Subnetting is one of those topics that looks intimidating – binary, masks, slashes – but follows a few simple rules. Once you understand them, you can work out any IPv4 network in your head. This guide takes you from the basics to worked examples. You can check every answer with our subnet calculator.
An IP address has two parts
Every IPv4 address is 32 bits long, written as four numbers (octets) from 0 to 255. Part of those bits identifies the network, and the rest identifies the host (device) within that network. Devices in the same network can talk to each other directly; to reach another network, they send traffic to a router.
The subnet mask says where the split is. A mask of 255.255.255.0 means the first three octets (24 bits) are the network and the last octet (8 bits) is for hosts.
CIDR notation
Writing masks in full is clumsy, so we use CIDR (Classless Inter-Domain Routing) notation: a slash followed by the number of network bits. 192.168.1.0/24 means “the network 192.168.1.0 with a 24-bit network part” – the same as mask 255.255.255.0.
In binary, a /24 mask is 24 ones followed by 8 zeros:
11111111.11111111.11111111.00000000 = 255.255.255.0 = /24
11111111.11111111.11111111.11000000 = 255.255.255.192 = /26Our IP converter shows any address in binary if you want to see the bits.
The key numbers in every subnet
- Network address – the first address, with all host bits set to 0. It names the network and cannot be given to a device.
- Broadcast address – the last address, with all host bits set to 1. Packets sent here reach every device in the subnet.
- Usable host range – everything in between.
- Number of addresses = 2(32 − prefix). Usable hosts = that number − 2.
The block-size shortcut
You rarely need binary. Find the octet where the mask is not 255 or 0 (the “interesting octet”) and calculate:
block size = 256 − mask value in the interesting octetNetworks start at every multiple of the block size in that octet. For mask 255.255.255.192, the block size is 256 − 192 = 64, so networks start at .0, .64, .128 and .192.
Worked example 1: 192.168.1.130/25
- /25 → mask 255.255.255.128 → block size 256 − 128 = 128.
- Networks start at .0 and .128. 130 falls in the .128 block.
- Network:
192.168.1.128. Broadcast: next block minus one =192.168.1.255. - Usable:
192.168.1.129–192.168.1.254= 126 hosts.
Worked example 2: 10.20.30.45/28
- /28 → mask 255.255.255.240 → block size 16.
- Blocks: .0, .16, .32, .48 … 45 falls in the .32 block.
- Network
10.20.30.32, broadcast10.20.30.47. - Usable
10.20.30.33–10.20.30.46= 14 hosts.
Worked example 3: 172.16.77.9/20
Here the interesting octet is the third one.
- /20 → mask 255.255.240.0 → block size 256 − 240 = 16, in the third octet.
- Blocks in the third octet: 0, 16, 32, 48, 64, 80 … 77 falls in the 64 block.
- Network
172.16.64.0. Broadcast: the next block starts at 172.16.80.0, so the broadcast is172.16.79.255. - Addresses: 212 = 4,096, so 4,094 usable hosts (172.16.64.1 – 172.16.79.254).
Quick reference table
| Prefix | Mask | Addresses | Usable hosts | Typical use |
|---|---|---|---|---|
| /8 | 255.0.0.0 | 16,777,216 | 16,777,214 | Very large private networks (10.0.0.0/8) |
| /16 | 255.255.0.0 | 65,536 | 65,534 | Campus or cloud VPC |
| /22 | 255.255.252.0 | 1,024 | 1,022 | Large office, guest Wi-Fi |
| /24 | 255.255.255.0 | 256 | 254 | Home network, small office |
| /26 | 255.255.255.192 | 64 | 62 | Department or VLAN |
| /28 | 255.255.255.240 | 16 | 14 | Small server group |
| /30 | 255.255.255.252 | 4 | 2 | Point-to-point link (traditional) |
| /31 | 255.255.255.254 | 2 | 2 | Point-to-point link (RFC 3021) |
| /32 | 255.255.255.255 | 1 | 1 | Single host, loopback, firewall rule |
Splitting a network into subnets
Each extra bit in the prefix halves the subnet. Say you have 192.168.50.0/24 and need four equal networks: borrowing 2 bits gives a /26, and the four subnets are .0/26, .64/26, .128/26 and .192/26, each with 62 hosts.
When subnets need different sizes, use VLSM (variable-length subnet masking): allocate the largest first. For 100 staff, 50 phones and 10 servers from 192.168.50.0/24: staff get .0/25 (126 hosts), phones .128/26 (62 hosts) and servers .192/28 (14 hosts), leaving .208–.255 free for later.
Wildcard masks
Some routers and firewall rules (notably Cisco ACLs and OSPF) use a wildcard mask, which is the inverse of the subnet mask: subtract each octet from 255. The wildcard for 255.255.255.192 is 0.0.0.63.
A note on IPv6
IPv6 uses the same CIDR notation, but the numbers are much larger. Standard practice is simple: every LAN segment is a /64, and your provider gives you a /56 or /48 to divide into /64s. There is no broadcast address in IPv6 and no need to squeeze hosts into small subnets. Read more in IPv6 explained.
Practice
Try these, then check them in the subnet calculator: 192.168.5.200/27, 10.1.1.1/30 and 172.20.130.4/18. (Answers: network .192, broadcast .223, 30 hosts; network 10.1.1.0, broadcast 10.1.1.3, 2 hosts; network 172.20.128.0, broadcast 172.20.191.255, 16,382 hosts.)