In the previous lesson you learned that the mask marks the boundary between the network portion and the host portion of an IPv4 address. In this lesson the mask goes from concept to calculation tool: you will see the AND operation with which every machine decides whether a destination is local or remote, a repeatable 5-step method to calculate the network, broadcast and usable range of any address, and the star technique of the module: subnetting, that is, splitting a network into smaller subnets. It is the skill with which we will finally design, with exact numbers, the Valencia and Bilbao networks we have been using since module 1. Nobody is born knowing subnetting: you learn it with method and worked examples, and that is what this lesson is about.

1. The mask in depth: decimal notation and CIDR notation
2. The bitwise AND operation: how a machine calculates its network
3. The 5-step method: network, broadcast, usable range and host count
4. Subnetting: borrowing host bits
5. The "jump" (block size) and the 256 trick
6. Meridiano case I: splitting 192.168.10.0/24 by VLANs
7. Meridiano case II: sizing Bilbao with a /27
8. VLSM: tailor-made masks and Meridiano's final plan
9. Practical verification: are two hosts on the same subnet?

A subnet mask is a 32-bit number with one strict rule: contiguous ones on the left, contiguous zeros on the right. The ones cover the network portion; the zeros, the host portion. Masks with ones and zeros mixed together do not exist (255.0.255.0 is not a valid mask).

Two notations for the same thing:

• Dotted decimal: 255.255.255.0 (what ipconfig shows on Windows).
• CIDR or prefix: /24 = "24 bits set to one" (what ip addr shows on Linux, and what you use when designing).

Since the ones fill in from the left, a mask octet can only take one of these nine values (the table you memorized in 05-01): 0, 128, 192, 224, 240, 248, 252, 254, 255. Full table of common prefixes:

Why 2^h − 2? With h host bits there are 2^h combinations, but two are reserved (lesson 05-01): all zeros (network address) and all ones (broadcast). In a /24: 2⁸ − 2 = 254 hosts. In a /30: 2² − 2 = 2 hosts — exactly what a point-to-point link between two routers needs.

When Marta's PC wants to send a packet, the first thing it decides is: is the destination on my network (deliver directly over Ethernet) or outside it (hand it to the gateway)? — the routing-table decision from module 4. The underlying calculation is a bitwise AND between address and mask: bit by bit, 1 AND 1 = 1 and any other combination gives 0. The practical effect: where the mask has ones, the address is copied; where it has zeros, it is wiped to zero. The result is the network address.

Worked calculation with Marta's IP:

Marta performs the same AND on the destination address and compares:

• Destination file server 192.168.10.10: AND /24 → 192.168.10.0. Matches her network → local delivery (ARP + direct Ethernet frame, module 2).
• Destination Jon's PC 192.168.20.7: AND /24 → 192.168.20.0. Does not match → the packet goes to the gateway 192.168.10.1 (and from there, through the VPN, to Bilbao).

With octet-aligned masks (/8, /16, /24) the AND is trivial by eye. Things get interesting when the boundary falls inside an octet. Example: 192.168.10.140 with mask /26 (255.255.255.192). The first three octets are copied as-is (mask 255); we work only the fourth:

Notice: 192.168.10.140/26 is not on network 192.168.10.0. This is the idea that breaks the beginner's intuition ("they start the same, so same network") and the reason the method that comes next exists.

A repeatable method for any address/mask pair. Guiding example: 192.168.10.140/26.

A second full example, with the boundary in the third octet: 172.16.35.123/20 (mask 255.255.240.0).

Practice this method until the five steps come out without looking. All of subnetting rests on it.

Subnetting means splitting a network into several smaller subnets by borrowing bits from the host portion and handing them to the network portion. Each borrowed bit doubles the number of subnets and (roughly) halves the hosts in each one:

Reference table when splitting a /24:

Design always answers two questions: how many subnets do I need? and how many hosts in the largest one? You pick the prefix that satisfies both (and if none can, you need a bigger starting network or VLSM, which we will see at the end).

The last column of the table above is the jump (block size): how often a new subnet starts in the "interesting" octet (the one where the mask is neither 255 nor 0). It is calculated with a trick that avoids binary altogether:

Examples:

• Mask 255.255.255.192 (/26) → jump = 256 − 192 = 64 → subnets at .0, .64, .128, .192.
• Mask 255.255.255.224 (/27) → jump = 256 − 224 = 32 → subnets at .0, .32, .64, .96, .128, .160, .192, .224.
• Mask 255.255.240.0 (/20) → interesting octet is the third: jump = 256 − 240 = 16 → subnets at x.y.0.0, x.y.16.0, x.y.32.0, …

With the jump, step 3 of the method becomes mental arithmetic: an address's network is the multiple of the jump immediately below or equal to the interesting octet. For 192.168.10.140/26: multiples of 64 → 0, 64, 128, 192; the one below or equal to 140 is 128 → network .128, broadcast .191 (next multiple minus 1). Same result as the AND, without touching binary. Use the AND to understand; use the jump to go fast.

Accumulated context from the course: in Valencia the switch has a corporate VLAN 10 and a guest VLAN 20 (module 3), and each VLAN must be its own IP subnet so the router can route between them. The IT team also decides to separate the servers (files/intranet .10.10, printer) into their own subnet so different rules can be applied to them.

Requirements:

• 3 subnets (corporate, guests, servers) + headroom for the future → at least 4.
• The largest (corporate) must host ~20 machines + AP + growth margin → 62 hosts is plenty.

Decision: /26 (2 borrowed bits → 4 subnets of 62 hosts, jump 64). Calculating the 4 subnets:

Assignment:

Two important observations from this design exercise:

• Meridiano's current plan (everything on one flat /24 with DHCP range .100–.199) stops being valid as-is: .100–.199 crosses the .127 and .128 boundaries. Redesigning subnets means redesigning DHCP, reservations and static addresses. In real networks, this is the cost of subnetting late.
• Each subnet burns 2 addresses on network/broadcast and 1 on the gateway. When sizing, always count the gateway in.

Bilbao has 5 people, a router, a printer and moderate expected growth. A whole /24 (254 hosts) is tidy waste — it works, but a fine-grained sizing exercise would say:

And within Bilbao's old /24, the blocks .32/27, .64/27, … .224/27 would remain free for future uses (a guest VLAN at the branch, for example). The design lesson: Jon's address does not change, but his mask does (from 255.255.255.0 to 255.255.255.224) — and as you will see in the last section, mixing machines with different masks is a recipe for phantom failures.

In the previous examples every subnet was the same size (fixed-length subnetting). But guests don't need 62 hosts, and neither do servers. VLSM (Variable Length Subnet Mask) allows different prefixes per subnet, assigning blocks from largest to smallest over the free space. It is the natural application of CIDR to internal design.

Meridiano's final plan with VLSM over 192.168.10.0/24 (Valencia) and 192.168.20.0/24 (Bilbao):

Golden rules of VLSM: assign the big blocks first, start each block at a multiple of its own jump, and document everything (a spreadsheet with network/broadcast/use prevents 90% of the overlaps). We won't go deeper: for a small business like Meridiano, this level of VLSM is exactly what gets used in practice.

An everyday support question: "machine A can't see machine B — are they even on the same subnet?". Procedure:

1. Get the address and mask of both: ipconfig (Windows) or ip addr (Linux), commands you already know from modules 2 and 4. In ip addr the mask comes in CIDR: inet 192.168.10.21/24.
2. Calculate each one's network (AND or the jump trick) with its own mask.
3. If both networks match and both masks match → same subnet: they should talk directly.

The classic case that justifies step 3: same apparent network, different mask. A technician installs a NAS in Valencia and types the mask from memory:

The consequence is asymmetric and baffling:

• Marta calculates: 140 AND /24 → 192.168.10.0 = my network → sends directly to the NAS. The packet arrives.
• The NAS calculates its reply: 21 AND /25 → 192.168.10.0 ≠ my network (its own is .128) → sends the reply to the gateway. Depending on how the router is set up (does it forward and signal with an ICMP redirect? does it filter?), the connection half-works, runs slow, or fails in one direction only.

Typical symptom: "the NAS answers ping from some machines but not others". Diagnosis: compare masks, not just addresses. The mask must be identical on every machine within the same subnet.

• Forgetting the −2. 2^h is the number of combinations; usable hosts are 2^h − 2 (network and broadcast). A /30 fits only 2 machines, not 4.
• Assuming the network by just eyeballing the octets. 192.168.10.140/26 is not on 192.168.10.0. With prefixes that don't end on an octet boundary, always calculate (AND or jump).
• Forgetting that the gateway consumes an address from the usable range when sizing.
• Letting the DHCP range cross subnet boundaries (as Meridiano's .100–.199 would when moving to /26). After subnetting, review DHCP, reservations and statics.
• Different masks on the same subnet: the NAS mistake. It produces asymmetric failures that are hard to spot; verify with ipconfig/ip addr on both ends.
• Starting a VLSM block at an octet that is not a multiple of its jump (a /27 starting at .40 is invalid: /27s start at multiples of 32).
• Exam-and-real-life tip: always write out the 5 steps. Thirty seconds of method save an hour of debugging.
• Tip: the 256 − mask trick plus multiples of the jump solves 95% of calculations without binary. Save the binary for verifying when in doubt.

The monitoring server of a Meridiano client has the address 172.16.35.123 with mask 255.255.240.0. Calculate, working through the 5 steps: host bits, usable hosts, network address, broadcast and usable range. Is 172.16.40.200 on its same subnet?

Meridiano opens a third site in Seville and assigns it 192.168.30.0/24. It needs 6 subnets (corporate, guests, servers, VoIP, management and reserve), all the same size. a) Which prefix does it need and how many hosts will each subnet have? b) List the first four subnets with their network, usable range and broadcast. c) Which subnet would host 192.168.30.77 belong to?

Two servers in a data center: A = 10.0.5.20/22 and B = 10.0.6.200/22. Are they on the same subnet? Work out the calculation of each one's network.

Solution 1

172.16.40.200: its third octet is 40, and 32 ≤ 40 ≤ 47, inside the 32–47 block. Its network with /20 is also 172.16.32.0 → yes, same subnet.

Solution 2

a) For ≥ 6 subnets you must borrow bits: 2 bits → 4 subnets (not enough); 3 bits → 8 subnets ✔. Prefix /24 + 3 = /27 (mask 255.255.255.224). Hosts per subnet: h = 5 → 2^5 − 2 = 30.

b) Jump = 256 − 224 = 32:

c) 192.168.30.77: multiples of 32 → the one ≤ 77 is 64. It belongs to subnet 3 (192.168.30.64/27), whose .65–.94 range contains it as a valid host.

Solution 3

Mask /22 = 255.255.252.0. Interesting octet: the 3rd. Jump = 256 − 252 = 4 → subnets start at third octet 0, 4, 8, … multiples of 4.

Same network (10.0.4.0/22) and same mask → yes, they are on the same subnet and communicate without going through the router, even though their third octets (5 and 6) differ. A good example of why "the first three octets match" is not the criterion: the criterion is the AND with the mask.

You now command the full mechanics of addressing: the mask in its two notations, the bitwise AND with which every machine chooses between local delivery and the gateway, the 5-step method (host bits → 2^h − 2 → network → broadcast → range), subnetting by borrowing bits with its /24-to-/30 table, the 256 − mask jump trick, and VLSM to fit each subnet to its real size — all applied to the Valencia VLAN plan and Bilbao's /27. And you know how to verify in the field whether two hosts share a subnet, including the unequal-masks trap.

One question has been left open since lesson 05-01: Meridiano's addresses are private and Internet routers drop them… and yet Marta browses the web, queries public APIs and downloads updates every day. The mechanism behind that magic trick — rewriting addresses at the exit router — is the next lesson: NAT and Private Addressing.