IP Subnetting Explained: Masks, CIDR, VLSM and IPv6

Subnetting is a way to give a network structure: it divides an address range into smaller groups that devices and network equipment can identify and route between. The practical payoff is easier network planning, clearer separation of devices, and more deliberate use of available IPv4 addresses. To work with subnets, you need to understand how an IP address combines a network identifier with a host identifier—and how a mask marks the boundary between them.

The ideas start with binary arithmetic and IPv4 addresses, then build toward subnet masks, CIDR notation, and variable length subnet masking (VLSM). Private addressing explains how many internal devices can share a smaller number of public addresses. IPv6 changes the address format and expands the address space, while retaining prefix lengths to describe networks.

Why networks use subnets

Devices need addresses to exchange data. A user’s computer may communicate with a printer, an application server, or a router; each device needs an address that lets network protocols deliver traffic to it. An IP address is numeric, even when people reach a service through a memorable name that is translated to an address.

Addressing alone does not organize a network. Consider a company with separate marketing and sales teams. Grouping each team’s computers and printers into its own subnet can make the network easier to administer and can help limit which devices appear together as local resources. A subnet is a logical grouping; it does not have to correspond to a particular floor or building, though organizations may design it that way.

Within an IP address, part of the value identifies the network or subnet, and the remaining bits identify a host on that subnet. Routers use this division to decide whether traffic belongs on a local network or needs to be sent elsewhere. A subnet is therefore both an addressing concept and a practical tool for organizing communication.

Binary is the arithmetic underneath

Computers represent IP addresses as bits: binary digits that can have a value of 0 or 1. Decimal numbers use base 10, so each position represents a power of ten: ones, tens, hundreds, and so on. Binary uses base 2, so each position represents a power of two: 1, 2, 4, 8, 16, 32, 64, and 128.

For example, decimal 105 can be written as the eight-bit binary value 01101001. Read from left to right, its place values are 128, 64, 32, 16, 8, 4, 2, and 1. The digits set to 1 contribute their place values:

0 × 128 + 1 × 64 + 1 × 32 + 0 × 16 + 1 × 8 + 0 × 4 + 0 × 2 + 1 × 1 = 105

IPv4 addresses contain 32 bits. For readability, those bits are split into four groups of eight and written as four decimal numbers separated by dots. Each group is called an octet and ranges from 0 to 255, since eight bits can represent 256 values.

IPv4 addresses and their parts

An IPv4 address is written in dotted decimal notation, such as 205.112.45.60 or 34.243.44.155. The same address, 205.112.45.60, in binary is 11001101.01110000.00101101.00111100. The address identifies an interface on a network; the mask or prefix length determines which bits describe the network and which identify the host.

Older networking material often introduces IPv4 through address classes. In that scheme, Class A begins with first-octet values from 0 through 126, Class B from 128 through 191, and Class C from 192 through 223. Class D spans 224 through 239, and Class E spans 240 through 255. The range beginning with 127 is set aside for loopback, which lets a device address itself.

Classes A, B, and C historically had default network boundaries after the first, second, and third octets respectively. That led to the familiar diagrams showing a network part followed by a host part. Class D and E addresses do not use that network-and-host division for ordinary host assignment. Class-based boundaries remain useful for learning the history and basic structure of IPv4, but modern address allocation and routing use classless prefixes.

For example, under the old Class C convention, an address such as 212.11.123.3 would have a 24-bit network portion and an 8-bit host portion. A subnet mask can move that boundary by using some of the host bits to identify smaller networks.

What a subnet mask tells you

A subnet mask is a 32-bit value that marks the network portion of an IPv4 address. In binary, the network bits are 1s and the host bits are 0s. A device combines the address and mask using a bitwise AND operation to determine the network address. Routers and hosts use that result to decide whether another address is on the same local subnet.

Take the mask 255.255.255.128. In binary, it is 11111111.11111111.11111111.10000000. The first 25 bits mark the network prefix; the final seven bits identify hosts within that subnet. This mask is also written /25, because the prefix contains 25 network bits.

Borrowing one bit from an eight-bit host portion creates two possible subnets, because one bit has two values: 0 or 1. Each resulting /25 subnet has seven bits left for host addresses. In the common IPv4 subnet model, the all-zero host value identifies the network and the all-one value is the directed broadcast address, leaving 126 assignable host addresses in each /25 subnet.

As the prefix grows, more bits describe the network and fewer remain for hosts. A /26 uses 26 network bits and leaves six host bits, which gives 64 total addresses and typically 62 assignable host addresses per subnet. A /30 leaves two host bits and typically allows two assignable addresses. Some point-to-point links use /31 prefixes under specific conventions, so the usual rule of subtracting network and broadcast addresses does not apply universally.

The following examples show the common relationship between prefix length, mask, and typical assignable host count:

The number of possible subnets depends on the starting address block and how many bits are assigned to the subnet. A prefix on its own does not tell you how many subnets an organization has created; it tells you the size of a particular address block. This distinction matters when reading subnet charts, since tables may assume a specific starting network and count conventions.

Public and private IPv4 addressing

IPv4 has 32 bits, allowing 2³² possible bit patterns. Some ranges are reserved for special uses, so that total is not the number of addresses available for ordinary public assignment. Loopback is one example. Other special uses include multicast and broadcast traffic.

Private IPv4 ranges are intended for internal networks and are not routed across the public Internet as ordinary destination addresses. The three private blocks are:

• 10.0.0.0/8, spanning 10.0.0.0 through 10.255.255.255.
• 172.16.0.0/12, spanning 172.16.0.0 through 172.31.255.255.
• 192.168.0.0/16, spanning 192.168.0.0 through 192.168.255.255.

An organization can assign private addresses to many internal devices while using public addressing for communication beyond its network. A router commonly performs network address translation to map between internal private addresses and an external address. The analogy is a company phone number with internal extensions: the external number reaches the organization, while extensions identify people inside it.

Private addressing does not itself provide encryption or anonymity. It defines where those addresses are intended to be used. Network design still needs appropriate routing, access controls, and other protections for the organization’s requirements.

CIDR replaces fixed class boundaries

Classless Inter-Domain Routing, or CIDR, represents an IPv4 network with an address and a prefix length, such as 205.112.45.60/25. The “/25” means that the first 25 bits form the network prefix. CIDR lets administrators choose network sizes without being limited to the old Class A, B, and C boundaries.

This flexibility helps avoid assigning a block much larger than a network needs. A /18 contains 16,384 total IPv4 addresses. If a site needs around 900 host addresses, allocating the entire /18 would leave a large portion unused. A /22 contains 1,024 total addresses and typically provides 1,022 assignable host addresses, making it a closer fit.

CIDR also supports route aggregation, sometimes called supernetting. Multiple adjacent networks can be represented by a shorter shared prefix when their addresses and routing arrangements permit it. That can reduce the amount of routing information that needs to be advertised. Subnetting divides a larger block into smaller networks; aggregation summarizes compatible smaller blocks into a larger route.

Common prefix sizes illustrate the range of block sizes:

These are total addresses in each block, not necessarily the number of assignable host addresses. In a typical subnet, the network and broadcast addresses are not assigned to individual hosts. Actual use also depends on the network’s purpose and routing rules.

VLSM gives different subnets different sizes

Variable length subnet masking means using subnets with different prefix lengths within an address plan. A large office, a small branch, and a point-to-point connection may have very different address needs. VLSM allows each to receive a block sized more closely to its requirements, instead of forcing every subnet to use the same mask.

To plan with VLSM, an administrator starts with the largest address needs and assigns appropriately sized blocks, then allocates smaller blocks from the remaining space. The blocks must fit within the parent range and align on valid prefix boundaries. Careful planning prevents overlaps and leaves room for growth.

Routing protocols must carry enough information for routers to understand these differing prefix lengths. Older RIPv1 routing does not include subnet mask information in its route updates, which limits its ability to support classless networks reliably. Protocols such as RIPv2 and OSPF carry prefix or mask information, allowing routers to distinguish routes with different subnet sizes.

IPv6: more address bits, prefix notation remains

IPv6 expands addresses from 32 bits to 128 bits. That provides 2¹²⁸ possible values: 340,282,366,920,938,463,463,374,607,431,768,211,456. The much larger space supports continued network growth and changes how addresses are written.

An IPv6 address is usually shown as eight groups of hexadecimal digits separated by colons. Each group represents 16 bits. A full form might look like 2001:0db8:85a3:0000:0000:8a2e:0370:7D34. Hexadecimal uses the digits 0–9 and letters A–F, providing a compact way to represent binary values.

IPv6 notation can omit leading zeros in a group. It can also replace one consecutive run of all-zero groups with a double colon. The example above can be shortened to 2001:0db8:85a3::8a2e:0370:7D34. The double colon can appear only once in an address, so the omitted groups can be inferred unambiguously.

Mixed notation is used in some contexts involving both IPv4 and IPv6, with the final part written in dotted decimal form. It combines hexadecimal groups with an IPv4-style suffix.

IPv6 does not use the dotted decimal subnet masks familiar from IPv4, but it still uses prefix lengths. In 2001:0db8:85a3::8a2e:0370:7D34/64, the first 64 bits form the prefix. That prefix can identify a network range or a subnet, depending on the address plan. Prefix notation is therefore still central to IPv6 routing and network design.

A practical way to read subnet notation

When you see an IPv4 address with a slash suffix, first read the suffix as the number of network bits. For example, in 205.112.45.60/25, the first 25 bits describe the network prefix and the remaining seven bits identify addresses within that block. The corresponding mask is 255.255.255.128.

Then determine the block size and usable range. With a /25, the final octet is divided into blocks of 128 values. Depending on the starting address, the subnet ranges span 0–127 or 128–255 in that octet. In the conventional subnet model, one address identifies the subnet and one is its directed broadcast address; the other 126 are available for hosts.

The same process works for other prefixes: translate the prefix into a mask, identify how many host bits remain, and calculate the size of the address block. Binary arithmetic explains why the values fall on powers of two, while the dotted decimal mask provides a convenient way to write the boundary.

Quick reference

Use “total addresses” when counting every value in a block, and “assignable hosts” when applying the conventional IPv4 rule that excludes the network and broadcast addresses. The phrase “number of subnets” requires a starting block and a target prefix; a prefix by itself specifies one block’s size.

What subnetting changes in practice

Subnetting makes address plans easier to reason about by giving devices meaningful network groupings. Masks and prefixes define those groupings; CIDR makes their sizes flexible; VLSM lets a single plan accommodate subnets with different needs. Private ranges support internal addressing, while routers use the network boundary to forward traffic between subnets.

The central calculation is simple once the terms are clear: an IP address is a 32-bit value in IPv4, and a mask or prefix marks which bits identify the network. More network bits mean smaller address blocks and fewer host addresses. IPv6 greatly expands the address space and uses colon-separated hexadecimal notation, while retaining prefix lengths for network boundaries. These are the working ideas behind planning, reading, and troubleshooting IP subnets.