All lessons are free · No login · No trackingStart learning
uohk.comNetwork Buddies 中

Network Stories 11 · Intermediate

The Art of Cutting Cake: Subnetting

There's only one block of addresses, but it has to be shared by three networks. How do you cut it just right?

Starring: Rue, MacAbout 10 min read

SubnettingSubnetIP AddressCIDR

Recommended first: Lesson 4, Story 9: “Router and Default Gateway”

1. The Story

Press "Next" to go through it step by step. In each step, one character steps up and explains what they are doing.

Prologue: a quick review

Step 1 of 10

What does /24 mean?

My address at home is 192.168.1.10/24. /24 means the first 24 bits, the first three numbers, are the network part. The last group is the device part, and it can have 256 addresses.

Animation text version (all steps)
  1. Prologue: a quick review
  2. What does /24 mean? · Mac: My address at home is 192.168.1.10/24. /24 means the first 24 bits, the first three numbers, are the network part. The last group is the device part, and it can have 256 addresses.
    • An IPv4 address has 32 bits
    • /24 = Subnet Mask 255.255.255.0
    • Of the 256 addresses, .0 is the Network Address and .255 is the Broadcast Address, so 254 are usable
  3. Act 1: one cake, three guests
  4. The studio needs three networks · Rue: The upstairs studio has its own Router and needs three separate networks: Office, CCTV and Servers. But I've set aside only one block of addresses for the studio: 192.168.40.0/24.
    • Office: about 30 devices
    • CCTV: about 10 cameras
    • Servers: about 5
  5. A whole block for each zone? Too wasteful · Rue: If every zone used a whole /24, the CCTV would use only 10 addresses and the other 240-plus would go to waste. We need to cut this block up. That's called Subnetting.
  6. Act 2: Rue cuts the cake
  7. Borrowing bits from the device part · Rue: I make the Subnet Mask longer, from /24 to /26, by borrowing 2 bits from the device part. 2 bits have 4 combinations (00, 01, 10, 11), so I can cut 4 slices, each with 64 addresses.
    • /24 = …11111111.00000000
    • /26 = …11111111.11000000 = 255.255.255.192
    • Writing it as /26 is called CIDR (Classless Inter-Domain Routing) notation
  8. Slice 1: the office · Rue: Slice 1 is 192.168.40.0/26, for the office. Its addresses run from .0 to .63: .0 is the Network Address, .63 is the Broadcast Address, and the 62 in between, .1 to .62, are usable.
    • By habit, the Default Gateway uses the first usable address: 192.168.40.1
  9. Slices 2 and 3 · Rue: Slice 2, 192.168.40.64/26, goes to the CCTV (usable .65 to .126). Slice 3, 192.168.40.128/26, goes to the servers (usable .129 to .190). Slice 4, .192/26, is kept spare for now.
    • Formula: 6 bits in the device part → 2⁶ − 2 = 62 usable addresses
    • Each slice has 64, so the Subnets start at 0, 64, 128 and 192
  10. Act 3: who are the neighbours?
  11. Same first three numbers, so neighbours? · Mac: The office PC 192.168.40.10 wants to reach the recorder 192.168.40.70. The first three numbers are both 192.168.40, so they're in the same network and can send directly... right?
  12. Wrong! Look at the /26 · Rue: With /26, the first 2 bits of the fourth group are part of the network part too. 10 falls between 0 and 63, so it's in the office. 70 falls between 64 and 127, so it's in the CCTV. They are different networks, and the traffic has to go through me!
    • 10 = 00001010 → first 2 bits 00 → .0/26
    • 70 = 01000110 → first 2 bits 01 → .64/26
  13. Only the same slice sends directly · Mac: Got it! 192.168.40.10 and 192.168.40.20 are both in the .0/26 slice, so they are neighbours and can send directly. To tell, you look at the prefix length, not just the first three numbers.
  14. Summary: cut just right · Rue: Subnetting cuts one block of addresses into slices of the right size. Each slice is a separate network, connected by a Router. But how does Rue, back in the home, know that 192.168.40.x should go to the studio Router? In the next story, take a look at my map!
    • Usable addresses = 2ⁿ − 2 (n = the number of bits in the device part)
    • /26 = 255.255.255.192, 64 addresses per slice
    • Traffic between different Subnets must go through a Router

2. Where Is the Problem

The upstairs studio has its own Router and needs three separate networks:

Network Approximate number of devices
Office 30
CCTV 10
Servers 5

But Rue has set aside only one block of addresses for the studio: 192.168.40.0/24.

If every zone used a whole /24 (254 usable addresses), the CCTV would use only 10 and the other 240-plus would go to waste. On top of that, the studio has only one block, which isn't enough for three zones anyway.

3. How the Network Solves It

A block of addresses is like a cake. Instead of giving every guest a whole cake, you cut it into slices, each just the right size.

Cutting one block of IP Addresses into several smaller networks is called Subnetting. Each slice is a Subnet.

The trick is to make the Subnet Mask longer: you "borrow" a few bits from the device part and give them to the network part. Borrow 2 bits and you can cut 4 slices. Each slice is a separate network, and traffic between them must be forwarded by a Router.

4. A Closer Look

A quick review: what does /24 mean?

An IPv4 address has 32 bits, split into four groups of 8 bits. The "24" in /24 is called the Prefix Length. It means the first 24 bits are the network part and the remaining 8 bits are the device part.

  • 8 bits give 2⁸ = 256 addresses (.0 to .255).
  • .0 is the Network Address. It stands for the whole network itself.
  • .255 is the Broadcast Address. Anything sent to it goes to every device in the network.
  • So 256 − 2 = 254 addresses can be given to devices.

Borrowing 2 bits: /24 becomes /26

/24  11111111.11111111.11111111.00000000  = 255.255.255.0
/26  11111111.11111111.11111111.11000000  = 255.255.255.192

The first 2 bits of the last group become part of the network part. 2 bits have 4 combinations (00, 01, 10, 11), so you get 4 slices. The device part has 6 bits left: each slice has 2⁶ = 64 addresses, and 64 − 2 = 62 of them are usable.

Writing it as "slash plus a number", like /26, is called CIDR (Classless Inter-Domain Routing) notation. It lets the prefix length be any number from 0 to 32, so it doesn't have to land exactly on a ".".

Four slices of cake

Subnet Use Network Address Usable range Broadcast Address
192.168.40.0/26 Office .0 .1 to .62 .63
192.168.40.64/26 CCTV .64 .65 to .126 .127
192.168.40.128/26 Servers .128 .129 to .190 .191
192.168.40.192/26 Spare .192 .193 to .254 .255

Each slice has 64 addresses, so the Subnets start at 0, 64, 128 and 192. By habit, the Default Gateway uses the first usable address of each slice. For the office, that's 192.168.40.1.

Who are the neighbours? Look at the prefix, not the first three groups

With /26, the first 2 bits of the fourth group also belong to the network part:

10   = 00001010  → first 2 bits 00 → 192.168.40.0/26   (Office)
70   = 01000110  → first 2 bits 01 → 192.168.40.64/26  (CCTV)
130  = 10000010  → first 2 bits 10 → 192.168.40.128/26 (Servers)

So even though 192.168.40.10 and 192.168.40.70 share the same first three groups, they are in different networks, and traffic between them must go through the studio Router. 192.168.40.10 and 192.168.40.20 are both in .0/26, so they can send to each other directly.

Don't want to convert to binary? Just check which range the fourth number falls in: 0–63, 64–127, 128–191 or 192–255.

Common prefixes at a glance

Prefix Subnet Mask Addresses per slice Usable addresses (2ⁿ − 2)
/24 255.255.255.0 256 254
/25 255.255.255.128 128 126
/26 255.255.255.192 64 62
/27 255.255.255.224 32 30
/28 255.255.255.240 16 14
/29 255.255.255.248 8 6
/30 255.255.255.252 4 2

n is the number of bits in the device part, which is 32 minus the prefix length. Each time the prefix grows by 1, every slice is cut in half.

The office has about 30 devices. Add the Default Gateway and it needs 31 addresses in total. A /27 has only 30 usable addresses, which isn't enough, so /26 (62 addresses) is chosen here, with room to spare.

5. Try It Yourself

Task: find your home's Subnet Mask

  1. In your phone's Wi-Fi settings, tap the network you are connected to and find the "Subnet Mask" field.
  2. Most homes will see 255.255.255.0, which is /24.
  3. Using the table above, work out the maximum number of devices your home network can have.

Mini game

Which Subnet is this address in?

Which slice of the studio's cake does each address belong to?

  1. 1192.168.40.10

  2. 2192.168.40.70

  3. 3192.168.40.130

  4. 4192.168.40.62

  5. 5192.168.40.65

  6. 6192.168.40.200

6. Where the Analogy Breaks

  • A cut cake can't be put back together, but Subnets can be re-planned. Just change the settings and you can merge slices or cut them smaller. However, the devices already in use will all need new addresses.
  • The slices don't have to be the same size. In this story every slice is a /26. Real networks can cut Subnets of different sizes as needed, for example one /26 and two /27s, but the slices must never overlap.
  • Every slice has two addresses you can't "eat". The Network Address and the Broadcast Address can't be given to devices, so the smaller you cut, the bigger the share that's wasted. (The special /31 and /32 have their own rules, which we won't cover here.)
  • Cutting the cake doesn't make the network faster. Subnetting is mainly for handing out addresses, keeping Broadcasts within a smaller area and making security rules easier to set up.
  • You can cut even when there are plenty of addresses. Home Private IPs will almost never run out, but companies still cut Subnets so that different departments can be managed separately.

7. Quiz

Question 1 of 3How many addresses in a /26 Subnet can be given to devices?
Question 2 of 3Are 192.168.40.10/26 and 192.168.40.70/26 in the same network?
Question 3 of 3Which prefix is the same as 255.255.255.192?

8. Key Notes

  • Subnetting cuts one block of addresses into several smaller networks. Each slice is a separate Subnet, and traffic between them must be forwarded by a Router.
  • Making the prefix longer means borrowing bits from the device part: borrow m bits and you can cut 2ᵐ slices.
  • Usable addresses per slice = 2ⁿ − 2 (n = the number of bits in the device part). The two taken away are the Network Address and the Broadcast Address.
  • /26 = 255.255.255.192. Each slice has 64 addresses, starting at 0, 64, 128 and 192.
  • To tell whether two devices are neighbours, look at the prefix length, not just the first three numbers.

Further reading

The studio's three networks are cut and all connected to the studio Router. But how does Rue, back in the home, know that 192.168.40.x should be handed to the studio Router? In the next story, we open Rue's map: Routing Tables and Static Routes.

Related stories