Subnets and CIDR Notation Explained, with a Calculator

Step-by-step

1. 1

   Read the prefix as a count of network bits

   In CIDR, the number after the slash is how many of the 32 bits are locked as the network. A /24 fixes the first 24 bits, leaving 8 bits for hosts; a /26 fixes 26 bits, leaving 6. The higher the prefix, the smaller the network. Drop the address into the Subnet Calculator and it fills in the mask, ranges, and counts, but the point of this tutorial is that you can also reason about it without the tool.

2. 2

   Convert prefix to subnet mask

   The mask is just the prefix written out as four octets. A /24 is 24 one-bits followed by 8 zero-bits, which is 255.255.255.0. A /26 is 255.255.255.192, because the last octet holds two one-bits, 128 plus 64, then zeros. This mapping is fixed and worth memorizing for the common values: /25 is .128, /26 is .192, /27 is .224, /28 is .240. Prefix and mask are two spellings of the same boundary, and every calculator converts freely between them.

3. 3

   Count the addresses with 2 to the power of host bits

   Total addresses in a block equal 2 raised to the number of host bits, which is 2^(32 minus prefix). A /24 has 2^8 = 256 addresses. A /26 has 2^6 = 64. From that total you subtract two to get usable hosts: one address is the network identifier and one is the broadcast address, and neither can be assigned to a machine. So a /24 gives 254 usable hosts and a /26 gives 62. The minus-two rule trips people up constantly, so make it automatic.

4. 4

   Identify the network and broadcast addresses

   The network address is the first address in the block, with all host bits set to zero; the broadcast is the last, with all host bits set to one. For 192.168.1.0/26 the network is 192.168.1.0 and the broadcast is 192.168.1.63. The usable range is everything strictly between them, 192.168.1.1 through 192.168.1.62. Anything you assign to a server, a gateway, or a printer has to live inside that usable window; the two boundary addresses are reserved and assigning them breaks things quietly.

5. 5

   Find the block size and step through subnets

   The block size in the interesting octet is 256 minus the mask value there. For a /26 the mask octet is 192, so the block size is 64, and subnets start every 64 addresses: .0, .64, .128, .192. That gives you four /26 subnets inside one /24. This is the fastest mental method: find the block size, then count in steps of it to get every network address without touching binary. A /28 has a mask octet of 240, block size 16, so subnets fall on .0, .16, .32, and so on.

6. 6

   Recognize the private ranges

   Three blocks are reserved by RFC 1918 for private use and never route on the public internet: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. Your home router almost certainly hands out something inside 192.168.0.0/16. If you check What Is My IP and see a 192.168 or 10 address locally but a different public one, that is NAT at work. Knowing these ranges keeps you from accidentally overlapping a VPN or cloud VPC with your office LAN.

7. 7

   Know why you subnet at all

   Subnetting is not busywork. You split a network to contain broadcast traffic, to draw security boundaries so a firewall rule can target one segment, and to allocate address space efficiently instead of dropping every device into one flat /16. A point-to-point link between two routers needs exactly two hosts, so a /30 with its two usable addresses is perfect and wastes nothing. Matching the prefix to the actual host count is the whole discipline, and the calculator makes the trade-offs obvious.