Andres Diaz

Subnetting

Oct 18, 2026 · Networking

Related: OSI Model · IP Addresses · Switches vs Routers
Reference: Acronyms · Ports

Why it matters for pentesting

1. Scope. A pentest only covers the IPs in scope, for example 10.10.20.0/23 but not 10.10.22.0/24. Scanning an IP outside it can break the contract or the law.
2. Planning scans. nmap 10.10.0.0/16 = 65,534 hosts (slow and noisy). nmap 10.10.5.0/24 = 254 hosts (minutes).
3. Knowing where you landed. On a new machine, ipconfig (Windows) or ip a (Linux) shows its IP and mask. From that you can work out the network, its size and the gateway, then look for other subnets to move into (pivoting).
4. Reading recon results. Is this IP internal? Are these two hosts on the same network (so ARP (Address Resolution Protocol) spoofing could work between them)?

How deep to go

The cheat sheet (memorize this)

The mask "magic numbers" (one octet, from 1 bit to 8 bits):

These aren't random. Each one is just the bit values added up from the left:

And here's my own version of the full cheat sheet, so I can read off any mask:

Reading The Cyber Mentor's subnetting sheet

How the rows work. The sheet has 4 rows, one per octet. The yellow header says which octet holds the x, meaning the octet that is only partly filled with 1s:

How to get the x.

1. Find your CIDR's column (1 to 8). Shortcut: CIDR minus the full octets before it (0, 8, 16 or 24).
2. The bottom row "Subnet Mask (Replace x)" at that column is the x: 128 192 224 240 248 252 254 255.
3. Put x into the row header.

Why it works: the column number is how many 1s spill into that octet. Column 5 = 5 ones = 128 + 64 + 32 + 16 + 8 = 248.

The last column (/8, /16, /24, /32) always gives x = 255, because that octet is full.

The Hosts row is total addresses. Always subtract 2 (network ID = first address, broadcast = last address), except /31 and /32. Each step left doubles the number.

The course examples

The method: block size in 4 steps

Works for any IP and mask, no binary needed.

1. Find the interesting octet: the one where the mask is not 255 and not 0 (if it is all 255s then a 0, use the 0 octet).
2. Block size = 256 − that mask value.
3. Network address: the biggest multiple of the block size that is less than or equal to the IP's number in that octet. Octets after it become 0.
4. Broadcast address: next block start − 1. Octets after it become 255.

Worked examples

My Wi-Fi: 192.168.12.34/22

1. Mask 255.255.252.0 > interesting octet = 3rd (252).
2. Block size = 256 − 252 = 4. Blocks in the 3rd octet: 0, 4, 8, 12, 16 ...
3. 12 is a multiple of 4 > network = 192.168.12.0
4. Next block is 16 > broadcast = 192.168.15.255
5. Hosts = 2^(32 − 22) − 2 = 2^10 − 2 = 1,022
6. Is 192.168.14.10 on my network? Yes (14 is between 12 and 15).
7. Is 192.168.16.1? No (16 starts the next block).

My WSL adapter: 192.168.176.1/20

1. Mask 255.255.240.0 > 3rd octet (240).
2. Block size = 256 − 240 = 16. Blocks: ... 160, 176, 192 ...
3. Network = 192.168.176.0, broadcast = 192.168.191.255, hosts = 2^12 − 2 = 4,094.

Example: proof from my own PC

Windows lists each network's broadcast address in the ARP cache. Both match the math above.

A small one: 10.10.20.77/26

1. Mask 255.255.255.192 > 4th octet (192).
2. Block size = 256 − 192 = 64. Blocks: 0, 64, 128, 192.
3. 77 falls in the block starting at 64 > network = 10.10.20.64
4. Next block 128 > broadcast = 10.10.20.127
5. Hosts = 2^6 − 2 = 62. Usable range: 10.10.20.65 to 10.10.20.126.

Scope check: is it in 10.10.20.0/23?

1. Mask 255.255.254.0 > 3rd octet (254), block size 2.
2. 20 is a multiple of 2 > range = 10.10.20.0 to 10.10.21.255.
3. 10.10.21.200 > in scope
4. 10.10.22.5 > out of scope. Do not scan it.

Nmap and subnets

nmap -sn 192.168.12.0/22

-sn = ping sweep (find live hosts, no port scan). Nmap accepts CIDR ranges directly, so the size of the range = how many hosts it will try.

ipcalc 192.168.12.34/22

On Kali Linux: shows network, broadcast, host range and host count. Use it to check my mental math.

Borrowing bits: splitting a network

Subnetting = borrowing bits from the host part to make more, smaller networks.

• Every bit borrowed doubles the number of subnets and halves the size of each one.
• Subnets = 2^(bits borrowed)
• New CIDR = old CIDR + bits borrowed
• Usable hosts per subnet = 2^(host bits left) − 2

Course example: 192.168.0.0/24, borrow 2 bits > 2^2 = 4 subnets of /26 (mask 255.255.255.192 = 11111111.11111111.11111111.11000000). Block size 64:

Each subnet can be used for a different segment, like one per office floor or department. The 2 borrowed bits count up 00, 01, 10, 11 across the 4 subnets.

Need a number of subnets that is not a power of 2? Round up. 5 subnets > borrow 3 bits (2^3 = 8), use 5 and keep 3 spare.

Practice

Use the Subnetting Course. No timer. Short lessons, then questions I work out in my notebook and type in. Finish a part to unlock the next:

1. Bits: read and write one octet in binary
2. Masks: turn a /number into a mask and back
3. Hosts: how many devices a network holds
4. Ranges: network address, broadcast, first usable
5. The Sheet: read The Cyber Mentor's sheet, get the x for any row, and work the course examples (including the trick row)
6. Pentesting: scope checks, splitting a network, landing on a machine

Wrong answer = a hint. Two wrong = "Show me how". After a part, Practice gives unlimited random questions for it.