Skip to content

IPv4 CIDR Subnetting & Addressing: RFC 1918, VLSM, Bitwise Math & Network Boundaries

Created: 2026-11-08  ·  Last updated: 2026-11-08  ·  Nejat Hakan

Executive Summary: Beneath every Linux network interface configuration and routing table entry lies Classless Inter-Domain Routing (CIDR). Rather than memorizing arbitrary IP classes, production systems engineering requires mastering 32-bit binary arithmetic: how the Linux kernel uses bitwise AND operations to evaluate local on-link destinations versus gateway hops, how to slice private address space (RFC 1918) using Variable Length Subnet Masking (VLSM), and how to verify subnet boundaries using tools like ipcalc.

  • Bitwise Kernel Logic

    Understand the bitwise AND calculation (IP & Subnet Mask = Network ID) performed by the kernel on every outgoing packet.

  • Full CIDR Reference Sheet

    Detailed sizing table from /32 host routes and /31 point-to-point links (RFC 3021) down to /16 campus supernets.

  • Private & Reserved Ranges

    Demystify RFC 1918 subnets, loopback 127.0.0.0/8, link-local APIPA 169.254.0.0/16, and Carrier-Grade NAT (CGNAT) 100.64.0.0/10.

  • VLSM Enterprise Architecture

    Step-by-step practical partitioning of a /24 prefix into DMZ, internal server, database, and router transit subnets without IP address waste.

1. Anatomy of an IPv4 Address & The Bitwise AND Routing Decision

An IPv4 address consists of 32 binary bits, grouped into four 8-bit octets separated by dots (Dotted Decimal Notation). A subnet mask defines which leading bits belong to the Network Prefix and which trailing bits identify the individual Host:

IP Address:   192.168.10.45       ->  11000000 . 10101000 . 00001010 . 00101101
Subnet Mask:  255.255.255.0 (/24) ->  11000000 . 11111111 . 11111111 . 00000000
--------------------------------------------------------------------------------
Network ID:   192.168.10.0        ->  11000000 . 10101000 . 00001010 . 00000000
Host ID:      45                  ->  00000000 . 00000000 . 00000000 . 00101101

When an application initiates a connection to a destination IP (e.g., 192.168.10.88), the Linux kernel routing subsystem performs a bitwise AND operation between the destination IP and the local interface subnet mask:

%%{init: {'flowchart': {'wrappingWidth': 600}}}%%
flowchart TB
    A["Outgoing Packet to Destination IP"] --> B["Kernel performs Bitwise AND:<br/>Dest IP & Local Subnet Mask"]
    B --> C{"Matches Local Network ID?"}
    C -->|"YES: Target is On-Link (Same LAN)"| D["Kernel bypasses Default Gateway.<br/>Sends ARP Request for Target MAC.<br/>Direct Layer-2 Delivery."]
    C -->|"NO: Target is Off-Link (Remote Net)"| E["Kernel queries Routing Table.<br/>Resolves Default Gateway IP MAC.<br/>Sends Frame to Router L2 MAC."]

Verifying Kernel Routing Decisions Live

You can query the kernel routing cache directly using ip route get <IP>: 

# Check routing to a local on-link host
ip route get 192.168.10.88
# Output: 192.168.10.88 dev eth0 src 192.168.10.45 uid 1000

# Check routing to a remote internet host
ip route get 1.1.1.1
# Output: 1.1.1.1 via 192.168.10.1 dev eth0 src 192.168.10.45 uid 1000

2. Comprehensive IPv4 CIDR Reference Sheet

In standard subnets, two IP addresses are reserved: 1. Network Identifier (All Host Bits = 0): Identifies the subnet itself. 2. Directed Broadcast (All Host Bits = 1): Sends packets to all hosts in the subnet.

Usable host addresses are calculated with the formula: 2^(32 - Prefix) - 2.

CIDR Prefix Subnet Mask Total IPs Usable Hosts Typical Infrastructure Role
/32 255.255.255.255 1 1 Single host route, Loopback VIP, WireGuard peer endpoint.
/31 255.255.255.254 2 2 (RFC 3021) Point-to-point router links (no network/broadcast waste).
/30 255.255.255.252 4 2 Legacy point-to-point firewall transit link.
/29 255.255.255.248 8 6 Small high-availability cluster (2 firewalls + 2 VIPs).
/28 255.255.255.240 16 14 Isolated DMZ segment (reverse proxies, bastion hosts).
/27 255.255.255.224 32 30 Dedicated database cluster or storage network.
/26 255.255.255.192 64 62 Department subnet or medium container host pool.
/25 255.255.128 128 126 Half of a /24 network segment.
/24 255.255.255.0 256 254 Standard server VLAN, homelab LAN, or Podman bridge.
/23 255.255.254.0 512 510 Large corporate office or virtual machine hypervisor farm.
/20 255.255.240.0 4,096 4,094 Cloud VPC availability zone supernet.
/16 255.255.0.0 65,536 65,534 Enterprise campus core or Kubernetes cluster CIDR.

3. RFC 1918 Private Ranges & Special Reserved Blocks

1. RFC 1918 Private IPv4 Ranges

These addresses are non-routable on the public internet and must be translated via NAT/Masquerading before accessing external WAN endpoints:

  • 10.0.0.0/8 (10.0.0.0 – 10.255.255.255): 16,777,216 IPs — Default choice for enterprise datacenters, multi-region cloud VPCs, and large WireGuard VPN meshes.
  • 172.16.0.0/12 (172.16.0.0 – 172.31.255.255): 1,048,576 IPs — Frequently utilized by Docker and Podman default bridge networks (172.17.0.0/16).
  • 192.168.0.0/16 (192.168.0.0 – 192.168.255.255): 65,536 IPs — Sliced into /24 subnets for homelabs, branch offices, and small business LANs.

2. Critical Special Reserved Ranges

  • 127.0.0.0/8 (Loopback): Traffic never touches physical wires; processed entirely inside the kernel via the lo interface.
  • 169.254.0.0/16 (Link-Local / APIPA): Automatically assigned when DHCP fails (RFC 3927). If your server holds a 169.254.x.x address, DHCP discovery timed out.
  • 100.64.0.0/10 (Carrier-Grade NAT / CGNAT - RFC 6598): Used by ISPs and fiber providers to share public IPv4 addresses among multiple subscribers.
  • 224.0.0.0/4 (Multicast): Used by dynamic routing protocols (e.g., OSPF 224.0.0.5, VRRP 224.0.0.18).

4. Variable Length Subnet Masking (VLSM) Enterprise Workshop

In enterprise network engineering, allocating fixed /24 subnets everywhere wastes massive amounts of IP space. VLSM allows engineers to subdivide a single prefix into variable-sized subnets tailored to exact workload needs.

Scenario: Slicing 192.168.10.0/24

Total Available Space: 192.168.10.0/24 (256 addresses)

+-----------------------------------+-----------------------------------+
|               192.168.10.0/25 (128 addresses)                         |
|               Reserved for Internal Workstations (120 hosts)          |
+-----------------+-----------------+-----------------+-----------------+
| 192.168.10.128  | 192.168.10.160  | 192.168.10.192  | 192.168.10.224  |
| /27 (32 IPs)    | /27 (32 IPs)    | /27 (32 IPs)    | /28 (16 IPs)    |
| Public DMZ      | DB Cluster      | Kubernetes Pods | Management VIPs |
+-----------------+-----------------+-----------------+--------+--------+
                                                      | .240   | .244   |
                                                      | /30    | /30    |
                                                      | P2P-1  | P2P-2  |
                                                      +--------+--------+

Partitioning Plan

Subnet Purpose Required Hosts Allocated CIDR Network ID Usable Host Range Broadcast
Workstations 100 hosts /25 192.168.10.0 192.168.10.1 – 192.168.10.126 192.168.10.127
Public DMZ 25 hosts /27 192.168.10.128 192.168.10.129 – 192.168.10.158 192.168.10.159
Database Tier 14 hosts /28 192.168.10.160 192.168.10.161 – 192.168.10.174 192.168.10.175
P2P Router Link 2 hosts /30 192.168.10.176 192.168.10.177 – 192.168.10.178 192.168.10.179

5. Linux Subnet Calculation & Automation Tooling

Install ipcalc and sipcalc on Debian to verify subnet calculations:

sudo apt update && sudo apt install -y ipcalc sipcalc

1. Generating Subnet Details with ipcalc

# Calculate boundaries, broadcast, and host counts
ipcalc 192.168.10.160/28

Output: 

Address:   192.168.10.160       11000000.10101000.00001010.1010 0000
Netmask:   255.255.255.240 = 28 11111111.11111111.11111111.1111 0000
Wildcard:  0.0.0.15             00000000.00000000.00000000.0000 1111
=>
Network:   192.168.10.160/28    11000000.10101000.00001010.1010 0000
HostMin:   192.168.10.161       11000000.10101000.00001010.1010 0001
HostMax:   192.168.10.174       11000000.10101000.00001010.1010 1110
Broadcast: 192.168.10.175       11000000.10101000.00001010.1010 1111
Hosts/Net: 14                   (Private Internet)

2. Splitting a Supernet into Smaller Subnets

# Slices 192.168.10.0/24 into four /26 subnets
ipcalc 192.168.10.0/24 -s 60

6. Next Steps

Now that you have mastered IPv4 subnet arithmetic and kernel routing decisions, transition to the modern world of 128-bit addressing and SLAAC autoconfiguration:

  • IPv6 in Practice (SLAAC, NDP & Dual-Stack)

    Explore 128-bit address architecture, Neighbor Discovery Protocol, router advertisements, and ICMPv6 firewall requirements.

    IPv6 in Practice Guide