IPv4 Subnetting, a Quick Overview

An address carries no information about which part identifies the network. The mask supplies that, marking a boundary between the bits that must match for two hosts to be on the same subnet and the bits that identify a host within it.

Every operation that appears to be arithmetic is really a question about where that boundary sits, which is why working in binary is faster than working in decimal once the network is not on an octet boundary.

The prefix lengths worth knowing

Two addresses are reserved in a subnet, the all zeros host portion identifying the network and the all ones identifying the directed broadcast, which is where the difference between the last two columns comes from.

The final row is the exception. On a point to point link there is no need for a broadcast address, so both addresses are usable, and using a thirty one halves the address consumption of every link in a network of any size.

Variable length masking is the normal case

Applying one mask across an entire network wastes addresses on links needing two and starves segments needing hundreds. Different masks in different places is not an optimisation, it is the ordinary way networks are addressed.

The requirement it imposes is that the routing protocol must carry the mask alongside the prefix, which classless protocols do and the earliest ones did not. That constraint is why the distinction still appears in documentation despite the classful protocols being long obsolete.

Summarisation, and why the plan comes first

A group of contiguous prefixes can be advertised as one shorter prefix if they share a common leading bit pattern and the block is aligned. Sixteen consecutive networks starting at an address divisible by sixteen summarise cleanly, and the same sixteen starting one along do not.

That alignment requirement is the reason addressing is planned before deployment rather than allocated as needed. Blocks handed out in the order requests arrive cannot be summarised afterwards, and the cost is paid permanently in table size and in the flooding scope of every future change.

The benefit is not only smaller tables. A summarised boundary hides instability, so a link flapping inside a summarised region does not propagate an update beyond the boundary, which is the more valuable property in a large network.

Wildcards are not inverted masks

Access lists and some protocol statements take a wildcard where a zero means the bit must match and a one means it is ignored. For a contiguous subnet that is the arithmetic inverse of the mask, which is why the two are often described as the same thing.

They are not the same thing, because a wildcard is not required to be contiguous. Ignoring alternating bits matches every odd or every even address across a range, which no subnet mask can express, and it is occasionally the shortest way to write a rule.

The mistakes that cost most

Overlapping allocations produce behaviour that depends on longest match rather than on intent, and they are usually discovered when a more specific prefix appears somewhere unexpected and silently attracts traffic.

Sizing to today's host count rather than to a growth boundary forces renumbering, which is disruptive out of proportion to the address saving. Rounding up to the next boundary costs nothing in a private range.

Allocating without a scheme is the expensive one. Addresses assigned in request order rather than grouped by site, function, or region cannot be summarised, and every routing table in the network carries that decision for as long as the network exists.

Note: if a subnetting question is taking longer than a few seconds, convert the interesting octet to binary rather than continuing in decimal. Every boundary question becomes obvious once the bits are visible, and the arithmetic that felt difficult disappears.