Subnetting and CIDR Explained for Real Networks

The short answer

A subnet mask and a CIDR prefix are two notations for exactly the same thing: the boundary that splits a 32-bit IPv4 address into a network part (the left bits, shared by every device on the segment) and a host part (the right bits, unique per device). The mask writes that boundary as four decimal octets of contiguous 1-bits followed by 0-bits — 255.255.255.0 — while CIDR writes only the count of 1-bits after a slash — /24. They carry identical information: /24 is 255.255.255.0, /26 is 255.255.255.192. Reading a prefix is just counting network bits. A /24 reserves 24 bits for the network and leaves 8 for hosts; a /26 reserves 26 and leaves 6. Every added prefix bit halves the block, so a /26 is one quarter the size of a /24.

The host count follows directly from the leftover host bits: total addresses = 2^(32 − prefix), and usable hosts = that number minus 2, because the all-zeros host address is the network (subnet) address and the all-ones host address is the broadcast — neither can be assigned to a device. So a /24 holds 2^8 = 256 addresses and 254 usable hosts; a /26 holds 2^6 = 64 addresses and 62 usable hosts; a /30 holds 4 and 2, the classic point-to-point link. The one number that makes subnetting fast in your head is the block size: 256 minus the mask's last non-255 octet. For a /26 that is 256 − 192 = 64, which means the subnets step .0, .64, .128, .192 — and any address you are handed lands in exactly one of those blocks.

What a subnet mask and CIDR prefix actually do

An IPv4 address is 32 bits, shown as four 8-bit octets in dotted decimal (0–255 each). The subnet mask is a second 32-bit value laid over the address: every bit position that is a 1 in the mask marks a network bit, every 0 marks a host bit. The mask is always a solid run of 1s followed by a solid run of 0s — you never see 255.0.255.0 on a real network — so the entire mask can be summarized by a single number: how many 1s it has. That count is the CIDR prefix. 255.255.255.0 is twenty-four 1-bits, hence /24. 255.255.255.192 adds two more 1-bits in the last octet (192 = 11000000), hence /26.

Converting a mask octet to bits is the whole trick. 255 is 11111111 (eight 1s). The only octet that varies is the 'interesting' one: 128=/1 bit, 192=/2, 224=/3, 240=/4, 248=/5, 252=/6, 254=/7, 255=/8 of that octet. A device uses the mask by ANDing it bit-for-bit against its own address to compute the network (subnet) address, then does the same for any destination it wants to reach. If the two network results match, the destination is local and the device sends the frame directly; if they differ, the destination is remote and the frame goes to the default gateway. That single AND operation is the entire reason subnetting exists — it is how a host decides 'switch to it' versus 'route to it.'

CIDR (Classless Inter-Domain Routing, RFC 4632) replaced the old Class A/B/C system in the early 1990s. Under classful addressing the mask was implied by the first octet (Class A = /8, Class B = /16, Class C = /24), which wasted enormous ranges and bloated routing tables. Classless notation lets the boundary fall on any bit, so an ISP can hand out a /29 or aggregate a thousand /24s into a single /14 route. When someone still says 'a class C,' they almost always mean a /24 — the size matches, but the fixed-class rules behind it are long dead.

• 32-bit address; mask = contiguous 1s (network) then 0s (host); prefix /n = number of 1-bits
• 255=8 ones per octet; interesting-octet values: 128,192,224,240,248,252,254 add 1–7 bits
• Host computes network = address AND mask; matching networks = local (switch), differing = remote (route to gateway)
• /24 = 255.255.255.0, /26 = 255.255.255.192, /30 = 255.255.255.252 — same info, two notations
• CIDR (RFC 4632) is classless; 'Class C' is legacy slang for /24, the rules no longer apply

Reading /24 vs /26: host counts and block size

Once you know the prefix, host math is mechanical. Host bits = 32 − prefix. Total addresses in the subnet = 2^(host bits). Usable hosts = total − 2, subtracting the network address (all host bits 0) and the broadcast address (all host bits 1). A /24 leaves 8 host bits: 2^8 = 256 total, 254 usable. A /26 leaves 6 host bits: 2^6 = 64 total, 62 usable. A /27 leaves 5: 32 total, 30 usable. Each added prefix bit halves the address count and roughly halves the usable hosts.

The fast field method is block size, also called the magic number: 256 minus the mask's interesting octet value. For a /26 (mask .192) the block size is 256 − 192 = 64, so subnets begin at .0, .64, .128, .192 and each spans 64 addresses. Given an address like 192.168.10.100/26, the .100 falls between 64 and 127, so its network is 192.168.10.64, its broadcast is 192.168.10.127, and its usable host range is .65 through .126 — with a gateway conventionally at .65 or .126. You can answer 'what subnet is this in, and what are its first/last usable addresses' in seconds without a calculator once block size is second nature.

Two prefixes break the minus-2 rule. A /31 (RFC 3021) has only 2 addresses and no broadcast; both are usable, which is ideal for point-to-point router links where you don't want to waste half a /30. A /32 is a single host — one address, used for loopbacks, host routes, and DHCP reservations. For everything from /8 down to /30, the minus-2 rule holds.

• Host bits = 32 − prefix; total = 2^(host bits); usable = total − 2 (network + broadcast reserved)
• /24 → 256 total / 254 usable; /26 → 64 / 62; /27 → 32 / 30; /28 → 16 / 14; /30 → 4 / 2
• Block size = 256 − interesting octet value: /26 (.192) → 64; /28 (.240) → 16; /29 (.248) → 8
• 192.168.10.100/26 → network .64, broadcast .127, usable .65–.126
• /31 = 2 usable, no broadcast (RFC 3021 point-to-point); /32 = single host (loopback, reservation)

Splitting a network into subnets

Splitting means borrowing host bits and turning them into network bits — a longer prefix, smaller blocks, more of them. Take 192.168.10.0/24 (254 hosts) and split it into four equal /26s by borrowing 2 bits (2^2 = 4 subnets). Block size is 64, so the four subnets are: 192.168.10.0/26 (hosts .1–.62, broadcast .63), 192.168.10.64/26 (hosts .65–.126, broadcast .127), 192.168.10.128/26 (hosts .129–.190, broadcast .191), and 192.168.10.192/26 (hosts .193–.254, broadcast .255). Every /26 loses 2 addresses to network+broadcast, so 4 × 62 = 248 usable hosts survive out of the original 254 — the cost of segmentation.

Subnets must start on a multiple of their own block size — this is the rule people break most often. A /26 can only begin at .0, .64, .128, or .192; you cannot put one at .32 or .100 because its bits would overlap the neighbor. If you draw a subnet that starts mid-block, its network address AND-computes back onto a boundary and two ranges silently collide, producing hosts that can reach some peers and not others. Aligning every subnet start to its block size is what prevents overlap.

Real networks rarely need equal pieces, so use VLSM (Variable Length Subnet Masking): carve one block into different-sized subnets and allocate largest-first. From 192.168.10.0/24 you might take a /25 for 120 workstations (.0–.127), a /26 for 60 phones (.128–.191), a /28 for 14 servers (.192–.207), and several /30s for router links from what remains — all non-overlapping because each still starts on its own boundary. Allocating the biggest blocks first keeps the leftovers cleanly aligned for the smaller ones; doing it smallest-first tends to fragment the space.

• Borrow n host bits → 2^n equal subnets; borrowing 2 bits turns a /24 into four /26s
• 192.168.10.0/24 → /26s at .0, .64, .128, .192 (block size 64), 62 usable hosts each
• Every subnet must start on a multiple of its block size — a /26 only at .0/.64/.128/.192, never .32 or .100
• Off-boundary starts cause silent overlap: two ranges AND back to the same network
• VLSM: mix prefix sizes in one block, allocate largest subnets first to avoid fragmenting the address space

CIDR quick reference table

The table below is the whole IPv4 subnetting cheat sheet for the last-octet prefixes plus the common large blocks. The pattern is a clean doubling/halving: each step from /24 toward /30 adds one prefix bit, halves the address count, and doubles the number of subnets you can fit in the parent. Read a row as: prefix, mask, block size (how far apart the subnets sit), total addresses, and usable hosts.

For prefixes shorter than /24, the boundary moves into the third octet (/16 to /23) or second octet (/8 to /15), and the same block-size logic applies to that 'interesting' octet instead of the last one. A /23, for example, has block size 2 in the third octet, spanning two consecutive /24s (510 usable hosts). A /22 spans four /24s (1022 hosts). Aggregating small blocks into a shorter prefix like this is called supernetting or route summarization, and it is how backbone routers keep tables small.

• /24 — 255.255.255.0 — block 256 — 256 total — 254 usable
• /25 — 255.255.255.128 — block 128 — 128 total — 126 usable
• /26 — 255.255.255.192 — block 64 — 64 total — 62 usable
• /27 — 255.255.255.224 — block 32 — 32 total — 30 usable
• /28 — 255.255.255.240 — block 16 — 16 total — 14 usable
• /29 — 255.255.255.248 — block 8 — 8 total — 6 usable
• /30 — 255.255.255.252 — block 4 — 4 total — 2 usable (point-to-point)
• /31 — 255.255.255.254 — 2 total — 2 usable, no broadcast (RFC 3021); /32 — 255.255.255.255 — 1 host
• Larger blocks: /23 = 512/510, /22 = 1024/1022, /16 = 65,536/65,534, /8 = 16,777,216/16,777,214

Applying it to real network design

On production networks almost everything runs in the RFC 1918 private ranges — 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 — with NAT at the edge. The design decision is not 'which class' but 'how big should each segment be,' and the honest answer is: size for the device count plus growth, then round up to the next prefix. A floor with 90 endpoints does not fit in a /26 (62 hosts); it needs a /25 (126). Leaving headroom matters because your DHCP scope, printers, APs, and static reservations all draw from the same pool, and re-addressing a live subnet later is disruptive.

Map one subnet to one VLAN to one broadcast domain — that one-to-one mapping is what keeps segmentation meaningful, letting you apply firewall and ACL policy per segment (users, voice, cameras, guest, management). For router-to-router and firewall-to-switch links that carry no hosts, use a /30 (2 usable) or, on gear that supports it, a /31 (2 usable, no wasted broadcast). The gateway address is a convention, not a rule: most shops use the first usable (.1) or the last usable of the subnet, but any host address in range works as long as it is consistent and documented.

Two practical checks prevent most outages. First, confirm every device on a segment shares the same mask — a host with the wrong prefix will mis-decide local versus remote and reach some peers but not the gateway. Second, verify subnets do not overlap before you deploy; an off-boundary or too-large block that runs into its neighbor causes intermittent, hard-to-diagnose reachability. Both are quick to catch with the block-size math above or a subnet calculator.

• Private space is RFC 1918: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 — NAT at the edge
• Size each subnet for device count + growth, then round up to the next prefix (90 hosts → /25, not /26)
• One subnet = one VLAN = one broadcast domain; segment by role (data, voice, camera, guest, mgmt) for per-segment policy
• Point-to-point links: /30 (2 usable) or /31 (2 usable, no broadcast) instead of wasting a /24
• Gateway at .1 or last-usable is convention, not a requirement — pick one and document it
• Verify uniform mask per segment and no overlapping subnets before deploying

Common subnetting mistakes and how to avoid them

The most frequent error is forgetting the minus-2 rule — assigning the network or broadcast address to a device. In 192.168.10.0/24, .0 is the network and .255 is the broadcast; neither is a valid host. Under a /26 the reserved pairs move (.0/.63, .64/.127, .128/.191, .192/.255), so an address that was a perfectly good host in a /24, like .63, becomes a broadcast address and stops working the moment you re-subnet. Always recompute the reserved addresses from the current prefix, not the old one.

The second classic mistake is starting a subnet off its block boundary or making it larger than the space it sits in, which creates silent overlap. A /26 placed at .100 or a /24 declared inside a range that only had a /26 free will AND-collide with a neighbor and produce hosts that reach some destinations and not others — symptoms that look like flaky hardware but are pure math errors. The fix is to always align a subnet's start to a multiple of its block size and to lay out largest-first with VLSM. Rounding these out with a calculator before deployment costs seconds; troubleshooting the overlap in production costs hours.

• Assigning the network (.0) or broadcast (.255 in a /24) address to a host — recompute reserved pairs for the actual prefix
• Assuming .1 is always the gateway — it is convention, verify the segment's real gateway
• Confusing /24 with 'Class C' rules — classful masks are obsolete; the prefix defines the boundary
• Starting a subnet off its block boundary (a /26 at .32 or .100) — causes silent overlap
• Using a /30 where a /31 fits, or a /24 for a two-router link — wasted address space
• Mismatched masks on one segment — a wrong prefix mis-decides local vs remote and breaks gateway reachability

Frequently asked questions