Subnet masking explained: CIDR calculation, subnetting, and network design

Every connected device on a Local Area Network (LAN) or Wide Area Network (WAN) requires an Internet Protocol (IP) address to send and receive packets. However, assigning thousands of devices to a single unmanaged network creates severe broadcast congestion, security vulnerabilities, and routing inefficiencies. Subnet masking solves this challenge by dividing large IP networks into smaller, logically isolated sub-networks known as subnets.

What is a subnet mask and how does it work?

An IPv4 address consists of 32 bits arranged into four 8-bit bytes (octets), represented in dotted-decimal format (such as 192.168.1.50). To route data packets correctly, network switches and routers must distinguish between two parts of this address:

1. Network identifier (Network ID): Specifies the specific sub-network to which the device belongs.
2. Host identifier (Host ID): Identifies the individual endpoint (such as a laptop, smartphone, access point, or printer) on that sub-network.

A subnet mask is a 32-bit companion filter that tells the router where the network identifier ends and the host identifier begins. In binary, a subnet mask uses contiguous 1s for network bits and contiguous 0s for host bits.

When a device attempts to transmit a packet, its operating system performs a bitwise AND operation between the destination IP address and its local subnet mask. If the resulting network address matches the local network ID, the packet is delivered directly across the local switch. If the network IDs differ, the packet is forwarded to the default gateway router for inter-VLAN or WAN routing.

Classful networking vs CIDR (Classless Inter-Domain Routing)

When IPv4 was introduced in 1981 under RFC 791, addresses were divided into rigid, fixed-length classes:

• Class A (1.0.0.0 to 126.0.0.0): Subnet mask 255.0.0.0 (/8 prefix). Reserved for massive multinational organisations, providing 16,777,214 hosts per network.
• Class B (128.0.0.0 to 191.255.0.0): Subnet mask 255.255.0.0 (/16 prefix). Provided 65,534 hosts per network.
• Class C (192.0.0.0 to 223.255.255.0): Subnet mask 255.255.255.0 (/24 prefix). Provided only 254 usable hosts per network.

Classful allocation proved highly inefficient. An enterprise requiring 500 IP addresses was forced to request a Class B network, wasting more than 65,000 unassigned addresses. In 1993, the Internet Engineering Task Force (IETF) introduced CIDR (RFC 1519), allowing network administrators to create variable-length subnets using slash notation (such as 10.0.0.0/22).

Complete IPv4 CIDR and subnet mask reference table

The following cheat sheet details the subnet mask, wildcard mask, and usable host capacity for standard enterprise IPv4 subnet allocations:

Worked example: calculating a /22 subnet for guest WiFi

To understand how subnet masks operate in binary arithmetic, consider an enterprise network team provisioning a guest WiFi scope using the network block 10.100.0.0/22:

1. Convert prefix to binary mask: A /22 prefix means the first 22 bits are set to 1 and the remaining 10 bits are set to 0:
   11111111.11111111.11111100.00000000
2. Convert binary octets to decimal:
   Octet 1: 11111111 = 255
   Octet 2: 11111111 = 255
   Octet 3: 11111100 = 252 (128 + 64 + 32 + 16 + 8 + 4)
   Octet 4: 00000000 = 0
   Resulting subnet mask: 255.255.252.0
3. Calculate total and usable hosts:
   Total IP addresses = 2^{(32 - 22)} = 2¹⁰ = 1,024
   Usable host addresses = 1,024 - 2 = 1,022 (subtracting the Network ID 10.100.0.0 and Broadcast Address 10.100.3.255).
4. Define usable IP range: 10.100.0.1 through 10.100.3.254.

Enterprise WiFi subnet design: preventing DHCP pool starvation

Network engineers designing wired corporate LANs typically assign standard /24 subnets (254 addresses) to each department, assuming devices remain connected for weeks. Applying this same logic to public and guest WiFi networks causes severe operational outages.

Public venues experience high visitor turnover. Furthermore, modern smartphones (iOS 14+, Android 10+, and Windows 11) employ private MAC address randomisation, generating new virtual hardware addresses when reconnecting or roaming across networks. A shopping centre or hotel with 400 concurrent visitors can easily consume over 1,500 DHCP leases across a 12-hour period.

If the guest VLAN is restricted to a /24 subnet (254 hosts) with a default 24-hour DHCP lease, the address pool will exhaust within two hours. Subsequent guests will experience connection failures, API timeouts, and captive portal loading errors.

Three rules for guest WiFi subnet architecture

• Deploy /22 or /21 subnets: Provision at least 1,022 (/22) or 2,046 (/21) usable IP addresses for high-density guest SSIDs to absorb peak daily turnover.
• Enforce short DHCP lease times: Set guest DHCP lease durations between 30 and 60 minutes. When a visitor leaves the venue, their allocated IP address returns to the available pool quickly.
• Enable Layer 2 client isolation and proxy ARP: While a /22 subnet creates a larger broadcast domain, enterprise wireless controllers eliminate broadcast overhead by enabling wireless client isolation. Access points drop client-to-client broadcast traffic and answer ARP requests directly from controller cache tables, protecting wireless airtime.

Automating network segmentation and access control with Purple

Modern enterprise environments require granular security boundaries between guest visitors, corporate staff, and automated IoT building systems:

• Guest WiFi captive management: Purple Guest WiFi integrates directly with enterprise hardware (Cisco Meraki, Aruba, Ruckus, Juniper Mist) to deliver branded onboarding, social logins, and automated bandwidth rate-limiting on guest subnets.
• Passwordless 802.1X staff access: Purple integrates with Microsoft Entra ID, Okta, and Google Workspace to provision certificate-based WPA3-Enterprise profiles, dynamically assigning staff devices to private corporate VLANs.
• Multi-tenant residential isolation: In Build-to-Rent (BTR) and student accommodation, Purple uses Identity Pre-Shared Keys (iPSK) to assign each resident an isolated /28 personal subnet, ensuring personal IoT devices (printers, smart TVs) remain invisible to neighbouring units.

For more details on securing wireless boundaries, explore our complete Enterprise WiFi Security Guide or test your configurations using our free Subnet Calculator tool.