Visual walkthrough — Subnetting — subnet mask, network - host bits, VLSM

Prerequisites we lean on but rebuild here: Bitwise AND OR, Network and Broadcast Addresses, IPv4 Addressing. Parent: Subnetting.

---

Step 1 — An address is a row of 32 light switches

WHAT. Forget dots and decimals for a moment. An IPv4 address is just 32 switches in a row, each either off (0) or on (1). That's all a computer ever sees.

WHY start here. Every later idea — "network part", "host part", "mask", "AND" — is a statement about which switches we look at. If you don't picture the switches, the notation floats. So we earn the switches first.

PICTURE. In the figure the 32 switches are drawn in 4 groups of 8. Each group of 8 is an octet. Read one octet by adding the place-values of the switches that are on.

$$\underset{\text{switch 1}}{\underbrace{128}}+\underset{\text{switch 2}}{\underbrace{64}}=\underset{\text{octet value}}{\underbrace{192}}$$

Here the first two switches of an octet are on, the rest off, so that octet reads $192$. Every octet is between $0$ (all off) and $255$ (all on, since $128+64+\cdots +1=255$).

---

Step 2 — Draw the dividing line: network switches vs host switches

WHAT. Slide a vertical line somewhere along the 32 switches. Everything left of the line answers "which network am I on?". Everything right of the line answers "which house on that network am I?".

WHY a line and not a formula. A network is "a bunch of addresses that share the same left part." So drawing where the shared part ends is the definition of a network. The line's position is the only thing we ever change in subnetting.

PICTURE. The line splits the switches into a burnt-orange network block and a teal host block. Count the network switches — call that count $n$.

$$\underset{\text{network switches}}{\underbrace{n}}+\underset{\text{host switches}}{\underbrace{h}}=\underset{\text{total switches}}{\underbrace{32}}⟹h=32-n$$

Moving the line right grows $n$ (more, smaller networks) and shrinks $h$ (fewer houses each). It is a zero-sum trade — you can't gain on both sides.

---

Step 3 — The mask is a stencil that marks the line

WHAT. How does a computer remember where the line is? With a second 32-switch row called the subnet mask: it turns all network switches ON (1) and all host switches OFF (0).

WHY all-1s on the left, no gaps. In the next step we'll shine the mask through the address to keep the network switches and erase the host switches. For that to be a clean "keep-left, erase-right", the 1s must be packed on the left with no gaps. A gap would erase a network switch — nonsense. So the mask is always ones-then-zeros.

PICTURE. The mask row sits under the address row. Orange squares (1s) line up under network switches; teal squares (0s) under host switches. The boundary is exactly the line from Step 2.

$$\underset{\text{sw 1}}{\underbrace{128}}+\underset{\text{sw 2}}{\underbrace{64}}=192\Rightarrow \text{255.255.255.192}$$

So /26 and 255.255.255.192 are the same picture, told two ways.

---

Step 4 — Shine the mask through: the AND operation finds the network

WHAT. Line the address row over the mask row. Wherever the mask is 1, copy the address switch down. Wherever the mask is 0, force the result to 0. The result is the network address.

WHY the AND rule specifically. The rule "1 AND x = x, but 0 AND x = 0" is exactly a filter: mask-1 lets the switch through, mask-0 blocks it (forces off). That is precisely "keep the network part, zero the host part." The tool is bitwise AND because it's the only boolean op that behaves like this per-switch filter — OR would force things on, XOR would flip; only AND gates cleanly.

PICTURE. Three rows: address, mask, and the result underneath. Watch the 4th octet: 130 has switches for $128+2$; the mask's last-two-on stencil keeps the $128$ and blocks the $2$, giving $128$.

$$\underset{\text{IP}}{\underbrace{\text{...130}}}\text{AND}\underset{\text{mask}}{\underbrace{\text{...192}}}=\underset{\text{network address}}{\underbrace{\text{...128}}}$$

Term by term in that last octet: $130=128+2$, mask keeps bit-$128$, drops bit-$2$, result $=128$. So 192.168.10.130/26 lives on network 192.168.10.128.

---

Step 5 — Count what fits: why $2^h$ patterns, minus 2

WHAT. Freeze the network switches. Now wiggle only the $h$ host switches. Every distinct pattern of those $h$ switches is one possible house. How many patterns? $2^h$ — because each switch independently doubles the count.

WHY minus 2. Two of those $2^h$ patterns are stolen for special jobs (this is Network and Broadcast Addresses):

• all host switches OFF → the network address (the block's nameplate).
• all host switches ON → the broadcast address (shout to everyone).

Neither can be a real machine, so:

$$\text{usable hosts}=\underset{\text{all patterns}}{\underbrace{2^h}}-\underset{\text{name + broadcast}}{\underbrace{2}}$$

PICTURE. A little binary "odometer" of $h=6$ host switches: the first row (000000) glows plum as network, the last row (111111) glows plum as broadcast, and everything between is a usable house.

---

Step 6 — Block size gives the boundaries; place the address

WHAT. The block size is how many addresses live in one subnet $=2^h$. In the varying octet it also equals $256-(\text{mask octet})$. Subnets start at multiples of the block size.

WHY $256-\text{mask octet}$. The mask octet is "how much is filled from the left"; the leftover to the top of the octet ($256$) is exactly the host room $=2^h$ inside that octet. Same number, computed from the mask you already have.

PICTURE. A number line of the last octet $0\dots 255$ chopped every $64$: boundaries at $0,64,128,192$. A burnt-orange marker drops at $130$ and slides left to its block start $128$; the block ends one step before the next boundary.

$$\text{block size}=256-192=64\Rightarrow \text{boundaries: }0,64,128,192$$

Now the full drill for 192.168.10.130/26, each line annotated:

$$\begin{array}{ll}\text{subnet}& \mathrm{192.168.10.}\underset{130\text{ falls in }128\text{–}191}{\underbrace{128}}\\ \text{broadcast}& \mathrm{192.168.10.}\underset{\text{next boundary }192-1}{\underbrace{191}}\\ \text{first host}& \mathrm{192.168.10.}\underset{\text{network}+1}{\underbrace{129}}\\ \text{last host}& \mathrm{192.168.10.}\underset{\text{broadcast}-1}{\underbrace{190}}\end{array}$$

---

Step 7 — Edge and degenerate cases (the ones people skip)

WHAT. Slide the line all the way to the extremes and check the formulas still make sense.

WHY. A rule you only tested in the middle will bite you at the ends. We test every boundary of the line.

PICTURE. Three miniature switch-rows: /30 (host block = 2 switches), /31 (1 switch), /32 (0 switches), each with its usable-host count annotated.

Prefix	$h=32-n$	$2^h-2$	Meaning
/30	2	$4-2=2$	smallest normal subnet — a router-to-router link
/31	1	$2-2=0$	formula says 0! Used as a special 2-host point-to-point (RFC 3021), no net/bcast
/32	0	$1-2=-1$	a single exact host (a "host route"); the $-2$ rule breaks, so it's a special case
/24	8	$256-2=254$	a full classic Class-C sized block

Takeaway. The clean law $2^h-2$ is honest for $h\ge 2$. At $h=1$ and $h=0$ the reserve-two idea no longer fits (there aren't two spare patterns), so those are handled as named exceptions — never force the formula there.

---

Step 8 — VLSM: why big blocks must go first

WHAT. VLSM gives each subnet its own line position, sized to its need. Split 192.168.1.0/24 for A=100, B=50, C=25, D=2 hosts.

WHY largest-first. A subnet of block size $S$ must start on a multiple of $S$ (Step 6). A big block needs a big, rare alignment slot. If a small block lands in the middle first, it can knock the big block off its required boundary. Place big first and every later block still finds an aligned home.

PICTURE. A bar $0\dots 255$ filled left-to-right: /25 (128 wide) grabs 0–127, /26 (64) grabs 128–191, /27 (32) grabs 192–223, /30 (4) grabs 224–227. Each fits snugly on its own boundary; a red "WRONG" inset shows a /30 placed first at .0 leaving no aligned /25 slot.

$$\begin{array}{lll}\text{A: }100\text{ hosts}& 2^7-2=126\ge 100& \Rightarrow /25,192.168.1.0/25,.1\text{–}.126\\ \text{B: }50\text{ hosts}& 2^6-2=62\ge 50& \Rightarrow /26,192.168.1.128/26,.129\text{–}.190\\ \text{C: }25\text{ hosts}& 2^5-2=30\ge 25& \Rightarrow /27,192.168.1.192/27,.193\text{–}.222\\ \text{D: }2\text{ hosts}& 2^2-2=2\ge 2& \Rightarrow /30,192.168.1.224/30,.225\text{–}.226\end{array}$$

Each prefix is the smallest $h$ whose $2^h-2$ still covers the need — no wasted host block, no overlap.

---

The one-picture summary

This last figure stacks the whole journey: switches → line → mask → AND → block size → boundaries → VLSM bar. Trace it top to bottom and you've re-derived subnetting.

Recall Feynman retelling — the whole walkthrough in plain words

An address is 32 light switches (Step 1). We draw a line through them: left = which building, right = which flat (Step 2). The mask is a stencil that's solid over the building switches and hollow over the flat switches (Step 3). Shining the stencil through the address (AND) keeps the building part and blanks the flat part — that's the network address (Step 4). If there are $h$ flat switches, there are $2^h$ possible flats, but two are off-limits — the building's nameplate and its loudspeaker — so $2^h-2$ real flats (Step 5). All flats sit inside one block; blocks are $2^h$ wide and start at multiples of that width, so any address snaps to its block start, and the broadcast is one step before the next block (Step 6). At the extreme ends (/31, /32) the "minus two" story runs out, so those are special (Step 7). And when different groups need different sizes, hand out the biggest blocks first so each lands on its own aligned boundary (Step 8). That's it — one line, slid around, does everything.

---

Connections

• IPv4 Addressing — the 32-switch structure this page draws
• Bitwise AND OR — the filter in Step 4
• Network and Broadcast Addresses — the two reserved patterns in Step 5
• Routing Tables and Longest Prefix Match — why we prefer few, well-sized networks
• Default Gateway and ARP — the host uses the mask to decide local vs remote
• CIDR and Supernetting — sliding the line the other way