---
{
  "title": "Subnetting and CIDR",
  "summary": "Understand CIDR prefixes and IPv4 subnet boundaries through a small /24-to-/26 example, including what subnetting cannot enforce.",
  "topic": "networking",
  "level": "Intermediate",
  "updated": "2026-10-12",
  "units": [
    1
  ],
  "aliases": [],
  "sources": [
    {
      "title": "Cisco: Networking basics",
      "url": "https://www.cisco.com/site/us/en/learn/topics/networking/what-is-computer-networking.html"
    },
    {
      "title": "IETF: CIDR, RFC 4632",
      "url": "https://www.rfc-editor.org/rfc/rfc4632.html"
    }
  ],
  "published": "2026-10-02",
  "editorialVersion": 2
}
---

## A prefix describes an address block

Subnetting divides an address space into smaller networks. CIDR notation writes an address followed by a slash and a prefix length, such as 192.168.10.0/24. The prefix length states how many leading address bits identify the network prefix. The remaining bits determine the size of the block.

For IPv4, a /24 contains 256 addresses, while a /26 contains 64. A longer prefix means a smaller block because fewer bits remain variable. The calculation describes address space; it does not automatically describe a security policy.

## Split one training network

Imagine a small lab uses the private block 192.168.10.0/24. Dividing it into /26 blocks produces boundaries at 192.168.10.0, 192.168.10.64, 192.168.10.128, and 192.168.10.192. Each block spans 64 addresses.

In the first conventional IPv4 /26 subnet, .0 is the network address and .63 is the broadcast address, leaving .1 through .62 for ordinary host assignments. Special-purpose cases have different rules, so this example should not become an assumption about every possible IPv4 prefix.

Now compare .62 and .65. Although their written addresses look close, they belong to different /26 blocks in this arrangement. A correctly configured host uses its local prefix and routing information to determine the appropriate delivery path. [[ip-addressing]] provides the surrounding addressing concepts.

## A boundary is not a firewall rule

Suppose the lab labels the first subnet “learners” and the second “administration.” If a router forwards all traffic between them, the labels have not created the intended access restriction. Address planning and enforcement need to work together.

[[network-segmentation]] explains the security objective, while [[firewalls]] and other enforcement mechanisms can implement restrictions on communication. A good diagram shows both the address boundary and the policy point rather than treating a different range as sufficient proof of isolation.

## Overlap makes paths confusing

Two separately managed networks may choose the same private range. When they later connect through a VPN or merger, overlapping addresses can make routing and service access ambiguous. Address planning should consider expected integrations and growth, not only today's device count.

For the fictional lab, reserve blocks deliberately and record ownership. Explain which subnets contain clients, services, and management interfaces, and how traffic should move between them. Avoid building a large undocumented collection of one-off exceptions.

## Work through the boundary

Use the /26 example to identify the block containing .130 and its conventional broadcast address. Explain the calculation in terms of 64-address boundaries rather than memorizing the answer. Then state whether an allowed route exists to another subnet and where that permission would be enforced.

Continue with [[routing-and-switching]] to connect the arithmetic to packet delivery. The useful skill is understanding how prefix choices affect local delivery, routing, and operational design, while keeping the separate security policy explicit.