Subnetting with CIDR - Part 2: Design Practice

Subnetting with CIDR — Part 2: Design Practice

What you'll learn

• Size a subnet from a host-count requirement (and remember the addresses beginners forget to count)
• Design a complete addressing plan for a multi-department office from a single /24
• Allocate different-sized subnets without gaps or collisions using the largest-first rule
• Verify a plan by checking alignment and overlaps before anything is configured
• Judge growth room and know when a plan needs to be rebuilt rather than patched

This lesson builds on Chapter 6 of Dr. Tahseen Al-Doori's Network Essentials. The chapter demonstrates subnetting with one clean example — taking the 172.20.0.0 network from a /16 mask to a /24, trading one giant 65,536-address network for 256 manageable ones — and offers a memorable image for it: subnetting is slicing a pie into portions you can actually serve. Part 1 taught you how the knife works. This lesson is about deciding where to cut.

From splitting to sizing

Part 1's arithmetic ran forward: given a prefix, how many subnets and how many hosts? Design runs it backward: given a required number of hosts, what is the smallest prefix that fits?

The tool is one formula. A subnet with h host bits contains 2^h addresses, of which two are never assignable — the network address (all host bits 0, the subnet's name) and the broadcast address (all host bits 1, the everyone-here address). So:

usable hosts = 2^h − 2, and the prefix length is 32 − h.

Here is the sizing ladder you will use for the rest of your career. Read it bottom-up when sizing: find the first row whose usable count covers your need.

Now the mistake that ruins more first designs than any arithmetic slip: count every address consumer, not just the computers. A department of 25 PCs also needs an address for the router interface that serves as the subnet's default gateway — and often for a printer, a wireless access point, a networked scanner. The professional habit is: take the stated device count, add one for the gateway, add any known infrastructure, and then consult the ladder. A "25-host" department is really 26 addresses minimum before you have added a single printer.

One more design instinct worth naming: the smallest prefix that fits is not automatically the right answer. It is the floor. Whether to buy one size up is a judgment call about growth, and we will return to it after the worked example.

The alignment rule and largest-first

When a plan mixes subnet sizes — and real plans almost always do; the practice is called VLSM (variable-length subnet masking), carving slices of different widths from one block — two rules keep the slices from colliding.

Rule 1 — alignment. A subnet can only begin at a multiple of its own size. A /26 spans 64 addresses, so within a /24 it may start only at .0, .64, .128 or .192. A /27 (32 addresses) may start at .0, .32, .64, .96, .128, .160, .192 or .224. A /28 (16 addresses) at any multiple of 16. An address like 192.168.10.48 can never be the network address of a /26 — 48 is not a multiple of 64, so a "/26 at .48" would be a slice cut mid-slice.

Rule 2 — largest first. Allocate the biggest subnet at the bottom of the block, then the next biggest immediately after it, and so on. Because every allocation's size is a power of two, each subnet ends exactly where a valid start for the next one begins — no gaps, no misalignment, and all the free space stays together in one contiguous run at the top, where it is most useful later. Allocate small subnets first and you fragment the block: the leftovers end up scattered in pieces too small to hold the big subnet you still owe.

Worked design: a four-department office

Here is the scenario — keep your work, because the Module 9 capstone asks you to do this for a whole company, and this plan is your dress rehearsal.

Step 1 — size each subnet. Add one gateway address to each stated count, then find the floor on the ladder:

Notice Engineering: 61 needed, 62 available. It fits — with one seat to spare. Hold that thought; it is the growth discussion waiting to happen.

Step 2 — allocate, largest first. /26, then the two /27s, then the /28, each starting exactly where the previous one ended:

The gateway convention here — first usable address in each subnet — is not a law, just the most common house style. Pick one convention and never deviate; future-you, troubleshooting at midnight, will be grateful.

Step 3 — read what's left. Addresses .144 through .255 remain: 112 addresses of contiguous free space, carveable as a /28 at .144, a /27 at .160 and a /26 at .192 — or other combinations. That single unbroken run is the largest-first rule paying off.

Checking your work: overlaps and alignment

Never hand over a plan you have not verified. The check takes two minutes.

Alignment check. For each subnet, confirm the network address is a multiple of the block size. 0 ÷ 64 ✓ · 64 ÷ 32 ✓ · 96 ÷ 32 ✓ · 128 ÷ 16 ✓. All aligned.

Overlap check. Sort subnets by network address and confirm each one's broadcast address is below the next one's network address: 63 < 64 ✓ · 95 < 96 ✓ · 127 < 128 ✓. No subnet reaches into its neighbor.

To see what failure looks like, suppose someone had placed Sales at 192.168.10.32/27 — the arithmetic of that subnet is internally fine (.32 is a multiple of 32; hosts .33–.62; broadcast .63). But Engineering's /26 spans .0 through .63, so every Sales address would sit inside Engineering's range. Two subnets, one territory: hosts in the overlap would be unreachable from one side or the other, and the failures would look random. Overlaps are the land-mine error of addressing plans — invisible in each row, obvious only when rows are compared. That is exactly why the check compares rows.

Planning for growth

Look again at Engineering: 61 of 62 addresses committed on day one. The plan works, and would score full marks on an exam — and a working engineer would reject it. One new hire, one extra printer, and the subnet is full; the fix at that point is renumbering a 60-host department, which is days of disruptive work. Growth is cheapest to buy at design time.

Three habits professionals apply:

• Ask about the future, not the present. "60 hosts" should trigger the question: what is the headcount in two years? Many shops size at roughly double the current need when space allows.
• Prefer one size up when the block can afford it. Here it can: an alternative plan gives Engineering a /25 (.0–.127, 126 usable), then Sales /27 at .128, Guest /27 at .160, Servers /28 at .192 — still leaving .208–.255 free. Total cost: 64 of the free addresses. Insurance is rarely this cheap.
• Keep free space contiguous and documented. A plan document that shows what is free is as valuable as one that shows what is used.

When growth does overflow a subnet despite planning, the honest options are: renumber into a larger subnet from your free space, or add a second subnet for the department and route between them. Both work; neither is fun; a growth-aware design postpones both.

Worksheet: Subnetting Workbook B

Twelve graded exercises in three sets — warm-up, core, design. Do them on paper, exactly as you would in a job interview: no calculator apps, just the sizing ladder and powers of two. Answers follow the exercises; grade yourself honestly. The same set, with extra practice rounds, is in Download: Subnetting Workbook B.

Set 1 — warm-up (sizing and masks).

1. How many usable host addresses does a /28 provide?
2. A subnet must accommodate 45 addresses in use (devices plus gateway). What is the smallest prefix that fits, and why is /27 not enough?
3. A point-to-point link between two routers needs exactly 2 usable addresses. Which prefix wastes the least?
4. Write /27 as a dotted-decimal mask.

Set 2 — core (ranges and membership).

5. For 192.168.50.96/27, give the network address, first and last usable hosts, and the broadcast address.
6. Are 10.4.7.100/25 and 10.4.7.200/25 on the same subnet? Show how you know.
7. A department needs 100 hosts plus a gateway. What is the smallest prefix, and how many spare seats does it leave?
8. Split 172.16.40.0/24 into four equal subnets. List the four network addresses with their prefix, and the usable host count of each.

Set 3 — design (the real skill).

9. Do 192.168.20.64/26 and 192.168.20.96/27 overlap? Prove your answer with both ranges.
10. Can 192.168.30.48 be the network address of a /26? Why or why not?
11. You are given 10.10.10.0/25. Fit three subnets — A needs 50 addresses, B needs 20, C needs 10 — using largest-first. Give each subnet's network, prefix, host range and broadcast, and state what remains free.
12. Your Engineering subnet is 192.168.10.0/26 with 61 of 62 addresses in use. Management forecasts 10 more staff this year. Evaluate the options and recommend one.

Deliverable. Worked answers for all twelve, showing the arithmetic — an answer without its working is half an answer.

Self-check (answers).

1. 14 (16 total − network − broadcast).
2. /26 — 62 usable ≥ 45. A /27 offers only 30 usable, well short.
3. /31 — 2 addresses, both usable, zero waste. RFC 3021 defines this special case for point-to-point links: with exactly two ends there is nobody to broadcast to, so the usual network/broadcast reservation is dropped and both addresses go to the routers. The traditional answer, /30 (4 total, 2 usable, 2 spent on network ID and broadcast), is still valid and still what you will most often meet in existing networks — but it wastes half the block, so it is not the prefix that "wastes the least".
4. 255.255.255.224 (27 ones: three full octets plus 3 bits = 224).
5. Network 192.168.50.96 · hosts .97 through .126 · broadcast 192.168.50.127.
6. No. A /25 splits the last octet at .128: one subnet spans .0–.127, the other .128–.255. Host .100 is in the lower half, .200 in the upper — different subnets, so they need a router to talk.
7. 101 addresses needed → /25 (126 usable), leaving 25 spare seats. A /26's 62 is too small.
8. 172.16.40.0/26, 172.16.40.64/26, 172.16.40.128/26, 172.16.40.192/26 — 62 usable hosts each.
9. Yes. The /26 spans .64–.127; the /27 spans .96–.127. The entire /27 sits inside the /26's territory — a full overlap.
10. No. A /26 block is 64 addresses wide and must start at a multiple of 64 (.0, .64, .128, .192). 48 is not one of them.
11. A: 10.10.10.0/26, hosts .1–.62, broadcast .63. B: 10.10.10.64/27, hosts .65–.94, broadcast .95. C: 10.10.10.96/28, hosts .97–.110, broadcast .111. Free: .112–.127 (one /28).
12. 61 + 10 = 71 > 62, so the /26 cannot hold the future department — patching is not an option. Best move now, while the neighboring space is still free: renumber Engineering to a /25 (126 usable) in a revised plan, shifting the smaller subnets up (as in this lesson's alternative layout). A second Engineering subnet with routing between the halves also works but splits one team across two broadcast domains permanently. Recommend the /25 — and recommend it before the hires arrive.

Scoring: 11–12 correct — you are capstone-ready. 8–10 — rework the misses; note which set they cluster in. Below 8 — redo Part 1's workbook A first; the mechanics need to be automatic before design can be.

Check yourself

1. In the worked office plan, a colleague proposes moving Guest Wi-Fi to 192.168.10.32/27 "to keep it near the bottom." What exactly breaks, and which two-minute check catches it?
2. The Servers subnet (192.168.10.128/28) currently uses 11 of its 14 usable addresses. The company wants to add a NAS, a backup appliance and one virtualization host. Does the plan survive, and what do you tell the owner?
3. Why does the largest-first rule allocate Engineering before Sales, rather than working alphabetically or smallest-first?
4. A Sales printer was hand-configured as 192.168.10.95 with mask 255.255.255.224 and nobody can print. Diagnose from the plan tables.
5. An intern says: "Engineering needs 61 addresses and /26 gives 62 — perfect fit, zero waste, best design." Give the professional counter-argument in two sentences.

Answers

1. The /27 at .32 spans .32–.63, which lies entirely inside Engineering's /26 (.0–.63) — an overlap. The overlap check catches it: sort by network address and compare each broadcast with the next network; Engineering's broadcast (.63) would not be below the proposed Sales/Guest network (.32).
2. 11 + 3 = 14 — it fits exactly, with zero seats left. Tell the owner: the addition works today, but the subnet is now full; the next device forces a renumber, so schedule a move to a larger server subnet (there is a free /27 at .160) before it is urgent.
3. Because of alignment: large blocks have the fewest legal starting points, so they claim space first while all aligned positions are still free. Each power-of-two allocation then ends exactly where the next one may legally begin, keeping leftovers contiguous. Small-first fragments the block and can leave no aligned gap wide enough for the big subnet.
4. 192.168.10.95 is the broadcast address of the Sales /27 (.64–.95) — one of the two addresses that can never be assigned to a device. The printer must be renumbered to a free host address in .65–.94.
5. A perfect fit today is a guaranteed failure tomorrow: one hire or one printer overflows the subnet, and the remedy — renumbering a whole department — costs days. Growth room bought at design time costs only free addresses, which this block has in abundance.

Key terms

• VLSM (variable-length subnet masking) — carving one address block into subnets of different sizes to match different needs.
• Sizing ladder — the prefix-to-usable-hosts table (/30 → 2 up to /24 → 254) used to pick the smallest fitting subnet.
• Usable hosts — 2^h − 2: every address except the network and broadcast addresses.
• Network address — all host bits 0; names the subnet; never assigned to a device.
• Broadcast address — all host bits 1; addresses everyone in the subnet; never assigned to a device.
• Alignment rule — a subnet may only start at a multiple of its own size.
• Largest-first allocation — placing the biggest subnets at the bottom of the block so slices pack without gaps or fragmentation.
• Overlap check — verifying, in sorted order, that each subnet's broadcast is below the next subnet's network address.
• Gateway convention — a fixed house style for gateway addresses (commonly the first usable) applied to every subnet.
• Renumbering — reassigning a live subnet's addresses to a new range; the expensive consequence a growth-aware design avoids.

Summary

• Design inverts Part 1's arithmetic: from required hosts, find the smallest prefix with 2^h − 2 ≥ need — then treat that as a floor, not the answer.
• Count every address consumer: devices plus the gateway plus known infrastructure, before consulting the ladder.
• Subnets start only at multiples of their own size; allocating largest-first packs them without gaps and keeps free space contiguous.
• The four-department plan: Engineering 192.168.10.0/26, Sales .64/27, Guest Wi-Fi .96/27, Servers .128/28, with .144–.255 free — verified for alignment and overlaps.
• Overlapping subnets are the classic silent design error; the sorted broadcast-versus-next-network check exposes them in minutes.
• Growth is cheapest at design time: near-full subnets (Engineering at 61 of 62) are a flag to buy one size up while space is free.
• This plan is your capstone rehearsal — Module 9's design project asks for exactly this work at company scale.

Next lesson

You have drawn the borders on the map. Next: how a single computer uses that map — the default gateway, the routing table inside your own machine, and the one-line rule that decides whether a packet stays home or leaves.

Sources and further study

• Al-Doori, T., Network Essentials, Chapter 6 — subnetting, the 172.20.0.0 /16-to-/24 example, and the pie image this lesson extends into design practice.
• RFC 4632, "Classless Inter-domain Routing (CIDR)" — https://www.rfc-editor.org/rfc/rfc4632 — the standard behind prefix-based addressing (BCP 122).
• RFC 1918, "Address Allocation for Private Internets" — https://www.rfc-editor.org/info/rfc1918/ — why 192.168.10.0/24 is free for you to design with (formally introduced in two lessons).
• Download: Subnetting Workbook B (this lesson's twelve exercises plus additional practice rounds with full worked solutions).