Subnetting and CIDR - Simply Explained

0:00 Welcome to the M365 FM podcast, where we explore the people, ideas and technologies shaping the future of work. Why your home router is already doing subnetting. Your home Wi-Fi router has been subnetting this whole time, and nobody told you. Every device on your network sits inside a block of two hundred fifty six addresses. And that block is what people mean when they say subnet. You might think subnetting has nothing to do with your job, but the moment you create an Azure Virtual network, you type one of these ranges yourself. The real tension here is that the idea is simple, and the notation is the one thing that scares people. By the end, you'll read something like ten point oh, one point oh two four and know exactly what it means, and you'll know the one mistake that breaks hybrid networks. So before we go anywhere near Azure, look at the box sitting in your hallway, your home router hands out addresses that all begin with the same numbers, something like one nine two dot one six eight one, and it gives every device its own ending.

0:46 Your laptop takes one, your phone takes one, the printer takes one, and the television takes one. Together, those addresses make one block of two hundred fifty six and that block is a subnet. Subnetting is the practice of taking a large block of addresses and carving out a smaller block for one group of devices. And that's the whole idea. A company might give one block to the laptops, another to the phones, a third to the storage, and a fourth to the cameras with guests on the WiFi getting their own. Each of those is a subnet and each one is a slice of something bigger. What matters for everything that follows is that a block has a size, and the size is where people get lost. You can't just pick any starting and ending address you like, because a block has to line up on certain boundaries, and the notation that describes those boundaries is what we're going to decode next. Once you see it, it stops looking like a code.

1:28 What an IP address is made of. An IPv4 address is four numbers separated by dots. And each of those numbers is called an octet. An octet holds eight bits, and eight bits can express any value from zero to two hundred and fifty five, which is why you never see a bigger number inside an address. The reason two fifty five is the ceiling is that eight binary digits set to one add up to one hundred and twenty eight plus sixty four plus thirty two plus sixteen plus eight, plus four plus two plus one. And that total is two fifty five. Picture eight light switches in a row where each switch is worth double the one before it, and flipping all eight on gives you the largest value the octet can hold four octets of eight bits. Each comes to thirty two bits, and thirty two bits of possibilities works out to about four point three billion addresses.

2:09 That's the entire internet, and it's a smaller supply than most people expect. One detail makes subnetting click. A single address is doing two jobs at once, because part of it names the network, and part of it names the device inside that network. Take one hundred and ninety two point one six eight one one two three one thirty two, which Microsoft uses in its own beginner documentation. The first three octets one hundred and ninety two point one six eight one twenty three. Describe the network and the final octet one hundred and thirty two describes the device. A second number, called the subnet mask, tells you where the network part stops and the host part begins. Without that mask, an address is just four numbers, and you have no way of knowing which digits are the street and which are the house number. The split matters because routers don't memorize where every single machine lives. A router only needs to know which network a device belongs to, and it keeps a table of routes to move traffic toward that network.

2:55 Once the packet reaches the right network. The last stretch of delivery is straightforward, which is why the network part of an address gets all the attention. That also explains why the mask isn't optional. The mask is the instruction sheet that says how much of the address is fixed and how much is free. Change the mask and you change how many devices can share one network. Change it enough, and two machines sitting side by side can end up believing they live on different networks, which is one of the failures we'll untangle later. The slash number is just a size. A subnet mask looks like an address, four numbers with dots between them, and the most common one is two, five, five two, five five five two five five five point zero. To read it, you compare it against the address above it. Wherever the mask shows a two fifty five, the matching part of the address is locked as the network.

3:35 Wherever it shows a zero, the matching part is free for hosts. Now two hundred and fifty five in binary is eight ones, so two fifty five point two five five two five five point zero is really twenty four ones, followed by eight zeros. Count those ones and you get the shortcut everyone uses, which is a slash followed by the number of ones. That's why two fifty five point two five five seven two five point oh and twenty four are the same things at two different ways. The slash number is a size and nothing more mysterious than that. A twenty four locks twenty four bits for the network and frees the last eight. So the block holds two hundred and fifty six addresses, a twenty three, locks twenty three bits and freeze nine, which gives you five hundred and twelve addresses, a sixteen lock, sixteen bits and freeze sixteen, which gives you sixty five thousand two hundred and thirty six addresses.

4:17 At the small end, a twenty nine gives you eight addresses and a thirty two is a single machine, while a zero covers the entire internet. One thing about a block catches almost everyone. The first address is the network address, and the last address is the broadcast address, and neither of them can be handed to a device. That means a twenty four holds two hundred fifty six addresses, and only two hundred and fifty four of them are usable because two addresses in every block are spoken for before you start, that's the first place a beginner's arithmetic goes wrong, and it won't be the last. There's one honest exception, because rules like this always have one modern point to point. Links between two routers use a thirty one, which is only two addresses, and the old reservation gets set aside so both of them can be used for everything a beginner touches. The first and last address.

4:57 Stay reserved. A block has to start where it starts, because the size and the starting point are tied together. A block of two hundred fifty six can only begin on a multiple of two fifty six. A block of sixty four can only begin on a multiple of sixty four, and so on down the line. You can't have a block that runs from one ninety two point one six eight one point five to one ninety two point one six two, eight point one point one three seven, because those boundaries don't line up. This is the rule that makes subnetting feel arbitrary until the pattern appears and the pattern is just doubling. Hold on to that two hundred fifty four number because it's about to get smaller when you build that network in the cloud. The platform takes a few more addresses off the top, and the reason is worth understanding why we split a network at all. Now we reach the question underneath all of this, which is why anyone bothers.

5:38 If one flat block of addresses works, there has to be a reason to carve it into smaller pieces. Start with noise. When devices share one network, they hear each other. So a machine that chatters constantly competes for attention with every other device in that block. That could be a backup server, or a misbehaving printer or a phone syncing photos all afternoon. Split the network and the chatter stays inside its own group. Then there's separation. If the guest WiFi and the file server sit in one block, a guest device can try to reach the file server directly, put them on separate blocks and reaching across becomes a deliberate act. Instead of an accident, which is the property you want around phones, cameras and the machines that handle money. And there's the plain matter of keeping things manageable. Handing out separate blocks and writing them down is easier than tracking one enormous pile of addresses.

6:21 And when a new office opens, you give it a block instead of redesigning everything. There's one more piece you need, and it's called the default gateway. When your device wants to talk to something outside its own block, it doesn't shout into the void. It hands the traffic to the router and the router moves it along. Your device works out whether the destination is local or remote by comparing its own address and mask against the destination, which is the same mask we've been talking about the whole time. The mask isn't just bookkeeping. It decides thousands of times a minute whether a device talks directly to its neighbor or goes through the gateway. That decision is also why a mask can make a machine reach the far side of the world, while failing to reach the printer in the next room. Now that the reason for the split is clear, the arithmetic behind it turns out to be smaller than it looks.

7:03 The math without fear. This is the part where most explanations lose people, so the smallest possible version is the one worth doing. Subnetting means borrowing bits from the host part of an address and giving them to the network part, and every bit you borrow doubles the number of networks, while halving the number of devices each one can hold. Take Microsoft's own worked example because it's clean. Start with one block of two hundred fifty six addresses and apply the mask two five five two five five one two five five one nine two. That last octet is eleven thousand thousand in binary, so you borrow two bits. Two borrowed bits give you four networks and the six bits left over. Give each network sixty two usable addresses. Since the first and last address in each one are reserved, you turned one block of two fifty six into four blocks of sixty four, and every one of those four gives you sixty two devices.

7:47 Nothing was added and nothing was lost because you simply drew new fences inside one field. Now put that to work. Imagine a small office with fifty people today and a plan to open a second location next year. You could choose a block that fits fifty devices and move on with your day. Growing out of your range later means renumbering machines and renumbering machines is a bad afternoon, so pick a block with room to spare and skip that entirely. Two things are worth remembering, because between them, they cover most real situations. The usable count in a block is the size of the block minus two, and the block sizes themselves always double. So eight, sixteen, thirty two, sixty four, one hundred and twenty eight, two, fifty six and upward. If you can double the number and take two away, you can size the network. The whole trick fits in one sentence.

8:27 A bigger number means a smaller network, and a smaller number means a bigger network. A twenty five is half of a twenty four, a twenty six is half of a twenty five. And every step down that list doubles the devices you can fit. That's the entire arithmetic, and there's no hidden layer underneath it. The part that trips people up is the notation rather than the idea, which is what the early architects of the internet discovered the hard way. Where the classes went and why. Sida one one piece of history explains why this notation exists at all. The original plan for addresses came from a nineteen eighty one document called RFC seven ninety one, and it divided addresses into classes. Class A used the first octet for the network and handed out roughly sixteen million addresses at a time. Class B used the first two octets and handed out sixty five thousand five hundred and thirty six.

9:12 Class C used the first three octets and handed out two hundred and fifty six. Read those three sizes again, because the problem is hiding in plain sight. You could get sixteen million addresses, or sixty five thousand five hundred and thirty six or two hundred and fifty six, and there was nothing in between. A company that needed a few thousand addresses had to accept sixty five thousand five hundred and thirty six and waste most of them, while a company that needed forty got two hundred fifty six. Instead, multiply that waste across the whole internet and you burn through the supply quickly. Roughly four point three billion addresses is all there ever was, and the class system spent them like the well would never run dry. The networking world scrapped the classes, a specification called RFC fifteen nineteen, published in September nineteen ninety three, introduced classless inter-domain routing, which everyone now shortens to Sidr.

9:56 Sidr dropped the fixed sizes and allowed a block to be any power of two size. So eight, sixteen, thirty two, one hundred and twenty eight, two hundred and fifty six, five hundred and twelve and upward are all fair game. That single change is why a modern network can be sized to fit instead of being forced into the nearest oversized box. It's also why you can order a block of the addresses you need and not a single one more. There's one honest left over here. Some organizations still hold enormous blocks that were handed out under the old system, and older documentation still says class C, even though the classes are long gone. You'll run into both of those, and now you'll know why. Subnetting in real life, your office, your home, your VPN. That's enough theory because this is where you meet it, starting with the place you're sitting right now. Your home router probably broadcasts two networks, one for you and one for guests.

10:40 And that guest network is a separate block. It's the reason a visitor can get online without being able to see your printer, your laptop, or the folder you left shared by accident. An office does this on a larger scale. Staff machines sit on one block, phones on another, security cameras on a third, and guest access somewhere else entirely. The point isn't tidiness. The point is that a camera with a default password can't wander over to the server because the two of them don't share a network. There's a version of this in the office that surprises people. Two departments can share one floor and plug into one switch while still being on different blocks, because a block is a logical decision rather than a physical one. The cable doesn't decide where a device lives. The address and the mask do. Now for the detail that sets up everything about the cloud. When your office connects back to a data center over a private link, that link needs a block of addresses that doesn't collide with anything you already use.

11:27 Two networks on one range are like two families sharing one street address, and the postman has no idea which door to knock on. This is a small sounding rule that causes enormous headaches later, and we'll see exactly how in a minute. The honest limit is that at home, you don't need to manage any of this. Your router ships with sensible defaults, and for most people, that's the right answer. The moment you build something in the cloud, though, the default stop being invisible and the choices become yours. That's the shift worth noticing at home. Someone else decides for you in the cloud. You decide, and then you live with it. Most of the pain people feel in Azure networking traces back to a range that somebody picked in a hurry during a first deployment. Subnetting in Azure. Azure is where this stops being abstract. A virtual network is a network you define in software, and you give it a private address range when you create it.

12:09 Azure uses the standard private ranges for this, which are ten point naught point zero one zero eight one hundred and seventy two point one six, zero point zero to twelve, and one hundred and ninety two point one six eight dot zero dot zero sixteen, and those ranges are set aside for private use, so they never clash with the public internet. Once you have that range, you carve subnets out of it. The way we carved blocks earlier. You use the masks and slash numbers we've already covered, and the arithmetic doesn't change. The only thing that changes is where you type it, because now it goes into a portal or a template instead of a router. That count I promised would get smaller, does get smaller in Azure and the number catches everyone. Azure reserves five addresses in every subnet. The first is the network identifier, the second is the default gateway. The third and fourth are used for Azure's internal DNS, and the last is the broadcast address.

12:53 That's five addresses gone. Before you assign a single device, the twenty four that gave you two hundred and fifty four usable addresses at home gives you two hundred fifty one in Azure, it's one block of two hundred fifty six. Either way, just three fewer devices go smaller and the numbers tighten fast because the smallest subnet Azure supports is at twenty nine, which leaves you three usable addresses. Microsoft's own three tier example makes it concrete. The web servers go in ten point oh one point oh two for the application, logic goes in ten point zero seven, two point zero twenty four, and the data tier goes in ten point oh three point zero twenty four. That gives you three subnets, each with its own traffic rules, so the data tier can accept connections from the application tier and nothing else. And here is the mistake from the opening.

13:34 If the range you choose for your virtual network overlaps the range your office already uses, routing breaks traffic can end up at the wrong destination, or it can simply vanish with no error message at all. And tracking that down is hard because nothing looks obviously broken. Microsoft's guidance is to plan one large range and subdivide it to leave at least thirty percent headroom in each subnet for growth and to keep blocks from overlapping across environments. Some Azure services also need a subnet of their own, with a required name and a fixed minimum size, which is why a real design ends up with a gateway subnet and a firewall subnet sitting alongside your workload. Subnets. What this means for Microsoft three hundred sixty five. Which brings us to Microsoft three hundred sixty five. And here I'll be straight with you. Microsoft three. three hundred sixty five is a service you connect to over the internet.

14:15 It isn't a network you subnet, and none of this is required to use teams outlook or SharePoint. Microsoft's own documentation goes even further. It doesn't recommend Expressroute for Microsoft three hundred sixty five in most cases, because a private circuit isn't the better path for most customers, and using one requires Microsoft's authorization. For most organizations, the internet is the right road. Subnetting shows up in Azure network behind your apps and in the office network that reaches it. That's the seam where these two worlds meet, and it's the part worth knowing what to remember. And one question for you. So here's the short version. The slash number is a size. The first and last addresses in a block aren't usable. Five more come off the top in Azure, which is why a twenty four gives you two fifty one there instead of two fifty four. And overlapping ranges are the mistake that breaks the connection between your office and your cloud.

14:59 My question for you is this which network in your world is still one big flat block with everything from the printers to the cameras sharing one range? If this made the topic feel less intimidating, subscribe to M365 FM to master the tools and the mindset shaping the future of work.