6.2 Subnetting & CIDR

Subnetting divides a larger address block into smaller networks. CIDR (Classless Inter-Domain Routing) is the modern way to write those blocks: network-address/prefix-length. On the Cyber Test, expect arithmetic: given an IP and a mask (or CIDR), find the network, broadcast, number of hosts, or the correct subnet for a host.

From Classful to Classless

Classful addressing forced /8, /16, or /24 based on the first octet. CIDR removes that restriction. An ISP can assign 203.0.113.0/26 even though the first octet looks "Class C." What matters is the prefix length, not the old class letter.

Writing forms you should recognize as equivalent:

• 192.168.10.0/24
• 192.168.10.0 with mask 255.255.255.0

Both mean: the first 24 bits identify the network; the last 8 bits identify the host.

---

The Core Formulas

Let n = prefix length (network bits). Then:

• Host bits = 32 − n
• Total addresses in the subnet = 2^(host bits)
• Usable host addresses (typical Ethernet LAN) = 2^(host bits) − 2
  • Subtract 1 for the network address (host bits all 0)
  • Subtract 1 for the broadcast address (host bits all 1)

/30 is classic for point-to-point links (two usable addresses). /32 identifies one specific host in routing or firewall rules.

---

Worked Example 1: /24 Baseline

Given: 192.168.5.77/24

1. Host bits = 32 − 24 = 8
2. Block size in the last octet = 2^8 = 256 (the whole last octet)
3. Network: 192.168.5.0
4. Broadcast: 192.168.5.255
5. Usable hosts: 192.168.5.1 – 192.168.5.254 (254 hosts)
6. Host 192.168.5.77 is a valid usable address on that subnet

---

Worked Example 2: /26 Subnet Math

Given: Find network, broadcast, and usable range for 10.10.10.100/26.

1. Host bits = 32 − 26 = 6
2. Addresses per subnet = 2^6 = 64
3. In the last octet, subnets jump by 64: .0, .64, .128, .192
4. Host .100 falls in the .64 block (64 ≤ 100 ≤ 127)
5. Network: 10.10.10.64
6. Broadcast: 10.10.10.127 (64 + 64 − 1)
7. Usable hosts: 10.10.10.65 – 10.10.10.126 (62 hosts)
8. Confirm: 100 is between 65 and 126 → valid host on 10.10.10.64/26

Same problem with binary intuition

Mask /26 means the first 26 bits are network. The last octet binary for mask 255.255.255.192 is 11000000 — two network bits borrowed from what was a /24, leaving six host bits. Those two borrowed bits create four /26 subnets inside a /24.

---

Worked Example 3: Borrowing Bits Inside a /24

You own 192.168.20.0/24 and need 4 equal subnets.

1. Four subnets require 2^k ≥ 4 → borrow k = 2 bits
2. New prefix = /24 + 2 = /26
3. Each subnet has 2^(32−26) = 64 addresses and 62 usable hosts

If you instead needed at least 50 usable hosts per subnet inside that /24:

• Need 2^h − 2 ≥ 50 → 2^h ≥ 52 → h = 6 → prefix /26
• Maximum equal /26 subnets from one /24 is still four — matches the table above

---

Worked Example 4: /28 and Broadcast Recognition

Given: What is the broadcast address of the subnet containing 172.16.8.19/28?

1. Host bits = 4 → block size = 16
2. Last-octet boundaries: .0, .16, .32, …
3. .19 is in .16–.31
4. Network: 172.16.8.16
5. Broadcast: 172.16.8.31
6. Usable: .17–.30 (14 hosts)

A common trap is answering .19 or .16 as broadcast — broadcast is the last address in the block, not the host or network address.

---

Finding "Which Subnet?" Quickly

For prefixes that only change the last octet (/24 through /30):

1. Compute block size = 256 − last mask octet (or 2^(32−prefix))
2. Find the greatest multiple of the block size that is ≤ the host's last octet
3. That multiple is the subnet's network last octet; add block − 1 for broadcast

Example: mask 255.255.255.224 (/27), host 192.168.1.70

• Block size = 256 − 224 = 32
• Multiples: 0, 32, 64, 96…
• 70 → network .64, broadcast .95

---

Classful vs Classless on Exam Wording

---

Operational Cyber Angle

Subnetting is not only math for routers. Analysts use CIDR in firewall allowlists (10.0.0.0/8), intrusion signatures, and VPN pools. Choosing too-large prefixes opens unnecessary attack surface; too-small prefixes break legitimate hosts. Practice until network/broadcast/host-count problems feel mechanical — speed matters under timed testing.