By Davy Rogers. Use these techniques only in environments you own or have explicit permission to test.

Subnets and Subnet Masks

Subnetting is the practice of dividing a network into smaller, more manageable pieces called subnets. It's a fundamental concept in networking that every cybersecurity professional must master. Understanding subnets helps you design secure networks, conduct reconnaissance, identify network ranges during pentesting, and troubleshoot connectivity issues. Whether you're scanning for hosts or segmenting a network, subnetting is essential.

What You'll Learn

  • What subnets and subnet masks are
  • How subnet masks work in binary
  • CIDR notation and slash notation
  • How to calculate network and broadcast addresses
  • How to determine the number of hosts in a subnet
  • Subnetting strategies and examples
  • How attackers use subnet knowledge
  • Tools for subnet calculation

What Is a Subnet?

A subnet (subnetwork) is a logical subdivision of an IP network.

Why Subnet?

1. Organization:

Company network (10.0.0.0/8):
- HR department:     10.1.0.0/16
- IT department:     10.2.0.0/16
- Sales department:  10.3.0.0/16

2. Security:

Separate networks for:
- Public servers (DMZ)
- Internal employees
- Guest Wi-Fi
- IoT devices

3. Performance:

Smaller broadcast domains = Less network congestion

4. IP Address Management:

Efficiently allocate addresses
Don't waste IPs

Subnet Masks

A subnet mask determines which part of an IP address is the network and which part is the host.

Binary Representation:

IP Address:     192.168.1.100
Subnet Mask:    255.255.255.0

In binary:
IP:             11000000.10101000.00000001.01100100
Mask:           11111111.11111111.11111111.00000000
                ────────────────────────── ────────
                      Network               Host

Network part:   192.168.1
Host part:      100

Rule:

  • 1 in mask = Network bit
  • 0 in mask = Host bit

Common Subnet Masks

Decimal and Binary:

Mask              Binary                           CIDR  Hosts
────────────────  ───────────────────────────────  ────  ──────
255.0.0.0         11111111.00000000.00000000.00000000  /8    16,777,214
255.255.0.0       11111111.11111111.00000000.00000000  /16   65,534
255.255.255.0     11111111.11111111.11111111.00000000  /24   254
255.255.255.128   11111111.11111111.11111111.10000000  /25   126
255.255.255.192   11111111.11111111.11111111.11000000  /26   62
255.255.255.224   11111111.11111111.11111111.11100000  /27   30
255.255.255.240   11111111.11111111.11111111.11110000  /28   14
255.255.255.248   11111111.11111111.11111111.11111000  /29   6
255.255.255.252   11111111.11111111.11111111.11111100  /30   2

CIDR Notation

CIDR (Classless Inter-Domain Routing) is a compact way to represent subnet masks.

Format: IP_ADDRESS/PREFIX_LENGTH

192.168.1.0/24
│           │
│           └─ Prefix length (number of network bits)
└───────────── Network address

Examples:

192.168.1.0/24   = 255.255.255.0
10.0.0.0/8       = 255.0.0.0
172.16.0.0/12    = 255.240.0.0
192.168.1.0/28   = 255.255.255.240

Converting CIDR to Subnet Mask:

/24 = 24 ones in binary
11111111.11111111.11111111.00000000
255     .255     .255     .0

/26 = 26 ones in binary
11111111.11111111.11111111.11000000
255     .255     .255     .192

Calculating Network Details

Given: 192.168.1.0/24

1. Subnet Mask

/24 → 255.255.255.0

2. Network Address

First address in range: 192.168.1.0

3. Broadcast Address

Last address in range: 192.168.1.255

4. First Usable Host

192.168.1.1
(Network address + 1)

5. Last Usable Host

192.168.1.254
(Broadcast address - 1)

6. Number of Hosts

Formula: 2^(host bits) - 2

/24 → 32 - 24 = 8 host bits
2^8 - 2 = 256 - 2 = 254 usable hosts

(-2 for network and broadcast addresses)

Subnet Calculation Examples

Example 1: 192.168.1.0/24

Network:         192.168.1.0
Mask:            255.255.255.0
First Host:      192.168.1.1
Last Host:       192.168.1.254
Broadcast:       192.168.1.255
Total Hosts:     254

Example 2: 10.0.0.0/16

Network:         10.0.0.0
Mask:            255.255.0.0
First Host:      10.0.0.1
Last Host:       10.0.255.254
Broadcast:       10.0.255.255
Total Hosts:     65,534

Example 3: 192.168.1.128/25

Network:         192.168.1.128
Mask:            255.255.255.128
First Host:      192.168.1.129
Last Host:       192.168.1.254
Broadcast:       192.168.1.255
Total Hosts:     126

Note: This is the SECOND half of 192.168.1.0/24
First half:  192.168.1.0/25   (192.168.1.0 - 192.168.1.127)
Second half: 192.168.1.128/25 (192.168.1.128 - 192.168.1.255)

Example 4: 172.16.50.0/26

Network:         172.16.50.0
Mask:            255.255.255.192
First Host:      172.16.50.1
Last Host:       172.16.50.62
Broadcast:       172.16.50.63
Total Hosts:     62

Octet 4 breakdown (/26):
11000000 = 192 (mask)
00000000 to 00111111 (0-63 in decimal)
Network: 0, Broadcast: 63
Usable: 1-62

Subnetting a Network

Scenario: You have 192.168.1.0/24 and need 4 subnets

Step 1: Determine how many bits to borrow

4 subnets = 2^2 → Need 2 bits
/24 + 2 = /26

Step 2: Calculate new subnet mask

/26 = 255.255.255.192

Step 3: Determine block size

256 - 192 = 64
Each subnet has 64 addresses (62 usable hosts)

Step 4: List subnets

Subnet 1: 192.168.1.0/26   → 192.168.1.0 - 192.168.1.63
Subnet 2: 192.168.1.64/26  → 192.168.1.64 - 192.168.1.127
Subnet 3: 192.168.1.128/26 → 192.168.1.128 - 192.168.1.191
Subnet 4: 192.168.1.192/26 → 192.168.1.192 - 192.168.1.255

Each subnet details:

Subnet 1:
  Network:    192.168.1.0
  First Host: 192.168.1.1
  Last Host:  192.168.1.62
  Broadcast:  192.168.1.63
  Hosts:      62

Subnet 2:
  Network:    192.168.1.64
  First Host: 192.168.1.65
  Last Host:  192.168.1.126
  Broadcast:  192.168.1.127
  Hosts:      62
...

VLSM (Variable Length Subnet Mask)

VLSM allows different subnet sizes in the same network.

Scenario: Company needs:

  • Network A: 50 hosts
  • Network B: 25 hosts
  • Network C: 10 hosts

Starting with: 192.168.1.0/24

Network A (50 hosts):

Need: 2^6 = 64 addresses (- 2 = 62 usable)
Subnet: /26
Range: 192.168.1.0/26 → 192.168.1.0 - 192.168.1.63

Network B (25 hosts):

Need: 2^5 = 32 addresses (- 2 = 30 usable)
Subnet: /27
Range: 192.168.1.64/27 → 192.168.1.64 - 192.168.1.95

Network C (10 hosts):

Need: 2^4 = 16 addresses (- 2 = 14 usable)
Subnet: /28
Range: 192.168.1.96/28 → 192.168.1.96 - 192.168.1.111

Remaining:

192.168.1.112/28 through 192.168.1.255 still available

Supernetting (Route Aggregation)

Supernetting combines multiple networks into one larger network.

Example:

You have:
192.168.0.0/24
192.168.1.0/24
192.168.2.0/24
192.168.3.0/24

Supernet:
192.168.0.0/22

Covers: 192.168.0.0 - 192.168.3.255

Use case: Simplify routing tables

Subnet Cheat Sheet

CIDR  Mask              Block  Hosts
────  ────────────────  ─────  ──────
/8    255.0.0.0         16.7M  16,777,214
/16   255.255.0.0       65536  65,534
/24   255.255.255.0     256    254
/25   255.255.255.128   128    126
/26   255.255.255.192   64     62
/27   255.255.255.224   32     30
/28   255.255.255.240   16     14
/29   255.255.255.248   8      6
/30   255.255.255.252   4      2
/31   255.255.255.254   2      2 (point-to-point)
/32   255.255.255.255   1      1 (single host)

Subnetting in Pentesting

Reconnaissance:

Identify network ranges:

# Your IP: 192.168.1.100
# Mask: 255.255.255.0 (/24)

# Network range: 192.168.1.0 - 192.168.1.255

# Scan entire subnet
nmap -sn 192.168.1.0/24

# Fast way to discover all hosts

Different subnet size:

# IP: 10.50.100.50
# Mask: 255.255.0.0 (/16)

# Network range: 10.50.0.0 - 10.50.255.255

# That's 65,534 hosts!
# Scan entire subnet (will take time)
nmap -sn 10.50.0.0/16

Network Segmentation:

Understand network layout:

192.168.1.0/24    - User workstations
192.168.10.0/24   - Servers
192.168.100.0/24  - DMZ (public-facing)
192.168.200.0/24  - Management network

If you compromise:

  • 192.168.1.x: User network (pivot to servers)
  • 192.168.10.x: Server network (jackpot!)
  • 192.168.200.x: Management network (full control)

Subnet Tools

1. ipcalc (Linux)

# Install
apt install ipcalc

# Calculate subnet
ipcalc 192.168.1.0/24

# Output:
Address:   192.168.1.0
Netmask:   255.255.255.0 = 24
Wildcard:  0.0.0.255
Network:   192.168.1.0/24
HostMin:   192.168.1.1
HostMax:   192.168.1.254
Broadcast: 192.168.1.255
Hosts/Net: 254

2. sipcalc

# Install
apt install sipcalc

# Calculate
sipcalc 192.168.1.0/24

# Also shows IPv6 info

3. Online Calculators

4. Python Script

import ipaddress

network = ipaddress.ip_network('192.168.1.0/24')

print(f"Network: {network.network_address}")
print(f"Netmask: {network.netmask}")
print(f"Broadcast: {network.broadcast_address}")
print(f"Num hosts: {network.num_addresses - 2}")
print(f"First host: {network.network_address + 1}")
print(f"Last host: {network.broadcast_address - 1}")

# List all hosts
for ip in network.hosts():
    print(ip)

5. Bash One-Liner

# List all IPs in subnet
nmap -sL 192.168.1.0/24 | grep 'Nmap scan report' | awk '{print $5}'

Binary Subnetting (The Hard Way)

Example: Is 192.168.1.50 in the same subnet as 192.168.1.100/26?

Step 1: Convert to binary

192.168.1.50:
11000000.10101000.00000001.00110010

192.168.1.100:
11000000.10101000.00000001.01100100

Mask /26 (255.255.255.192):
11111111.11111111.11111111.11000000

Step 2: Apply mask to both

192.168.1.50 AND mask:
11000000.10101000.00000001.00110010
11111111.11111111.11111111.11000000
────────────────────────────────────
11000000.10101000.00000001.00000000 = 192.168.1.0

192.168.1.100 AND mask:
11000000.10101000.00000001.01100100
11111111.11111111.11111111.11000000
────────────────────────────────────
11000000.10101000.00000001.01000000 = 192.168.1.64

Result: Different networks!

  • 192.168.1.50 is in 192.168.1.0/26
  • 192.168.1.100 is in 192.168.1.64/26

Try It Yourself

Exercise 1: Basic Calculation

Given: 10.20.30.0/24

Calculate:

  • Subnet mask
  • First usable host
  • Last usable host
  • Broadcast address
  • Number of hosts
Answer
Subnet mask:     255.255.255.0
First host:      10.20.30.1
Last host:       10.20.30.254
Broadcast:       10.20.30.255
Hosts:           254

Exercise 2: Subnet Division

Divide 192.168.0.0/24 into 8 equal subnets.

What is the new subnet mask and the range of each subnet?

Answer
8 subnets = 2^3 → Borrow 3 bits
/24 + 3 = /27 (255.255.255.224)
Block size: 256 - 224 = 32

1. 192.168.0.0/27   → .0 - .31
2. 192.168.0.32/27  → .32 - .63
3. 192.168.0.64/27  → .64 - .95
4. 192.168.0.96/27  → .96 - .127
5. 192.168.0.128/27 → .128 - .159
6. 192.168.0.160/27 → .160 - .191
7. 192.168.0.192/27 → .192 - .223
8. 192.168.0.224/27 → .224 - .255

Exercise 3: Network Range

You're on IP 172.16.50.75 with mask 255.255.255.192.

What is:

  • Your network address?
  • The broadcast address?
  • Valid host range?
Answer
Mask: 255.255.255.192 = /26
Block size: 256 - 192 = 64

75 falls in range 64-127
Network:    172.16.50.64
Broadcast:  172.16.50.127
Range:      172.16.50.65 - 172.16.50.126

Exercise 4: Practical Scanning

# Find your subnet
# Linux
ip addr show

# Windows
ipconfig

# Example output:
# IP: 192.168.1.100
# Mask: 255.255.255.0

# Scan your entire subnet
nmap -sn 192.168.1.0/24

# How many hosts did you find?

Common Subnetting Mistakes

Mistake 1: Forgetting -2

Wrong:  /24 = 256 hosts
Right:  /24 = 254 usable hosts (network + broadcast excluded)

Mistake 2: Wrong Broadcast

Network: 192.168.1.128/25

Wrong broadcast:  192.168.1.255 (that's /24's broadcast)
Right broadcast:  192.168.1.255 (wait, that IS correct for /25!)

Actually: 192.168.1.128/25 broadcast is 192.168.1.255
But: 192.168.1.0/25 broadcast is 192.168.1.127

Mistake 3: Assuming /24

Just because it starts with 192.168 doesn't mean /24
Could be /16, /20, /22, etc.
Always check the subnet mask!

Resources

Calculators:

Practice:

Reading:

Next Steps

  1. Practice, practice, practice: Subnetting is a skill that requires repetition
  2. Learn VLSM: Variable-length subnet masks for efficient IP allocation
  3. Understand CIDR: Essential for modern networking
  4. Master binary: Helps with complex subnetting problems
  5. Apply to pentesting: Use subnetting knowledge during reconnaissance

Subnetting might seem intimidating at first, but it's a fundamental skill. Once you master it, network reconnaissance becomes much more efficient and effective!

"To subnet is to divide and conquer—both networks and pentests."

Up next

OSI Model

The seven layers of network communication.