Understanding Subnets & CIDR

A subnet (subnetwork) is a logical division of an IP network. If the internet is a massive metropolitan area, an IP address is a street address, while a subnet defines your specific gated community or office building layout. Without subnets, every computer on earth would belong to one giant flat network, creating massive traffic congestion and security risks.

The Anatomy of an IP Split

Every IPv4 address contains exactly 32 bits. This address is strictly divided into two segments: the Network ID (which tells routers where your network lives) and the Host ID (which identifies your specific device inside that space).

How a /24 Subnet Mask Splits Binary Bits

IP Address
11000000. 10101000. 00000001. 01011010 Value: 192.168.1.90
Mask (/24)
11111111. 11111111. 11111111. 00000000 Value: 255.255.255.0

The Blue Bits (1s) lock the network path. The Red Bits (0s) are assignable to devices.

CIDR Notation (The Slash Shorthand)

Writing out subnet masks like 255.255.255.0 gets tedious. Engineers use CIDR (Classless Inter-Domain Routing) notation instead. The slash number (like /24) explicitly tells you exactly how many bits are locked down for the network address path:

CIDR Notation Subnet Mask Equivalent Total Available Host IPs Common Use Case
/24 255.255.255.0 254 Standard home Wi-Fi networks and local office branches.
/16 255.255.0.0 65,534 Large enterprise campuses or cloud VPC infrastructure (AWS/GCP).
/30 255.255.255.252 2 Point-to-point links connecting exactly two backend routers.

The Rule of "-2": Unassignable IP Addresses

If you calculate a /24 subnet, the host bits provide 256 mathematical addresses (28 = 256). However, you can only connect 254 devices. This is because the first and last IP addresses in every single subnet are strictly reserved:

Why do Network Admins Subnet?

Mitigating Broadcast Storms

Devices constantly announce themselves via network broadcasts. If 10,000 devices were on one giant unsegmented network, the sheer noise of devices shouting background discoveries would crash old network interfaces.

Security Isolation

By dividing your layout into independent subnets, you can implement structural firewall access rules. Your corporate guest Wi-Fi subnet can be locked out completely from routing packets into your accounting database subnet.

Behind the Scenes: When you connect to public internet routing systems, your home router is running a calculation called a bitwise AND operation using its assigned Subnet Mask. This local comparison is how your machine determines instantly if another target IP address lives inside your house or out on the public internet.