A Subnet (Subnetwork) is a logical subdivision of an IP network. By partitioning a large network into smaller, isolated sub-networks, organization network administrators minimize broadcast noise, enhance security isolation, and optimize Layer 3 routing efficiency across local and cloud environments.

Every IPv4 address is a 32-bit binary number represented in 4 decimal octets separated by dots. Understanding bit values, positional binary weights ($128, 64, 32, 16, 8, 4, 2, 1$), and bitwise operations is fundamental to networking.

CIDR (Classless Inter-Domain Routing) specifies how many leading bits in an IP address represent the network prefix. Adjust the slider or click any bit box below to interactively observe how changing prefix length affects subnet mask, bit allocation, total addresses, and usable host count.

Variable Length Subnet Masking (VLSM) allows network engineers to subdivide an IP address space into non-uniform subnets tailored to exact host requirements. Instead of assigning a fixed mask (like `/24`) everywhere, VLSM prevents IP address exhaustion by assigning larger masks (e.g., `/26`, `/27`, `/30`) where fewer hosts reside.

192.168.1.0/24 (256 Total IPs)
├── 192.168.1.0/26   [Engineering: 50 hosts required, 62 usable (.1-.62)]
├── 192.168.1.64/27  [Sales:       25 hosts required, 30 usable (.65-.94)]
├── 192.168.1.96/28  [Executive:   10 hosts required, 14 usable (.97-.110)]
├── 192.168.1.112/30 [Router Link 1: 2 hosts required, 2 usable (.113-.114)]
├── 192.168.1.116/30 [Router Link 2: 2 hosts required, 2 usable (.117-.118)]
└── 192.168.1.120/24 [Reserved Future Allocation Pool: 136 IPs remaining]

While both VLANs (Virtual LANs) and Subnets isolate network traffic, they operate at different layers of the OSI model. Understanding how Layer 2 physical switch isolation pairs with Layer 3 IP addressing is essential for modern enterprise network design.

IPv6 replaces IPv4's 32-bit address space with a massive 128-bit address space ($3.4 \times 10^38$ total addresses). Designed to eliminate NAT workarounds, IPv6 provides end-to-end global connectivity, built-in IPsec security, stateless auto-configuration (SLAAC), and simplified router headers.

IP addresses are split into globally routable Public IPs and localized Private IPs. Because IPv4 addresses are scarce, Network Address Translation (NAT) allows hundreds of devices on a private LAN to share a single public IP address when communicating over the internet.

Enter an IPv4 address and select a CIDR prefix length to calculate network boundaries, broadcast addresses, usable host ranges, and subnet masks in real time.

Building custom subnets on a local area network requires methodical planning and accurate configuration across your gateway router, managed switches, and endpoint operating systems. Follow this 4-step workflow to partition and verify your subnets.

! Step 2: Configure Router Sub-Interfaces (Router-on-a-Stick)
interface GigabitEthernet0/0.10
 description LAN_Subnet_Staff
 encapsulation dot1Q 10
 ip address 192.168.10.1 255.255.255.0
 no shutdown
!
interface GigabitEthernet0/0.20
 description LAN_Subnet_Guest
 encapsulation dot1Q 20
 ip address 192.168.20.1 255.255.255.0
 no shutdown

# Assign Static IP & Netmask on Windows via Netsh
netsh interface ip set address name="Ethernet" static 192.168.10.50 255.255.255.0 192.168.10.1

# Configure Primary DNS Server
netsh interface ip set dns name="Ethernet" static 1.1.1.1

# 1. Verify Gateway Reachability
ping 192.168.10.1

# 2. Test Inter-Subnet Routing to Guest Subnet
ping 192.168.20.50

# 3. Trace Route Path across Gateway (Windows / Linux)
tracert 192.168.20.50   # Windows
traceroute 192.168.20.50 # Linux / macOS

Supernetting (also called CIDR Route Aggregation or Route Summarization) is the process of combining multiple contiguous smaller networks into a single, shorter-prefix network route. This dramatically reduces core routing table sizes and conserves memory on enterprise network backbones.

Cloud hyperscalers (AWS, Azure, GCP) use Software-Defined Networking (SDN) to deliver virtual private clouds. While cloud subnets share traditional CIDR math, cloud vendors enforce vendor-specific IP reservations, availability zone scopes, and routing rules.

# AWS VPC & Subnet Terraform Example
resource "aws_vpc" "main" {
  cidr_block = "10.0.0.0/16"
}

resource "aws_subnet" "public_az1" {
  vpc_id            = aws_vpc.main.id
  cidr_block        = "10.0.1.0/24"
  availability_zone = "us-east-1a"
}

Subnetting divides physical networks into isolated broadcast domains, but routers forward traffic between subnets by default. Firewalls & Access Control Lists (ACLs) enforce Zero-Trust boundaries by inspecting and filtering packet headers at subnet gateways.

! Cisco Extended Access Control List (ACL 100)
! 1. Allow Web Subnet (VLAN 10) to access Database Subnet (VLAN 20) on PostgreSQL port 5432
access-list 100 remark --- Permit Web to DB Postgres ---
access-list 100 permit tcp 192.168.10.0 0.0.0.255 192.168.20.0 0.0.0.255 eq 5432

! 2. Allow Web Subnet (VLAN 10) to access Shared HTTPS Services (VLAN 30)
access-list 100 remark --- Permit Web to Shared HTTPS ---
access-list 100 permit tcp 192.168.10.0 0.0.0.255 192.168.30.0 0.0.0.255 eq 443

! 3. Explicitly DENY all remaining inter-subnet traffic & log violation attempts
access-list 100 remark --- Deny & Log all other cross-subnet packets ---
access-list 100 deny ip 192.168.10.0 0.0.0.255 192.168.20.0 0.0.0.255 log

! 4. Apply ACL inbound on VLAN 10 Interface
interface GigabitEthernet0/0.10
 ip access-group 100 in

Subnetting issues can lead to subtle network failures, including host isolation, asymmetric routing, IP conflicts, and cross-subnet packet drops. Master these 6 diagnostic scenarios and follow the 6-step troubleshooting workflow.

# Windows: Inspect IPv4 Subnet Mask
ipconfig /all

# Linux: Verify assigned IP & Prefix length
ip -4 addr show dev eth0

Master subnetting with real-world scenarios and certification-style drill questions. Test your calculations for network boundaries, host ranges, broadcast addresses, and VLSM allocations, then toggle answers to verify your steps.

Quick-reference hub containing essential subnet formulas, comprehensive CIDR prefix lookup tables (/8 through /32), and mental math shortcuts for rapid network calculations in exams and production deployments.

Click an answer to check it. Your score is tracked at the bottom.

Modern cloud-native systems rely on virtualized network namespaces (netns), virtual ethernet pairs (veth), overlay tunnels, and kernel-level packet manipulation. Discover how Kubernetes CNI plugins, Docker isolation modes, and Layer 4/7 load balancers route microservice traffic at scale.

# Cilium L7 HTTP NetworkPolicy Example
apiVersion: "cilium.io/v2"
kind: CiliumNetworkPolicy
metadata:
  name: secure-api-access
spec:
  endpointSelector:
    matchLabels:
      app: payment-service
  ingress:
  - fromEndpoints:
    - matchLabels:
        app: checkout
    toPorts:
    - ports:
      - port: "8080"
        protocol: TCP
      rules:
        http:
        - method: "POST"
          path: "/v1/charge"

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: production-ingress
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
spec:
  ingressClassName: nginx
  rules:
  - host: api.company.com
    http:
      paths:
      - path: /v1/users
        pathType: Prefix
        backend:
          service:
            name: user-service
            port:
              number: 8080
      - path: /v1/orders
        pathType: Prefix
        backend:
          service:
            name: order-service
            port:
              number: 9090

Master essential network troubleshooting CLI utilities (ping, traceroute, mtr, iperf3, dig, nmap). Test commands interactively in the simulated bash terminal sandbox, execute instant command presets, and reference the diagnostic cheat sheet.

Routers are the backbone of IP communications. They build forwarding decisions by evaluating packet destination addresses against local Routing Tables. Explore how routers learn paths dynamically via IGP & EGP Protocols, maintain seamless default gateway uptime with HSRP/VRRP Redundancy, condense massive ISP tables using BGP Aggregation, and execute Longest Prefix Matching.

Every interaction on the internet depends on Packet Encapsulation—the process where raw application data is wrapped layer-by-layer with Transport headers, IP headers, and Ethernet frames before physical transmission over the wire. Understanding header bit fields, stateful TCP handshakes, and PCAP analysis tools like Wireshark is essential for network engineering and security analysis.

Modern Enterprise Wireless LANs (WLANs) seamlessly bridge unguided RF radio signals to wired Ethernet infrastructures. This section explores SSID-to-VLAN mapping, Wireless LAN Controller (WLC) topologies, RF spectrum frequency bands (2.4GHz, 5GHz, 6GHz), Channel Bonding, and real-time Signal Propagation & Interference dynamics.

Modern cloud and enterprise networks enforce defense-in-depth through multi-layered access control mechanisms. From Stateless Subnet NACLs and Stateful Instance Security Groups to Encapsulated Overlay Tunnels (VPN & VXLAN) and Network Address Translation (NAT), secure network architectures protect workloads at every hop.