From Cookie Jars to Cloud Security: The DevOps Engineer’s Guide to Mastering IP Subnetting

By Vincent Ifeanyi, DevOps & Cloud Security Engineer

Introduction: The “Aha!” Moment

If you are a DevOps engineer or aspiring cloud security professional, you have likely stared at a subnet mask like 255.255.255.192 and felt a moment of panic. You know it’s important for security groups, VPCs, and routing, but the math feels like ancient magic.

I was there too. I struggled to connect the binary switches to the “Magic Number” until I realized: Subnetting isn’t complex math; it’s just counting in boxes.

This guide is the resource I wish I had. We will strip away the academic fluff, travel back to the 1980s to understand why we do this, and then master the mental model that lets you calculate network ranges in seconds, no calculator required.

Part 1: The History Lesson (Why We Are Here)

To understand subnetting, you must understand the disaster that created it.

The 1980s: The “Cookie Jar” Disaster

In the early days of the internet (formalized in RFC 791 in 1981), engineers created a system called Classful Addressing. They imagined the IP address space as a bakery that only sold three sizes of cookie jars:

• Class A (The Stadium): 16 million addresses. Reserved for giants like the US Department of Defense.
• Class B (The School): 65,534 addresses. For universities and large corporations.
• Class C (The House): 254 addresses. For small businesses.

The Problem: Imagine you are a company with 300 employees.

A Class C jar is too small (you need 46 more cookies).

You are forced to buy a Class B jar.

The Waste: You use 300 addresses and throw 65,234 into the trash.

By the early 1990s, the internet was running out of addresses not because we didn’t have enough, but because the rigid classes were forcing us to waste millions of IPs. The Class B pool was exhausted, and the routing tables were exploding.

The Solution: CIDR (Smashing the Classes)

In 1993, the Internet Engineering Task Force introduced CIDR (Classless Inter-Domain Routing) via RFC 1519.

What it did: It smashed the fixed Class A/B/C walls.

The Result: If you needed 300 addresses, you could now get a custom box of 512. No waste.

The Notation: This introduced the “Slash” notation (e.g., /24, /26), which tells us exactly where the network ends and the hosts begin.

Key Takeaway: Classes (A, B, C) are dead history. CIDR is the modern standard that allows DevOps engineers to carve cloud networks with surgical precision.

Part 2: The Mental Model (The 32-Switch Dashboard)

Forget binary strings like 11000000 for a moment. Let’s visualize an IP address as a dashboard with 32 light switches.

The Rules of the Dashboard

• Total Switches: Every IPv4 address has exactly 32 switches.
• ON (1): Represents the Network Part (The Street Name). This is fixed.
• OFF (0): Represents the Host Part (The House Number). This is variable.
• The CIDR Number (/24, /26): This is simply the count of how many switches are turned ON from the left.

Where Does /24 Come From?

• Instruction: Turn 24 switches ON.
• Visual: ON… (24 times) … | OFF… (8 times)
• Meaning: The first 24 bits define the network. The remaining 8 switches are OFF, meaning they are available for devices.
• Math: 2 raise to power 8 =256. This is your total box size.

Where Does /26 Come From?

• Instruction: Turn 26 switches ON.
• Visual: ON… (26 times) … | OFF… (6 times)
• Meaning: You “borrowed” 2 more switches from the host side to create more networks. Now only 6 switches are OFF.
• Math: 2 Raise to power 6=64. This is your total box size.

Pro Tip: The subnet mask (e.g., 255.255.255.192) is just the decimal value of the switches that are turned ON.

In /26, the last octet has 2 switches ON: 128 + 64 = 192. That’s why the mask ends in .192.

Part 3: The “Magic Number” Trick (Instant Calculation)

This is the secret to passing interviews and designing VPCs without a calculator. The Magic Number is simply the size of your subnet box.

The Formula

Magic Number=2

Number of OFF Switches

Alternatively: 256−Subnet Mask Octet

The Cheat Sheet (Memorize This)

CIDR OFF Switches Calculation Magic Number Subnet Mask

"CIDR","OFF Switches","Calculation","Magic Number","Subnet Mask"
"/25".  ,"7".           ,"2^7".       ,"128".        ,".128"
"/26".  ,"6".           ,"2^6".       ,"64".         ,".192"
"/27".  ,"5".           ,"2^5".       ,"32".         ,".224"
"/28".  ,"4".           ,"2^4".       ,"16".         ,".240"
"/29".  ,"3".           ,"2^3".       ,"8".          ,".248"
"/30".  ,"2".           ,"2^2".       ,"4".          ,".252"

How to Use It (The “Count Up” Method)

Let’s solve a real problem: IP 192.168.10.50 with a /26 mask.

• Find the Magic Number:

/26 means 6 OFF switches.

2 Raise to power 6 =64.

• Count by 64s:

Box 1: 0 to 63

Box 2: 64 to 127

Box 3: 128 to 191

• Locate the IP:

Where does 50 fit? It’s in the 0-63 box.

Instant Answers:

• Network Address: The start of the box → 192.168.10.0
• Broadcast Address: The end of the box → 192.168.10.63
• Usable Range: Everything in between → 192.168.10.1 to 192.168.10.62

Part 4: The Three Goals of a Subnet Mask

In an interview, if asked “What is the purpose of the subnet mask?”, you can now answer with precision:

• Determine Usable Hosts: The mask tells us how many switches are OFF.

Formula: 2 OFF −2.

Why minus 2? The first address (Network) and last address (Broadcast) are reserved.

Example (/26): 64−2=62 usable hosts.

• Identify the Network Address: The mask forces all Host bits (OFF switches) to 0. This gives you the “Street Name” (192.168.10.0).
• Define the Broadcast & Range: The mask defines the boundary. The Broadcast is the very last number in the box (all Host bits set to 1). The usable range is strictly between the Network and Broadcast.

Part 5: IPv6-The Cloud Native Future

As a Cloud Security Engineer, you will encounter IPv6. The rules change slightly because scarcity is no longer the problem.

No Classes: IPv6 was born classless.

The Golden Rule: The standard subnet size is /64.

Why? The auto-configuration protocol (SLAAC) requires exactly 64 bits for the host portion to function.

DevOps Mindset: In IPv4, we subnet to save addresses. In IPv6, we subnet to organize security.

Structure: You typically get a /48. You slice it into sixteen /52s, or 256 /56s, or 65,536 /64s.

Security: Since every device has a public IP (no NAT), your Security Groups and Firewalls become the only line of defense. Subnetting allows you to create micro-segments (e.g., Web Tier /64, DB Tier /64) for strict access control.

Conclusion: From Confusion to Mastery

Subnetting is not about memorizing binary charts. It is about understanding that:

CIDR is just a count of ON switches.

Magic Number is just the value of the OFF switches ( 2 off. ).

Ranges are just counting up by that Magic Number.

Next time you see a /26, don’t panic. Just think: “32 minus 26 is 6. 2 raise to power 6 is 64. I count by 64s.”

You now have the mental model to design secure, efficient networks in AWS, Azure, or on-prem. Go forth and subnet with confidence!

Found this guide helpful? Follow me for more deep dives into Cloud Security and DevOps engineering