Networking › Module 2 › Lesson 2
Subnetting Basics
Learn subnet masks, CIDR notation, and how networks are divided
Opening
Networks are neighborhoods—and subnets are the blocks
A company with 5,000 employees cannot put every device on one flat network. Subnetting divides a large IP range into smaller, manageable segments. For defenders, subnets define security zones: DMZ, internal LAN, guest Wi-Fi, and server VLANs each live on different subnets.
1. Subnet Masks — Drawing the Line
A subnet mask tells devices which part of an IP is the network ID and which part is the host ID. It uses the same dotted decimal format: IP: 192.168.1.50 Subnet mask: 255.255.255.0 Here, the first three octets (192.168.1) identify the network. The last octet (.50) identifies the host. That gives 254 usable host addresses on this subnet (1–254; .0 is network, .255 is broadcast).
2. CIDR Notation — The Slash Shortcut
Instead of writing 255.255.255.0, you can write /24. The number after the slash is the count of network bits: 192.168.1.0/24 — 256 addresses (254 hosts) 10.0.0.0/8 — Over 16 million addresses 172.16.0.0/16 — 65,536 addresses You will see CIDR everywhere: cloud consoles, firewall rules, and ip addr output like 192.168.1.50/24.
3. Why Subnetting Matters for Security
Network segmentation
Isolate sensitive systems. If an attacker compromises the guest Wi-Fi subnet, they should not reach the database subnet.
Firewall rules
Rules often say "allow 10.0.1.0/24 to reach 10.0.2.50 on port 443." You need CIDR to read and write them.
Scanning scope
Pen testers define scan ranges like 192.168.10.0/24. Too wide a scan wastes time; too narrow misses targets.
Common masks to memorize
/24 = 255.255.255.0 (254 hosts — home and small office default) /16 = 255.255.0.0 (65,534 hosts — medium networks) /8 = 255.0.0.0 (huge — class A legacy feel)
Knowledge Check
What does a subnet mask define?
Multiple choice
Knowledge Check
What does /24 mean in CIDR notation?
Multiple choice
Knowledge Check
True or False: Network segmentation helps contain breaches by isolating subnets.
True or False