Subnets and CIDR
“What does `10.4.16.0/20` mean? How does a host decide whether a destination is on its own subnet, and what happens differently if it is not?”
What this tests
- CIDR arithmetic without a calculator
- The on-link vs via-gateway decision every host makes
- Why subnets exist at all
Answers by level
Read the beginner answer first and notice what is missing.
10.4.16.0/20 describes 2^12 = 4,096 addresses from 10.4.16.0 to 10.4.31.255; the mask 255.255.240.0 keeps the first 20 bits. In IPv4 the first (network) and last (broadcast) addresses are conventionally unusable, so 4,094 hosts. The prefix length is the whole story — dotted masks are just a notation for it.
Before sending any packet, a host ANDs the destination with its own mask and compares the result with its own network: 10.4.20.7 & /20 = 10.4.16.0 — same network → on-link: resolve the destination’s MAC with ARP (IPv4) or Neighbor Discovery (IPv6) and send the frame directly. 10.4.40.7 & /20 = 10.4.32.0 — different → off-link: look up the routing table (usually the default route), resolve the gateway’s MAC instead, and send the frame to the gateway with the destination IP unchanged. The packet looks the same; only the Ethernet destination differs.
Subnets exist because a flat network does not scale: broadcast domains must stay small, routing tables must aggregate (one /20 route instead of 4,096 host routes), and boundaries are where policy (firewalls, ACLs) attaches. Getting the mask wrong on a host is a classic failure: a host that believes it is /16 on a /20 network will try to ARP for addresses that are actually behind the router, and get silence.
Green flags · Red flags
- Computes range, mask and host count from the prefix length
- Explains the AND-and-compare decision and what changes in the frame (the MAC, not the IP)
- Says why subnets exist: broadcast domains, route aggregation, policy boundaries
- Knows IPv4 network/broadcast conventions and that IPv6 has no broadcast
- Cannot convert
/20to a mask or a range - Thinks the router is involved for on-link traffic
- Believes the destination IP changes when sending via the gateway
- Treats IPv6 subnets as "bigger IPv4 subnets"
Follow-up questions
/24s fit in a /20?10.4.20.7/16 on a network that is really /20. What breaks?ip route get 10.4.40.7 tell you?Scenario
10.4.16.0/20 cannot reach 10.4.16.0/20 on the peer side. Explain why "routes are in place" is not enough here.