Subnetting Explained for PLC and OT Networks, With a Free CCNA Video Lesson

Subnetting is splitting one block of IPv4 addresses into smaller networks by moving the boundary between the network bits and the host bits. The fast way to do it: work out the block size (256 minus the mask value in the octet the mask splits), find the multiple of that block at or below the address, and you have the network address; the next block minus one is the broadcast. For a PLC at 192.168.10.37/27 that gives network .32, broadcast .63 and hosts .33 to .62.

Checked 1 October 2026. Exam details come from Cisco's own pages on that date.

This lesson is by Jeremy's IT Lab, from his free CCNA 200-301 course, and it is one of the three subnetting lessons in our free Computer Networking and CCNA 200-301 Prep course, in the module on subnetting and VLSM. Jeremy covers the old address classes, how addresses are assigned, CIDR, how many usable addresses each prefix gives, the special cases /31 and /32, CIDR notation, and a subnetting scenario with a quiz at the end. Watch it once straight through, then use this walkthrough to apply the same arithmetic to the networks automation engineers actually build.

Why should a controls engineer learn subnetting?

Because every PLC, HMI, drive, remote I/O rack and camera on a modern line has an IP address, a subnet mask and usually a gateway, and the person commissioning them is often you, not IT. Three faults come up again and again on site:

• The mask is wrong. A PLC set to 255.255.255.0 when the line uses a /23 decides that half of its neighbours are on another network and tries to send their traffic to a gateway that does not exist.
• The gateway is missing. Everything on the line works, but the SCADA server in the control room, on another subnet, cannot reach anything.
• Two subnets overlap. Someone gives the vision cell 10.10.4.224/27 when the SCADA subnet already ends at .223, and one camera works while the next one does not, depending on which way the traffic flows.

PROFINET and EtherNet/IP devices sit on ordinary Ethernet networks and carry IP addresses, so the rules below apply whatever the PLC brand. Segmenting the plant into subnets (and VLANs) is also the basis of the zones that OT security standards such as ISA/IEC 62443 ask for: you cannot put a firewall between two networks that are really one.

What do the mask and the prefix length mean?

An IPv4 address is 32 bits, written as four octets. The prefix length, such as /27, says how many of those bits identify the network; the rest number the hosts. RFC 4632 describes this as the address followed by a slash and the number of significant bits. A /27 is 27 ones followed by 5 zeros, which written as octets is 255.255.255.224.

Five host bits give 2 to the power of 5, which is 32 addresses. The first is the network address and the last is the broadcast, so 30 are usable. That pattern, 2 to the power of the host bits minus 2, works for every prefix down to /30. The table below is the one worth memorising.

How do you subnet an address quickly?

The block size method avoids converting everything to binary. Take the PLC at 192.168.10.37/27:

1. The mask is 255.255.255.224, so the fourth octet is the one being split.
2. Block size is 256 minus 224, which is 32. Networks start at .0, .32, .64, .96, .128, .160, .192 and .224.
3. 37 falls in the block starting at 32, so the network is 192.168.10.32.
4. The next network is .64, so the broadcast is 192.168.10.63.
5. The usable hosts are .33 to .62, which is 30 devices.

Now an example where the mask splits the third octet, which catches people out: 172.20.9.200/22. The mask is 255.255.252.0, so the third octet is the interesting one. Block size is 256 minus 252, which is 4, so networks start at 172.20.0.0, 172.20.4.0, 172.20.8.0 and 172.20.12.0. The third octet is 9, which sits in the block starting at 8, so the network is 172.20.8.0/22, the broadcast is 172.20.11.255, and hosts run from 172.20.8.1 to 172.20.11.254: 1,022 usable addresses.

Practise this until each question takes under two minutes. That is the target the course sets, and it is roughly the pace the CCNA exam needs.

A worked VLSM plan for a packaging line

Variable-length subnet masking (VLSM) means giving each network the size it needs rather than making every subnet the same. Here is a realistic brief. A plant has been allocated 10.10.4.0/23 (512 addresses, 10.10.4.0 to 10.10.5.255) for a new packaging line, and needs:

• Line control: 120 addresses for PLCs, drives, remote I/O and HMIs.
• CCTV: 50 cameras.
• SCADA and engineering servers: 20.
• Vision and robot cell: 10.
• Firewall transit link to the plant core: 2.

The rule is largest first. Each subnet must start on a multiple of its own block size, and allocating the big ones first keeps them aligned without gaps.

1. 120 hosts needs 7 host bits (126 usable), so a /25: 10.10.4.0/25.
2. 50 hosts needs 6 host bits (62 usable), so a /26, starting at the next free address: 10.10.4.128/26.
3. 20 hosts needs 5 host bits (30 usable), so a /27: 10.10.4.192/27.
4. 10 hosts needs 4 host bits (14 usable), so a /28: 10.10.4.224/28.
5. 2 hosts fits a /30: 10.10.4.240/30.

Everything from 10.10.4.244 up to 10.10.5.255 is left for growth, including a whole /24 at 10.10.5.0. Leave room: lines gain a second robot, a new checkweigher or another camera far more often than they shrink. A /25 for 120 devices has only six spare addresses, so in practice many engineers would give line control the whole 10.10.5.0/24 and keep the /25 for the next line.

Where do /30 and /31 fit?

A link between two routers, or a router and a firewall, needs only two addresses. The traditional answer is a /30, which wastes the network and broadcast addresses. RFC 3021 allows a /31 on point-to-point links, where both addresses are treated as hosts; it notes that a network with 500 such links saves 1,000 addresses. Use it on routed links only, never on a LAN segment with PLCs on it. Jeremy covers /31 and /32 in the video, and both are fair game in the exam.

Which addresses should a plant use?

Private ranges. RFC 1918 reserves three blocks for private networks: 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. Most plants use 10.x or 172.16 to 172.31 internally, because 192.168.0.x and 192.168.1.x clash with home routers and with the factory default addresses of a great many devices. A few habits save hours at commissioning:

• Write an IP plan before anything is powered. One row per device: tag, subnet, address, mask, gateway, VLAN. It is a commissioning document like the I/O list.
• Reserve ranges inside each subnet. For example .1 for the gateway, .10 to .49 for PLCs, .50 to .99 for drives and I/O, .100 upwards for HMIs and PCs. Anyone can then guess what a device is from its address.
• Use static addresses for control devices. A PLC that gets a new address from DHCP after a power cut breaks every connection configured to the old one.
• Change factory defaults before the device goes on the line. Two new devices with the same default address will fight.

What to do after watching

1. Do the course's practice task. In the subnetting module, you allocate 172.20.8.0/22 to a production LAN of 300 hosts, an office LAN of 120, a CCTV LAN of 50, a management LAN of 10 and two router links, using VLSM largest first. Write the network, mask, first host, last host and broadcast for each.
2. Build it in Packet Tracer. Cisco Packet Tracer is free from the Cisco Networking Academy, and the course uses it throughout. Configure two subnets on a router, put a PC in each, and prove they can ping each other only when the gateways are right.
3. Watch Parts 2 and 3. The same module has Jeremy's lessons on Class B and Class A subnetting and on VLSM.
4. Take the course project. It is a segmented office and plant network for a bottling site, built in Packet Tracer, with an IP address plan, a network architecture, an ACL and NAT register and a test report as deliverables.

Common mistakes

• Starting a subnet in the wrong place. A /26 must start at .0, .64, .128 or .192. 10.10.4.100/26 is a host address, not a network.
• Forgetting the two reserved addresses. A /28 has 16 addresses but only 14 hosts.
• Allocating smallest first in VLSM. You end up with gaps and misaligned blocks.
• Mixing up the mask and the wildcard. ACLs and OSPF use wildcard masks (0.0.0.31 for a /27). Device addresses use subnet masks.
• Copying an address plan without the masks. An address without its prefix length is half a fact.

Learn it properly, free

The Computer Networking and CCNA 200-301 Prep course takes you from binary through switching, subnetting, VLANs, OSPF, ACLs and NAT, with Packet Tracer labs in every module and one final assessment. Then Industrial Communication puts the same IP knowledge to work on Modbus TCP, PROFINET and OPC UA, and OT and ICS Cybersecurity with ISA/IEC 62443 shows how subnets become security zones. The industrial networks courses page lists the rest, and our Modbus tutorial is a good next read.

The courses are free in full. If you pass the final and want proof, the optional EDWartens Certificate of Completion costs from US$2.99 and carries a code anyone can check at edwartens.com/verification. It is not the Cisco CCNA, which only Cisco awards for passing the 200-301 exam.

Take the free course

Networking · Beginner · Free

Computer Networking and CCNA 200-301 Prep

Industrial networks · Intermediate · Free

Industrial Communication: Serial, Fieldbus, Ethernet, Modbus, PROFINET and OPC UA

Cybersecurity · Intermediate · Free

OT and ICS Cybersecurity with ISA/IEC 62443

PLC programming · Beginner · Free

Siemens TIA Portal