Some organizations need far more subnets than a typical /24-based design provides. A small ISP allocating a separate subnet to each of 4,000 clients is a realistic example: with a /8 network to work with, there’s plenty of host-portion room to borrow from. This guide works through the full process, including five completely worked examples with every resulting address calculated explicitly, so the reasoning behind every number is fully visible rather than left implicit.
Setting Up the Problem
Starting network: 115.0.0.0/8, default mask 255.0.0.0. A /8 prefix leaves 24 host bits available, 32 total bits minus 8 network bits.
Total network address space: 115.0.0.0 through 115.255.255.255, with a network address of 115.0.0.0 and a broadcast address of 115.255.255.255 for the entire /8 block.
Step 1: Determine Bits to Borrow
The formula is 2ⁿ = number of subnets. Since 2¹² = 4,096, borrowing 12 bits produces enough subnets to comfortably cover the 4,000 needed, with 96 spare subnets left over for future growth.
Borrowing happens left to right, starting with the first available host bit. Since the /8 network’s host portion starts at the second octet, those 12 bits come from: all 8 bits of the second octet, plus the top 4 bits of the third octet.
Step 2: Determine the New Subnet Mask
Extending the network portion from 8 bits to 8 + 12 = 20 bits gives a /20 prefix.
- Before: 11111111.00000000.00000000.00000000 = 255.0.0.0 (/8)
- After: 11111111.11111111.11110000.00000000 = 255.255.240.0 (/20)
Step 3: Confirm Subnet Count and Host Count
With 12 bits borrowed for network use, 12 bits remain for hosts (24 original host bits − 12 borrowed = 12 remaining). That gives:
- Subnets: 2¹² = 4,096, numbered 0 through 4,095
- Usable hosts per subnet: 2¹² − 2 = 4,094
Finding Any Subnet’s Address Range: The Five-Step Method
- Convert the subnet number into binary.
- Pad or truncate to exactly 12 bits, adding leading zeros if needed.
- Place those 12 bits into the borrowed-bit positions: the first 8 bits fill the second octet entirely, and the last 4 bits fill the top nibble of the third octet.
- The network address has all remaining host bits set to 0; the first usable address has all host bits at 0 except the rightmost bit, set to 1.
- The last usable address has all host bits at 1 except the rightmost bit, set to 0; the broadcast address has every remaining host bit set to 1.
Five Fully Worked Examples
Example 1: Subnet Number 1055
1055 in binary is 10000011111 (11 bits), padded to 12 bits: 010000011111.
Splitting: first 8 bits → 01000001 = 65 (second octet). Last 4 bits → 1111 = 15, giving 15 × 16 = 240 (third octet).
| Address | |
|---|---|
| Network address | 115.65.240.0/20 |
| First usable host | 115.65.240.1 |
| Last usable host | 115.65.255.254 |
| Broadcast address | 115.65.255.255 |
Example 2: Subnet Number 2040
2040 in binary is 11111111000 (11 bits), padded to 12 bits: 011111111000.
Splitting: first 8 bits → 01111111 = 127 (second octet). Last 4 bits → 1000 = 8, giving 8 × 16 = 128 (third octet).
| Address | |
|---|---|
| Network address | 115.127.128.0/20 |
| First usable host | 115.127.128.1 |
| Last usable host | 115.127.143.254 |
| Broadcast address | 115.127.143.255 |
Example 3: Subnet Number 2980
2980 in binary is 101110100100, already exactly 12 bits, no padding needed.
Splitting: first 8 bits → 10111010 = 186 (second octet). Last 4 bits → 0100 = 4, giving 4 × 16 = 64 (third octet).
| Address | |
|---|---|
| Network address | 115.186.64.0/20 |
| First usable host | 115.186.64.1 |
| Last usable host | 115.186.79.254 |
| Broadcast address | 115.186.79.255 |
Example 4: Subnet Number 4025
4025 in binary is 111110111001, already exactly 12 bits.
Splitting: first 8 bits → 11111011 = 251 (second octet). Last 4 bits → 1001 = 9, giving 9 × 16 = 144 (third octet).
| Address | |
|---|---|
| Network address | 115.251.144.0/20 |
| First usable host | 115.251.144.1 |
| Last usable host | 115.251.159.254 |
| Broadcast address | 115.251.159.255 |
Example 5: Subnet Number 4095 (The Last Subnet)
4095 in binary is 111111111111, all 12 bits set to 1, confirming this is the final subnet in the range.
Splitting: first 8 bits → 11111111 = 255 (second octet). Last 4 bits → 1111 = 15, giving 15 × 16 = 240 (third octet).
| Address | |
|---|---|
| Network address | 115.255.240.0/20 |
| First usable host | 115.255.240.1 |
| Last usable host | 115.255.255.254 |
| Broadcast address | 115.255.255.255 |
All Five Examples at a Glance
| Subnet # | Network Address | First Usable | Last Usable | Broadcast |
|---|---|---|---|---|
| 1055 | 115.65.240.0/20 | 115.65.240.1 | 115.65.255.254 | 115.65.255.255 |
| 2040 | 115.127.128.0/20 | 115.127.128.1 | 115.127.143.254 | 115.127.143.255 |
| 2980 | 115.186.64.0/20 | 115.186.64.1 | 115.186.79.254 | 115.186.79.255 |
| 4025 | 115.251.144.0/20 | 115.251.144.1 | 115.251.159.254 | 115.251.159.255 |
| 4095 | 115.255.240.0/20 | 115.255.240.1 | 115.255.255.254 | 115.255.255.255 |
Borrowing proceeds strictly left to right through the available host bits, and since the second octet’s 8 bits come first in that order, all of them are used before any bits from the third octet are touched. Only once the second octet is entirely exhausted does borrowing spill into the third octet’s leftmost bits, which is exactly why the split lands at 8 full bits plus 4 partial bits rather than some other combination.
Why This Technique Matters Beyond Just Large ISPs
This exact same subnet-number-to-address process scales down cleanly to far more modest scenarios, borrowing bits across two octets instead of within one is a genuinely common requirement any time a base prefix shorter than /16 needs to be divided into a large number of subnets. Understanding it at this larger, more demanding scale, /8 down to /20, makes the more commonly taught /24-based examples feel almost trivially simple by comparison, since the underlying method never actually changes, only the number of octets the borrowed bits happen to span.
Verifying the Worked Examples
A quick way to sanity-check any of these results is to confirm the block size pattern holds consistently. Since only the top 4 bits of the third octet are borrowed, valid subnet boundaries in that octet must always be multiples of 16: 0, 16, 32, 48, and so on up through 240. Every network address above does land on exactly one of these values, 240, 128, 64, 144, and 240 again for the final example, which is exactly the kind of consistency check worth running on your own calculations before trusting them, and it takes only a few seconds once you know what to look for.
It’s also worth confirming that the second-octet value never needs any adjustment for the borrowed bits in the third octet; since the second octet is fully consumed by borrowing (all 8 bits), it behaves exactly like an ordinary octet value with no partial-bit complexity, while all of that complexity is concentrated entirely in the third octet’s top nibble. Keeping this division of labor clear, full-octet borrowing in the second octet, partial-nibble borrowing in the third, is what makes working through these calculations manageable by hand rather than genuinely error-prone, and it’s a distinction worth stating explicitly rather than leaving implicit.
Troubleshooting Large-Scale Subnetting Deployments
A client reports their assigned subnet doesn’t match what was documented. Recompute the subnet number’s binary conversion independently rather than trusting a written record that might contain a transcription error, exactly the kind of mistake this guide’s original source material demonstrates can happen even in published reference material. A fresh calculation from the subnet number itself is always more reliable than trusting a static document that may have been copied incorrectly at some point.
Routing tables are growing unmanageably large across 4,000 subnets. This is a genuine, expected challenge at this scale, and it’s exactly why route summarization matters enormously in large subnetted deployments. Grouping contiguous subnet ranges into summary routes wherever the network topology allows keeps routing tables manageable even as individual subnet count climbs into the thousands, a design consideration worth planning for from the very start rather than retrofitting later.
Two subnets that should be adjacent don’t appear to be. Double-check that both were calculated using the same borrowed-bit convention, borrowing left to right starting from the correct octet. A single miscounted bit position shifts every subsequent calculation, producing addresses that look plausible individually but don’t actually align correctly with their neighbors, a subtle error that’s easy to miss without checking against the expected block-size pattern.
Frequently Asked Questions
How many bits do I need to borrow for a specific number of subnets?
Use the formula 2ⁿ = number of subnets, where n is the number of bits borrowed, and solve for the smallest n that meets or exceeds your required subnet count. For 4,000 subnets, 2¹¹ = 2,048 falls short, so 2¹² = 4,096 is the smallest sufficient value, borrowing 12 bits total across two octets.
Why does borrowing 12 bits split across two different octets instead of one?
Because a single octet only has 8 bits available, and 12 bits are needed to reach 4,096 subnets, the borrowing has to continue into the next octet once the first is fully used. This is exactly why the second octet gets used in full while only the top 4 bits of the third octet are needed, rather than the borrowing being confined entirely within one octet the way smaller examples like a /24-to-/26 conversion typically are.
How do I know how many hosts each subnet supports?
Subtract the total bits borrowed from the original host bit count to find the remaining host bits, then apply 2^(remaining bits) − 2. In this example, 24 original host bits minus 12 borrowed leaves 12 remaining, giving 2¹² − 2 = 4,094 usable hosts per subnet, the corrected figure this guide relies on throughout.
What’s the fastest way to find a specific subnet’s address without a calculator?
Convert the subnet number to binary, pad it to the exact number of borrowed bits, and split it directly into the octets the borrowed bits span, exactly as demonstrated in the five worked examples above. With practice, converting smaller subnet numbers (under 256) becomes fast enough to do mentally, though a calculator remains the more practical choice for verification on larger numbers like the ones covered throughout this guide.
Is 4,096 subnets from one /8 actually a realistic real-world scenario?
Large ISPs, cloud providers, and organizations managing very large numbers of small client networks or IoT deployments genuinely do need subnetting at this scale. It’s a less commonly taught scenario than smaller /24-based subnetting exercises specifically because it’s less common in day-to-day enterprise networking, not because the underlying technique differs in any meaningful way, and the same five-step method applies regardless of scale.
Why does the last subnet’s network address end in .240.0 rather than .255.0 or something else?
Because only the top 4 bits of the third octet were borrowed, not the full octet, the maximum possible value in that octet’s borrowed portion is 1111 in binary, which equals 15, and 15 × 16 = 240. The remaining 4 bits of the third octet stay part of the host portion, which is exactly why 240, not 255, marks the boundary, a distinction worth remembering whenever borrowing stops partway through an octet rather than at a clean byte boundary.
What happens to the 96 leftover subnets if only 4,000 are actually needed?
They remain available within the same /8 block for future growth, additional clients, new services, or expansion, without requiring any renumbering of the 4,000 subnets already allocated. This is one of the practical advantages of borrowing slightly more bits than the bare minimum required, building in headroom rather than sizing exactly to the current requirement, a small margin that pays off considerably later.
