Complete Guide to IPv4 & IPv6 Subnetting, CIDR & Network Architecture
Subnetting is the fundamental practice of dividing a large computer network into two or more smaller, isolated physical or logical networks. In computer networking (RFC 791 and RFC 1519), internet protocols identify hosts and route packets using 32-bit (IPv4) or 128-bit (IPv6) numerical identifiers. Without subnetting, every connected workstation, server, and IoT device in an organization would share a single flat broadcast domain, leading to catastrophic broadcast storms, routing table exhaustion, and critical security vulnerabilities.
1. The Evolution: Classful Addressing vs Classless Inter-Domain Routing (CIDR)
In the early 1980s, the original ARPANET and DARPA Internet assigned IP addresses according to rigid architectural classes based on the first octet bits:
- Class A (0.0.0.0 – 127.255.255.255): 8 network bits (/8 prefix), allocating over 16.7 million usable host addresses per organization. Reserved for massive organizations like IBM, MIT, and General Electric.
- Class B (128.0.0.0 – 191.255.255.255): 16 network bits (/16 prefix), allocating exactly 65,534 usable hosts per network block.
- Class C (192.0.0.0 – 223.255.255.255): 24 network bits (/24 prefix), allocating only 254 usable hosts. Too small for medium corporations, forcing them to request multiple Class B blocks.
- Class D (224.0.0.0 – 239.255.255.255): Multicast groups (OSPF, RIPv2, streaming).
- Class E (240.0.0.0 – 255.255.255.255): Experimental research (RFC 1112).
Because organizations needing 500 IP addresses were assigned full /16 blocks with 65,000 wasted IPs, the global IPv4 address pool faced imminent exhaustion by 1993. The Internet Engineering Task Force (IETF) solved this crisis by publishing RFC 1518 and RFC 1519: Classless Inter-Domain Routing (CIDR). CIDR abolished rigid /8, /16, and /24 class boundaries, allowing network administrators to segment address space at arbitrary bit increments (/1 to /32).
2. The Mathematical Anatomy of an IPv4 Subnet Mask
An IPv4 address consists of 32 binary bits divided into four 8-bit octets separated by decimal dots. A subnet mask serves as a binary filter that dictates which portion represents the Network ID (identifying the subnet itself) and which portion represents the Host ID (identifying the specific device interface on that subnet).
To compute the Network ID mathematically, router hardware performs a bitwise logical AND operation between the 32-bit IP address and the 32-bit Subnet Mask:
ext{Network ID} = ext{IP Address} land ext{Subnet Mask}
For instance, if host IP 192.168.1.130 has subnet mask 255.255.255.192 (/26):
- IP in Binary: 11000000.10101000.00000001.10000010
- Mask in Binary: 11111111.11111111.11111111.11000000
- Bitwise AND Result (Network ID): 11000000.10101000.00000001.10000000 = 192.168.1.128
- Broadcast Address (Host bits set to 1): 11000000.10101000.00000001.10111111 = 192.168.1.191
3. Host Capacity Formulas & RFC Exceptions (/31 and /32)
The total number of IP addresses contained in any IPv4 subnet is calculated as $2^H$, where $H = 32 - ext{Prefix Length}$. Under traditional RFC 791 rules, two addresses are reserved and cannot be assigned to hosts:
- Network Address (Host bits all 0): Identifies the subnet route in routing tables.
- Broadcast Address (Host bits all 1): Sends packets to every active interface on the subnet simultaneously.
- Usable Hosts Formula: $ ext{Usable Hosts} = 2^{(32 - P)} - 2$
However, modern networking standards introduce two critical exceptions:
- RFC 3021 (/31 Subnets): Specifically created for point-to-point router links. Because only two hosts exist on the wire (Router A and Router B), directed broadcast is unnecessary. Both addresses are fully usable host interfaces ($2^1 = 2$ hosts), conserving millions of IPv4 addresses across telecom backbones.
- /32 Host Routes: Represents a single host machine or loopback interface ($2^0 = 1$ address). Used extensively in BGP Anycast routing, Kubernetes cluster service IPs, and VPN client tunnels.
4. RFC 1918 Private Ranges vs Carrier-Grade NAT (RFC 6598)
To prevent private intranets from conflicting with the public internet routing table, the IETF reserved three dedicated private address scopes under RFC 1918:
- 10.0.0.0/8: 10.0.0.0 – 10.255.255.255 (16,777,216 addresses) — Standard for enterprise data centers and cloud VPCs.
- 172.16.0.0/12: 172.16.0.0 – 172.31.255.255 (1,048,576 addresses) — Commonly used in virtualization environments and Docker bridges.
- 192.168.0.0/16: 192.168.0.0 – 192.168.255.255 (65,536 addresses) — Standard for residential Wi-Fi routers and small office networks.
Additionally, RFC 6598 (100.64.0.0/10) specifies Carrier-Grade NAT (CGNAT) or Shared Address Space. Cellular telecoms (5G/4G LTE) and residential ISPs use CGNAT to connect millions of mobile handsets to the internet through shared public IPv4 gateways without colliding with customer home networks.
5. Cloud Architecture Best Practices: AWS VPC, Azure VNet & Kubernetes CIDR Design
In modern DevOps and cloud engineering, improper CIDR allocation is one of the most expensive architectural mistakes to fix. Re-architecting overlapping VPC subnets after microservices are deployed requires painful cross-account peering downtime. Follow these production rules:
- Allocate Large Parent VPCs: Standardize cloud VPCs on a /16 prefix (e.g. 10.100.0.0/16 = 65,536 IPs), allowing room for multi-region expansion without IP overlaps.
- Multi-Availability Zone (AZ) Segmentation: Divide your VPC into dedicated tiers across at least 3 Availability Zones:
- Public Subnets (/24): Internet-facing ALBs and NAT Gateways.
- Private App Subnets (/22): Kubernetes EKS/GKE nodes and ECS microservices (1,022 IPs per AZ).
- Isolated Database Subnets (/24): RDS PostgreSQL/MySQL clusters with zero internet gateway route.
- Account for Cloud Provider Reservations: Amazon AWS and Google Cloud reserve the first 4 and last 1 IP address in every subnet (Network ID, VPC Router, DNS Resolver, Future Use, and Broadcast), meaning a /28 subnet provides only 11 usable IPs, not 14.