Networks, Automation, Connectivity & Data Centres · Chapter 2 of 18
Addressing and subnetting, done properly
Binary for twenty minutes, then a set of worked examples you can do in your head. This is the most testable knowledge in networking and the most commonly faked.
Subnetting has a reputation for being hard that it does not deserve. It is arithmetic in base 2, there are eight numbers to memorise, and once you have done a dozen examples by hand you will never need a calculator again. It also appears in interviews constantly, because it is one of the few networking topics where you cannot bluff — either you can split a /24 into six usable subnets on a whiteboard or you cannot.
The eight numbers
An IPv4 address is 32 bits, written as four 8-bit octets. The mask says how many of those bits identify the network; the rest identify the host. Everything follows from that.
| Bits borrowed | Mask (last octet) | Block size | Subnets | Usable hosts each |
|---|---|---|---|---|
| /25 | 128 | 128 | 2 | 126 |
| /26 | 192 | 64 | 4 | 62 |
| /27 | 224 | 32 | 8 | 30 |
| /28 | 240 | 16 | 16 | 14 |
| /29 | 248 | 8 | 8 per /26 | 6 |
| /30 | 252 | 4 | — | 2 |
| /31 | 254 | 2 | — | 2 (point-to-point, RFC 3021) |
| /32 | 255 | 1 | — | 1 (a single host) |
The block size is the number to hold in your head, because subnet boundaries always fall on multiples of it. A /26 has block size 64, so the boundaries are .0, .64, .128 and .192 — never anything else. Given any address you can find its subnet by asking which multiple of the block size it falls between.
Work these by hand before you read the answers
1. Which subnet is 172.16.45.200/27 in, and what is its broadcast? Block size for /27 is 32. Multiples of 32: 0, 32, 64, 96, 128, 160, 192, 224. 200 falls between 192 and 223, so the subnet is 172.16.45.192/27, the usable range is .193 to .222, and the broadcast is .223.
2. You need six subnets from 192.168.10.0/24, each with at least 25 hosts. Six subnets needs 3 borrowed bits (2³ = 8 ≥ 6), giving /27. A /27 has 30 usable hosts, which covers 25. So: .0/27, .32/27, .64/27, .96/27, .128/27, .160/27, with .192 and .224 spare. If the requirement had been 35 hosts you would need /26, which only yields four subnets, and you would have to say so — the constraints are incompatible in a single /24, and noticing that is the actual test.
3. Do 10.1.1.100/22 and 10.1.3.50/22 talk directly? A /22 has block size 4 in the third octet, so the subnet is 10.1.0.0/22 covering 10.1.0.0 to 10.1.3.255. Both addresses are inside it, so yes — same broadcast domain, no router needed. This one catches people because the block size has moved out of the last octet.
VLSM: use a mask that fits the segment, not one mask everywhere
Variable-length subnet masking simply means different subnets in the same network can have different sizes. A point-to-point link between two routers needs exactly two addresses, so it gets a /30 — or a /31 if your kit supports RFC 3021, which uses both addresses and wastes nothing. Giving that link a /24 wastes 252 addresses.
Allocate largest first, then work down. If you allocate the small subnets first you will fragment the space and find you have no contiguous block left for the big one.
The private ranges, and why your VPCs collide
| Range | CIDR | Addresses | Where you see it |
|---|---|---|---|
| 10.0.0.0 – 10.255.255.255 | 10.0.0.0/8 | 16.7 million | Enterprise networks, most VPCs |
| 172.16.0.0 – 172.31.255.255 | 172.16.0.0/12 | 1 million | Docker's default bridge, some clouds |
| 192.168.0.0 – 192.168.255.255 | 192.168.0.0/16 | 65,536 | Home routers, small offices |
| 100.64.0.0 – 100.127.255.255 | 100.64.0.0/10 | 4 million | Carrier-grade NAT, Tailscale, some k8s |
| 169.254.0.0/16 | link-local | 65,536 | APIPA — an address here means DHCP failed |
| 127.0.0.0/8 | loopback | 16.7 million | All of it is localhost, not just 127.0.0.1 |
An address in 169.254.x.x is worth recognising instantly: it means the machine asked for DHCP and got no answer, so it assigned itself something. That is a DHCP problem, not a routing problem, and it saves you twenty minutes of looking in the wrong place. In cloud environments, 169.254.169.254 is the instance metadata service, which is a different use of the same range and the target of a well-known class of SSRF attack.
The overlap problem that will eventually be your problem
Almost everyone builds their first VPC (Virtual Private Cloud) as 10.0.0.0/16. So does everyone else. When your company acquires another company, or you need to peer with a partner, or you connect a second cloud, the ranges collide — and VPC peering flatly refuses to work with overlapping CIDRs.
The fix afterwards is expensive: NAT everything, or renumber, which means touching every security group, firewall rule and hard-coded address in the estate.
The fix beforehand is free: keep a single register of allocated ranges across the whole organisation, allocate deliberately from it, and never let a team pick 10.0.0.0/16 because it was the default in the tutorial. Being the person who asks about this in a design review is a very cheap way to look senior.
IPv6, briefly, because it is now unavoidable
IPv6 is 128 bits, written as eight groups of four hex digits, with one run of zeros collapsible to ::. The things worth knowing for an interview:
- The subnet is always /64. Not because of scarcity — there is no scarcity — but because stateless address autoconfiguration assumes it. A site typically gets a /48, giving 65,536 /64 subnets.
- There is no NAT and no ARP. Neighbour Discovery, which runs over ICMPv6, replaces ARP. This is why blocking all ICMP on IPv6 breaks the network entirely, rather than just breaking traceroute.
- fe80::/10 is link-local and every interface has one, always.
- Dual stack is the normal state, and it creates a real failure mode: a host with a broken IPv6 path but a working IPv4 one may still prefer IPv6 and appear to hang. Happy Eyeballs (RFC 8305) exists to race both and is why browsers usually survive this and command-line tools usually do not.
Check yourself