✂️ Subnetting & CIDR
Slicing networks into smarter, safer pieces⏱ ~3 min
The school is the whole network. Each floor is a subnet — 1st floor = students, 2nd floor = teachers, 3rd floor = administration. They're all in the same building, but they have separate hallways, separate access cards, and can't just wander into each other's areas. Subnetting does exactly this for networks: it creates isolated zones inside the same IP range.
How Subnet Masks Work
A subnet mask marks which part of an IP address is the 'network' and which is the 'host.' Think of it like the zip code on a letter — the first part routes to the right city, the last part finds the exact house.
| IP Address | Subnet Mask | Network Part | Host Part | Usable Hosts |
|---|---|---|---|---|
| 192.168.1.10 | 255.255.255.0 (/24) | 192.168.1 | .10 | 254 |
| 192.168.1.10 | 255.255.0.0 (/16) | 192.168 | .1.10 | 65,534 |
| 10.0.0.5 | 255.0.0.0 (/8) | 10 | .0.0.5 | 16,777,214 |
CIDR Notation — the shortcut
- •/24 → 256 total addresses, 254 usable (first and last are reserved)
- •/25 → 128 addresses, 126 usable — splits a /24 in half
- •/30 → 4 addresses, 2 usable — perfect for a point-to-point link between 2 routers
- •Formula: Hosts = 2^(32 - prefix) − 2
Why Subnet? (Security Reasons)
- •🔒 Isolate sensitive systems — payroll servers on their own subnet, unreachable from student computers
- •🛡️ Contain breaches — if attackers get onto one subnet, they can't automatically reach others
- •📉 Reduce broadcast traffic — broadcasts stay inside their subnet, not the whole network
- •🎯 VLANs work alongside subnets: a VLAN separates broadcast domains at Layer 2, while a subnet separates IP ranges at Layer 3 — each VLAN typically gets its own subnet
Your school network is 172.16.0.0/16. The IT team wants to give students 200 IPs and teachers 50 IPs, on separate subnets. Which masks should they use?