🎯 By the end of this module you should be able to…
- Convert confidently between binary and decimal in both directions.
- Read an IPv4 address, identify its class, and separate the network part from the host part.
- Explain what a subnet mask does and write it in both dotted-decimal and CIDR form.
- Calculate the number of subnets and usable hosts for any prefix length.
- Subnet a network using FLSM, and explain when FLSM wastes addresses.
- Subnet a network using VLSM, allocating largest requirement first.
- Pick a sensible CIDR block for an AWS VPC and its subnets.
Binary, and why an IP address looks like that
An IPv4 address is 32 bits. We write it as four decimal numbers only because
192.168.1.10 is easier to say than
11000000.10101000.00000001.00001010. Every subnetting question is really a binary question
wearing a decimal costume.
Decimal → binary: subtract the largest value that fits
200 - 128 = 72 → 1 (128)
72 - 64 = 8 → 1 (64)
8 - 32 < 0 → 0 (32)
8 - 16 < 0 → 0 (16)
8 - 8 = 0 → 1 (8)
→ 0 0 0 (4, 2, 1)
200 = 11001000The eight values every mask octet can take
| Bits set | Binary | Decimal |
|---|---|---|
| 1 | 10000000 | 128 |
| 2 | 11000000 | 192 |
| 3 | 11100000 | 224 |
| 4 | 11110000 | 240 |
| 5 | 11111000 | 248 |
| 6 | 11111100 | 252 |
| 7 | 11111110 | 254 |
| 8 | 11111111 | 255 |
128, 192, 224, 240, 248, 252, 254, 255. A subnet mask octet is always one of these. If you ever compute a mask octet of 200, you have made an arithmetic mistake.
Address classes, private ranges and special addresses
| Class | First octet | Default mask | Networks | Hosts per network |
|---|---|---|---|---|
| A | 1 – 126 | 255.0.0.0 (/8) | 126 | 16,777,214 |
| B | 128 – 191 | 255.255.0.0 (/16) | 16,384 | 65,534 |
| C | 192 – 223 | 255.255.255.0 (/24) | 2,097,152 | 254 |
| D | 224 – 239 | — | Multicast | |
| E | 240 – 255 | — | Experimental / reserved | |
Private ranges (RFC 1918) — memorise these
These never appear on the public internet. A router at the edge performs NAT to translate them into a public address. Every AWS VPC you create uses one of these ranges.
| Address | Meaning |
|---|---|
| 127.0.0.1 | Loopback — this machine. The whole 127.0.0.0/8 block is reserved. |
| 169.254.0.0/16 | APIPA / link-local. A host self-assigns this when DHCP fails — a useful diagnostic. |
| 0.0.0.0 | "This host" or, in a route table, "everything". You will type this constantly in AWS. |
| 255.255.255.255 | Limited broadcast — everyone on this link. |
| x.x.x.0 | Network address — identifies the subnet, not assignable to a host. |
| x.x.x.255 | Broadcast address for that subnet — not assignable either. |
Subnet masks, CIDR and the host formula
The mask answers one question: which bits of this address identify the network, and which identify the host? A 1 in the mask means "network", a 0 means "host".
The two formulas
🏠 Usable hosts
2h − 2
where h = number of host bits (32 − prefix). You subtract 2 for the network address and the broadcast address.
🔗 Number of subnets
2b
where b = the number of bits you borrowed from the host portion.
| CIDR | Subnet mask | Total addresses | Usable hosts | Common use |
|---|---|---|---|---|
| /16 | 255.255.0.0 | 65,536 | 65,534 | A whole AWS VPC |
| /20 | 255.255.240.0 | 4,096 | 4,094 | Large AWS subnet |
| /24 | 255.255.255.0 | 256 | 254 | Classic office LAN, typical AWS subnet |
| /25 | 255.255.255.128 | 128 | 126 | Half a /24 |
| /26 | 255.255.255.192 | 64 | 62 | Department segment |
| /27 | 255.255.255.224 | 32 | 30 | Small team |
| /28 | 255.255.255.240 | 16 | 14 | Smallest practical AWS subnet |
| /30 | 255.255.255.252 | 4 | 2 | Point-to-point router link |
In an AWS subnet, five addresses are reserved, not two: the network address, the VPC router, the DNS server, one reserved for future use, and the broadcast address. So a /28 subnet in AWS gives you 11 usable addresses, not 14. This catches people out in real deployments and in exams.
FLSM — fixed length subnet masking
FLSM cuts a network into equal-sized pieces. Simple to compute, simple to document, and wasteful the moment your segments are different sizes.
Worked example
Given: 192.168.10.0/24. Required: four subnets of equal size.
1. Subnets needed = 4 → 2^b ≥ 4 → b = 2 bits borrowed
2. New prefix = /24 + 2 = /26
3. New mask = 255.255.255.192
4. Block size = 256 - 192 = 64
5. Host bits = 32 - 26 = 6 → 2^6 - 2 = 62 usable hosts each| Subnet | Network | First host | Last host | Broadcast |
|---|---|---|---|---|
| 1 | 192.168.10.0/26 | 192.168.10.1 | 192.168.10.62 | 192.168.10.63 |
| 2 | 192.168.10.64/26 | 192.168.10.65 | 192.168.10.126 | 192.168.10.127 |
| 3 | 192.168.10.128/26 | 192.168.10.129 | 192.168.10.190 | 192.168.10.191 |
| 4 | 192.168.10.192/26 | 192.168.10.193 | 192.168.10.254 | 192.168.10.255 |
256 minus the interesting mask octet = the block size. Then just count in steps of that number. A /26 gives 256 − 192 = 64, so the subnets start at 0, 64, 128, 192. This is far faster than writing out binary, and it is how experienced engineers do it in their head.
FLSM works well when…
- All segments are roughly the same size
- You want a scheme anyone can read at a glance
- Routing protocols are old and classful (RIPv1)
FLSM wastes addresses when…
- One segment needs 100 hosts and another needs 2
- You have point-to-point WAN links — 62 addresses for a link that needs 2
- Address space is scarce, which with IPv4 it always is
VLSM — variable length subnet masking
VLSM lets each subnet have the mask that it needs. The rule that makes it work: always allocate the largest requirement first, then subdivide what remains.
Worked example
Given: 192.168.1.0/24. Required: Sales 100 hosts, IT 50 hosts, HR 25 hosts, plus two point-to-point WAN links of 2 hosts each.
Sales 100 hosts → 2^7-2 = 126 ≥ 100 → /25 (block 128)
IT 50 hosts → 2^6-2 = 62 ≥ 50 → /26 (block 64)
HR 25 hosts → 2^5-2 = 30 ≥ 25 → /27 (block 32)
WAN 1 2 hosts → 2^2-2 = 2 ≥ 2 → /30 (block 4)
WAN 2 2 hosts → 2^2-2 = 2 ≥ 2 → /30 (block 4)| Segment | Need | CIDR | Range | Usable |
|---|---|---|---|---|
| Sales | 100 | 192.168.1.0/25 | .0 – .127 | .1 – .126 (126) |
| IT | 50 | 192.168.1.128/26 | .128 – .191 | .129 – .190 (62) |
| HR | 25 | 192.168.1.192/27 | .192 – .223 | .193 – .222 (30) |
| WAN 1 | 2 | 192.168.1.224/30 | .224 – .227 | .225 – .226 (2) |
| WAN 2 | 2 | 192.168.1.228/30 | .228 – .231 | .229 – .230 (2) |
| Free | — | 192.168.1.232/29 onward | .232 – .255 | 24 addresses kept for growth |
Allocating smallest-first. If you place the two /30 WAN links at .0 and .4, the /25 for Sales can no longer start at .0 or .128 cleanly and you end up fragmenting the space. Largest first, always.
A VPC gets a /16 such as 10.0.0.0/16. Inside it you carve public and private subnets per
Availability Zone — typically /24 each, giving 251 usable addresses. You are doing VLSM every time you
design a VPC. Plan for growth: you cannot shrink a subnet later, and overlapping CIDRs make VPC peering
impossible.
💡 Practice 1
Subnet 172.16.0.0/16 into eight equal
subnets. What is the new prefix, the mask, and the third subnet's range?
💡 Practice 2
From 10.10.0.0/22, allocate with VLSM:
500 hosts, 200 hosts, 60 hosts, 2 hosts.
💡 Practice 3
Which subnet does 192.168.5.130 belong
to if the mask is 255.255.255.192? What is its broadcast address?
Key takeaways
- ✅An IPv4 address is 32 bits; dotted decimal is only a convenience for humans.
- ✅A mask octet is always one of 128, 192, 224, 240, 248, 252, 254, 255.
- ✅Usable hosts = 2^h − 2. In an AWS subnet it is 2^h − 5.
- ✅Block size = 256 − the interesting mask octet. Count in those steps.
- ✅FLSM gives equal subnets and wastes space; VLSM sizes each subnet to its need.
- ✅With VLSM, always allocate the largest requirement first.
- ✅10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16 are the private ranges — and your VPC lives in one.