Subnetting & CIDR
Subnetting is the practice of dividing a network into smaller, manageable pieces. Understanding it is critical for scoping targets and pivoting through networks.
Why Pentesters Need This
IP Address Structure
Every IP address has two parts: the Network ID (which network it belongs to) and the Host ID (which specific device).
CIDR Notation
Classless Inter-Domain Routing (CIDR) uses a suffix like /24 to indicate how many bits are used for the network portion.
The remaining bits define how many hosts can exist in that network.
| CIDR | Subnet Mask | Network Bits | Host Bits | Usable Hosts | Common Use |
|---|---|---|---|---|---|
| /32 | 255.255.255.255 | 32 | 0 | 1 | Single host |
| /30 | 255.255.255.252 | 30 | 2 | 2 | Point-to-point links |
| /28 | 255.255.255.240 | 28 | 4 | 14 | Small network segment |
| /24 | 255.255.255.0 | 24 | 8 | 254 | Most common (Class C) |
| /20 | 255.255.240.0 | 20 | 12 | 4,094 | Medium enterprise |
| /16 | 255.255.0.0 | 16 | 16 | 65,534 | Large enterprise (Class B) |
| /8 | 255.0.0.0 | 8 | 24 | 16,777,214 | Massive network (Class A) |
The Formula
We subtract 2 because the first IP is the Network ID and the last is the Broadcast address.
The Magic Number Method
Forget memorizing tables. This 4-step method lets you calculate any subnet in your head in seconds.
The Core Concept: 256 Minus the "Interesting" Octet
The Magic Number = 256 - (subnet mask value in the interesting octet)
The "interesting octet" is where the subnet mask changes from 255 to something less. This magic number tells you the size of each subnet block.
Step 1: Find the Interesting Octet
| CIDR Range | Interesting Octet | Subnet Mask Pattern |
|---|---|---|
| /1 - /8 | 1st octet | X.0.0.0 |
| /9 - /16 | 2nd octet | 255.X.0.0 |
| /17 - /24 | 3rd octet | 255.255.X.0 |
| /25 - /32 | 4th octet | 255.255.255.X |
Step 2: Know Your Magic Numbers
Memorize this pattern — it's the same for every octet. The magic number is always 256 - mask value.
| Bits in Octet | Mask Value | Magic Number | CIDR Examples |
|---|---|---|---|
| 1 bit | 128 | 128 | /1, /9, /17, /25 |
| 2 bits | 192 | 64 | /2, /10, /18, /26 |
| 3 bits | 224 | 32 | /3, /11, /19, /27 |
| 4 bits | 240 | 16 | /4, /12, /20, /28 |
| 5 bits | 248 | 8 | /5, /13, /21, /29 |
| 6 bits | 252 | 4 | /6, /14, /22, /30 |
| 7 bits | 254 | 2 | /7, /15, /23, /31 |
| 8 bits | 255 | 1 | /8, /16, /24, /32 |
Memory Trick
Step 3: Find the Network ID
Take the interesting octet value from your IP. Find the largest multiple of the magic number that is ≤ that value.
Step 4: Find the Broadcast
The broadcast address is one less than the next network's start.
Complete Walkthrough: 172.16.57.200/22
Step 1: Which octet is interesting?
/22 falls in range /17-24 → 3rd octet is interesting
Subnet mask pattern: 255.255.X.0
Step 2: What's the magic number?
/22 means 22 bits for network. In the 3rd octet, that's 22 - 16 = 6 bits.
6 bits → mask value 252 → magic number = 256 - 252 = 4
Step 3: Find the Network ID
The 3rd octet value is 57. What's the largest multiple of 4 that's ≤ 57?
4 × 14 = 56 ✓ (4 × 15 = 60, too big)
Network ID: 172.16.56.0
Step 4: Find the Broadcast
Network ID (56) + Magic (4) - 1 = 59 in the 3rd octet
4th octet maxes out at 255
Broadcast: 172.16.59.255
✅ Final Answer
Practice Problems
Try these yourself before revealing the answers. Use the Magic Number Method!
Problem 1: 192.168.45.130/26
Interesting octet: 4th (/25-32 range)
Bits in octet: 26-24 = 2 bits → Magic = 64
130 ÷ 64 = 2.03 → floor to 2 → 2 × 64 = 128
Network: 192.168.45.128
Broadcast: 192.168.45.191 (128 + 64 - 1)
Host Range: .129 - .190 (62 hosts)
Problem 2: 10.200.100.50/19
Interesting octet: 3rd (/17-24 range)
Bits in octet: 19-16 = 3 bits → Magic = 32
100 ÷ 32 = 3.125 → floor to 3 → 3 × 32 = 96
Network: 10.200.96.0
Broadcast: 10.200.127.255 (96 + 32 - 1 = 127)
Host Range: 10.200.96.1 - 10.200.127.254 (8,190 hosts)
Problem 3: 172.31.200.1/13
Interesting octet: 2nd (/9-16 range)
Bits in octet: 13-8 = 5 bits → Magic = 8
31 ÷ 8 = 3.875 → floor to 3 → 3 × 8 = 24
Network: 172.24.0.0
Broadcast: 172.31.255.255 (24 + 8 - 1 = 31)
Host Range: 172.24.0.1 - 172.31.255.254 (524,286 hosts)
Problem 4: 192.168.1.67/29
Interesting octet: 4th (/25-32 range)
Bits in octet: 29-24 = 5 bits → Magic = 8
67 ÷ 8 = 8.375 → floor to 8 → 8 × 8 = 64
Network: 192.168.1.64
Broadcast: 192.168.1.71 (64 + 8 - 1)
Host Range: .65 - .70 (6 hosts)
Real-World Tip
Special Addresses in Every Subnet
Network ID
First address - identifies the network
192.168.1.0
Gateway (usually)
Often .1 or .254
192.168.1.1
Broadcast
Last address - reaches all hosts
192.168.1.255
Worked Example
Given: 10.50.25.67/20
Pentest Scenario
10.50.25.67/20. Now you know there are ~4,000 potential hosts from 10.50.16.1 to 10.50.31.254. Time to scan: nmap -sn 10.50.16.0/20
Quick Mental Math Cheat Sheet
For the most common subnets in the 4th octet, memorize these block sizes:
The One-Liner Method
For any IP/CIDR, ask yourself these 3 questions:
- 1. Which octet changes? (CIDR ÷ 8, round up)
- 2. What's the block size? (256 ÷ 2^(bits in that octet))
- 3. Which block am I in? (round down to nearest multiple)
Useful Commands
ip addr show
ip routeipconfig /all
route printipcalc 192.168.1.100/24
sipcalc 10.50.25.67/20nmap -sn 192.168.1.0/24
fping -a -g 192.168.1.0/24 2>/dev/nullInteractive Tool
Mental math is great for quick estimates, but use our calculator for accuracy.
Open Subnet Calculator
Calculate Network ID, Broadcast, Host Range, and more instantly.
Evidence Collection
Subnet work is arithmetic plus a reading of the device. Keep both, or the range you quote cannot be checked:
The arithmetic:
The network, broadcast, first and last host you reported, next to the CIDR string and mask they were derived from - with the ipcalc or sipcalc transcript if you used one.
The route table:
The ip route or route print output from the in-scope host, showing which prefixes are directly connected and where the default route points.
The VLAN-to-subnet map:
The device-side VLAN interface table (show ip interface brief, show vlan) or the client IPAM export that names each segment and its purpose.
Vantage and observation: The host and timestamp the range was enumerated from, plus the live-host count you actually observed against the count the formula predicted.
False Positive Identification
- Reachable is not local: Two hosts in different subnets that route to each other appear adjacent in topology tools and traceroutes. Only the mask decides what is on-link.
- Overlapping RFC 1918 space: The same 10.x or 192.168.x prefix is routinely reused across sites and behind NAT. A second 10.0.0.0/24 is a different network unless the route table says otherwise.
- Point-to-point and loopback prefixes: A /31 has two addresses and no network or broadcast; a /32 is a single host. Applying the "minus two" rule to either invents a host range that does not exist.
- Silence from a sweep: Hosts missing from a ping sweep are hosts that did not answer ICMP. Disable the sweep or move to ARP and TCP probes before claiming the segment is empty.
Remediation & Defense
Segmentation is a design decision made once and enforced forever - not a rule added after an incident.
Address plan
- • Size each segment for growth (a /24 minimum per function) and keep supernets contiguous per site so summarisation stays possible.
- • Reserve a documented range per environment so a lab prefix is never carved out of production space.
- • Keep the IPAM record and the device configuration as the same artefact - reconcile them on a schedule.
Enforcement
- • Put an ACL between every pair of segments that does not need to talk, and default-deny the rest.
- • Separate OT, management, data and user planes, and route them through a single inspected egress rather than a flat core.
- • Derive the host range from the device in front of you, not from a diagram - the diagram is the design, the device is the state.