The Complete IPv4 Subnetting, CIDR & VLSM Reference Manual

1. Historical Context: Classful Exhaustion & The RFC 1519 Paradigm Shift

When RFC 791 formally specified the Internet Protocol in 1981, the global network architecture was structured around a rigid system known as Classful Addressing. The 32-bit IPv4 address space (comprising 2³² = 4,294,967,296 theoretical unique addresses) was partitioned into five discrete classes—Class A, B, C, D, and E—derived strictly from the most significant bits (MSBs) of the first octet.

• Class A (0.0.0.0/8 to 127.255.255.255/8): Leading bit 0. Allocated 8 bits for the network identifier and 24 bits for host addressing, granting each of the 128 Class A assignments a colossal capacity of 2²⁴ - 2 = 16,777,214 usable host IP addresses.
• Class B (128.0.0.0/16 to 191.255.255.255/16): Leading bits 10. Split the 32-bit space evenly into 16 network bits and 16 host bits, yielding 65,534 usable hosts per block across 16,384 distinct networks.
• Class C (192.0.0.0/24 to 223.255.255.255/24): Leading bits 110. Allocated 24 bits to the network identifier and only 8 bits to hosts, capping each block at a modest 254 usable addresses across 2,097,152 networks.
• Class D (224.0.0.0/4) & Class E (240.0.0.0/4): Reserved exclusively for IP Multicast groups and experimental/future research respectively.

By the late 1980s, the explosive commercial adoption of TCP/IP triggered a severe structural crisis. Mid-sized enterprises routinely required more than 254 host addresses, making a single Class C assignment insufficient. However, granting a full Class B block (65,534 addresses) to an organization needing only 500 IP addresses resulted in an astounding 99% address waste rate. This coarse granularity rapidly depleted the unassigned Class B pool and caused an unmanageable explosion in global Border Gateway Protocol (BGP) routing table entries, as ISPs were forced to advertise thousands of fragmented Class C routes.

"In September 1993, the Internet Engineering Task Force (IETF) published RFC 1519, officially defining Classless Inter-Domain Routing (CIDR). CIDR permanently abolished rigid class boundaries, introducing variable-length prefix notation and saving the IPv4 architecture from premature collapse."

Under CIDR, a network boundary is no longer restricted to 8, 16, or 24-bit octet boundaries. Instead, an arbitrary integer prefix N (where 0 ≤ N ≤ 32) is appended to an IP address with a forward slash (e.g., 10.50.0.0/22). The integer N explicitly denotes the exact number of high-order contiguous 1-bits in the subnet mask vector. This granularity allows network architects to provision subnets sized precisely to operational host demands, ranging from a massive /12 cloud VPC space down to a concise /30 or /31 point-to-point link.

2. Mathematical Foundations: 32-Bit Unsigned Binary Conversion

Although human engineers interact with IPv4 addresses using Dotted-Decimal Notation (four base-10 integers separated by periods, e.g., 192.168.1.75), underlying networking silicon, operating system kernels, and hardware switch fabrics process IP addresses exclusively as raw 32-bit unsigned binary integers.

Converting a dotted-decimal IPv4 address (O₁, O₂, O₃, O₄) into its scalar 32-bit integer representation V₃₂ is governed by positional bit-shifting mathematics:

V_32 = (O_1 << 24) | (O_2 << 16) | (O_3 << 8) | O_4

Mathematical Expansion:
V_32 = (O_1 * 2^24) + (O_2 * 2^16) + (O_3 * 2^8) + (O_4 * 2^0)

Example: Converting 192.168.1.75
  Octet 1: 192 -> 11000000_2  (192 * 16,777,216 = 3,221,225,472)
  Octet 2: 168 -> 10101000_2  (168 * 65,536     =    11,010,048)
  Octet 3:   1 -> 00000001_2  (1   * 256        =           256)
  Octet 4:  75 -> 01001011_2  (75  * 1          =            75)
------------------------------------------------------------------
Total Unsigned 32-Bit Scalar Integer         = 3,232,235,851

In JavaScript and TypeScript engine runtimes (V8, JavaScriptCore), standard bitwise operations implicitly convert operands into signed 32-bit integers (two's complement). Consequently, performing a left shift on an octet like 192 (192 << 24) causes bit 31 to flip to 1, producing a negative integer (-1,073,741,824). To force the JavaScript runtime to interpret the binary result as an unsigned 32-bit scalar, network utility functions execute a zero-fill right shift by 0 bits (>>> 0):

// Production TypeScript IPv4 Conversion Engine
export function ipToLong(ip: string): number {
  const octets = ip.split('.').map(Number);
  return (((octets[0] << 24) | (octets[1] << 16) | (octets[2] << 8) | octets[3]) >>> 0);
}

3. Explaining Bitwise Routing Operations: AND (&), NOT (~), and OR (|)

Routers evaluate packet forwardability by executing hardware-level bitwise boolean logic across the 32-bit IP address vector and the Subnet Mask vector.

A. Subnet Mask Vector Generation

A subnet mask vector corresponding to CIDR prefix N (1 ≤ N ≤ 32) consists of N consecutive 1-bits starting from the MSB, padded with 32 - N 0-bits to the LSB. Mathematically, it is generated via binary left shift:

maskLong = (0xFFFFFFFF << (32 - N)) >>> 0;

For N = 26 (/26 Prefix):
32 - 26 = 6 host bits
0xFFFFFFFF << 6 = 11111111.11111111.11111111.11000000_2
Dotted-Decimal Equivalent = 255.255.255.192

B. Network Address Derivation via Bitwise AND (&)

The Bitwise AND operator compares corresponding bits of two 32-bit integers. The resulting bit is 1 if and only if both input bits are 1; otherwise, it resolves to 0.

Because the mask contains 26 leading 1s, the bitwise AND preserves the high-order 26 network bits of the IP address unchanged while zeroing out all 6 host bits. The resulting integer 192.168.1.64 represents the immutable Network ID.

C. Wildcard & Broadcast Derivation via Bitwise NOT (~) and OR (|)

The Wildcard Mask (the inverse of the subnet mask, utilized extensively in Cisco Access Control Lists and OSPF area declarations) is derived by executing a Bitwise NOT on the subnet mask vector:

wildcardLong = (~maskLong) >>> 0;

For /26 Subnet Mask (255.255.255.192):
~11111111.11111111.11111111.11000000_2
= 00000000.00000000.00000000.00111111_2
Dotted-Decimal Wildcard = 0.0.0.63

To compute the Directed Broadcast Address (the highest address in the block where all host bits are set to 1), the router executes a Bitwise OR (|) between the Network Address integer and the Wildcard integer:

broadcastLong = (networkLong | wildcardLong) >>> 0;

  11000000.10101000.00000001.01000000_2  (Network: 192.168.1.64)
| 00000000.00000000.00000000.00111111_2  (Wildcard: 0.0.0.63)
-----------------------------------------------------------------
= 11000000.10101000.00000001.01111111_2  (Broadcast: 192.168.1.127)

4. Hardware Silicon Physics: TCAM & Longest Prefix Match (LPM)

In core backbone routers (e.g., Cisco Nexus, Arista 7000 series, Juniper PTX), processing millions of packet headers per second per line card renders software-based RAM lookup algorithms far too slow. Enterprise routing silicon implements two specialized hardware concepts: Longest Prefix Match (LPM) and Ternary Content-Addressable Memory (TCAM).

When a router receives an IP packet, its Routing Information Base (RIB) may contain multiple overlapping CIDR matches for the destination address. For example, a packet heading to 192.168.1.75 matches all three of the following routing table rules:

• Rule 1: 10.0.0.0/8 (Default corporate aggregate)
• Rule 2: 192.168.0.0/16 (Regional branch aggregate)
• Rule 3: 192.168.1.64/26 (Local VLAN subnet)

The Longest Prefix Match (LPM) algorithm dictates that the router must always select the matching route entry with the highest prefix length N (the most specific route). In this case, Rule 3 (/26) is selected over Rule 2 (/16) and Rule 1 (/8).

High-Order 24 Network Bits: 11000000.10101000.00000001 (Stored as 1s and 0s)
Low-Order  8 Host Bits:    XXXXXXXX                  (Stored as Don't Care X)

1. The VLSM Paradigm: Eliminating Fixed Subnet Mask (FLSM) Waste

In Fixed-Length Subnet Masking (FLSM), an engineer partitions a network block into equal-sized subnets using a single, static prefix length applied across all segments. While administratively simple, FLSM leads to catastrophic address starvation in heterogeneous enterprise networks.

Consider a typical corporate branch requiring five distinct network segments:

1. Engineering & R&D Workstations: 110 hosts
2. Finance & HR Department: 50 hosts
3. Executive Management & Legal: 25 hosts
4. Internal Server Farm & DevOps: 12 hosts
5. Point-to-Point Router WAN Links (2 links): 2 hosts each

If an engineer provisions this branch using FLSM with a fixed /25 mask (126 usable hosts per subnet) to accommodate the 110-host Engineering department, every single segment consumes a full 128-address block. The point-to-point WAN links (requiring only 2 host IP addresses) waste 124 IP addresses each (a 98.4% waste rate).

Variable Length Subnet Masking (VLSM) (standardized in RFC 1009 and RFC 1812) solves this by enabling recursive subnetting. A parent CIDR address space is dynamically sub-divided into subnets with distinct prefix lengths tailored to exact host requirements.

2. Algorithmic Host Allocation & Natural Boundary Alignment

Executing an enterprise VLSM allocation requires strict adherence to a four-step mathematical algorithm:

3. Step-by-Step Enterprise Allocation Walkthrough Scenario

Let us execute a complete, real-world VLSM allocation. We are assigned a parent IP block of 10.50.0.0/24 (256 total addresses, spanning 10.50.0.0 to 10.50.0.255) to provision the multi-department branch described above.

By applying VLSM algorithms, we successfully satisfied all department requirements, provisioned two point-to-point WAN links, and preserved a contiguous 10.50.0.248/29 slack block for future growth—all within a single parent /24 allocation. Under FLSM, this topology would have required three full /24 blocks.

4. Route Aggregation & Summarization Strategy

Beyond address conservation, VLSM and CIDR enable Route Summarization (Supernetting). Route summarization collapses multiple contiguous specific routing table entries into a single aggregate prefix advertisement.

For example, an edge router managing four branch subnets (172.16.0.0/24, 172.16.1.0/24, 172.16.2.0/24, and 172.16.3.0/24) can summarize all four subnets into a single prefix: 172.16.0.0/22.

Binary Breakdown of Subnet Third Octets:
  172.16.0.0/24:  10101100.00010000.000000 00.00000000
  172.16.1.0/24:  10101100.00010000.000000 01.00000000
  172.16.2.0/24:  10101100.00010000.000000 10.00000000
  172.16.3.0/24:  10101100.00010000.000000 11.00000000
                  |<--- Common 22 Bits --->|
Summarized CIDR Advertised to BGP/OSPF: 172.16.0.0/22

Route summarization provides two critical benefits to enterprise routing stability:

1. LSDB/RIB Table Reduction: Reduces BGP global routing table memory consumption and speeds up switch ASIC hardware processing.
2. Route Flap Dampening Isolation: If an individual internal link in 172.16.2.0/24 flaps (repeatedly drops and recovers), only the local router recomputes OSPF Shortest Path First (SPF). External core routers advertising the aggregate 172.16.0.0/22 route remain completely stable, preventing global routing instability.

5. Comprehensive Subnet Prefix Quick-Reference Matrix

The reference matrix below details every CIDR prefix from /8 to /32, mapping prefix lengths to dotted-decimal masks, wildcard vectors, total IP block capacities, and usable host counts.