🧮 01-05: IPv4 Subnetting & CIDR¶

📌 Why Subnet?¶

Splitting one large network into smaller subnets (sub-networks) lets you:

Avoid wasting addresses on networks that don't need thousands of hosts
Contain broadcast traffic to smaller segments (better performance)
Isolate departments/functions from each other (a security win — see Module 05: Firewalls & Access Control)

This lesson builds on the subnet mask concept introduced in 01-04: IPv4 Addressing Basics.

🔹 Original Class-Based Addressing¶

Before CIDR existed, IP addresses were divided into fixed-size classes:

Class	Range	Default Mask	Use
A	1.0.0.0 – 126.255.255.255	/8	Large networks
B	128.0.0.0 – 191.255.255.255	/16	Medium networks
C	192.0.0.0 – 223.255.255.255	/24	Small networks
D	224.0.0.0 – 239.255.255.255	Multicast	Special
E	240.0.0.0 – 255.255.255.255	Reserved	Experimental

💡 127.x.x.x is reserved for loopback (see 01-04).

The problem: a company that needed 300 hosts either wasted a whole Class B (65,534 hosts) or had to juggle multiple Class Cs. This rigid, wasteful system helped drive IPv4 address exhaustion.

🔹 CIDR (Classless Inter-Domain Routing)¶

CIDR removes the fixed-class limitation and allows a subnet mask of any length, not just /8, /16, or /24.

Format: IP_Address/Prefix_Length

Example: 192.168.60.3/26

/26 → 26 bits for network, 6 bits for host
Binary mask: 11111111.11111111.11111111.11000000 → 255.255.255.192

💡 CIDR is dramatically more flexible and efficient — you size the subnet to the actual number of hosts needed.

🔹 Important Terms¶

Network ID — the first address in a subnet (all host bits = 0)
Broadcast ID — the last address in a subnet (all host bits = 1), used to reach every host on that subnet at once
Address Range — every address from the Network ID to the Broadcast ID
Usable Host Range — the addresses actual devices can use (Network ID and Broadcast ID excluded)

For a subnet with h host bits, there are 2^h total addresses and 2^h - 2 usable addresses (subtracting the network and broadcast addresses).

🧩 Worked Example¶

Question: Find the Network ID, Broadcast ID, Address Range, and Usable Host Range for 192.168.192.0/19.

Method 1 — Binary¶

/19 → subnet mask: 11111111.11111111.11100000.00000000
IP in binary: 192.168.192.0 → 11000000.10101000.11000000.00000000

First address (all host bits = 0): 11000000.10101000.11000000.00000000 → 192.168.192.0

Last address (all host bits = 1): 11000000.10101000.11011111.11111111 → 192.168.223.255

Method 2 — Block Size (faster in practice)¶

/19 → subnet mask: 255.255.224.0
Block size = 256 − 224 = 32

The 3rd octet increases in steps of 32: 0, 32, 64, 96, 128, 160, 192, 224.

The given network starts at 192 → the next block boundary is 224, so this subnet's last address is one less than 192.168.224.0, i.e. 192.168.223.255.

✔ Final Answer¶

Network ID: 192.168.192.0
Broadcast ID: 192.168.223.255
Address Range: 192.168.192.0 – 192.168.223.255
Usable Host Range: 192.168.192.1 – 192.168.223.254

Want more practice? Work through 02-exercises Module 01 — three fully worked subnetting problems with both methods shown step by step.

🔐 Why This Matters for Security¶

Subnetting is a core building block of network segmentation, which is one of the most effective, low-cost security controls that exists:

Put servers, employee workstations, and guest Wi-Fi in separate subnets.
A firewall or router ACL between subnets can allow only the traffic that's actually needed (see Module 05).
If one subnet is compromised, a well-segmented network limits how far an attacker can move ("blast radius").

📌 Key Takeaways¶

CIDR replaced rigid IP classes with flexible, arbitrary-length prefixes.
Block size = 256 − subnet mask value in the octet where the mask changes.
Network ID = all host bits 0; Broadcast ID = all host bits 1.
Usable hosts per subnet = 2^h − 2, where h is the number of host bits.
Subnetting isn't just about saving addresses — it's a foundational network security tool (segmentation).