A /24 holds 256 addresses and 254 of them can be assigned to something. The first is the network address and the last is the broadcast address, and neither can belong to a host — which is where the missing two go.
Once that is clear the rest of subnetting is one piece of arithmetic repeated. The number after the slash is how many of the 32 bits identify the network; the remaining bits identify hosts inside it.
How does the slash number become a size?
By subtraction and a power of two. Thirty-two minus the prefix gives the host bits, and two to that power gives the total addresses.
| Prefix | Mask | Addresses | Usable |
|---|---|---|---|
| /24 | 255.255.255.0 | 256 | 254 |
| /25 | 255.255.255.128 | 128 | 126 |
| /26 | 255.255.255.192 | 64 | 62 |
| /28 | 255.255.255.240 | 16 | 14 |
| /30 | 255.255.255.252 | 4 | 2 |
Every extra bit halves the block, which is the whole mental model. A /25 is half a /24, a /26 is a quarter, and splitting a network is always a matter of borrowing host bits.
The /30 at the bottom is the classic link between two routers: four addresses, two usable, one for each end. There is also a /31, which under an older reading has no usable addresses at all and which a later specification permits on point-to-point links precisely because the broadcast address is pointless when there are only two devices.
Why is the mask always contiguous?
Because the hardware matches on a prefix. A mask is ones followed by zeros with no gaps, so 255.255.255.0 is valid and something like 255.0.255.0 is not a mask at all.
That constraint is what makes the two notations interchangeable. Counting the ones in a mask gives the prefix length, and a prefix length expands to exactly one mask, so converting between them is lookup rather than calculation.
It is also why subnet sizes are always powers of two. There is no way to express a block of 100 addresses, so a hundred hosts need a /25 and its 126 usable slots.
Which ranges are private?
Three, and the middle one is the one people get wrong.
| Range | Prefix | Size |
|---|---|---|
| 10.0.0.0 | /8 | 16.7 million |
| 172.16.0.0 | /12 | 1 million |
| 192.168.0.0 | /16 | 65,536 |
The middle block covers 172.16 through 172.31 and stops there. Addresses in 172.32 and above are public, which is a genuinely awkward boundary and a reliable source of firewall rules that do not do what they were meant to.
Several other ranges are special without being private. The loopback range is the whole of 127, link-local addresses starting 169.254 are what a machine assigns itself when it cannot reach a server, and a range beginning 100.64 exists for carrier-grade address sharing — so seeing one of those on a connection means the provider is doing the sharing rather than the router.
What changes with IPv6?
The arithmetic stays and the scarcity goes. An address is 128 bits rather than 32, written as eight groups of four hex digits, with runs of zeros collapsed to a double colon once per address.
A /64 is the standard subnet and it is not a small one — it holds more addresses than the entire IPv4 space squared. Allocating anything smaller than a /64 to a network breaks address autoconfiguration, which is why the advice is to hand out /64s freely rather than to conserve them.
There is no broadcast address in IPv6 at all, so the minus-two rule does not apply. Its work is done by multicast, and the address translation that IPv4 needs is unnecessary when every device can have a routable address.
How should a network be split?
By what it needs to contain, rounded up to the next power of two, with room to grow. A subnet sized exactly to today’s device count is a renumbering exercise waiting to happen.
Keeping subnets aligned to readable boundaries matters more than saving addresses. A /24 per site or per function is easy to read in a firewall rule and easy to summarise into a larger prefix later, and in private space the addresses cost nothing.
Summarisation is the reason to keep related subnets adjacent. Four consecutive /26s can be written as one /24 in a route, and four scattered ones cannot.
Overlap is the failure that costs most to fix. Two sites numbered 192.168.1.0/24 cannot be joined by a tunnel without translating one of them, and the discovery usually happens years later during a merger — which is the argument for picking an unusual block out of the 10 range at the start rather than the default the router shipped with.
Questions people ask
Can the network address be assigned to a host? No. It identifies the subnet itself, and equipment treats it as such.
What is a wildcard mask? The inverse of a subnet mask, used in some access lists. A /24 mask of 255.255.255.0 becomes 0.0.0.255.
Do I need to subnet a home network? Rarely for size, occasionally for separation — keeping guest or smart-home devices in their own subnet is the common reason.
Why does my /22 span four third octets? Because it borrows two bits from that octet. A /22 is four /24s, so 10.0.4.0/22 covers 10.0.4 through 10.0.7.
Let the arithmetic be done for you. The subnet calculator and CIDR calculator give the range, mask and usable count together, IP CIDR and IPv4 calculator work from an address, CIDR to netmask and netmask to CIDR do the notation swap, IP range turns two addresses into a prefix, private IP checker settles which block an address falls in, and the IPv6 calculator handles the longer form.