Subnetting & CIDR
IntermediateSubnetting divides a network into smaller segments using a subnet mask. CIDR (Classless Inter-Domain Routing) notation /prefix replaces the rigid class system and enables flexible, efficient IP allocation.
Overview
The original IP address classes (Class A, B, C) wasted millions of addresses — a company needing 300 hosts was forced to take a Class B block of 65,534 hosts. CIDR, introduced in 1993, replaced this with flexible prefix-length notation: 192.168.1.0/24 means the first 24 bits are the network, last 8 bits are hosts (254 usable). A subnet mask defines which bits are network vs host — /24 corresponds to 255.255.255.0. Subnetting is the practice of dividing a large network block into smaller ones. For backend engineers, CIDR is everywhere: AWS VPC CIDR blocks, Kubernetes pod CIDRs, security group ingress rules, and firewall allow-lists all use CIDR notation. Being able to quickly calculate whether an IP falls within a CIDR range, how many hosts a subnet holds, and how to divide a VPC into subnets is an essential cloud engineering skill.
CIDR Notation and Subnet Calculation
The prefix length (/n) tells you how many bits are fixed as the network part. The remaining bits are for hosts. 2^(32-n) − 2 gives usable hosts (subtract network address and broadcast address).
// CIDR notation: IP/prefix
// 192.168.1.0/24
// Network: 192.168.1. (first 24 bits fixed)
// Hosts: .0 – .255 (last 8 bits variable)
// Usable: 192.168.1.1 – 192.168.1.254 (254 hosts)
// Network: 192.168.1.0 (reserved)
// Broadcast: 192.168.1.255 (reserved)
// Common subnet sizes:
// /8 → 16,777,214 hosts (255.0.0.0) — Class A equivalent
// /16 → 65,534 hosts (255.255.0.0) — Class B equivalent
// /24 → 254 hosts (255.255.255.0) — Class C equivalent
// /28 → 14 hosts (255.255.255.240) — small subnet, cloud common
// /30 → 2 hosts (255.255.255.252) — point-to-point links
// /32 → 1 host (255.255.255.255) — single IP (security group rule)
// Hosts formula: 2^(32 - prefix) - 2
// /24 → 2^8 - 2 = 254
// /28 → 2^4 - 2 = 14
// /30 → 2^2 - 2 = 2
// Java: check if IP is in a CIDR range
InetAddress ip = InetAddress.getByName("192.168.1.50");
InetAddress network = InetAddress.getByName("192.168.1.0");
int prefix = 24;
byte[] ipBytes = ip.getAddress();
byte[] netBytes = network.getAddress();
int mask = 0xFFFFFFFF << (32 - prefix);
int ipInt = ByteBuffer.wrap(ipBytes).getInt();
int netInt = ByteBuffer.wrap(netBytes).getInt();
boolean inSubnet = (ipInt & mask) == (netInt & mask); // trueSubnetting a VPC — Practical Example
Cloud VPCs are allocated a CIDR block and then divided into subnets — typically public (internet-facing) and private (internal services). The subnet design directly affects routing, security, and scalability.
// AWS VPC design example:
// VPC CIDR: 10.0.0.0/16 (65,534 usable IPs)
//
// Divide into subnets by Availability Zone and tier:
//
// Public subnets (internet-facing load balancers):
// 10.0.0.0/24 → AZ-1a (254 hosts)
// 10.0.1.0/24 → AZ-1b (254 hosts)
//
// Private subnets (application servers, ECS tasks):
// 10.0.10.0/24 → AZ-1a (254 hosts)
// 10.0.11.0/24 → AZ-1b (254 hosts)
//
// Database subnets (RDS, ElastiCache — no internet route):
// 10.0.20.0/28 → AZ-1a (14 hosts)
// 10.0.21.0/28 → AZ-1b (14 hosts)
// Security group ingress rule using CIDR:
// Allow HTTPS from anywhere: 0.0.0.0/0 port 443
// Allow DB from app subnet only: 10.0.10.0/24 port 5432
// Allow SSH from office only: 203.0.113.0/30 port 22
// Kubernetes pod CIDR (separate from node CIDR):
// Nodes: 10.0.0.0/16
// Pods: 172.16.0.0/16 (each node gets a /24 from this range)
// Services: 10.96.0.0/12 (ClusterIP range)Key Points to Remember
- 1CIDR /n means n bits are the network prefix; remaining 32-n bits are for hosts.
- 2Usable hosts per subnet = 2^(32-n) − 2 (minus network address and broadcast).
- 3/24 → 254 hosts, /28 → 14 hosts, /30 → 2 hosts, /32 → single IP.
- 4Subnet mask and CIDR prefix are equivalent: /24 = 255.255.255.0.
- 5Cloud VPCs are divided into public, private, and database subnets across Availability Zones.
- 6Security group rules use CIDR notation to allow/deny traffic from specific IP ranges.
Interview Questions
Sign in to ask AriaHow many usable hosts are in a /24 subnet?
What is the difference between a subnet mask and a CIDR prefix?
You have a 10.0.0.0/16 VPC. How would you divide it into public and private subnets across two AZs?
Is 10.0.1.50 in the subnet 10.0.1.0/28?
Why do Kubernetes pods get their own CIDR range separate from nodes?
Ask Aria about Subnetting & CIDR
Your personal AI tutor — ask anything about this concept
Revision Status
Personal Notes
Sign in to save personal notes for this topic.
Discussion
Sign in to join the discussion.