are more or less the same problem, and in both cases the scheme that works is the one where everything lines up on powers of two and you do not argue with it.

Going the other way: supernetting

Supernetting is the same operation as subnetting, run backwards. Take several small networks that happen to be adjacent and aligned, and describe them with a single shorter prefix. Routers do this constantly. Every routing table you have ever looked at is an exercise in pretending that thousands of /24s are actually a handful of /16s whenever the routers can get away with it, because the alternative is a router with a CPU on fire.

The two /24 subnets live inside 10.20.0.0/16. The red bracket is the smallest single prefix that covers both. Slide A and B to consecutive even positions (4 and 5, 128 and 129, 200 and 201) and the bracket neatly becomes a /23 with no collateral. Slide them apart or onto misaligned positions (say 3 and 4, or 5 and 8) and the supernet has to expand to cover everything between, sweeping in a lot of addresses that aren't yours.

This is the thing that always bites people the first time they try to "summarize their networks." You cannot announce 10.20.3.0/24 and 10.20.4.0/24 as 10.20.3.0/23, because /23 requires alignment to a multiple of 2, and 3 isn't. The smallest honest supernet for those two is 10.20.0.0/21, which pulls in six neighbors you probably don't own. The rule in both directions (subnetting and supernetting) is the same: the line has to fall on a power-of-two boundary, or the math quietly decides for you.

The practical consequence is that address plans are designed, not discovered. If you intend to aggregate later, you allocate now in a way that lets the aggregation work: consecutive sites get consecutive, aligned blocks. Put one site in 10.1.0.0/20 and the next in 10.1.16.0/20, and later you can advertise 10.1.0.0/19 and every router on the internet silently thanks you.

Reserved and special ranges

Not every address is fair game. The IANA keeps the IPv4 Special-Purpose Address Registry, which is the authoritative list of blocks set aside for specific purposes. Below are the ones that come up often enough to be worth knowing by heart.

• 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 are RFC 1918 private space. Route them inside your network, NAT them at the edge, never let them leak out. The internet at large will not route them back.
• 127.0.0.0/8 is loopback. The whole /8 works, not just 127.0.0.1, but everyone pretends it's only the one address because the other 16.7 million feel wasteful and are.
• 169.254.0.0/16 is link-local. A host that fails to get a DHCP lease gives itself an address in this range and can at least talk to its neighbors on the same link. If you ever see a machine with a 169.254 address, its DHCP server is not well.
• 224.0.0.0/4 is multicast, used for routing protocols (OSPF, PIM) and for any application that wants one-to-many delivery without sending N copies. The IANA multicast registry carves this further for specific protocols.
• 255.255.255.255 is the limited broadcast address, which means "everyone on this link right now." DHCP clients use this before they know their own address.
• 0.0.0.0 is "this host, this network" in some contexts and "any address" in others, depending on where you're listening. A service bound to 0.0.0.0 is listening on every interface the host has.
• 100.64.0.0/10 is RFC 6598 shared address space, introduced so that ISPs could do carrier-grade NAT without stepping on RFC 1918 space that their customers were probably already using.

The regional internet registries (ARIN, RIPE, APNIC, LACNIC, AFRINIC) hand out the rest of the space to ISPs and end users under delegation from IANA. If you want to know who owns a given public address, look it up in the matching registry's whois service. If a packet surprises you, the surprise usually involves one of the reserved ranges above showing up somewhere you didn't expect it.

Same subnet or gateway: the decision a host makes on every packet

Every host that wants to send a packet asks itself one question first: is the destination on my local subnet, or not? If it is, the packet goes directly (ARP for the destination's MAC, send). If it is not, the packet goes to the default gateway, which is some router on the local subnet that has agreed to take packets off the host's hands and figure out where they belong. The host never thinks about where the router will send the packet next. That is the router's problem, and in exchange for that favor the router gets to charge you an extra MAC-layer frame rewrite on every packet that crosses it.

Two hosts, two addresses, one shared mask. The bits under the network portion either match or they don't. Slide the mask to change where the line falls and watch the decision flip. A /24 might put both hosts on the same subnet; a /26, on the same underlying ethernet, might not, because the line has moved and now the network bits disagree.

This is the reason a misconfigured subnet mask breaks connectivity in the exact pattern it does. If your mask is too long, you think your neighbors are on other networks and hand every packet to the gateway, which will either route them back out the same interface (wasteful but functional) or drop them on the floor (silent and infuriating). If your mask is too short, you think hosts on other networks are your neighbors, ARP for their MAC addresses, get no answer, and conclude that the network is down, when in fact the network is fine and you are the one who has misunderstood the map.

The bit that makes the rest make sense

Subnetting is not a different skill from address arithmetic. It is address arithmetic, performed on 32-bit numbers, with the bits grouped into octets for dotted decimal only because humans are bad at binary. Every question about a subnet (what is the network address, what is the broadcast, what is the next subnet, can these two hosts talk directly) is answered by looking at the bits with the mask applied. Whole books have been written to avoid saying this. The books are longer than the idea.

Once the bits are visible, the rest is geometry. A /24 is not smaller than a /16 because somebody said so; it is smaller because 24 is more than 16, and those extra 8 bits of network portion leave 8 fewer bits of host portion, and 2^8 is 256 instead of 65536. The whole of IPv4 subnetting is in that sentence, with a rounding error for the two addresses you can't use.

IPv6 does the same thing with 128 bits instead of 32, which fixes the scarcity problem and changes essentially nothing about how the math works. Which is good, because having learned this once is plenty.