Most people learn subnetting as a pile of formulas: count the bits, subtract two, memorize the table. That works for exams, but it falls apart the moment you are standing in front of a real network with an IP like 10.0.5.130/27 and someone asks "what network is this on?"
This article is the version I wish someone had given me: a single mental model that turns every subnetting question into arithmetic you can do in your head, plus the three shortcuts that make it fast.
The one idea that makes subnetting click
An IPv4 address is 32 bits. A prefix like /26 means: the first 26 bits are the network, the last 6 bits are the host. That's it. Everything else follows from this sentence.
The consequences of those 6 host bits:
- Total addresses in the subnet:
2^6 = 64 - Usable hosts:
64 - 2 = 62(the first address is the network ID, the last is the broadcast)
Notice you never needed the subnet mask 255.255.255.192. The prefix and the mask are the same statement in two languages — but the prefix form is the one that keeps the math obvious.
The block size shortcut (replaces binary math)
Here is the shortcut that removes binary from your daily life:
Block size = 256 minus the last non-255 octet of the mask.
-
/26→ mask ends in.192→ block =256 - 192 = 64 -
/27→.224→ block = 32 -
/28→.240→ block = 16
Once you have the block size, subnets can only start at multiples of that block: 0, 64, 128, 192 for a /26. No exceptions. This is the single most useful fact in practical subnetting, because it means you can validate anyone's network design in seconds.
Worked example: which subnet is 10.0.5.130/27 on?
- Block size = 32
- List multiples: 0, 32, 64, 96, 128, 160...
- 130 falls between 128 and 160 → network is
10.0.5.128/27 - Usable range:
.129to.158, broadcast.159
You just did the entire subnetting calculation — network address, usable range, broadcast — with nothing but subtraction.
Sizing: the question people actually get wrong
The exam question "how many hosts in a /28?" is easy. The real question is "I have 28 devices — which prefix do I pick?" And here people consistently fail in the same direction: too tight.
- 28 devices in a
/27(30 usable) = one printer installation from an outage - The rule I use: current need + 30-50% headroom, then round up to the next prefix
So 28 devices → aim for ~40 → /27 gives 30, not enough → /26 gives 62, take it. Wasted space is cheap. Re-numbering a live network is not.
Three mistakes that cause real outages
1. Misaligned boundaries. Someone configures 192.168.1.50/26 as a "new subnet." The mask zeroes the lower 6 bits, so the actual network is 192.168.1.0/26 — the same subnet as the engineering VLAN. The config "looks valid" but silently overlaps. Rule: every network address must be a multiple of the block size.
2. Mask mismatch after migration. You re-subnet a segment from /24 to /26, but one server keeps the old /24 mask. It ARPs for addresses outside its real subnet, fails, and the ticket says "network is slow" — because the truth (half the hosts are unreachable) is invisible to the application team. Change masks in a maintenance window, all devices, all at once.
3. Forgetting the two reserved addresses. .0 and .255 (or block edges on other prefixes) are not usable. A device handed a network or broadcast address fails in ways that depend on the OS — which means the symptom looks random.
When unequal subnets are the right answer
Equal subnets are a training exercise. Real networks have one 60-person department and three 8-person teams, and giving everyone a /26 wastes three quarters of your address space. The professional answer is VLSM (Variable Length Subnet Masking): allocate the biggest subnet first, then fit the smaller ones into what remains.
For a /24 with a 50-host engineering team, a 30-device guest network, and two small teams:
| Need | Prefix | Network |
|---|---|---|
| Engineering (50) | /26 | 192.168.1.0/26 |
| Guest (30) | /27 | 192.168.1.64/27 |
| Team A (12) | /28 | 192.168.1.96/28 |
| Team B (8) | /28 | 192.168.1.112/28 |
Everything fits in the bottom half, and the entire top half stays free for growth. Start big and work down — never the reverse, or you fragment the range.
Sanity-check any design in 60 seconds
Before you touch a router, verify three things:
- Alignment — every network address is a multiple of its block size
- No overlaps — sort subnets by network address; each broadcast must be below the next network address
- Capacity — usable hosts ≥ current devices × 1.3
If all three pass, the design is sound. If any fails, you have just prevented an outage that would have been very hard to diagnose later — subnetting bugs don't show up as "subnetting bugs," they show up as "the network is weird."
If you want to verify any of these calculations without doing them by hand — or you inherited a network and want to reverse-engineer which subnet an address belongs to — I maintain a free Subnet Calculator that runs entirely in your browser (no signup, nothing leaves your device). There is also a CIDR converter for jumping between prefix and range notation, and a subnet mask cheat sheet worth pinning next to your terminal.
What's your subnetting horror story? The misaligned-boundary one in the comments section is guaranteed to be good.
Top comments (0)