The Complete IPv4 & IPv6 Subnetting & CIDR Architecture Guide
Subnetting is the fundamental mathematical technique used in computer networking to divide a large physical or virtual network into smaller, logically organized sub-networks (subnets). By partitioning IP address spaces, network architects enhance security through access-control isolation, contain broadcast storms, reduce latency, and ensure maximum conservation of IPv4 addresses. Understanding Classless Inter-Domain Routing (CIDR) and bitwise subnet masks is an indispensable prerequisite for network engineers, cloud infrastructure architects (AWS VPC, Azure VNet, Google Cloud VPC), and cybersecurity professionals.
1. Mathematical Foundations of IPv4 Subnetting
An IPv4 address consists of 32 binary bits arranged into four 8-bit bytes called octets, separated by periods (e.g., 192.168.1.1). Every IP address is fundamentally divided into two segments: the Network Prefix (which identifies the subnet) and the Host Identifier (which identifies the individual interface or host on that subnet).
- Bitwise AND Operation: A router determines the network address by performing a logical bitwise AND between the 32-bit IP address and the 32-bit subnet mask. Wherever the mask bit is
1, the IP bit is preserved; wherever the mask bit is0, the result is forced to0. - Total Host Formula: If a subnet mask reserves
hhost bits (whereh = 32 - CIDR), the total number of IP addresses in the subnet is2^h. - Usable Host Formula: In standard IPv4 networking, two addresses are reserved and cannot be assigned to endpoints: the Network Address (where all host bits are binary
0) and the Broadcast Address (where all host bits are binary1). Therefore, the number of usable hosts is2^h - 2. - Point-to-Point /31 Subnets (RFC 3021): For direct router-to-router point-to-point serial links, RFC 3021 eliminates dedicated network and broadcast addresses, allowing both addresses in a
/31block to be assigned to the two peer router interfaces, conserving vast blocks of IPv4 space.
2. Private IP Spaces (RFC 1918) vs. Public Routing
To prevent premature exhaustion of the global 4.29 billion IPv4 address pool, the Internet Engineering Task Force (IETF) designated three private IPv4 blocks under RFC 1918 that are guaranteed never to be routed on the public internet:
- 10.0.0.0/8 (Class A Private): Range:
10.0.0.0to10.255.255.255(16,777,216 total addresses). Ideal for large enterprise campus networks, global WANs, and cloud multi-tier VPC topologies. - 172.16.0.0/12 (Class B Private): Range:
172.16.0.0to172.31.255.255(1,048,576 addresses across 16 contiguous /16 blocks). Frequently used in mid-sized enterprise networks, virtualization clusters, and Docker/Kubernetes container overlays. - 192.168.0.0/16 (Class C Private): Range:
192.168.0.0to192.168.255.255(65,536 addresses across 256 contiguous /24 blocks). Standard default for home routers, small-office/home-office (SOHO) Wi-Fi networks, and lab benches. - 100.64.0.0/10 (Carrier-Grade NAT / CGNAT - RFC 6598): Range:
100.64.0.0to100.127.255.255(4,194,304 addresses). Used by ISPs to aggregate multiple residential subscribers behind shared public IPv4 gateways.
3. IPv6 Architecture & The Mandatory /64 Prefix
IPv6 replaces IPv4's 32-bit limitation with a massive 128-bit address space, representing 2^128 (approximately 340 undecillion) unique addresses. IPv6 addresses are written as eight groups of four hexadecimal digits (hextets) separated by colons.
- Global Routing Prefix (Typically /48 to /56): Assigned by Regional Internet Registries (RIRs) and ISPs to enterprises and organizations.
- Subnet Identifier (Bits 48 through 64): Gives an enterprise up to 65,536 distinct
/64subnets from a single/48assignment. - Interface Identifier (Bits 64 through 128): RFC 4291 mandates that standard subnets use a
/64prefix to allow Stateless Address Autoconfiguration (SLAAC). Each individual/64subnet contains18,446,744,073,709,551,616unique host addresses.
4. Cloud VPC Subnetting (AWS, Azure & GCP)
When architecting subnets in major cloud environments such as Amazon Web Services (AWS VPC), Microsoft Azure Virtual Networks, and Google Cloud Platform (GCP VPC), cloud providers reserve additional IP addresses within each subnet for hypervisor infrastructure services:
.0: Network address..1: VPC router / default gateway address..2: DNS resolver service (Amazon Provided DNS or Azure DNS)..3: Cloud internal management or broadcast emulation..255: Network broadcast address.
Consequently, in an AWS VPC, a /24 subnet provides 251 usable host IP addresses rather than the traditional on-premise count of 254. Keep this cloud reserve in mind when sizing subnets for Kubernetes node pools or elastic load balancer clusters.