⚡ Intermediate

Subnetting & CIDR

Subnetting is the practice of dividing a network into smaller, manageable pieces. Understanding it is critical for scoping targets and pivoting through networks.

Why Pentesters Need This

When you compromise a host, knowing the subnet tells you which other hosts are directly reachable. A /24 means 254 potential targets. A /16 means 65,534. Scope your pivoting accordingly.

IP Address Structure

Every IP address has two parts: the Network ID (which network it belongs to) and the Host ID (which specific device).

192.168.1.100 /24
Network ID
Host ID

CIDR Notation

Classless Inter-Domain Routing (CIDR) uses a suffix like /24 to indicate how many bits are used for the network portion. The remaining bits define how many hosts can exist in that network.

CIDR Subnet Mask Network Bits Host Bits Usable Hosts Common Use
/32 255.255.255.255 32 0 1 Single host
/30 255.255.255.252 30 2 2 Point-to-point links
/28 255.255.255.240 28 4 14 Small network segment
/24 255.255.255.0 24 8 254 Most common (Class C)
/20 255.255.240.0 20 12 4,094 Medium enterprise
/16 255.255.0.0 16 16 65,534 Large enterprise (Class B)
/8 255.0.0.0 8 24 16,777,214 Massive network (Class A)

📐 The Formula

Usable Hosts = 2(32 - CIDR) - 2

We subtract 2 because the first IP is the Network ID and the last is the Broadcast address.

Special Addresses in Every Subnet

Network ID

First address - identifies the network

192.168.1.0

Gateway (usually)

Often .1 or .254

192.168.1.1

Broadcast

Last address - reaches all hosts

192.168.1.255

Worked Example

Given: 10.50.25.67/20

Subnet Mask: 255.255.240.0
Network ID: 10.50.16.0
First Usable Host: 10.50.16.1
Last Usable Host: 10.50.31.254
Broadcast Address: 10.50.31.255
Usable Hosts: 4,094

Pentest Scenario

You land on 10.50.25.67/20. Now you know there are ~4,000 potential hosts from 10.50.16.1 to 10.50.31.254. Time to scan: nmap -sn 10.50.16.0/20

Quick Mental Math

For common subnets, memorize these "magic numbers":

/24
256 addresses
x.x.x.0-255
/25
128 addresses
Split at .128
/26
64 addresses
Split at .64
/27
32 addresses
Split at .32

Useful Commands

Find your IP and subnet (Linux) 
ip addr show
ip route
Find your IP and subnet (Windows) 
ipconfig /all
route print
Calculate subnet info (Linux) 
ipcalc 192.168.1.100/24
sipcalc 10.50.25.67/20
Scan entire subnet for live hosts 
nmap -sn 192.168.1.0/24
fping -a -g 192.168.1.0/24 2>/dev/null

Interactive Tool

Mental math is great for quick estimates, but use our calculator for accuracy.

🧮 Open Subnet Calculator

Calculate Network ID, Broadcast, Host Range, and more instantly.

→