DEV Community

syntaxbender
syntaxbender

Posted on Fully Autonomous

Subnet Calculation and Network Design: From Fundamentals to Practice

#architecture #infrastructure #networking

Subnetting can look like little more than IP address math at first glance. In practice, though, the goal is not simply to calculate how many addresses exist inside a CIDR block.

The real purpose is to divide an available address space into logical network segments based on actual requirements.

Suppose we start with:

192.168.0.0/16
Enter fullscreen mode Exit fullscreen mode

If we want to separate employees, management devices, printers, and IoT devices into different network segments, subnetting gives us a structured way to do that.

This article explains why subnetting is used, how IPv4 and CIDR calculations work, and how to design subnets based on real network requirements.

1. What Is Subnetting Used for in Network Design?

The main purpose of subnetting is to divide devices into logical network segments.

A company network might contain:

  • Employee workstations
  • Management devices
  • Printers
  • IoT devices
  • Servers

Technically, all of these devices could exist inside one large IP network.

That does not necessarily mean they should.

As the network grows, placing everything inside the same network can make routing, security, troubleshooting, and access control harder to manage.

Subnetting allows us to create a structure such as:

Employees     → 192.168.0.0/22
IoT           → 192.168.4.0/23
Management    → 192.168.6.0/25
Printers      → 192.168.6.128/26
Enter fullscreen mode Exit fullscreen mode

A router or firewall can then determine how traffic is allowed to move between these networks.

For example:

Employees  → Printers      ALLOW
Employees  → Management    DENY
IoT        → Management    DENY
Management → All           ALLOW
Enter fullscreen mode Exit fullscreen mode

This is why subnetting is not only about dividing IP addresses. It also helps create security and routing boundaries inside a network.

Subnets and VLANs Are Not the Same Thing

A subnet describes an IP network at Layer 3.

A VLAN separates devices at Layer 2.

In real environments, they are often used together:

VLAN 10 → Employees  → 192.168.0.0/22
VLAN 20 → IoT        → 192.168.4.0/23
VLAN 30 → Management → 192.168.6.0/25
Enter fullscreen mode Exit fullscreen mode

The VLAN defines the Layer 2 broadcast domain, while the subnet defines the corresponding Layer 3 IP address space.

What Makes a Subnet Public or Private?

A subnet does not become public or private simply because it uses /24, /22, or any other prefix length.

In cloud environments, the distinction is usually determined by routing.

A public subnet might look like:

Public Subnet
      ↓
Internet Gateway
      ↓
Internet
Enter fullscreen mode Exit fullscreen mode

A private subnet may instead use:

Private Subnet
      ↓
NAT Gateway
      ↓
Internet
Enter fullscreen mode Exit fullscreen mode

So the public/private distinction is primarily a routing design decision, not a CIDR calculation.

2. The Foundation of Subnetting: IPv4 and CIDR

Before subnet calculations make sense, it helps to understand how an IPv4 address is structured.

Why Is IPv4 32 Bits?

An IPv4 address contains four octets.

For example:

192.168.1.10
Enter fullscreen mode Exit fullscreen mode

Each octet contains 8 bits:

8 + 8 + 8 + 8 = 32 bits
Enter fullscreen mode Exit fullscreen mode

That is why an IPv4 address is 32 bits long.

For example, the decimal value:

192
Enter fullscreen mode Exit fullscreen mode

is represented in binary as:

11000000
Enter fullscreen mode Exit fullscreen mode

The bit positions inside one octet have the following values:

128  64  32  16  8  4  2  1
2⁷   2⁶  2⁵  2⁴  2³ 2² 2¹ 2⁰
Enter fullscreen mode Exit fullscreen mode

If all bits are set to 1:

11111111
Enter fullscreen mode Exit fullscreen mode

their values add up to:

128 + 64 + 32 + 16 + 8 + 4 + 2 + 1
= 255
Enter fullscreen mode Exit fullscreen mode

This is why each IPv4 octet can contain a value between:

0 - 255
Enter fullscreen mode Exit fullscreen mode

What Does CIDR Mean?

In CIDR notation, the number after the slash tells us how many bits belong to the network portion of the address.

For example:

192.168.1.0/24
Enter fullscreen mode Exit fullscreen mode

means:

24 bits → network
8 bits  → host
Enter fullscreen mode Exit fullscreen mode

because:

32 - 24 = 8
Enter fullscreen mode Exit fullscreen mode

host bits remain.

The subnet mask in binary is:

11111111.11111111.11111111.00000000
Enter fullscreen mode Exit fullscreen mode

Its decimal form is:

255.255.255.0
Enter fullscreen mode Exit fullscreen mode

How Do We Calculate the Number of IP Addresses?

Once we know the number of host bits, the total number of addresses can be calculated with:

2^(number of host bits)
Enter fullscreen mode Exit fullscreen mode

For a /24:

32 - 24 = 8 host bits

2^8 = 256 addresses
Enter fullscreen mode Exit fullscreen mode

In a traditional IPv4 subnet, the first address is reserved as the network address and the last as the broadcast address.

That leaves:

256 - 2 = 254
Enter fullscreen mode Exit fullscreen mode

usable host addresses.

So:

/24
Total addresses = 256
Usable hosts    = 254
Enter fullscreen mode Exit fullscreen mode

Example: /22

For a /22:

32 - 22 = 10 host bits
Enter fullscreen mode Exit fullscreen mode

Therefore:

2^10 = 1024
Enter fullscreen mode Exit fullscreen mode

total addresses exist.

In a traditional host subnet:

1024 - 2 = 1022
Enter fullscreen mode Exit fullscreen mode

usable host addresses remain.

The binary subnet mask is:

11111111.11111111.11111100.00000000
Enter fullscreen mode Exit fullscreen mode

The decimal equivalent is:

255.255.252.0
Enter fullscreen mode Exit fullscreen mode

So:

/22 = 255.255.252.0
Enter fullscreen mode Exit fullscreen mode

3. Designing Subnets Around Real Requirements

Now suppose we have the following address space:

192.168.0.0/16
Enter fullscreen mode Exit fullscreen mode

And our network requires:

Group Required Hosts
Employees 700
IoT 300
Management 120
Printers 50

Instead of assigning an arbitrary /24 to every group, we can choose the smallest suitable subnet for each requirement.

This approach is known as VLSM — Variable Length Subnet Masking.

700 Employees

We need at least 700 usable addresses.

A /23 provides:

32 - 23 = 9

2^9 = 512
Enter fullscreen mode Exit fullscreen mode

512 addresses are not enough.

The next option is /22:

32 - 22 = 10

2^10 = 1024
Enter fullscreen mode Exit fullscreen mode

Traditionally:

1024 - 2 = 1022 usable addresses
Enter fullscreen mode Exit fullscreen mode

So:

Employees → /22
Enter fullscreen mode Exit fullscreen mode

300 IoT Devices

A /24 provides:

2^8 = 256
Enter fullscreen mode Exit fullscreen mode

which is not enough.

A /23 provides:

2^9 = 512
Enter fullscreen mode Exit fullscreen mode

which is sufficient.

Therefore:

IoT → /23
Enter fullscreen mode Exit fullscreen mode

120 Management Devices

A /25 gives us:

32 - 25 = 7

2^7 = 128
Enter fullscreen mode Exit fullscreen mode

Traditionally:

128 - 2 = 126
Enter fullscreen mode Exit fullscreen mode

usable host addresses.

So:

Management → /25
Enter fullscreen mode Exit fullscreen mode

50 Printers

A /26 gives us:

32 - 26 = 6

2^6 = 64
Enter fullscreen mode Exit fullscreen mode

Traditionally:

64 - 2 = 62
Enter fullscreen mode Exit fullscreen mode

usable addresses.

Therefore:

Printers → /26
Enter fullscreen mode Exit fullscreen mode

At this point, our requirements are:

Employees     /22
IoT           /23
Management    /25
Printers      /26
Enter fullscreen mode Exit fullscreen mode

4. Placing the Subnets Inside the Parent CIDR Block

Now we can place these networks inside:

192.168.0.0/16
Enter fullscreen mode Exit fullscreen mode

A common approach is to allocate the largest subnet first.

Finding the Boundary of a /22

The subnet mask for /22 is:

255.255.252.0
Enter fullscreen mode Exit fullscreen mode

The changing octet is the third octet.

We can calculate the block size with:

256 - subnet mask value
Enter fullscreen mode Exit fullscreen mode

So:

256 - 252 = 4
Enter fullscreen mode Exit fullscreen mode

This means /22 networks increment by 4 in the third octet:

192.168.0.0/22
192.168.4.0/22
192.168.8.0/22
192.168.12.0/22
...
Enter fullscreen mode Exit fullscreen mode

If the first /22 is assigned to employees:

Employees
192.168.0.0/22
Enter fullscreen mode Exit fullscreen mode

the address range is:

192.168.0.0
-
192.168.3.255
Enter fullscreen mode Exit fullscreen mode

The next available address is:

192.168.4.0
Enter fullscreen mode Exit fullscreen mode

Placing the /23

The subnet mask for /23 is:

255.255.254.0
Enter fullscreen mode Exit fullscreen mode

Block size:

256 - 254 = 2
Enter fullscreen mode Exit fullscreen mode

So /23 networks advance by 2 in the third octet.

We can assign:

192.168.4.0/23
Enter fullscreen mode Exit fullscreen mode

to the IoT network.

Its range is:

192.168.4.0
-
192.168.5.255
Enter fullscreen mode Exit fullscreen mode

The next available address becomes:

192.168.6.0
Enter fullscreen mode Exit fullscreen mode

Placing the /25

For management:

192.168.6.0/25
Enter fullscreen mode Exit fullscreen mode

Its range is:

192.168.6.0
-
192.168.6.127
Enter fullscreen mode Exit fullscreen mode

The next available address is:

192.168.6.128
Enter fullscreen mode Exit fullscreen mode

Placing the /26

For printers:

192.168.6.128/26
Enter fullscreen mode Exit fullscreen mode

Its range is:

192.168.6.128
-
192.168.6.191
Enter fullscreen mode Exit fullscreen mode

Our final design becomes:

Group Subnet Total Addresses Usable Hosts
Employees 192.168.0.0/22 1024 1022
IoT 192.168.4.0/23 512 510
Management 192.168.6.0/25 128 126
Printers 192.168.6.128/26 64 62

5. Determining Which Subnet an IP Belongs To

Suppose we have:

192.168.5.100/23
Enter fullscreen mode Exit fullscreen mode

and want to determine its network address.

The subnet mask for /23 is:

255.255.254.0
Enter fullscreen mode Exit fullscreen mode

In binary:

11111111.11111111.11111110.00000000
Enter fullscreen mode Exit fullscreen mode

The third octet of the IP address is:

5
Enter fullscreen mode Exit fullscreen mode

which is:

00000101
Enter fullscreen mode Exit fullscreen mode

The third octet of the subnet mask is:

254
Enter fullscreen mode Exit fullscreen mode

which is:

11111110
Enter fullscreen mode Exit fullscreen mode

Now perform a bitwise AND:

00000101
11111110
--------
00000100
Enter fullscreen mode Exit fullscreen mode

00000100 is:

4
Enter fullscreen mode Exit fullscreen mode

in decimal.

So the network address is:

192.168.4.0
Enter fullscreen mode Exit fullscreen mode

and the subnet is:

192.168.4.0/23
Enter fullscreen mode Exit fullscreen mode

Therefore:

192.168.5.100/23
Enter fullscreen mode Exit fullscreen mode

belongs to:

192.168.4.0/23
Enter fullscreen mode Exit fullscreen mode

6. Calculate Instead of Memorizing

There is no need to memorize every subnet table.

A few simple relationships are enough.

Number of Host Bits 

32 - CIDR prefix
Enter fullscreen mode Exit fullscreen mode

For example:

/22

32 - 22 = 10 host bits
Enter fullscreen mode Exit fullscreen mode

Total Number of Addresses 

2^(number of host bits)
Enter fullscreen mode Exit fullscreen mode

For example:

2^10 = 1024
Enter fullscreen mode Exit fullscreen mode

Traditional Usable Host Count 

2^(number of host bits) - 2
Enter fullscreen mode Exit fullscreen mode

For example:

1024 - 2 = 1022
Enter fullscreen mode Exit fullscreen mode

Keep in mind that the -2 rule does not apply in the same way to special cases such as /31 and /32.

Block Size

To find subnet boundaries, use the changing octet of the subnet mask:

256 - subnet mask value
Enter fullscreen mode Exit fullscreen mode

For a /22:

255.255.252.0

256 - 252 = 4
Enter fullscreen mode Exit fullscreen mode

So the subnet boundaries are:

0
4
8
12
16
...
Enter fullscreen mode Exit fullscreen mode

For a /23:

255.255.254.0

256 - 254 = 2
Enter fullscreen mode Exit fullscreen mode

The subnet boundaries are:

0
2
4
6
8
...
Enter fullscreen mode Exit fullscreen mode

Once this relationship becomes familiar, there is little reason to memorize /22, /23, or /24 subnet tables.

7. The Bigger Picture

Subnetting becomes unnecessarily abstract when it is taught only as binary arithmetic.

In practice, the reasoning process is much simpler:

How many devices do I have?
        ↓
How many IP addresses do I need?
        ↓
How many host bits are required?
        ↓
Which CIDR prefix provides enough addresses?
        ↓
Where are the subnet boundaries?
        ↓
Where should this subnet be placed inside the parent CIDR?
        ↓
Which networks should be allowed to communicate?
Enter fullscreen mode Exit fullscreen mode

For example:

700 hosts
↓
At least 700 addresses are required
↓
2^9 = 512  → not enough
2^10 = 1024 → enough
↓
10 host bits
↓
32 - 10 = /22
↓
255.255.252.0
↓
block size = 4
Enter fullscreen mode Exit fullscreen mode

The result could be:

192.168.0.0/22
Enter fullscreen mode Exit fullscreen mode

The real goal of subnetting is not to memorize values such as /22 or /24.

It is to understand how to move from a real network requirement to the correct CIDR prefix, identify the correct network boundaries, and allocate address space without overlaps or unnecessary waste.

Once that logic becomes familiar, topics such as VPC design, Kubernetes networking, VLAN architecture, firewall rules, and cloud network design become much easier to reason about.

Top comments (0)