Andres Diaz

andres@diaz:~$ whoami

Andres Diaz

Defect Reproduction Engineer at Filevine

andresdiaztech@gmail.com

LinkedIn GitHub Blog

andres@diaz:~/blog$ cat how-i-learned-the-basics-of-subnetting.md

cd ..

How I learned the basics of subnetting

Oct 18, 2026

In short

I went from "why is /21 255.255.248.0?" to splitting networks on paper in one day. The trick was not memorizing a table. It was asking a lot of small "why" questions, and rebuilding my practice tool three times until it taught the way I learn.

Related: My subnetting notes ยท Day 02 log

The questions I asked

On Day 02 of PEH (Practical Ethical Hacking) I spent the day working through the Network Refresher with Claude as a tutor. Looking back at my questions, they fell into four groups.

1. "What is this thing, and why does my computer have it?"

  • What is a MAC (Media Access Control) address, why does my phone have one, and why does my PC show four of them?
  • Are network adapters actual chips, one for Wi-Fi, one for Ethernet?
  • Is my router's MAC what gets sent to the internet? (It is not. A MAC only travels one hop.)

2. "How do these pieces fit together?"

  • Switches vs routers, and why MAC addresses keep coming up with switching.
  • TCP (Transmission Control Protocol) vs UDP (User Datagram Protocol).
  • ARP (Address Resolution Protocol) and DHCP (Dynamic Host Configuration Protocol), twice, until it stuck.
  • What happens when my DHCP lease runs out? Does it renew every day?

3. "Can I see it myself?"

  • What can I test in PowerShell right now?
  • Why is Wireshark not capturing anything? (I had picked a virtual adapter with no traffic.)
  • Too much data: how do I see only my own request? Is this packet the original SYN?

4. "Why is subnetting like this?"

  • Is subnetting important for a pentester, and how deep do I need to go?
  • Why is /21 equal to 255.255.248.0? Should I memorize it or is there a reason?
  • Why does /30 fit 2 hosts and /32 fit 1? Is the 1 host the .255?
  • What does /8 stand for?
  • Why is a /24 254 hosts and not 255?
  • How do you get the x for each row of The Cyber Mentor's subnetting sheet?

Where I struggled

Mixing up the mask with an address. I thought the 255 in 255.255.255.255 might be the one host. It is not: the 255s in a mask mean "this part is locked." The host count comes from the zeros.

Counting from 0. A /24's last octet goes 0 to 255. That is 256 values, not 255. Minus the network and broadcast addresses gives 254.

Where the mask numbers come from. 128, 192, 224, 240, 248, 252, 254, 255 looked random until I saw they are running totals of the bit values 128 + 64 + 32 + 16 + 8 + 4 + 2 + 1. /21 is 16 full bits plus 5 more, and 128 + 64 + 32 + 16 + 8 = 248.

Quiz traps. Two section quiz questions caught me:

  • I picked 10.10.0.265 as a valid IP. No octet can go above 255.
  • I picked 10.11.15.10 as inside 10.10.0.0/16. A /16 locks the first two octets, so 10.11 is a different network.
  • I picked .1 as a reserved address in a /24 because routers usually use it. Only the network (first) and broadcast (last) addresses are reserved.

Tooling. Wireshark showed nothing because I was capturing on the wrong interface. Then it showed everything, and I had to learn display filters to find my own traffic.

How the tool changed (three versions)

I built a subnetting practice tool with Claude called Subnetting Course. The first two versions did not work for me, and figuring out why was the most useful part.

VersionWhat it wasWhat happened
1A timed game: 60-second rounds of multiple choice, scope checks, scores and streaksFun, but the timer pushed me to guess. I was matching patterns, not understanding.
2A big "lab": a 32-bit explorer, a bit builder, a subnet splitter, a practice tab, a cheat sheetToo much at once. Everything was on screen, so nothing felt important.
3A step-by-step course in 6 parts. Each part unlocks only after the last one is finishedThis is the one that worked.

What made version 3 work:

  • One small idea at a time. A few sentences, one picture, then a question.
  • Work it out on paper first. Every question says to use my notebook before typing an answer.
  • No skipping. The Next button stays off until I type the right answer.
  • Hints, not answers. A wrong answer gives a hint. Two wrong answers unlock "Show me how," but I still have to type the answer myself.
  • It grew with my questions. When I asked how to read The Cyber Mentor's sheet, we added a whole part for it.

The 6 parts, in order:

  1. Bits: read and write one octet (8 bits) using 128 64 32 16 8 4 2 1
  2. Masks: the /number counts the 1s, so /26 = 24 + 2 = 255.255.255.192
  3. Hosts: host bits = 32 minus the /number, usable hosts = 2 to that power, minus 2
  4. Ranges: block size = 256 minus the mask value, which gives the network and broadcast
  5. The Sheet: find the column, read the x from the bottom row, and catch the trick row (192.168.1.0/23 really belongs to 192.168.0.0/23)
  6. Pentesting: is this IP in scope? Split a /24 into 4. I landed on a box, what do I ping sweep?

You can try it on the Tools page of this site. It is the same course I used.

What I would tell someone starting subnetting

  1. Understand it once, then memorize. Learn why 248 is 248, then memorize the row 128 192 224 240 248 252 254 255 so you do not redo the math every time.
  2. Count the 1s. Every mask question is "how many 1s, and where does the last partial octet land?"
  3. Block size does the rest. 256 minus the mask value tells you where every network starts and ends.
  4. Check where the range really starts. 192.168.1.0/23 looks like it starts at .1.0, but the network is 192.168.0.0.
  5. If a study tool is not working, change the tool. My first two versions failed, and that told me what I needed: small steps, paper first, no timer.