Use ← → arrows, the dots, or the ☰ menu. Switch to the Lab Guide up top.
The big picture
Your 4-stop journey through subnetting
💡
Think of it like… dividing a huge plot of land into fenced lots. One big address block is wasteful; subnetting puts up internal fences so each team gets a right-sized lot with its own sub-address.
🔲
1
Why & the rules
Classful waste, pros/cons, and the non-negotiable rules.
📐
2
Borrowing bits
Move the mask fence; two key formulas.
✨
3
The magic number
One recipe, then fully worked examples.
🧩
4
FLSM & VLSM
Fixed vs variable subnets, CIDR, right-sizing.
Part 1 · Why subnet
Classful networks waste addresses
Class A
16,777,214
hosts per network
Class B
65,534
hosts per network
Class C
254
hosts per network
🧩
The problem: almost no organisation needs 16 million (or even 254) hosts on ONE flat network. The rest sits unused. The fix → carve a classful network into smaller subnets (A, B & C only).
💡
Think of it like… renting a 1,000-room hotel just to house a family of four. Subnetting lets you wall it into right-sized apartments — and use the rest — instead of wasting the whole building.
Part 1 · Why subnet
The trade-off: pros vs cons
👍 Advantages
● Split ONE block into many networks ● Less traffic — smaller routing tables, fewer collisions ● Easier to manage & troubleshoot ● Better security — separate departments ● Cleaner accounting & admin
👎 Disadvantages
● 2 addresses wasted PER subnet (network + broadcast) ● Extra hop adds a little delay ● Costs more — routers, switches ● Needs an experienced admin to plan
Part 1 · The rules
Four rules you can’t break
2ⁿ
Power of 2
The number of subnets is always 2ⁿ (n = bits borrowed).
⚖️
Equal size
Every subnet of a block holds the SAME number of addresses.
Never mask more than 30 bits — keep ≥ 2 host bits.
💡
Think of it like… fencing land into equal lots, where each lot must keep a sign-post (network address) and a noticeboard (broadcast) — so the tiniest legal lot still needs 4 plots.
Part 2 · The toolkit
Refresher: powers of 2 & place values
Every subnetting trick rests on these. Learn them cold:
Memory hook: the mask values just keep adding the next bit: 128, +64→192, +32→224, +16→240… These ARE your subnet masks.
Part 2 · The toolkit
The big idea: borrowing host bits
A classful address has 2 parts. Subnetting adds a 3rd — the Subnet ID — by moving the mask “fence” to the right.
Before (classful):
Network IDHost ID
After (subnetted): the fence moves right →
Network IDSubnet IDborrowedHost ID
💡
Think of it like… the mask is a sliding fence between “network” and “host” land. Borrowing bits = pushing the fence rightward, turning host space into numbered sub-sections. Each bit you steal DOUBLES the number of subnets.
Part 2 · The toolkit
Two questions, two formulas
🗂️
How many SUBNETS?
subnets = 2borrowed
Borrow more bits → more subnets.
👥
How many HOSTS each?
hosts = 2host bits − 2
Minus 2 for network & broadcast.
🧠
Memory hook: “Borrow for subnets; what’s Left is for hosts (minus 2).” Either requirement — number of subnets OR hosts per subnet — tells you how many bits to borrow.
Self-Test #1
Concepts & Rules
Tap a green answer to reveal it.
Q Why subnet a classful network?
A To use addresses efficiently & gain smaller routing tables, less congestion, better security.
Q The number of subnets created is always…?
A A power of 2 — borrow n host bits → 2ⁿ subnets.
Q What’s the smallest valid subnet, and why?
A 4 addresses (/30): network + broadcast + 2 hosts. So you mask at most 30 bits.
Q What 3rd part does subnetting add, and how?
A A Subnet ID — by borrowing host bits (extending the mask with more 1s).
Part 3 · The magic number
The one recipe to rule them all
Step
Do this
1
Count the 1s — the /slash value = how many 1-bits are in the mask.
2
Write the mask in dotted-decimal (e.g. /26 → 255.255.255.192).
3
Magic number = 256 − the interesting mask octet (256 − 192 = 64).
4
Spot the changing octet (the partial one is your “*”).
5
Start the * at 0 and add the magic number for each subnet boundary.
💡
Think of it like… the magic number is your step size on a ruler. Subnets always begin at 0 and jump in equal magic-number strides — 0, 64, 128, 192… — so once you know the step, you know every boundary.
Memory hook: Magic = 256 − 128 = 128, so subnets land on 0 and 128. Each holds 2⁷ − 2 = 126 hosts.
Part 3 · Worked example
Create 4 subnets from 192.168.4.0/24
Need 4 subnets → borrow 2 bits (2² = 4) → /26. Mask = 255.255.255.192. Magic = 256 − 192 = 64. Start at 0, step by 64.
Subnet
Network
Usable hosts
Broadcast
S1
.0
.1 – .62
.63
S2
.64
.65 – .126
.127
S3
.128
.129 – .190
.191
S4
.192
.193 – .254
.255
(all in 192.168.4.x) · each subnet = 64 addresses, 62 usable hosts (2⁶ − 2).
Part 3 · Worked example
Work backwards from requirements
Given 192.168.15.0 (Class C, /24). Need ≥ 50 hosts/subnet AND ≥ 4 subnets. Which mask?
Step
Reasoning
Result
1 · Hosts first
Need ≥ 50 → 2ʰ − 2 ≥ 50 → 2⁶ − 2 = 62 ✓
keep 6 host bits
2 · Borrow
8 host bits − 6 kept = 2 borrowed
/24 + 2 = /26
3 · Check subnets
2² = 4 subnets ≥ 4 required ✓
both met!
4 · Mask
255.255.255.192
= /26
🧠
Memory hook: when given a HOST requirement, size the host bits first (2ʰ − 2), then whatever’s left over gets borrowed for subnets — and double-check the count.
Part 3 · Reference
The subnet table to memorise (Class C)
Snap a photo of this — it answers most exam questions in seconds.
CIDR
Mask (last octet)
Magic #
Subnets
Usable hosts
/25
255.255.255.128
128
2
126
/26
255.255.255.192
64
4
62
/27
255.255.255.224
32
8
30
/28
255.255.255.240
16
16
14
/29
255.255.255.248
8
32
6
/30
255.255.255.252
4
64
2
Each row down DOUBLES the subnets and (roughly) HALVES the hosts.
Self-Test #2
The Magic Number
Tap a green answer to reveal it.
Q For /26, what’s the subnet mask and the magic number?
A 255.255.255.192; magic = 256 − 192 = 64.
Q How many usable hosts in a /27 subnet?
A 2^(32−27) − 2 = 2⁵ − 2 = 30.
Q List the four /26 subnets of 192.168.4.0.
A .0, .64, .128, .192 — each spanning 64 addresses.
Q Need ≥ 50 hosts/subnet (Class C). How many host bits & what mask?
● Drops rigid A/B/C classes — just use /n ● /n = count of 1-bits in the mask ● Advertises routes on the Internet (ISP side)
🧩
VLSM
Variable Length Subnet Mask
● Different masks for different subnets ● “Subnetting a subnet” — right-size each ● Used inside a company for efficiency
🧠
Memory hook: CIDR = classless notation for the OUTSIDE world (Internet / ISPs). VLSM = variable masks for the INSIDE (your own network).
Part 4 · Classless world
FLSM vs VLSM — same size or right size?
FLSM — Fixed Length
Every subnet is the SAME size. Simple — but a 2-host link still grabs a full-size block. Wasteful.
/26/26/26/26
VLSM — Variable Length
Each subnet is sized to its need — big blocks for big teams, tiny blocks for router links.
/25/26/27/30
💡
Think of it like… moving house with identical boxes (FLSM) means a single spoon gets its own huge box. VLSM uses assorted box sizes — pack big things in big boxes, small in small.
Part 4 · Classless world
VLSM in 3 steps (worked)
The recipe
① Sort the needed subnets LARGEST → smallest (by host count). ② Carve the biggest one first from the block. ③ Repeat down the list, splitting the next free space.
Block 192.168.1.0/24 → 4 teams
Need
Mask
Subnet
Range
100
/25
…1.0
.0 – .127
50
/26
…1.128
.128 – .191
25
/27
…1.192
.192 – .223
2
/30
…1.224
.224 – .227
💡
Think of it like… packing a suitcase: put the big items in first, then tuck the smaller ones into the gaps. Allocate your largest subnet first, and the rest slot neatly after it.
Self-Test #3
CIDR, FLSM & VLSM
Tap a green answer to reveal it.
Q CIDR vs VLSM — where is each used?
A CIDR (classless /n) advertises routes on the Internet (ISP side); VLSM (different masks per subnet) is used inside a company.
Q FLSM vs VLSM in one line?
A FLSM = all subnets the same size; VLSM = right-sized subnets (“subnetting a subnet”) — far less waste.
Q First step of VLSM allocation?
A Sort the required networks from largest to smallest host count, then allocate the biggest first.
One-page cheat sheet
Subnetting in a single glance
Why subnet
Classful blocks waste addresses
Smaller routing tables · security
A/B/C networks only
The rules
#subnets = 2ⁿ · all same size
Min subnet = 4 addr (/30)
Max 30 bits masked
Borrowing bits
Extend the mask with 1s
Host bits → Subnet ID
Each bit DOUBLES subnets
Two formulas
subnets = 2^(borrowed)
hosts = 2^(host bits) − 2
(−2 = network + broadcast)
Magic number
256 − mask octet = step
Subnets start at 0, +magic
/26 → 64 → 0,64,128,192
Mask table
/25=128 /26=192 /27=224
/28=240 /29=248 /30=252
magic: 128·64·32·16·8·4
CIDR
Classless /n notation
/n = # of 1-bits
For the Internet / ISPs
FLSM vs VLSM
FLSM = all subnets same size
VLSM = right-sized
(subnet a subnet) less waste
VLSM steps
Sort needs LARGEST → smallest
Allocate biggest first
Repeat / split as needed
Subnetting? Solved.
Borrow bits, find the magic number, step through the boundaries — then right-size everything with VLSM. With the reference table and the recipe, the maths is just counting. Revise with the cheat sheet, test yourself with the quizzes.
Chapter 6 — the final chapter ✓
Ready to make it real? Switch to the 🧪 Lab Guide — let ipcalc do the subnet maths for you on Kali Linux.
1 / 21
Chapter 6 · Hands-on labs
Subnetting Made Easy — live on Kali Linux
Six small, beginner-friendly labs. Subnetting maths is scary by hand — so we let ipcalc do it and just read the answers. You’ll see the mask, the network & broadcast, the host counts, and even the binary — for any /xx you type.
SET-UP · Open the Kali Terminal. No sudo or capturing needed — this chapter is pure calculation. Install the two helper tools once: sudo apt install -y ipcalc sipcalc. The ❯ is just the prompt — Copy grabs only the command.
NOTE · ipcalc just does maths on addresses you type — it sends nothing on the network, so it’s completely safe to experiment with any address.
Maps to Ch.6:The mask marks the network bits (1s) vs host bits (0s); AND it with the IP for the network address.You’ll learn:See the mask in binary and where the “network / host” fence sits — ipcalc shows it all.Tools:ipcalc
Look at the Netmask binary: 11111111… then …00000000. The 1s mark the network; the 0s mark the host. The Network line is just the IP with the host bits zeroed (that’s the AND).
Why it matters · A subnet mask really is just a run of 1s followed by 0s. Everything in subnetting is deciding where that line sits — and ipcalc draws it for you in binary.
Your turn · In the Netmask binary, how many 1s are there — and does that match the /24? (answer below)
2
Borrow Bits, Halve the Hosts
Maps to Ch.6:Borrowing host bits: each bit borrowed DOUBLES the subnets and (roughly) HALVES the hosts.You’ll learn:Run the same network at /24, /25, /26 and watch the host count fall as you borrow bits.Tools:ipcalc
1
One big network (no bits borrowed):
ipcalc 192.168.1.0/24
Representative
Network: 192.168.1.0/24 Hosts/Net: 254
2
Borrow 1 bit → /25 (now each subnet is half the size):
ipcalc 192.168.1.0/25
Representative
Network: 192.168.1.0/25 Hosts/Net: 126
3
Borrow 2 bits → /26 (halved again):
ipcalc 192.168.1.0/26
Representative
Network: 192.168.1.0/26 Hosts/Net: 62
Why it matters · 254 → 126 → 62: every bit you borrow for the network roughly halves the hosts (and doubles the number of subnets). That’s the see-saw the two formulas describe — now you’re watching it happen.
Your turn · Without running it, predict the Hosts/Net for /27. Then check with ipcalc 192.168.1.0/27. (answer below)
3
List Every Subnet
Maps to Ch.6:The magic number — split a /24 into /26 subnets that start at 0, 64, 128, 192.You’ll learn:Enumerate all the subnets of a block in one command with sipcalc.Tools:sipcalc (sudo apt install sipcalc)
1
Split a /24 into /26 subnets — -s 26 means “cut it into /26s”:
There’s the magic number in action: the subnets start at 0, 64, 128, 192 — steps of 64 (256 − 192). The last address of each block is its broadcast.
2
No sipcalc? Check any single subnet with ipcalc instead:
ipcalc 192.168.4.64/26
Why it matters · The “magic number” you computed by hand (64) is exactly the gap between these subnets. sipcalc just counts in those steps for you — 0, +64, +64, +64.
Your turn · If you split the /24 into /28 instead, what would the magic number (step) be, and how many subnets? (answer below)
4
Size a Network to a Requirement
Maps to Ch.6:Work backwards: “I need ≥ N hosts” → find the host bits → pick the mask.You’ll learn:Try masks until the host count clears your requirement — the requirements-driven method.Tools:ipcalc
Goal: each subnet must hold at least 50 hosts. Try masks until Hosts/Net ≥ 50.
1
Try /26 (does it give enough hosts?):
ipcalc 192.168.15.0/26
Representative — 62 ≥ 50 ✓
Network: 192.168.15.0/26 Hosts/Net: 62
2
Would /27 still work? Check — it shouldn’t (too few):
ipcalc 192.168.15.0/27
Representative — 30 < 50 ✗ too small
Network: 192.168.15.0/27 Hosts/Net: 30
Why it matters · /26 gives 62 (≥ 50 ✓) but /27 only 30 (✗). So /26 is the smallest mask that meets “≥ 50 hosts” — exactly the requirements-driven answer from the slides, found by trying masks instead of doing the algebra.
Your turn · What’s the smallest mask (most bits) that still gives at least 10 usable hosts? (answer below)
5
Build the Reference Table, Live
Maps to Ch.6:The /25–/30 reference table: mask, magic number, subnets, host count.You’ll learn:Generate the famous table yourself, one ipcalc per row — and confirm it’s right.Tools:ipcalc
1
Run each mask from /25 to /30 and note the mask + Hosts/Net:
for m in 25 26 27 28 29 30; do echo "/$m:"; ipcalc 192.168.1.0/$m | grep -E 'Netmask|Hosts'; done
Why it matters · This is the exact table from the slides — but you just built it from scratch. Note the last octet (128, 192, 224, 240, 248, 252) and how the hosts halve each step (126→62→30→14→6→2). The magic number is 256 minus that last octet.
Your turn · From your table, what’s the magic number for /28? (256 − the /28 last octet.) (answer below)
6
VLSM: Right-Size Each Subnet
Maps to Ch.6:VLSM — give big teams big blocks, tiny links tiny blocks, instead of one fixed size (FLSM).You’ll learn:Carve a /24 into different-sized subnets for needs of 100, 50, 25 and 2 hosts.Tools:ipcalc
Block 192.168.1.0/24. Four teams need 100, 50, 25, 2 hosts. Allocate biggest first, checking each fits:
1
Team A (100 hosts) → /25 (126 hosts), starts at .0:
ipcalc 192.168.1.0/25
2
Team B (50 hosts) → /26 (62), starts after A at .128:
ipcalc 192.168.1.128/26
3
Team C (25 hosts) → /27 (30), starts at .192:
ipcalc 192.168.1.192/27
4
Link D (2 hosts) → /30 (2), starts at .224:
ipcalc 192.168.1.224/30
The finished VLSM plan
A 100 → /25 192.168.1.0 – .127
B 50 → /26 192.168.1.128 – .191
C 25 → /27 192.168.1.192 – .223
D 2 → /30 192.168.1.224 – .227
Why it matters · Each team got just enough — the 2-host link uses a /30, not a wasteful full-size block. That’s VLSM: right-size every subnet, biggest first, with room to spare. FLSM would have handed all four the same size.
Your turn · After team D ends at .227, how much of the /24 is still free for future subnets? (answer below)
✓
Answer Key & Where Next
Lab 1. There are 24 ones in the netmask (three full octets of 11111111) — which is exactly what /24 means: 24 network bits.
Lab 3. Splitting a /24 into /28: magic number = 256 − 240 = 16 (subnets at 0, 16, 32…), giving 16 subnets.
Lab 4./28 gives 14 usable hosts (≥ 10 ✓); /29 gives only 6 (✗). So /28 is the smallest mask with at least 10 hosts.
Lab 5. /28’s last octet is 240, so the magic number is 256 − 240 = 16.
Lab 6. Used so far: .0 – .227. Free: .228 – .255 (28 addresses) — room for, say, more small /30 links.
This chapter built on…
From…
Masks & the AND operation
Chapter 4 — the IPv4 address & mask
Network & broadcast addresses
Chapter 4 — address math (the −2)
Private ranges you subnet
Chapter 5 — RFC 1918 & NAT
ipcalc
Chapter 2 & 4 — your everyday IP calculator
You did it! · With ipcalc doing the arithmetic, you’ve borrowed bits, listed subnets, sized networks to requirements, rebuilt the reference table, and planned a full VLSM scheme — the whole of Chapter 6, hands-on. That completes the course. 🎉
Chapter 6 — Subnetting · Slides + Hands-On Kali Labs