Subnetting & CIDR

Every time you spin up a VPC on AWS or GCP, you're asked to pick a CIDR block and carve it into subnets. Interviewers use subnetting questions to check you understand how address space, routing scope, and network isolation are actually decided — not just memorized as trivia — and to see whether you can do the bit-math on the spot without a calculator.

What Is Subnetting?

Subnetting is the practice of taking one large pool of network addresses and dividing it into smaller, separate sections. Instead of every device in a company sharing one giant flat network, subnetting carves that space into smaller groups — one for engineering, one for guest Wi-Fi, one for servers — so traffic and access can be controlled and contained within each group.

What Is CIDR?

CIDR (Classless Inter-Domain Routing) is simply the notation used to describe how big a slice was cut and where it starts — the /20 part of an address like 10.4.0.0/20. The number after the slash tells you how much of the address is "fixed" for that group versus how much is left free to assign to individual devices.

Where This Is Used

• Setting up a new AWS VPC or Google Cloud network always starts with choosing a CIDR range, like 10.0.0.0/16.
• Home routers typically hand out addresses in a small subnet such as 192.168.0.x, room enough for a household's worth of devices.
• IT teams at large companies split networks by department or office location so problems in one area can't spread to another.
• Internet providers receive blocks of addresses from regional registries and further divide them among their customers using CIDR.

A Day-to-Day Example

Picture a large warehouse with one loading dock address that delivery trucks use. Inside, the warehouse is divided into numbered aisles, and each aisle is assigned a range of shelf numbers — aisle 3 might hold shelves 300 through 399. Subnetting is dividing the warehouse into those aisles; CIDR is the label system that tells you exactly how many shelves each aisle was given.

Deep Dive: What "/24" Actually Means, Bit by Bit

192.168.1.0/24
                  network bits (24)     host bits (8)
192.168.1.0  =  11000000.10101000.00000001 . 00000000
                └──────── fixed (network) ───────┘└ varies (hosts) ┘

/24 = first 24 of the 32 bits are the network prefix.
Remaining 32 - 24 = 8 bits identify individual hosts within that subnet.
2^8 = 256 total addresses in the block.
Subtract 2 (network address + broadcast address) = 254 usable host addresses.

192.168.1.0    = network address   (all host bits 0 — not assignable)
192.168.1.1    - 192.168.1.254     = usable host addresses (254 of them)
192.168.1.255  = broadcast address (all host bits 1 — not assignable)

The quick formula to memorize cold: usable hosts = 2^(32 - prefix) - 2. This is the single most commonly asked "do the math live" question in networking interviews.

Deep Dive: Common Prefix Sizes Compared

Prefix   Host bits   Total addrs   Usable hosts   Typical use
/16      16          65,536        65,534         entire VPC
/20      12          4,096         4,094           large subnet / AZ
/24      8           256           254             one subnet / one AZ tier
/28      4           16            14              small reserved block (e.g. NAT/LB)
/30      2           4             2               point-to-point link (e.g. VPN tunnel)

Notice /30 gives exactly 2 usable addresses — just enough for the two ends of a point-to-point link, which is why you'll see /30 or /31 used for router-to-router or VPN tunnel interfaces where there are only ever two hosts, never a broadcast domain to speak of.

Deep Dive: Carving a VPC Into Subnets

Start:  10.0.0.0/16          (65,536 addresses, whole VPC)

Split into four /18s by borrowing 2 more bits:
10.0.0.0/18      → 10.0.0.0   - 10.0.63.255    (public subnet, AZ-a)
10.0.64.0/18     → 10.0.64.0  - 10.0.127.255   (public subnet, AZ-b)
10.0.128.0/18    → 10.0.128.0 - 10.0.191.255   (private subnet, AZ-a)
10.0.192.0/18    → 10.0.192.0 - 10.0.255.255   (private subnet, AZ-b)

Each borrowed bit halves the block size and doubles the number of subnets:
/16 → /17 (2 subnets) → /18 (4 subnets) → /19 (8 subnets) → /20 (16 subnets)

Key Pointers

• CIDR notation (a.b.c.d/n) specifies an IP address plus a prefix length n — the number of leading bits that identify the network portion of the address.
• A smaller prefix (e.g. /16) means a larger network with more host addresses; a larger prefix (e.g. /28) means a smaller network with fewer hosts.
• Usable host count in a subnet is 2^(32-n) - 2 for IPv4 — subtracting the network address and broadcast address.
• /24 gives 256 addresses (254 usable) — the classic "one subnet per office/AZ" size; /16 gives 65,536 addresses (65,534 usable) — a common size for an entire VPC.
• Subnetting lets cloud architects split one large CIDR block into isolated ranges — public subnets, private subnets, per-availability-zone subnets — each with its own routing table and security group.
• The subnet mask (e.g. 255.255.255.0) is the dotted-decimal equivalent of the CIDR prefix and is used by routers to determine which bits are network vs host bits.

How It Works

1. Start with an address block, e.g. 10.0.0.0/16 — 65,536 total addresses.
2. Decide how many subnets you need and borrow bits from the host portion to create them — splitting into four /18 blocks, or sixteen /20 blocks, etc.
3. Each subnet gets its own network address (all host bits 0) and broadcast address (all host bits 1); the addresses in between are usable.
4. A router or cloud routing table directs traffic to the correct subnet by comparing the destination IP against each subnet's CIDR range (longest-prefix match wins when ranges overlap).
5. In a VPC, each subnet is typically pinned to a single availability zone and gets its own route table, controlling whether it's "public" (has a route to an internet gateway) or "private."

Try It Yourself

# Compute network/broadcast address and usable range for a CIDR block:
ipcalc 10.0.4.0/22
# (install via: brew install ipcalc  /  apt install ipcalc)

# Manual bit-math check for 10.0.4.0/22:
# /22 -> 32-22 = 10 host bits -> 2^10 = 1024 addresses, 1022 usable
# block size in the 3rd octet = 256 / 2^(24-22) = 4 -> ranges start at
# multiples of 4: 10.0.4.0, 10.0.8.0, 10.0.12.0 ...
# so 10.0.4.0/22 spans 10.0.4.0 - 10.0.7.255

# See your own machine's subnet mask:
ifconfig en0 | grep netmask     # macOS
ip -4 addr show                 # Linux (shows /prefix directly)

# Check whether two hosts are on the same subnet (same network portion):
ipcalc 192.168.1.10/24
ipcalc 192.168.1.200/24
# same "Network:" line -> same subnet, can talk without routing

Interview Q&A

Q: What does /24 mean?

A: The first 24 of the 32 bits in the IPv4 address are the network prefix — fixed for every host in that subnet. The remaining 8 bits identify individual addresses within that subnet, giving 2^8 = 256 total addresses, 254 of which are usable after subtracting the network and broadcast addresses.

Q: What's the network address and broadcast address for 10.0.4.0/22?

A: /22 leaves 10 host bits (2^10 = 1024 addresses). Because the block size in the third octet is 4 (256 / 2^(24-22)), blocks start at multiples of 4, so 10.0.4.0/22 spans 10.0.4.0 through 10.0.7.255. Network address is 10.0.4.0, broadcast is 10.0.7.255, giving 1022 usable addresses in between.

Q: Why not just give every service in a VPC a flat /16 with no subnetting?

A: Subnetting is how you enforce isolation boundaries — public-facing tiers get subnets with a route to an internet gateway, private tiers (databases, internal services) get subnets with no such route, and each subnet can carry its own security group and network ACL. Without subnetting you lose the ability to apply different routing and access policy to different parts of your infrastructure; everything would share one flat broadcast domain and one routing policy.

System Design Tie-in

Any "design the infrastructure" or "how would you deploy this" system design answer that includes a VPC should specify subnetting explicitly: public subnets (one per AZ, for load balancers and NAT gateways) and private subnets (one per AZ, for app servers and databases), sized so each AZ's subnet won't run out of IPs as the fleet autoscales. A common oversight candidates make is picking a subnet too small (e.g. a /28 for an autoscaling group that can burst to 50 instances) — 14 usable addresses caps you at 14 instances no matter what your autoscaling policy says.

Trade-offs

Common interview gotcha: forgetting to subtract network and broadcast addresses when computing usable hosts, or miscounting bits when converting between CIDR and dotted-decimal mask. Oversizing subnets wastes address space and makes route tables harder to reason about; undersizing forces painful re-IP'ing later as a service scales — cloud teams typically over-provision (e.g. a /16 VPC split into several /20 subnets) precisely to avoid that. Also expect to be asked to compute a subnet range by hand under time pressure, so practicing the bit-math until it's automatic is worth more than memorizing a chart.