What a Subnet Is
An IPv4 address is 32 bits, written as four decimal octets. A subnet mask splits those 32 bits into a network portion and a host portion. Every address sharing the same network portion is on the same subnet and can reach the others directly; anything else has to go through a router.
The mask is a run of 1 bits followed by a run of 0 bits. CIDR notation just counts the 1 bits: /24 means the first 24 bits are network, leaving 8 for hosts, which is the same as the mask 255.255.255.0.
The Three Special Addresses
| Address | How it is found | Usable by a host? |
|---|---|---|
| Network address | IP AND mask — all host bits set to 0 | No |
| Broadcast address | All host bits set to 1 | No |
| Host addresses | Everything between them | Yes |
This is why usable hosts is 2(32−prefix) − 2 rather than the full count. A /24 has 256 addresses but only 254 assignable hosts.
Two exceptions exist. A /31 has no network or broadcast address and provides two usable addresses, defined by RFC 3021 specifically for point-to-point links. A /32 is a single host route.
Worked Example
Take 192.168.1.130 /24:
| Decimal | Binary | |
|---|---|---|
| IP | 192.168.1.130 | 11000000.10101000.00000001.10000010 |
| Mask | 255.255.255.0 | 11111111.11111111.11111111.00000000 |
| Network | 192.168.1.0 | 11000000.10101000.00000001.00000000 |
| Broadcast | 192.168.1.255 | 11000000.10101000.00000001.11111111 |
The network address is a bitwise AND of the IP and the mask; the broadcast sets every host bit to 1. Usable hosts run from 192.168.1.1 to 192.168.1.254.
CIDR Reference Table
| Prefix | Subnet mask | Total addresses | Usable hosts |
|---|---|---|---|
| /8 | 255.0.0.0 | 16,777,216 | 16,777,214 |
| /9 | 255.128.0.0 | 8,388,608 | 8,388,606 |
| /10 | 255.192.0.0 | 4,194,304 | 4,194,302 |
| /11 | 255.224.0.0 | 2,097,152 | 2,097,150 |
| /12 | 255.240.0.0 | 1,048,576 | 1,048,574 |
| /13 | 255.248.0.0 | 524,288 | 524,286 |
| /14 | 255.252.0.0 | 262,144 | 262,142 |
| /15 | 255.254.0.0 | 131,072 | 131,070 |
| /16 | 255.255.0.0 | 65,536 | 65,534 |
| /17 | 255.255.128.0 | 32,768 | 32,766 |
| /18 | 255.255.192.0 | 16,384 | 16,382 |
| /19 | 255.255.224.0 | 8,192 | 8,190 |
| /20 | 255.255.240.0 | 4,096 | 4,094 |
| /21 | 255.255.248.0 | 2,048 | 2,046 |
| /22 | 255.255.252.0 | 1,024 | 1,022 |
| /23 | 255.255.254.0 | 512 | 510 |
| /24 | 255.255.255.0 | 256 | 254 |
| /25 | 255.255.255.128 | 128 | 126 |
| /26 | 255.255.255.192 | 64 | 62 |
| /27 | 255.255.255.224 | 32 | 30 |
| /28 | 255.255.255.240 | 16 | 14 |
| /29 | 255.255.255.248 | 8 | 6 |
| /30 | 255.255.255.252 | 4 | 2 |
| /31 | 255.255.255.254 | 2 | 2 |
| /32 | 255.255.255.255 | 1 | 1 |
Private Address Ranges (RFC 1918)
Three ranges are reserved for internal networks and are never routed on the public internet. This is what makes NAT possible and why millions of home networks can all use 192.168.1.0/24.
| Range | CIDR | Addresses | Typically used by |
|---|---|---|---|
| 10.0.0.0 – 10.255.255.255 | 10.0.0.0/8 | 16,777,216 | Large enterprise networks |
| 172.16.0.0 – 172.31.255.255 | 172.16.0.0/12 | 1,048,576 | Medium networks, Docker defaults |
| 192.168.0.0 – 192.168.255.255 | 192.168.0.0/16 | 65,536 | Home and small office routers |
Other reserved ranges worth recognising: 127.0.0.0/8 is loopback, 169.254.0.0/16 is link-local (the address a device self-assigns when DHCP fails), and 224.0.0.0/4 is multicast.
Address Classes
Before CIDR arrived in 1993, the first bits of an address determined a fixed split between network and host portions.
| Class | First octet | Default mask | Networks | Hosts each |
|---|---|---|---|---|
| A | 1–126 | /8 | 126 | 16,777,214 |
| B | 128–191 | /16 | 16,384 | 65,534 |
| C | 192–223 | /24 | 2,097,152 | 254 |
| D | 224–239 | — | Multicast | |
| E | 240–255 | — | Reserved | |
Classful addressing wasted enormous quantities of address space — an organisation needing 300 hosts had to take a class B with 65,534. CIDR replaced it with arbitrary prefix lengths, which is why the class of an address is now historical trivia rather than an operational fact.
Wildcard Masks
A wildcard mask is the bitwise inverse of a subnet mask: the /24 mask 255.255.255.0 has the wildcard 0.0.0.255. Cisco access control lists and OSPF configuration use wildcards rather than subnet masks, so mixing them up is a classic source of misconfigured rules.
Choosing a Prefix
| Hosts needed | Prefix | Usable | Typical use |
|---|---|---|---|
| 2 | /30 or /31 | 2 | Point-to-point router link |
| up to 6 | /29 | 6 | Small server group |
| up to 14 | /28 | 14 | Small office |
| up to 30 | /27 | 30 | Department VLAN |
| up to 62 | /26 | 62 | Medium VLAN |
| up to 254 | /24 | 254 | Standard office or home LAN |
Broadcast traffic scales with subnet size, so very large flat subnets perform badly. Most network designs keep a single broadcast domain under 254 hosts even where more addresses are available.
Frequently Asked Questions
Why can't I use the network or broadcast address?
The network address identifies the subnet itself in routing tables, and the broadcast address delivers to every host at once. Neither can identify an individual machine.
What does /24 mean?
The first 24 bits are the network portion, leaving 8 bits for hosts — 256 addresses, 254 usable. It is equivalent to the mask 255.255.255.0.
Does this work for IPv6?
No. IPv6 uses 128-bit addresses and has no broadcast address, so the arithmetic differs. This calculator is IPv4 only.
Why does my router show a different network?
Almost always a different prefix. The same IP address yields a different network address under /24 than under /16, so the mask must match what the device is configured with.