IP Addressing & Subnetting

Every device on a network needs an address, and every address is really two pieces glued together: which network it belongs to, and which host it is on that network. Get the split wrong — size a range too small, or misread which bits are network versus host — and the failure ranges from "this device can't reach anything" to a redesign forced months later once every address in a too-small range is spoken for.

TL;DR — in 30 seconds:

• Every IPv4 address splits into a network portion and a host portion; the CIDR /N suffix says where that split falls — a smaller N leaves more host bits and yields a bigger range.
• A range's usable host count is always raw size minus 2 — the all-zeros network address and the all-ones broadcast address are both reserved, never assigned to a device.
• Three ranges (RFC 1918) are reserved for private networks only and need NAT to reach the public internet.

1. IPv4 addresses and the network/host split

An IPv4 address is 32 bits, written as four decimal numbers (192.168.1.10). Every address splits into a network portion and a host portion — the question is only where that split falls, and that's exactly what the CIDR (Classless Inter-Domain Routing) notation's /N suffix tells you.

flowchart LR
    A["10.0.1.42/24"] --> B["Network portion<br/>10.0.1.0 (first 24 bits)"]
    A --> C["Host portion<br/>.42 (last 8 bits)"]

• /24 means the first 24 bits are the network portion, leaving 8 bits for hosts — 2⁸ = 256 addresses.
• A smaller prefix number means a bigger range: /16 holds far more addresses than /24.
• Two addresses can only talk directly (without a router) if they share the same network portion.

2. Usable hosts, network address, and broadcast address

A range's usable host count is always 2 less than its raw size, because two addresses in every range are reserved:

Address	Role
Network address	the all-zeros host bits (10.0.1.0 for a /24) — identifies the range itself, never assigned to a device
Broadcast address	the all-ones host bits (10.0.1.255 for a /24) — reaches every host on that network at once

CIDR prefix	Raw addresses	Usable hosts
/24	256	254
/25	128	126
/26	64	62
/28	16	14

(Cloud providers commonly reserve a few additional addresses per subnet for their own control-plane use — that's a platform-specific rule on top of this base IPv4 math, not a contradiction of it.)

3. Subnetting — carving one range into many

Subnetting takes one CIDR block and splits it into smaller ranges by increasing the prefix length. A /16 (65,536 addresses) carved into /24 subnets yields 256 separate /24 ranges of 254 usable hosts each — the same trade every design makes: fewer, bigger subnets versus more, smaller ones.

flowchart TB
    P["10.0.0.0/16<br/>(65,536 addresses)"]
    P --> S1["10.0.0.0/24"]
    P --> S2["10.0.1.0/24"]
    P --> S3["10.0.2.0/24"]
    P --> S4["… up to 10.0.255.0/24"]

Sizing a subnet is a one-way door in practice: pick it too small and you either run out of hosts or have to re-carve the whole range later, so real designs size for eventual, not just current, host count.

4. Private address ranges

Three ranges are reserved (RFC 1918) for use inside private networks — never routable on the public internet:

Range	CIDR
10.0.0.0 – 10.255.255.255	10.0.0.0/8
172.16.0.0 – 172.31.255.255	172.16.0.0/12
192.168.0.0 – 192.168.255.255	192.168.0.0/16

A private address needs a translation step (NAT) to reach the public internet — the cloud-specific version of that mechanism (Internet Gateway vs NAT Gateway) is covered where it matters operationally: the AWS module's VPC networking page.

5. How this connects

• This is the general IPv4 mechanic underneath the cloud-specific CIDR/subnet material in AWS's VPC networking page (module 05, AWS, §1 "CIDR blocks and subnets") — that page assumes you can already read a CIDR block and compute a host range; this page is where that skill comes from.
• The next page, Routing & gateways, covers what actually decides whether two addresses on different subnets can reach each other.

Common gotchas

• Assuming a bigger prefix number means a bigger range. Fix: it's the opposite — /N counts network bits, so a smaller N leaves more bits for hosts and yields a bigger range (/16 > /24).
• Treating a subnet's raw address count as its usable host count. Fix: subtract 2 — the all-zeros network address and the all-ones broadcast address are both reserved, never assigned to a device.
• Sizing a subnet for today's headcount instead of eventual growth. Fix: re-carving a too-small range later is a one-way door in practice; size for the eventual host count, not just what's needed right now.
• Assuming a cloud subnet's usable hosts is exactly raw-minus-2. Fix: that's the base IPv4 rule — cloud providers commonly reserve a few additional addresses per subnet on top of it for their own control-plane use, so the provider's actual usable count can be lower.

Check yourself — you carve a 10.0.0.0/16 range into /24 subnets. How many subnets do you get, and how many usable hosts does each one hold?

256 subnets — going from a /16 to a /24 adds 8 network bits (24 − 16 = 8), and 2⁸ = 256. Each /24 holds 256 raw addresses, minus 2 (network + broadcast) = 254 usable hosts.

Check yourself — a device has the address 192.168.1.10. Why can't it reach the public internet directly, even though it's a syntactically valid IPv4 address?

It falls inside 192.168.0.0/16, one of the three RFC 1918 private ranges reserved for use inside private networks only — never routable on the public internet. Reaching the public internet from it requires a translation step (NAT).

You can defend this when you can take any CIDR block and state its network address, broadcast address, and usable host count without a calculator, and explain why a /16 split into /24s gives exactly 256 subnets.