Subnet and prefix length

The prefix length counts the fixed leading bits: /24 fixes three bytes and leaves 8 bits (256 addresses, 254 usable: the first names the network, the last is broadcast). /25 halves it, /23 doubles it. Two devices talk directly only if each sees the other inside its own subnet; everything else goes to a gateway.

How subnetting works

An IPv4 address is 32 bits. The prefix length says how many of the leading bits name the network; the rest name the host on it. 10.0.1.10/24 means the first 24 bits, 10.0.1, are the network and the last 8, .10, are the host. The mask 255.255.255.0 is the same fact in another notation: 24 one-bits, then 8 zeros.

With h host bits a subnet holds 2^h addresses. Two are reserved: the first, all host bits 0, is the network address, and the last, all host bits 1, is the broadcast address. So a /24 has 256 addresses and 254 for devices. Each extra prefix bit halves the block:

A /31 is the exception: RFC 3021 lets a point-to-point link between two routers use both of its addresses, with no network or broadcast address.

To find the network an address is in, keep the network bits and zero the host bits. For 10.0.1.200/26 the last byte keeps its top two bits: 200 is 11001000, so the network is 11000000, 192. The block size is 256 − 192 = 64, so the subnet runs from 10.0.1.192 to the broadcast 10.0.1.255. The same arithmetic, worked for any address, is what the subnet calculator does.

The prefix exists for one decision. Before sending, a machine checks whether the destination is inside its own subnet. If it is, the machine ARPs for it and sends directly. If not, the packet goes to the default gateway.

What it looks like on a Linux machine

In the addresses and subnets lab, alice holds 10.0.1.10/24. Setting the address is what creates the route for her subnet:

$ ip -4 addr show eth0
    inet 10.0.1.10/24 brd 10.0.1.255 scope global eth0
$ ip route
default via 10.0.1.2 dev eth0
10.0.1.0/24 dev eth0 proto kernel scope link src 10.0.1.10

ipcalc does the arithmetic. For the printer's address at three prefix lengths:

$ ipcalc -nbm 10.0.1.200/26
NETMASK=255.255.255.192
BROADCAST=10.0.1.255
NETWORK=10.0.1.192
$ ipcalc -nbm 10.0.1.200/30
NETMASK=255.255.255.252
BROADCAST=10.0.1.203
NETWORK=10.0.1.200

ip route get asks the kernel which route it would use: for 10.0.1.11 the answer has no via, for 10.0.2.10 it says via 10.0.1.2.

What goes wrong, and how you see it

A prefix too long. Give alice /25 instead of /24. Her subnet shrinks to .0–.127, and the printer at .200 now looks remote. She sends to the router, which forwards the packet back onto the same wire and may send an ICMP redirect. It still works, one hop slower, and traceroute shows the extra hop. The printer replies directly, so the two directions take different paths. This is the quiet mistake that lasts for months.

A prefix too short. With /16, the file server at 10.0.2.10 looks local. Alice ARPs for it, nobody on her wire answers, the neighbour entry goes FAILED and ping says Destination Host Unreachable from alice herself. The router could have delivered it, but she never asked.

Overlapping subnets. Two networks behind one router with overlapping prefixes, or a VPN that hands out a range already used at home, make some addresses reachable two ways. The longest prefix wins, which is rarely what anyone meant.

Questions people ask

How many hosts are in a /24, /27 or /30? 2^(32 − prefix) − 2: 254, 30 and 2.

What is CIDR? Classless Inter-Domain Routing (RFC 4632): writing the prefix with every address, so a network can be any size. Before it, the size was implied by the first octet: class A /8, B /16, C /24.

How do I split one network into smaller ones? Borrow host bits. A /24 gives two /25s, four /26s or eight /27s. Different sizes from one block, largest first, is VLSM, practised in the VLSM lab.

See it on real machines