Day 6: IP Addressing & Subnetting for Hackers — The Only Guide You'll Ever Need (2026)

📰 Originally published on SecurityElites — the canonical, fully-updated version of this article.

DAY 6 OF 100
100-Day Ethical Hacking Course

Full Course →

🔴 Day 6 — IP Addressing & Subnetting for Beginners

Day 100 — Professional Pentester

← Day 5: Networking Basics

Day 7: Wireshark Basics →

06

Every time a student types nmap 192.168.1.0/24 in a tutorial, I ask them: “What does the /24 mean?” Most can’t answer. They typed it because the tutorial said to. That works right up until something goes wrong — and then they have no idea why.

Today you learn to actually understand that notation. And once you do, every scan range, every network diagram, and every infrastructure assessment you’ll ever do will make complete, immediate sense.

I’m going to be direct about subnetting: it has a reputation for being the topic that breaks beginners. That reputation exists because most teachers jump straight into the math without explaining why any of it matters. I’m going to do the opposite — purpose first, mechanics second. By the end of today you’ll understand subnetting well enough to calculate target ranges in your head for common networks.

📋 Day 6 Contents

1. Why Subnetting Matters for Hackers
2. IPv4 Address Structure
3. Binary — Just Enough to Understand
4. Subnet Masks Demystified
5. CIDR Notation — The Shorthand
6. Calculating Host Ranges
7. Common Subnets Cheat Sheet
8. Tools — ipcalc, ip route, Nmap
9. Subnetting in Real Assessments
10. Day 6 Practical Task

Why Subnetting Matters — The Hacker’s Perspective

Before we touch any math, I want you to understand exactly where subnetting shows up in practical ethical hacking work. This context will make the technical details meaningful rather than abstract.

🔍

Defining Scan Targets
When you run nmap 10.10.10.0/24, you need to know what that /24 means — 254 potential hosts on that network segment. Understanding this prevents you from accidentally scanning too broad (entire internet) or too narrow (missing live hosts).

🗺️

Reading Network Diagrams
Penetration test reports include network topology diagrams. Every segment is labelled with CIDR notation. Understanding subnetting means you can read a network map, identify which systems are on which segment, and plan lateral movement accordingly.

🎯

OSINT & Scope Definition
Bug bounty programs define scope using CIDR ranges. A company might say “in-scope: 203.0.113.0/24” — you need to know exactly which IPs that includes to stay inside the rules.

🏢

Internal Network Understanding
Enterprise networks are divided into subnets by function — 10.1.0.0/24 for servers, 10.2.0.0/24 for workstations, 10.3.0.0/24 for management. Recognising these patterns tells you what’s likely on each segment during a pentest.

IPv4 Address Structure — Anatomy of an IP

An IPv4 address is a 32-bit number written in a human-readable format called dotted decimal notation. The 32 bits are split into four groups of 8 bits (called octets), each converted to a decimal number between 0 and 255, separated by dots.

Anatomy of an IP address: 192.168.1.100

OCTET 1
192
11000000

OCTET 2
168
10101000

OCTET 3
1
00000001

OCTET 4
100
01100100

Each octet = 8 bits  |  4 octets × 8 bits = 32 bits total  |  Values: 0–255 per octet
Total possible IPv4 addresses: 2³² = 4,294,967,296 (~4.3 billion)

Every IP address has two parts: the network portion (which network does this belong to?) and the host portion (which specific device on that network?). The subnet mask tells you where the dividing line falls between these two parts.

Binary — Just Enough to Understand Subnetting

I’m not going to teach you to think in binary. I’m going to give you the one table you need, and the one concept that makes subnet masks immediately clear. That’s all the binary you need for subnetting.

Binary bit values — one octet (8 bits), memorise this row

BIT POSITION
7
6
5
4
3
2
1
0

DECIMAL VALUE
128
64
32
16
8
4
2
1

Example: decimal 192 in binary

128 + 64 = 192 → binary: 11000000

bit 7 = 1 (128) + bit 6 = 1 (64) + rest = 0

Example: decimal 255 in binary

128+64+32+16+8+4+2+1 = 255 → binary: 11111111

All 8 bits = 1. Maximum value of one octet = 255.

💡 The one thing to remember: A subnet mask is always a string of 1 bits followed by 0 bits — never mixed. 11111111.11111111.11111111.00000000 is valid. 11110101.00001111.11110000.10101010 is not a valid subnet mask. This single rule explains everything about how subnet masks work.

Subnet Masks Demystified — What They’re Actually Telling You

A subnet mask is a 32-bit number that tells you which part of an IP address is the network portion (the 1 bits) and which part is the host portion (the 0 bits). Every device on a network has both an IP address and a subnet mask — together they define what network the device belongs to.

Subnet mask breakdown — 255.255.255.0 explained bit by bit

IP Address: 192 . 168 . 1 . 100

IP Binary: 11000000.10101000.00000001.01100100

Subnet Mask: 255 . 255 . 255 . 0

Mask Binary: 11111111.11111111.11111111.00000000

←──── NETWORK PORTION ────→ ←HOST→

The 1s in the mask = network bits (locked — same for all hosts in subnet)

The 0s in the mask = host bits (varies — different for each device)

Network address (all host bits = 0): 192.168.1.0

Broadcast address (all host bits = 1): 192.168.1.255

Usable hosts: 192.168.1.1 → 192.168.1.254 (254 addresses)

NETWORK ADDRESS
192.168.1.0
All host bits = 0
Identifies the subnet itself

USABLE HOSTS
192.168.1.1–254
254 addresses
Assigned to devices

BROADCAST ADDRESS
192.168.1.255
All host bits = 1
Sends to all devices

CIDR Notation — The Shorthand That Appears Everywhere

Writing out 255.255.255.0 every time is clunky. CIDR (Classless Inter-Domain Routing) notation solves this by just counting the number of 1 bits in the mask and appending that count after a slash. It’s a compressed way to express both the network address and the subnet mask together.

---

📖 Read the complete guide on SecurityElites

This article continues with deeper technical detail, screenshots, code samples, and an interactive lab walk-through. Read the full article on SecurityElites →

---

This article was originally written and published by the SecurityElites team. For more cybersecurity tutorials, ethical hacking guides, and CTF walk-throughs, visit SecurityElites.