LFCE 8 🐧 Subnetting — Concepts and Practice - KandZ

⏱️ Estimated read: 12 min | |

Subnetting is the operation that turns a single allocated address block into multiple logical networks. It is the practical application of the classless addressing model examined in the previous chapter: you take a prefix, extend the network portion by borrowing bits from the host portion, and produce smaller prefixes within the original range. For the LFCE candidate, subnetting is not an academic exercise. The networking objectives include configuring a system to route IP traffic dynamically, and every routing decision depends on correct prefix lengths, network addresses, and host ranges . A routing daemon configured with the wrong mask will advertise unreachable networks or silently drop traffic.

This chapter covers the mechanics of subnetting: the formulas that determine subnet count and host capacity, the arithmetic that produces network addresses and broadcast addresses, the increment method for enumerating subnets, and the Linux tools that verify your calculations. The goal is fluency—the ability to look at a prefix like 192.168.1.0/26 and immediately know its range, its broadcast address, and its usable host count.

Key point: Subnetting borrows bits from the host portion and adds them to the network portion. Each borrowed bit doubles the subnet count and halves the host capacity. The formula for usable hosts is 2^h − 2, where h is the number of remaining host bits; the subtraction accounts for the network address and the broadcast address, neither of which can be assigned to a host.

Why subnetting exists

The separation problem.

A single flat network allows every device to reach every other device directly. This is acceptable in a small lab. It is unacceptable in any environment where different populations require different policies. A school with students, faculty, and administration on one subnet cannot apply firewall rules between them without inspecting every packet individually . Subnetting creates boundaries. Students in 10.0.1.0/24, faculty in 10.0.2.0/24, administration in 10.0.3.0/24—now a router sits between them, and access control becomes a routing decision rather than a packet-filtering afterthought.

The broadcast domain problem.

Every device on a subnet receives every broadcast frame. In a /16 with 65,534 hosts, that is 65,534 devices processing every ARP request and every DHCP discovery. The broadcast traffic consumes bandwidth and CPU on hosts that have no interest in the broadcast. Subnetting reduces the broadcast domain to the size of the subnet. A /26 with 62 hosts generates far less broadcast noise than a /16 containing the same devices . This is why access layer design almost always uses /24 or smaller: the broadcast domain should match the organizational unit.

The address efficiency problem.

An organization with 800 hosts that receives a /22 has 1,022 usable addresses. If it assigns all 800 hosts to a single flat subnet, it wastes 222 addresses and creates a broadcast domain larger than necessary. If it subdivides the /22 into four /24 subnets of 254 hosts each, it can distribute the hosts across smaller broadcast domains, reserve one subnet for infrastructure, and still have room for growth. Subnetting is the mechanism that turns a right-sized allocation into a usable internal design.

a. The subnetting arithmetic

Subnetting operates on the 32-bit address. The original prefix determines how many bits are already network bits. The new prefix determines how many bits are borrowed from the host portion to become subnet bits.

# Subnetting arithmetic for 192.168.1.0/24 into /26
# Original prefix: /24 → 24 network bits, 8 host bits
# New prefix:     /26 → 26 network bits, 6 host bits
# Borrowed bits:  26 - 24 = 2 bits
# Subnets created: 2^2 = 4
# Remaining host bits: 8 - 2 = 6
# Usable hosts per subnet: 2^6 - 2 = 62
# The -2 accounts for the network address and broadcast address

The borrowed bits are always taken from the left side of the host portion. In a /24 being subnetted to /26, the first two bits of the fourth octet become subnet bits. The possible values of those two bits produce four subnets: 00, 01, 10, and 11, corresponding to the fourth octet values 0, 64, 128, and 192 .

# The four /26 subnets within 192.168.1.0/24
# Subnet 0: 192.168.1.0/26   range 192.168.1.1   - 192.168.1.62   broadcast 192.168.1.63
# Subnet 1: 192.168.1.64/26  range 192.168.1.65  - 192.168.1.126  broadcast 192.168.1.127
# Subnet 2: 192.168.1.128/26 range 192.168.1.129 - 192.168.1.190  broadcast 192.168.1.191
# Subnet 3: 192.168.1.192/26 range 192.168.1.193 - 192.168.1.254  broadcast 192.168.1.255

The network address is always the lowest address in the range—the one where all host bits are zero. The broadcast address is always the highest address—where all host bits are one. Neither can be assigned to a host .

b. The increment method

The fastest way to enumerate subnets is to calculate the increment. The increment is the value of the lowest remaining host bit after subnetting, expressed in the octet where the subnet bits fall. It is also the difference between consecutive network addresses .

# Increment calculation for 192.168.1.0/26
# The subnet mask in the fourth octet is 192 (binary 11000000)
# The increment is 256 - 192 = 64
# Network addresses: .0, .64, .128, .192
# Each subnet spans 64 addresses; the next subnet starts at +64

# For 192.168.1.0/27:
# Mask fourth octet: 224 (binary 11100000)
# Increment: 256 - 224 = 32
# Networks: .0, .32, .64, .96, .128, .160, .192, .224
# Each subnet has 2^5 - 2 = 30 usable hosts

The increment method works because the subnet mask in the relevant octet is always a value that is a power of two subtracted from 256. The mask 255.255.255.192 borrows two bits, leaving six host bits, so the increment is 2^6 = 64. The mask 255.255.255.224 borrows three bits, leaving five host bits, so the increment is 2^5 = 32.

# Increment method across an octet boundary
# 172.16.0.0/18 subnetted from a /16
# Borrowed bits: 18 - 16 = 2
# The third octet mask is 192 (borrowing from the third octet's left)
# Increment in the third octet: 256 - 192 = 64
# Networks: 172.16.0.0/18, 172.16.64.0/18, 172.16.128.0/18, 172.16.192.0/18
# Each subnet has 2^14 - 2 = 16,382 usable hosts

c. Linux tools for verification

Manual calculation is error-prone. Linux provides tools that compute network addresses, broadcast addresses, and host ranges from an address and prefix. The subnetcalc utility is available in Debian and FreeBSD repositories and performs exactly this calculation .

# Install subnetcalc on Debian/Ubuntu
apt install subnetcalc

# Calculate a /26 network
subnetcalc 192.168.1.0/26
# Output includes: network address, broadcast address, host range,
# maximum number of hosts, and binary representation

For scripting and automation, the ipcalc tool or the ip route commands provide similar information without requiring a separate calculator. The Linux kernel’s routing table itself is the final authority: ip route get shows which route a packet will actually use, which is the ground truth that a calculator can only approximate .

# Verify which route the kernel selects for a host in a subnet
ip route get 192.168.1.50
# If a /26 route for 192.168.1.0/26 exists, this address matches it
# If a /24 route also exists, the /26 wins by longest-prefix match

# Add a subnet route and verify
ip route add 192.168.1.0/26 via 10.0.0.1
ip route get 192.168.1.50
# Output confirms the /26 route is selected

Complete Example Session

# ============================================
# PART 1: THE ALLOCATION
# ============================================
# An organization receives 192.168.1.0/24 from its provider.
# Requirement: four departments, each needing approximately 50 hosts.
# The /24 has 254 usable hosts, so the total capacity is sufficient.
# We need four subnets, each with at least 50 usable hosts.

# ============================================
# PART 2: DETERMINE THE SUBNET SIZE
# ============================================
# Formula: 2^h - 2 >= 50
# 2^5 - 2 = 30 (too small)
# 2^6 - 2 = 62 (sufficient)
# h = 6 host bits
# New prefix: 32 - 6 = /26
# Borrowed bits: 26 - 24 = 2
# Subnets created: 2^2 = 4

# ============================================
# PART 3: CALCULATE THE INCREMENT
# ============================================
# The /26 mask in the fourth octet is 192 (binary 11000000).
# Increment: 256 - 192 = 64.
# The four subnets start at .0, .64, .128, and .192.

# ============================================
# PART 4: ENUMERATE THE SUBNETS
# ============================================
# Subnet A: 192.168.1.0/26    hosts .1-.62     broadcast .63
# Subnet B: 192.168.1.64/26   hosts .65-.126   broadcast .127
# Subnet C: 192.168.1.128/26  hosts .129-.190  broadcast .191
# Subnet D: 192.168.1.192/26  hosts .193-.254  broadcast .255

# ============================================
# PART 5: CONFIGURE THE ROUTER INTERFACES
# ============================================
# The router needs one interface in each subnet, using the first host address.
ip addr add 192.168.1.1/26 dev eth0.10     # Subnet A gateway
ip addr add 192.168.1.65/26 dev eth0.20    # Subnet B gateway
ip addr add 192.168.1.129/26 dev eth0.30   # Subnet C gateway
ip addr add 192.168.1.193/26 dev eth0.40   # Subnet D gateway

# ============================================
# PART 6: VERIFY THE INTERFACE CONFIGURATION
# ============================================
ip addr show eth0.10
# Output should show: inet 192.168.1.1/26
# The prefix length is 26, not 24

# ============================================
# PART 7: ADD ROUTES FOR EACH SUBNET
# ============================================
# The router knows all four subnets are directly connected.
# No static routes are needed for directly connected networks.
# But a remote router must be told about them.
ip route add 192.168.1.0/26 via 10.0.0.1
ip route add 192.168.1.64/26 via 10.0.0.1
ip route add 192.168.1.128/26 via 10.0.0.1
ip route add 192.168.1.192/26 via 10.0.0.1

# ============================================
# PART 8: AGGREGATE THE SUBNETS
# ============================================
# The four /26s together constitute the original /24.
# A remote router can use a single aggregate route:
ip route add 192.168.1.0/24 via 10.0.0.1
# This is supernetting: the /24 covers all four /26s.
# The remote router does not need to know the internal subdivision.

# ============================================
# PART 9: VERIFY LONGEST-PREFIX MATCH
# ============================================
# If both the /24 aggregate and the /26 routes exist, the /26 wins for local traffic.
ip route get 192.168.1.50
# Output: 192.168.1.50 dev eth0.10  (matches the /26 directly connected route)
# The /24 aggregate would only be used if no more specific route exists.

# ============================================
# PART 10: SUBNETTING A /16 ACROSS AN OCTET BOUNDARY
# ============================================
# 172.16.0.0/16 subnetted into /18
# Borrowed bits: 2
# Subnets: 172.16.0.0/18, 172.16.64.0/18, 172.16.128.0/18, 172.16.192.0/18
# Host bits: 14, usable hosts: 2^14 - 2 = 16,382
# The increment is 64 in the third octet, not the fourth.
# The third octet changes; the fourth octet ranges from 0.1 to 63.254.
subnetcalc 172.16.0.0/18
# Verify: network 172.16.0.0, broadcast 172.16.63.255, hosts 16,382

The ten parts traced the complete subnetting workflow: determine the required host capacity, select the prefix length, calculate the increment, enumerate the subnets, configure interfaces, add routes, and verify with the kernel’s own routing table.

Quick Reference

Subnetting Formulas

Formula	Purpose	Example for /26
2^s	Number of subnets created (s = borrowed bits)	2^2 = 4
2^h − 2	Usable hosts per subnet (h = remaining host bits)	2^6 − 2 = 62
256 − mask_octet	Increment between network addresses	256 − 192 = 64
32 − prefix	Remaining host bits	32 − 26 = 6

Common Prefixes and Capacities

Prefix	Mask (last octet)	Borrowed Bits	Subnets from /24	Usable Hosts
/25	128	1	2	126
/26	192	2	4	62
/27	224	3	8	30
/28	240	4	16	14
/29	248	5	32	6
/30	252	6	64	2

Network and Broadcast Addresses

Address Type	Rule	Example (/26 subnet .64)
Network address	All host bits = 0	192.168.1.64
First usable host	Network address + 1	192.168.1.65
Last usable host	Broadcast address − 1	192.168.1.126
Broadcast address	All host bits = 1	192.168.1.127

Best Practices

✅ Do This:

# Calculate the required host bits before choosing a prefix
# Need 50 hosts: 2^6 - 2 = 62, so use /26                    # ✅
# Use the increment method to enumerate subnets
# /26 mask 192 → increment 64 → .0, .64, .128, .192            # ✅
# Assign the first usable address to the router interface
ip addr add 192.168.1.1/26 dev eth0.10                        # ✅
# Verify with the kernel routing table
ip route get 192.168.1.50                                     # ✅
# Use subnetcalc for independent verification
subnetcalc 192.168.1.0/26                                     # ✅
# Aggregate subnets into a single route when advertising
ip route add 192.168.1.0/24 via 10.0.0.1                     # ✅

❌ Don’t Do This:

# Choose a prefix without checking host capacity
# A /27 gives 30 hosts, insufficient for 50                       # ❌
# Assume the increment is always 64
# /27 increment is 32, /28 increment is 16                       # ❌
# Assign the network or broadcast address to a host
ip addr add 192.168.1.64/26 dev eth0    # .64 is the network    # ❌
# Use a /24 mask on an interface that belongs to a /26
ip addr add 192.168.1.70/24 dev eth0    # Wrong prefix          # ❌
# Forget the −2 in host capacity
# 2^6 = 64 is not the usable host count                          # ❌
# Advertise every /26 individually to a remote router
# One /24 aggregate is sufficient                                # ❌

Common Pitfalls

Pitfall	Why It Happens	Fix
Subnet too small for host count	Prefix chosen without calculating 2^h − 2	Count required hosts, then select prefix
Wrong increment	Mask octet not subtracted from 256	Use 256 − mask_octet
Network address assigned to host	Forgetting all host bits must be 0	Network address is the lowest in range
Broadcast address assigned to host	Forgetting all host bits must be 1	Broadcast is the highest in range
Subnets overlap	Incorrect increment calculation	Verify next subnet starts at previous + increment
Wrong prefix on interface	Copy-paste from a different subnet	Check with `ip addr show`
Aggregate route missing	Advertising /26s individually	Supernet to the original /24 when possible

Real-World Examples

1. Determine prefix for 50 hosts

# 2^6 - 2 = 62 ≥ 50, so 6 host bits → /26
# 2^5 - 2 = 30 < 50, so /27 is too small

2. Calculate increment for /27

# /27 mask fourth octet = 224
# Increment = 256 - 224 = 32
# Networks: .0, .32, .64, .96, .128, .160, .192, .224

3. First usable host in a /28

# /28 network .16 → first host is .17
# Last host is .30, broadcast is .31
ip addr add 192.168.1.17/28 dev eth0

4. Router interface per subnet

# Four /26 subnets, four gateway addresses
ip addr add 192.168.1.1/26 dev eth0.10
ip addr add 192.168.1.65/26 dev eth0.20
ip addr add 192.168.1.129/26 dev eth0.30
ip addr add 192.168.1.193/26 dev eth0.40

5. Verify with subnetcalc

subnetcalc 192.168.1.64/26
# Confirms network .64, broadcast .127, hosts .65-.126

6. Aggregate four /26s into one /24

ip route add 192.168.1.0/24 via 10.0.0.1
# Covers .0, .64, .128, and .192 subnets

7. Subnet across an octet boundary

# 10.0.0.0/16 to /20
# Borrowed bits: 4, subnets: 16
# Increment in third octet: 16 (256 - 240)
subnetcalc 10.0.0.0/20

8. Confirm longest-prefix match

ip route add 192.168.1.0/24 via 10.0.0.1
ip route add 192.168.1.0/26 via 10.0.0.2
ip route get 192.168.1.50    # Matches the /26

9. Point-to-point /30

# /30 provides exactly 2 usable hosts
ip addr add 10.0.0.1/30 dev eth0
ip addr add 10.0.0.2/30 dev eth1

10. Check broadcast address

# For 192.168.1.64/26, broadcast is 192.168.1.127
# The next subnet starts at .128, confirming the boundary

Visual

Subnetting a /24 into Four /26s

┌──────────────────────────────────────────────────────────────┐
│  192.168.1.0/24 → FOUR /26 SUBNETS                           │
│                                                              │
│  Original: 192.168.1.0/24                                    │
│  ├─ Network bits: 24 ─────────────────────────┤              │
│  └─ Host bits: 8 ─────────────────────┤                      │
│                                                              │
│  Subnetted to /26: borrow 2 host bits                        │
│  ├─ Network bits: 26 ───────────────────────────┤            │
│  ├─ Subnet bits: 2 ──┤                                       │
│  └─ Host bits: 6 ──────────────┤                             │
│                                                              │
│  Increment: 256 − 192 = 64                                   │
│                                                              │
│  ┌─────────────────┬─────────────────┬─────────────────────┐ │
│  │ Subnet          │ Host Range      │ Broadcast           │ │
│  ├─────────────────┼─────────────────┼─────────────────────┤ │
│  │ 192.168.1.0/26  │ .1  – .62       │ .63                 │ │
│  │ 192.168.1.64/26 │ .65 – .126      │ .127                │ │
│  │ 192.168.1.128/26│ .129 – .190     │ .191                │ │
│  │ 192.168.1.192/26│ .193 – .254     │ .255                │ │
│  └─────────────────┴─────────────────┴─────────────────────┘ │
│                                                              │
│  Each subnet: 62 usable hosts. Total: 248 usable addresses.  │
│  Original /24 had 254 usable; 6 addresses lost to subnetting.│
└──────────────────────────────────────────────────────────────┘

Network and Broadcast Address Positions

┌──────────────────────────────────────────────────────────────┐
│  ADDRESS ROLES WITHIN A SUBNET (EXAMPLE: /26 SUBNET .64)     │
│                                                              │
│  .64          .65                        .126      .127      │
│   │            │                          │         │        │
│   ▼            ▼                          ▼         ▼        │
│  ┌────┐  ┌──────────────────────────┐  ┌────┐  ┌────┐        │
│  │NET │  │      USABLE HOSTS        │  │LAST│  │BCST│        │
│  │ADDR│  │      62 addresses        │  │HOST│  │ADDR│        │
│  └────┘  └──────────────────────────┘  └────┘  └────┘        │
│                                                              │
│  Network address: all host bits = 0 (cannot assign)          │
│  Broadcast address: all host bits = 1 (cannot assign)        │
│  Usable hosts: 2^6 − 2 = 62                                  │
│                                                              │
│  The next subnet starts at .128 (increment = 64).            │
└──────────────────────────────────────────────────────────────┘

Subnetting Across an Octet Boundary

┌──────────────────────────────────────────────────────────────┐
│  172.16.0.0/16 → FOUR /18 SUBNETS                            │
│                                                              │
│  Borrowed bits: 2 (from the third octet)                     │
│  Third octet mask: 192 → increment 64                        │
│                                                              │
│  ┌──────────────────┬──────────────────┬───────────────────┐ │
│  │ Subnet           │ Third Octet      │ Host Range (3rd/4th)│ │
│  ├──────────────────┼──────────────────┼───────────────────┤ │
│  │ 172.16.0.0/18    │ 0                │ .0.1  – .63.254   │ │
│  │ 172.16.64.0/18   │ 64               │ .64.1 – .127.254  │ │
│  │ 172.16.128.0/18  │ 128              │ .128.1 – .191.254 │ │
│  │ 172.16.192.0/18  │ 192              │ .192.1 – .255.254 │ │
│  └──────────────────┴──────────────────┴───────────────────┘ │
│                                                              │
│  Host bits: 14 (16 original host bits − 2 borrowed)          │
│  Usable hosts per subnet: 2^14 − 2 = 16,382                  │
└──────────────────────────────────────────────────────────────┘

Summary

Item	Value
Subnetting	Borrowing host bits to create smaller networks within an allocation
Borrowed bits	New prefix − original prefix
Subnet count	2^s, where s = borrowed bits
Usable hosts	2^h − 2, where h = remaining host bits
Increment	256 − subnet mask octet value
Network address	Lowest address; all host bits = 0; cannot assign
Broadcast address	Highest address; all host bits = 1; cannot assign
First usable host	Network address + 1
Last usable host	Broadcast address − 1
Verification tool	`subnetcalc`, `ip route get`
Aggregation	Combining subnets back into the original prefix

Key takeaways:

Subnetting is arithmetic, not intuition. The formulas 2^s for subnets and 2^h − 2 for hosts are the foundation. Every design decision flows from them.
The −2 is not optional. The network address and broadcast address are reserved. A /26 has 64 addresses but only 62 usable hosts.
The increment determines the subnet boundaries. For a /26 with mask 192, the increment is 64. Subnets start at .0, .64, .128, and .192.
Borrowed bits come from the left. The host portion shrinks from the left; the subnet bits are the highest remaining bits in the host field.
The kernel is the final authority. Manual calculation can be verified with ip route get and subnetcalc. If the route selected by the kernel does not match your expectation, the mask is wrong.
Subnetting loses addresses. Four /26s from a /24 provide 248 usable addresses instead of 254. The six lost addresses are the network and broadcast addresses of the three additional subnets.
Aggregation reverses subnetting. The four /26s can be advertised as a single /24 to remote routers, hiding the internal subdivision.

Remember: Subnetting is the bridge between an allocated prefix and a working network design. You receive a block, you choose a prefix length based on host requirements, you calculate the increment, and you enumerate the subnets. Each subnet has a network address, a broadcast address, and a range of usable hosts. The router interfaces sit inside those ranges, and the routing table reflects the prefix lengths. When the LFCE exam asks you to configure a system to route IP traffic dynamically, the prefixes you advertise are the product of this arithmetic. Get the arithmetic right, and the routing follows.

Was this helpful?

Stop using slow, ad-bloated tool sites! 🤮

🔎 Search “KandZ Tools” on Google to use many professional utilities for free.

KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)

⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free

🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!