Subnetting Basics

On IPv4 Ethernet, a broadcast domain is the set of hosts that receive a frame sent to the broadcast address. One giant flat network means one giant broadcast domain: DHCP chatter, ARP, accidents, and some malware noise reach everyone. Subnetting (and VLANs that map to subnets) carves that into smaller neighborhoods. Routers sit on the borders. Packets between neighborhoods are a Layer-3 decision — and a place to put a firewall policy.

Security teams subnet so that guest Wi-Fi, user laptops, and payment servers are not one neighborhood. If a kiosk is compromised, the mask plus routing policy should stop it from talking to the database subnet as if it were a local ARP neighbor. That is not "hacking math." That is blast-radius design. Cloud security groups and on-prem ACLs are written in CIDR because CIDR is how you name a neighborhood in one token: 10.0.4.0/24.

The mask is a 32-bit pattern. A 1-bit means "this bit is part of the network ID." A 0-bit means "this bit is host." Written dotted decimal, 255.255.255.0 means the first 24 bits are network — because 255 is eight 1s, three times. CIDR writes the same fact as /24: twenty-four leading 1s. ip addr showing 192.168.1.50/24 is already this lesson in one token. You do not need a lookup table for that line. You need to decode it.

Start with 192.168.1.0/24. Prefix length 24 means 32 − 24 = 8 host bits. 2^8 = 256 addresses in the block. The block starts at 192.168.1.0 (the network address — not a usable host in ordinary IPv4). It ends at 192.168.1.255 (the directed broadcast for this subnet). Usable hosts are 192.168.1.1 through 192.168.1.254 — 254 addresses. Mask 255.255.255.0 is exactly /24. Two hosts in this range share a prefix of 192.168.1 and can ARP each other if they are on the same L2 segment; they do not need a router for that local delivery.

Now cut the same 256 addresses into /26 pieces. Prefix 26 means 32 − 26 = 6 host bits. 2^6 = 64 addresses per subnet. 256 / 64 = 4 subnets. Repeatable arithmetic, not a chart: subnet size is always 2^(32−prefix). First subnet: 192.168.1.0/26. Network 192.168.1.0. Last address (broadcast) = network + 64 − 1 = 192.168.1.63. Usable hosts: 192.168.1.1–192.168.1.62 (62 hosts). Next subnet starts where this one ended: 192.168.1.64/26 (broadcast .127). Then .128/26 and .192/26. A host at 192.168.1.70/26 is not a Layer-3 neighbor of 192.168.1.10/26 — different network IDs — even though both "look like 192.168.1."

How to repeat this on any prefix: (1) host bits = 32 − prefix. (2) block size = 2^(host bits). (3) network address = the address with host bits zeroed (for our /24 and /26 examples, that is the .0 or .64 aligned start). (4) broadcast = network + block size − 1. (5) usable = everything strictly between them (classic IPv4). Do not memorize twenty rows. Run this five-step on the CIDR your NIC already has.

ip -br addr prints STATE and the CIDR in one line. ip route shows which prefixes this host considers connected versus default-via. You are reading your own fence, not mapping a campus.

# YOUR machine — inventory, not a sweep
ip -br addr
ip addr
ip route

# Decode one non-lo line, e.g. ens33 UP 192.168.1.50/24
#   /24 → 8 host bits → 256 addresses
#   network .0  broadcast .255  usable .1–.254  (classic IPv4)
#   mask 255.255.255.0 is the same /24

# If you see /26, repeat: 2^6=64 addresses in THAT block
# Do not invent a table of every prefix

# NEVER: nmap or ping-sweep a CIDR you do not own
# NEVER: change masks on a production iface as homework

You already knew an IPv4 dotted quad. You can now split it with a mask: /24 is 256 addresses and 255.255.255.0; /26 is 64-address slices; subnetting exists to bound broadcasts and security zones. Next up — IPv6 Introduction — why 32 bits ran out, how 128-bit addresses look, and why "too big to scan" is not a reason to ignore v6.