Subnetting step by step

Subnetting splits one network into smaller networks of equal size by moving the boundary between the network part and the host part to the right. Every host bit you borrow for the network part doubles the number of subnets and halves the size of each one: borrowing s bits from a network with h host bits gives 2^s subnets of 2^(h − s) addresses. The method has five steps. First, work out how many bits to borrow from what you need, a number of subnets or a number of hosts per subnet. Second, write the new prefix length and mask. Third, find the block size: 256 minus the mask value in the octet where the boundary falls. Fourth, list the subnets, which start at multiples of the block size. Fifth, check each subnet’s network address, host range and broadcast address. This lesson runs every step on worked examples and in Python.

Why networks are split

RFC 950, the standard that introduced subnets, describes organisations that divided one network into several subnets instead of asking for more network numbers. The reasons still hold. Each subnet is its own broadcast domain, so a broadcast from one floor of a building does not reach every device on the campus. Each subnet can carry its own rules: the guest Wi-Fi can be kept away from the accounts office by filtering between two subnets. And a router can reach a whole building through one route instead of one route per device.

Equal subnets are the simplest plan: every subnet gets the same prefix length. The next lesson of this module, on VLSM, gives each subnet a size of its own. Both rest on the same arithmetic, which is what this lesson practises.

Step 1: decide how many bits to borrow

Start from what you need:

• A number of subnets N. Borrow the smallest s with 2^s ≥ N. Six subnets need s = 3, because 2³ = 8 is the first power of two that reaches 6, so a /24 becomes a /27.
• A number of hosts per subnet H. Keep the smallest number of host bits h with 2^h − 2 ≥ H; the new prefix is 32 − h. Fifty hosts need h = 6 (2⁶ − 2 = 62), so the subnets are /26.
• Both. The prefix must be at least the one the subnets need and at most the one the hosts need. When those two limits cross, no equal split works.

# Step 1 of subnetting: how many bits to borrow from 192.168.10.0/24, from a number of subnets, a number of
# hosts per subnet, or both.
import math


def bits_for_subnets(count):
    return (count - 1).bit_length()  # the smallest s with 2**s >= count


def bits_for_hosts(count):
    return (count + 1).bit_length()  # the smallest h with 2**h - 2 >= count


def describe(prefix):
    return f"/{prefix}, {2 ** (prefix - BASE)} subnets of {2 ** (32 - prefix) - 2} hosts"


def need_text(subnets, hosts):
    if subnets and hosts:
        return f"{subnets} subnets of {hosts} hosts"
    return f"{subnets} subnets" if subnets else f"{hosts} hosts each"


BASE = 24
for subnets, hosts in [(6, None), (None, 50), (6, 25), (6, 40)]:
    shortest = BASE + bits_for_subnets(subnets) if subnets else BASE  # enough subnets from here on
    longest = 32 - bits_for_hosts(hosts) if hosts else 30           # enough hosts up to here
    need = need_text(subnets, hosts)
    if shortest > longest:
        print(f"{need}: impossible")
        print(f"  (subnets need /{shortest} or longer, hosts /{longest} or shorter)")
    else:
        print(f"{need}: {describe(shortest if subnets else longest)}")

# Whole numbers avoid the rounding of a floating-point logarithm at an exact power of two.
print("ceil(log(2**29, 2)) =", math.ceil(math.log(2**29, 2)))
print("bits_for_subnets(2**29) =", bits_for_subnets(2**29))

6 subnets: /27, 8 subnets of 30 hosts
50 hosts each: /26, 4 subnets of 62 hosts
6 subnets of 25 hosts: /27, 8 subnets of 30 hosts
6 subnets of 40 hosts: impossible
  (subnets need /27 or longer, hosts /26 or shorter)
ceil(log(2**29, 2)) = 30
bits_for_subnets(2**29) = 29

The fourth case is worth a second look. Six subnets need at least 3 borrowed bits, which leaves 5 host bits and 30 hosts, while 40 hosts need 6 host bits, which leaves room to borrow only 2. The answer is to ask for a larger network, or to give the subnets different sizes with VLSM.

In code, (n - 1).bit_length() is the smallest s with 2^s ≥ n, and (n + 1).bit_length() is the smallest h with 2^h − 2 ≥ n. Both stay in whole numbers. A formula built on math.ceil(math.log(n, 2)) can be one too high at an exact power of two, as the last two lines show: math.log(2**29, 2) comes out a little above 29, so its ceiling is 30.

Steps 2 and 3: the new mask and the block size

The new prefix gives the new mask, and only one octet of the mask is interesting: the one where the boundary falls. Prefixes /1 to /8 put the boundary in the first octet, /9 to /16 in the second, /17 to /24 in the third and /25 to /32 in the fourth. Inside that octet the mask can take only these values:

The block size is 256 minus the mask value: how far apart two neighbouring subnets are in that octet. For a /27 the fourth octet of the mask is 224, so the subnets are 32 apart. For a /20 the third octet of the mask is 240, so the third octet counts up in steps of 16. When the prefix is a multiple of 8, as with /16 or /24, the mask value in the interesting octet is 255 and the block size is 1: each subnet is one value of that octet, such as 10.1.0.0/16, 10.2.0.0/16 and 10.3.0.0/16.

Step 4: list the subnets

Subnets start at every multiple of the block size in the interesting octet. Within one subnet:

• the network address is the start of the block;
• the first host is the start plus 1;
• the last host is the start plus the block size minus 2;
• the broadcast address is the start plus the block size minus 1, one less than the next subnet’s network address.

For 192.168.10.0/24 cut into /27s the block size is 32, so the eight subnets start at .0, .32, .64, .96, .128, .160, .192 and .224. The program lists them from the block size and compares the list with ipaddress.subnets():

# Steps 2 to 4: the /27 subnets of 192.168.10.0/24 from the block size, compared with ipaddress.subnets().
import ipaddress

base = ipaddress.ip_network("192.168.10.0/24")
new_prefix = 27
mask = ipaddress.ip_network(f"0.0.0.0/{new_prefix}").netmask
block = 256 - int(str(mask).split(".")[3])  # the boundary falls in the fourth octet
print(f"mask {mask}, block size {block}")

by_hand = []
for start in range(0, 256, block):
    hosts = f".{start + 1}-.{start + block - 2}"
    print(f"192.168.10.{start:<3}  hosts {hosts:<10} broadcast .{start + block - 1}")
    by_hand.append(f"192.168.10.{start}/{new_prefix}")

print("same as ipaddress:", by_hand == [str(n) for n in base.subnets(new_prefix=new_prefix)])

mask 255.255.255.224, block size 32
192.168.10.0    hosts .1-.30     broadcast .31
192.168.10.32   hosts .33-.62    broadcast .63
192.168.10.64   hosts .65-.94    broadcast .95
192.168.10.96   hosts .97-.126   broadcast .127
192.168.10.128  hosts .129-.158  broadcast .159
192.168.10.160  hosts .161-.190  broadcast .191
192.168.10.192  hosts .193-.222  broadcast .223
192.168.10.224  hosts .225-.254  broadcast .255
same as ipaddress: True

Step 5: find the subnet of an address

Going the other way, from an address to its subnet, takes three moves. Take the interesting octet of the address and round it down to a multiple of the block size: that is the network address in that octet. Add the block size minus 1 to get the broadcast address in that octet. Octets before the interesting one stay as they are; octets after it become 0 in the network address and 255 in the broadcast address.

Take 172.16.45.77/20. The boundary is in the third octet, where the mask is 240 and the block size 16. 45 rounds down to 32, so the network address is 172.16.32.0, and 32 + 15 = 47 gives the broadcast address 172.16.47.255. The address lies strictly between them, so it is a usable host.

# Step 5: which subnet holds an address, by the block-size method, and whether the address is a usable host.
import ipaddress


def locate(address, prefix):
    octets = [int(x) for x in address.split(".")]
    i = (prefix - 1) // 8                    # the octet where the boundary falls (0 to 3)
    bits_in_octet = prefix - 8 * i            # network bits inside that octet (1 to 8)
    block = 2 ** (8 - bits_in_octet)
    start = octets[i] // block * block
    network = octets[:i] + [start] + [0] * (3 - i)
    broadcast = octets[:i] + [start + block - 1] + [255] * (3 - i)
    return ".".join(map(str, network)), ".".join(map(str, broadcast)), i + 1, block


for address, prefix in [("172.16.45.77", 20), ("192.168.10.95", 27), ("192.168.10.96", 27),
                        ("10.200.15.255", 21), ("10.200.12.255", 21), ("10.200.12.0", 21)]:
    network, broadcast, octet, block = locate(address, prefix)
    role = {network: "network address", broadcast: "broadcast address"}.get(address, "usable host")
    print(f"{address}/{prefix}: octet {octet}, block {block}")
    print(f"  {network} - {broadcast}, {role}")
    net = ipaddress.ip_network(f"{address}/{prefix}", strict=False)
    assert (str(net.network_address), str(net.broadcast_address)) == (network, broadcast)

172.16.45.77/20: octet 3, block 16
  172.16.32.0 - 172.16.47.255, usable host
192.168.10.95/27: octet 4, block 32
  192.168.10.64 - 192.168.10.95, broadcast address
192.168.10.96/27: octet 4, block 32
  192.168.10.96 - 192.168.10.127, network address
10.200.15.255/21: octet 3, block 8
  10.200.8.0 - 10.200.15.255, broadcast address
10.200.12.255/21: octet 3, block 8
  10.200.8.0 - 10.200.15.255, usable host
10.200.12.0/21: octet 3, block 8
  10.200.8.0 - 10.200.15.255, usable host

An address that ends in .255 is not always a broadcast address, and one that ends in .0 is not always a network address. In 10.200.8.0/21 the broadcast address is 10.200.15.255, so 10.200.12.255 and 10.200.12.0 are ordinary hosts. Only the interesting octet and the octets after it decide.

Subnets that cross an octet boundary

The borrowed bits do not have to fit inside one octet. Suppose 172.16.0.0/16 must be cut into at least 500 subnets. That needs 9 borrowed bits (2⁹ = 512), so the new prefix is /25. The boundary sits in the fourth octet, where the block size is 128, but the borrowed bits run through the whole third octet as well. Two /25 subnets fit in each value of the third octet: 172.16.0.0 and 172.16.0.128, then 172.16.1.0 and 172.16.1.128, and so on.

Subnet number k (counting from 0) therefore starts k × 128 addresses after the base. Dividing k × 128 by 256 gives the third octet, and the remainder gives the fourth: subnet 299, the 300th subnet, is 172.16.149.128/25.

# Subnetting across an octet boundary: 172.16.0.0/16 cut into at least 500 equal subnets.
import ipaddress

base = ipaddress.ip_network("172.16.0.0/16")
borrowed = (500 - 1).bit_length()  # 2**9 = 512 >= 500
prefix = base.prefixlen + borrowed
size = 2 ** (32 - prefix)
print(f"/{prefix}: {2 ** borrowed} subnets of {size} addresses ({size - 2} hosts)")

# Each subnet is the base address plus k times the subnet size: with 128 addresses per subnet,
# two subnets fit in each value of the third octet.
for k in [0, 1, 2, 3, 299, 511]:
    third, fourth = divmod(k * size, 256)
    print(f"subnet {k:<3}  172.16.{third}.{fourth}/{prefix}")

subnets = list(base.subnets(new_prefix=prefix))
print("ipaddress agrees:", str(subnets[299]) == "172.16.149.128/25", len(subnets))

/25: 512 subnets of 128 addresses (126 hosts)
subnet 0    172.16.0.0/25
subnet 1    172.16.0.128/25
subnet 2    172.16.1.0/25
subnet 3    172.16.1.128/25
subnet 299  172.16.149.128/25
subnet 511  172.16.255.128/25
ipaddress agrees: True 512

The zero subnet and the all-ones subnet

RFC 950 asked networks not to assign the subnets whose subnet bits are all zeros or all ones, because those values also meant “this network” and “all hosts”. Ten years later RFC 1878 called excluding them obsolete and noted that modern software can use every subnet that can be defined. Today a /24 split into /27s gives eight usable subnets, the first and the last included.

Some exam questions and older textbooks still follow the old rule. When a question says the zero subnet and the all-ones subnet must not be used, count 2^s − 2 subnets instead of 2^s: a /24 split with 3 borrowed bits then gives 6 usable subnets rather than 8. Without such an instruction, use all of them.

Checking an answer in seconds

A few checks catch almost every slip:

• The network address’s interesting octet is a multiple of the block size, and every later octet is 0.
• The broadcast address is one less than the next subnet’s network address.
• A subnet has 2^h − 2 usable hosts (a /31 point-to-point link is the exception, with 2).
• The number of subnets times the addresses in each equals the addresses of the network you started with: 8 × 32 = 256 for the /27s of a /24.
• Writing only the interesting octet in binary confirms an edge: the host bits of a network address are all 0 and those of a broadcast address all 1.

Interview questions

What is the block size of a /27, and what are the first three /27 subnets of 192.168.10.0/24?

A /27 mask is 255.255.255.224, so the boundary falls in the fourth octet and the block size is 256 − 224 = 32: each /27 holds 32 addresses, 30 of them usable. Subnets start at multiples of 32 in the fourth octet, so the first three are 192.168.10.0/27 (hosts .1 to .30, broadcast .31), 192.168.10.32/27 (hosts .33 to .62, broadcast .63) and 192.168.10.64/27 (hosts .65 to .94, broadcast .95). A /24 holds eight of them; the last is 192.168.10.224/27.

Key takeaways

• Borrowing s host bits makes 2^s subnets; keeping h host bits leaves 2^h − 2 usable hosts in each.
• Six subnets need 3 borrowed bits and 50 hosts need 6 host bits; when the two needs cross, no equal split works.
• The block size is 256 minus the mask value in the octet where the boundary falls, and subnets start at its multiples.
• An address’s subnet: round its interesting octet down to a multiple of the block size; the broadcast address is one less than the next subnet.
• Borrowed bits can span octets: subnet k of a split starts k × (subnet size) addresses after the base.
• Modern networks use the zero subnet and the all-ones subnet; drop them only when a question says so.