Subnetting Explained — CIDR, VLSM, and How to Calculate Subnets Fast

Subnetting is not a trick or an obscure skill — it is arithmetic with a fixed, learnable pattern. Once the pattern clicks, subnetting questions go from the scariest part of an exam to the fastest points available, because unlike a scenario question, there is exactly one correct answer and a mechanical way to reach it. This is the single most-tested skill on CompTIA Network+, appears throughout Cisco CCNA, and shows up in a lighter form even on cloud certifications where VPC and subnet sizing decisions matter.

The mental model

An IPv4 address is 32 bits, split conceptually into a network portion and a host portion. The network portion identifies which network an address belongs to; the host portion identifies a specific device on that network. Subnetting means moving the boundary between those two portions — borrowing bits from the host side to create more, smaller networks, at the cost of fewer possible hosts per network.

Think of it like a postal address: the network portion is the street, the host portion is the house number. Subnetting is deciding to split one long street into several shorter streets, each with its own name — you gain more distinct streets, but each one has fewer house numbers to hand out.

CIDR notation explained

CIDR (Classless Inter-Domain Routing) notation writes the network-portion length as a number after a slash: 192.168.1.0/24 means the first 24 bits (of 32 total) are the network portion, leaving 8 bits for hosts. This is equivalent to the subnet mask 255.255.255.0 — CIDR notation and dotted-decimal subnet masks describe the exact same boundary, just written differently. The exam expects you to convert fluently between both notations.

The formula that solves every question

Three steps, every time:

1. Host bits = 32 − CIDR prefix
2. Total addresses = 2^{host bits}
3. Usable hosts = total addresses − 2 (subtracting the network address and the broadcast address)

That subtract-2 step is where most points are lost on exam day — not because the math is hard, but because it is easy to forget under time pressure, or to apply when the question actually asked for total addresses, not usable hosts. Read the question stem twice before committing to an answer.

Worked example: /26

Worked example: /28

Notice the pattern: each subnet's size (16 addresses here) is also the “block size” you add to find the next subnet's starting address — the next /28 after 10.0.5.16/28 starts at 10.0.5.32. This block-size shortcut is faster than recalculating from scratch for consecutive subnets.

Network address vs broadcast address

Every subnet reserves exactly two addresses that no host can use: the network address (all host bits set to 0 — identifies the subnet itself, used in routing tables) and the broadcast address (all host bits set to 1 — a single address that reaches every host on that subnet at once). This is why the formula always subtracts 2. The only IPv4 exceptions are /31 (point-to-point links, both addresses usable per RFC 3021, no network/broadcast reserved) and /32 (a single host route, not really a "subnet" in the usual sense).

VLSM — sizing subnets to actual need

Variable Length Subnet Masking (VLSM) means carving different-sized subnets out of the same address block instead of using one fixed size everywhere. Real networks have wildly different host requirements per segment — a server VLAN might need 50 addresses, a point-to-point router link needs exactly 2. VLSM assigns each subnet only as many addresses as it needs, largest to smallest, avoiding the address waste a flat subnet size would cause.

The rule: always allocate largest-need-first. If you assign small subnets first, you can accidentally fragment the address space so the larger subnet you need later no longer fits in one contiguous block. This ordering trap is a common CCNA design-scenario question.

How this differs in IPv6

The concept transfers — borrowing bits to create smaller networks — but the practice looks different. IPv6 has no broadcast address at all (multicast covers that use case), address space is vast enough that conservation is not the driving concern it is in IPv4, and the common real-world convention is allocating uniform /64 subnets rather than VLSM-style variable sizing. Exam questions on IPv6 addressing tend to focus on address typerecognition (global unicast, link-local, unique local) rather than subnetting math.

Common misconceptions

• “Usable hosts and total addresses are the same thing.” False — always subtract 2 unless the question explicitly asks for total addresses in the block.
• “A /24 always means a class C-style network.” False — classful addressing (Class A/B/C) is obsolete. CIDR lets any prefix length apply to any address range.
• “VLSM subnets need to be assigned in address order.” False — they need to be assigned largest-need-first to avoid fragmentation, not in numeric address order.
• “/31 always wastes 2 addresses like every other prefix.” False — /31 is a documented exception for point-to-point links where both addresses are usable.

How to get fast at this

Speed comes from pattern memorization, not re-deriving the formula every time. Memorize the total-addresses column for /24 through /30 (256, 128, 64, 32, 16, 8, 4) so you recognize them instantly. Then practice timed: aim to answer a "given this CIDR, what are the usable hosts and broadcast address" question in under 45 seconds without scratch paper. That speed threshold is what separates comfortable exam pacing from running out of time on the last stretch of questions.

How this is tested across certifications

Subnetting is the connective tissue across nearly every entry-to-associate-level networking and security certification:

• CompTIA Network+ — the single most-tested skill on the exam, reused across Domains 1, 2, 4, and 5. Full breakdown: Network+ Exam Guide.
• Cisco CCNA — tested at similar depth plus VLSM network-design scenarios, since CCNA expects you to design address schemes, not just calculate given ones. See Network+ vs CCNA.
• CompTIA Security+ — tested indirectly through network segmentation and firewall-rule scenario questions that assume you can read CIDR notation fluently.
• Cloud certifications (AWS, Google Cloud, Azure) — a lighter version, sizing VPC and subnet CIDR blocks, though cloud providers reserve additional addresses per subnet beyond the standard network/broadcast pair (AWS reserves 5, for example).

Frequently asked questions