IPv4 Subnetting: Binary, CIDR, and AWS Subnet Design

IPv4 subnetting divides one network into smaller, non-overlapping networks called subnets. It helps you organise workloads, control routing boundaries, distribute resources across Availability Zones, and plan address capacity.

This is Part 23 of the AWS Cloud Practitioner Study Notes series. Part 22 introduced CIDR blocks; this article shows how to calculate subnet counts, address ranges, network boundaries, and AWS-usable addresses.

Step 1: Understand IPv4

Every IPv4 address has 32 bits divided into four octets of 8 bits:

10.0.0.0
00001010.00000000.00000000.00000000
   8 bits     8 bits     8 bits     8 bits

Each octet can contain a value from 0 to 255, because 8 bits represent 2^8 = 256 values.

Step 2: Network bits and host bits

Consider:

10.0.0.0/16

The /16 means that the first 16 bits identify the network. The remaining 16 bits identify addresses inside that network.

Subnet mask:  11111111.11111111.00000000.00000000
              <------ network ------><--- host --->
                 16 network bits       16 host bits

The equivalent dotted-decimal mask is 255.255.0.0.

Network bits = prefix length
Host bits = 32 - prefix length

Step 3: Calculate total addresses

Use:

Total IPv4 addresses = 2^(host bits)
                      = 2^(32 - prefix length)

For 10.0.0.0/16, there are 32 - 16 = 16 host bits, so 2^16 = 65,536 addresses.

Prefix	Host bits	Total IPv4 addresses
/16	16	65,536
/17	15	32,768
/18	14	16,384
/19	13	8,192
/20	12	4,096
/21	11	2,048
/22	10	1,024
/23	9	512
/24	8	256
/25	7	128
/26	6	64
/27	5	32
/28	4	16

For AWS IPv4 subnets, subtract five addresses because AWS reserves the first four and last address. A /24 therefore has 256 total addresses and 251 available for resources.

Step 4: Create equal-sized subnets

To create equal-sized subnets, borrow host bits from the original prefix:

Number of subnets = 2^(borrowed bits)
New prefix = original prefix + borrowed bits

Required subnets	Borrowed bits	New prefix from /16
2	1	/17
4	2	/18
8	3	/19
16	4	/20
32	5	/21

Example: divide a /16 into four

Four subnets require two borrowed bits because 2^2 = 4. The new prefix is /18, and the ranges are:

Subnet	Address range
10.0.0.0/18	10.0.0.0 – 10.0.63.255
10.0.64.0/18	10.0.64.0 – 10.0.127.255
10.0.128.0/18	10.0.128.0 – 10.0.191.255
10.0.192.0/18	10.0.192.0 – 10.0.255.255

Step 5: Use the magic-number method

Binary explains the result, but the magic-number method is faster for subnet calculations.

For /18:

Subnet mask:  255.255.192.0
Magic number: 256 - 192 = 64

The interesting octet is the one that is neither 255 nor 0. Subnet network addresses begin at multiples of 64 in the third octet:

10.0.0.0/18
10.0.64.0/18
10.0.128.0/18
10.0.192.0/18

/19 example

/19 = 255.255.224.0
Magic number = 256 - 224 = 32

The boundaries are 0, 32, 64, 96, 128, 160, 192, 224, producing eight /19 subnets:

10.0.0.0/19       10.0.32.0/19
10.0.64.0/19      10.0.96.0/19
10.0.128.0/19     10.0.160.0/19
10.0.192.0/19     10.0.224.0/19

/20 example

/20 = 255.255.240.0
Magic number = 256 - 240 = 16

Valid third-octet boundaries include 0, 16, 32, 48, 64, 80, 96, 112, 128. This is why 10.0.50.0/20 is not a valid network address: 50 is not a multiple of 16. The range containing it starts at 10.0.48.0/20.

Find a subnet’s range

For 10.0.64.0/18, the magic number is 64. The next subnet starts at 10.0.128.0, so the current subnet ends one address before it:

Network address: 10.0.64.0
Last address:    10.0.127.255

The mathematical range is 10.0.64.0–10.0.127.255. AWS then reserves five addresses inside that range for an actual VPC subnet.

AWS multi-AZ subnet design

A subnet belongs to one Availability Zone, so a resilient production design creates equivalent subnets in at least two Availability Zones.

For a small VPC, you might use:

Tier	Availability Zone A	Availability Zone B
Public	10.0.1.0/24	10.0.2.0/24
Private	10.0.11.0/24	10.0.12.0/24

This gives four separate, easy-to-read subnets and leaves gaps for future tiers. An equal split of a /16 into four /18 ranges is also mathematically correct, but may be unnecessarily large for a small workload. Size subnets for expected network interfaces, AWS service requirements, peak scale, and future growth.

The labels “public” and “private” describe routing and exposure, not the CIDR itself. A subnet is public because its route table has a path to an Internet Gateway and its resources have appropriate public addressing; a CIDR such as 10.0.1.0/24 is not inherently public or private.

AWS reserved IP addresses

For 10.0.1.0/24, AWS reserves:

Address	Reservation
10.0.1.0	Network address
10.0.1.1	VPC router
10.0.1.2	VPC DNS server
10.0.1.3	Future use
10.0.1.255	Final address; VPC does not support broadcast

Available range:

10.0.1.4 – 10.0.1.254 = 251 usable addresses

AWS permits IPv4 subnet sizes from /28 to /16. A /28 has 16 total and 11 available addresses; a /16 has 65,536 total and 65,531 available before other allocations or service requirements.

Subnetting cheat sheet

Prefix	Subnet mask	Magic number	Boundary octet
/24	255.255.255.0	256	Fourth
/23	255.255.254.0	2	Third
/22	255.255.252.0	4	Third
/21	255.255.248.0	8	Third
/20	255.255.240.0	16	Third
/19	255.255.224.0	32	Third
/18	255.255.192.0	64	Third

Remember:

Total addresses = 2^(32 - prefix)
AWS usable IPv4 addresses = total addresses - 5

Cloud Practitioner exam focus

You do not need to memorise every binary conversion for the Cloud Practitioner exam. Understand these ideas:

• /16 has 65,536 total IPv4 addresses.
• /24 has 256 total IPv4 addresses.
• A longer prefix creates a smaller subnet.
• Subnets inside a VPC must not overlap.
• A subnet belongs to one Availability Zone.
• AWS reserves five IPv4 addresses in every subnet.
• 0.0.0.0/0 represents all IPv4 addresses, but it is not automatically an allow rule.
• Public or private status depends on routing, addressing, and security configuration—not the CIDR prefix alone.

Final takeaway

Subnetting divides a larger IPv4 network into smaller ranges. Start with the prefix length, calculate host bits and total addresses, borrow bits when you need equal subnets, and use the magic number to find valid boundaries and ranges.

In AWS, distribute subnets across Availability Zones, account for five reserved addresses, keep CIDRs non-overlapping, and leave capacity for growth. The key mental model is: the prefix controls the size, subnet boundaries control the range, and AWS reservations control usable capacity.

Sources

• Subnet CIDR blocks — Amazon VPC documentation
• Create a subnet — Amazon VPC documentation
• Subnets for your VPC
• Create a VPC — Amazon VPC documentation
• IP addressing for your VPCs and subnets