Subnetting and CIDR in Practice: Splitting a /24 and Aggregating Address Ranges

Subnetting boils down to one sentence: every +1 on the prefix splits a block in half. Learn that rule plus one cheat sheet and you won't need a calculator for everyday network planning. Follow along with our IPv4 subnet calculator, IPv6 subnet calculator and IP address converter.

Prefix-to-mask cheat sheet

Prefix	Mask	Total addresses	Usable hosts	Typical use
/30	255.255.255.252	4	2	Legacy point-to-point links
/29	255.255.255.248	8	6	Small device groups
/27	255.255.255.224	32	30	Small offices
/26	255.255.255.192	64	62	Department segments
/25	255.255.255.128	128	126	Larger departments
/24	255.255.255.0	256	254	The classic LAN segment
/16	255.255.0.0	65,536	65,534	Large enterprises, Docker default

Mnemonic: each octet of a mask can only be one of 9 values — 0, 128, 192, 224, 240, 248, 252, 254, 255.

Hands-on: splitting a /24 across four departments

Requirement: divide 192.168.1.0/24 among 4 departments with about 60 devices each.

1. Each subnet needs ≥62 usable addresses → the table says /26 (62 usable).
2. Going from /24 to /26 adds 2 bits → 2² = 4 subnets, exactly enough:

Department	Subnet	Usable range	Broadcast
Engineering	192.168.1.0/26	.1 – .62	.63
Marketing	192.168.1.64/26	.65 – .126	.127
Finance	192.168.1.128/26	.129 – .190	.191
Guests	192.168.1.192/26	.193 – .254	.255

Enter 192.168.1.0/24 in the IPv4 subnet calculator with a new prefix of 26 and you get this table directly.

Why subtract 2: the first address of each subnet is the network address (it names the segment itself) and the last is the broadcast address — neither can be assigned to a host. Two exceptions: on a /31 point-to-point link (RFC 3021) both addresses are usable, which is how modern router interconnects conserve space; a /32 is a host route identifying a single device.

IPv6 subnets: forget about conserving

The splitting logic is identical, but the mindset flips — there are too many addresses to bother saving them:

• One site gets a /48: that's 65,536 subnets to work with;
• Every segment is a /64: SLAAC (stateless address autoconfiguration) only works on /64, so stop wondering whether a 5-device segment deserves a /126;
• A /64 holds 2⁶⁴ ≈ 18.4 quintillion addresses, and with no broadcast address there is no "minus 2".

IPv6 addresses have compressed and expanded spellings; the IPv6 subnet calculator computes subnet ranges and also identifies the address type (link-local fe80::/10, unique local fc00::/7, multicast ff00::/8, and so on).

Advanced: aggregating any address range into CIDRs

Firewall allowlists are often given as ranges (e.g. 192.168.1.10 - 192.168.1.200), but ACLs only accept CIDR notation. The manual method: starting from the first address, repeatedly take the smaller of "the largest block alignment permits" and "the largest block that still fits", until the range is covered. For example, .1 - .6 aggregates to:

192.168.1.1/32
192.168.1.2/31
192.168.1.4/31
192.168.1.6/32

The range aggregation feature of the IP address converter does this in one step, producing the shortest CIDR list that covers exactly the original range — no more, no less.

Three common pitfalls

1. Mistakes happen "across the boundary": 192.168.1.100/25 and 192.168.1.200/25 are on different subnets (first half vs. second half) and need a gateway to talk — don't trust your /24 intuition when the mask isn't /24.
2. Overlapping ranges: before connecting a VPC to an office network (leased line or VPN), verify the CIDRs don't overlap, or routing can't tell them apart.
3. Docker's default range collides: Docker uses 172.17.0.0/16 by default; if your company VPN uses the same block you'll get routing conflicts — change bip or default-address-pools in daemon.json.

Last updated: 2026-09-08