A subnet mask is a line drawn through the 32 bits of an address: everything left is network, everything right is host. Subnetting is moving that line — the goal here is to see the see-saw and solve any range by block size, not memorize tables.
live mask builder · block-size walkthroughs · scored practice · the /24–/30 matrix
The 32 bits are split into exactly two piles by the line — every bit is either network or host, never both. Move the line one step right: the network pile gains a bit (subnets double), the host pile loses one (each subnet halves). That's why subnets × size stays constant — you're re-partitioning a fixed pool, not creating address space.
The −2 on usable hosts is charged per subnet: the all-host-bits-0 pattern is the network ID (the subnet's name), all-host-bits-1 is the broadcast. Neither is assignable to a machine.
The line is a trust boundary. Two hosts in the same subnet talk L2-direct — no router, no ACL, no firewall between them. Same subnet = same broadcast domain = same blast radius for ARP spoofing, sniffing, lateral movement. Subnetting isn't addressing hygiene, it's segmentation: carving a /24 into /27s forces cross-group traffic through a router where policy can live. A flat /16 hands an attacker the whole L2 neighborhood.