Networking Tutorial · Networking Basics · Lesson 5 of 28
Subnets and CIDR
Read CIDR notation like 10.0.0.0/16, calculate how many addresses a subnet holds, and split a network into subnets.
CIDR notation
A subnet is a contiguous block of addresses. CIDR notation writes it as a network address plus the
number of fixed leading bits: 10.0.0.0/16 means "the first 16 bits are fixed", leaving 16 bits, or 65,536
addresses, for hosts.
| Prefix | Addresses | Typical use |
|---|---|---|
/16 |
65,536 | a whole cloud network (VPC) |
/20 |
4,096 | a large subnet (e.g. Kubernetes pods) |
/24 |
256 | a typical subnet |
/28 |
16 | the smallest AWS subnet |
/32 |
1 | a single host (common in firewall rules) |
Each extra prefix bit halves the size. The netmask is the same thing written as an address: /24 is
255.255.255.0.
import ipaddress
net = ipaddress.ip_network("10.0.0.0/16")
print("addresses:", net.num_addresses)
print("netmask: ", net.netmask)
print("first: ", net.network_address, " last:", net.broadcast_address)
Output
addresses: 65536 netmask: 255.255.0.0 first: 10.0.0.0 last: 10.0.255.255
Is an address in a subnet?
Firewall rules, route tables and security groups all ask this question.
import ipaddress
office = ipaddress.ip_network("203.0.113.0/24")
for ip in ["203.0.113.77", "203.0.114.1"]:
print(ip, "in", office, "->", ipaddress.ip_address(ip) in office)
Output
203.0.113.77 in 203.0.113.0/24 -> True 203.0.114.1 in 203.0.113.0/24 -> False
Splitting a network
Plan a network by carving a large block into equal subnets, for example one per availability zone and tier.
import ipaddress
vpc = ipaddress.ip_network("10.0.0.0/16")
subnets = list(vpc.subnets(new_prefix=20))
print(len(subnets), "subnets of /20 fit in", vpc)
names = ["public-a", "public-b", "public-c", "private-a", "private-b", "private-c"]
for name, net in zip(names, subnets):
print(f"{name:10} {str(net):15} {net.num_addresses - 5} usable on AWS")
Output
16 subnets of /20 fit in 10.0.0.0/16 public-a 10.0.0.0/20 4091 usable on AWS public-b 10.0.16.0/20 4091 usable on AWS public-c 10.0.32.0/20 4091 usable on AWS private-a 10.0.48.0/20 4091 usable on AWS private-b 10.0.64.0/20 4091 usable on AWS private-c 10.0.80.0/20 4091 usable on AWS
In a subnet, the first address (network) and the last (broadcast) aren't usable for hosts. Cloud providers reserve a few more: AWS and Azure reserve 5 addresses per subnet, Google Cloud 4.
Test yourself
How many addresses does a /22 contain?
2565121,0244,096
Show answer
Answer: 1,024
32 - 22 = 10 host bits, and 2 to the power of 10 is 1,024.