Subnet Masks and CIDR Notation Explained

An IP address on its own does not tell you much. The number 192.168.1.50 only becomes meaningful once you know which part of it identifies the network and which part identifies an individual device on that network. That split is exactly what a subnet mask, and its modern shorthand CIDR notation, exists to describe. Understanding it is the difference between confidently designing an address plan and guessing why two machines cannot talk to each other. This guide walks through what the mask actually does, how to read prefix lengths, and how to carve a network into smaller pieces. You can follow along and check your own numbers with the Subnet Calculator calculator.

Every IPv4 address is 32 bits long, usually written as four decimal numbers (octets) from 0 to 255, such as 192.168.1.50. Those 32 bits are divided into two parts: the network portion, which is shared by every device on the same local network, and the host portion, which is unique to each device. Devices with the same network portion can reach each other directly; to talk to anything with a different network portion they must go through a router.

The catch is that nothing in the four octets themselves tells you where the dividing line falls. The address 192.168.1.50 could be on a tiny network of a handful of machines or part of a much larger block. The subnet mask supplies the missing information by marking which bits belong to the network and which belong to the host.

A subnet mask is also 32 bits long and is written the same way as an IP address, for example 255.255.255.0. Read it in binary and its meaning becomes obvious: every bit set to 1 marks a network bit, and every bit set to 0 marks a host bit. The mask 255.255.255.0 is twenty-four 1s followed by eight 0s (11111111.11111111.11111111.00000000), so the first three octets are the network and the last octet is the host.

A valid mask is always a solid run of 1s followed by a solid run of 0s, never mixed. That is why you see 255, 254, 252, 248, 240, 224, 192, and 128 in masks but never an arbitrary value like 255.255.255.100. If you want to see the binary breakdown of any address or mask, the IP to Dec / Bin / Hex tool converts between decimal, binary, and hexadecimal so you can watch the boundary line for yourself.

Writing out 255.255.255.0 every time is tedious, so CIDR (Classless Inter-Domain Routing) notation replaces the mask with a single number: the count of network bits, written after a slash. Because 255.255.255.0 has twenty-four 1 bits, it is written /24. The two notations are perfectly equivalent; /24 and 255.255.255.0 describe the same boundary in different words.

The number after the slash is called the prefix length, and reading it is straightforward: the larger the prefix, the more bits are committed to the network and the fewer are left for hosts. A /30 leaves only 2 host bits, so it is a very small network; a /16 leaves 16 host bits, so it is a large one. Prefix length and host capacity move in opposite directions, which is the single most useful intuition to carry forward.

The number of host bits sets the size of a subnet. If h is the number of host bits, the block contains 2 to the power of h addresses in total. A /24 has 8 host bits, so 2 to the 8th = 256 addresses; a /28 has 4 host bits, so 2 to the 4th = 16 addresses; a /30 has 2 host bits, so just 4 addresses.

Not all of those are assignable, though. In each IPv4 subnet two addresses are reserved: the first is the network address (all host bits 0), which names the subnet itself, and the last is the broadcast address (all host bits 1), used to reach every device at once. Everything in between is a usable host address. So a /24 has 256 total but 254 usable, ranging from .1 through .254, with .0 as the network and .255 as the broadcast. The general rule is usable hosts = 2 to the power of h, minus 2. The /31 is a special case used for point-to-point links where, by convention, both addresses are usable. The Subnet Calculator calculator works all of this out instantly, including the exact network address, broadcast address, and first and last usable host for any input.

It helps to memorize a handful of the most common prefixes and their capacities. /30 = 255.255.255.252, 4 addresses, 2 usable (ideal for a link between two routers). /29 = 255.255.255.248, 8 addresses, 6 usable. /28 = 255.255.255.240, 16 addresses, 14 usable. /27 = 255.255.255.224, 32 addresses, 30 usable. /24 = 255.255.255.0, 256 addresses, 254 usable (the classic small LAN). /16 = 255.255.0.0, 65,536 addresses, 65,534 usable. /8 = 255.0.0.0, 16,777,216 addresses, 16,777,214 usable.

Notice the pattern: each step from /24 toward /30 halves the number of addresses, while each step toward /8 multiplies them. Once you internalize that doubling and halving, you can estimate any subnet's size in your head without reaching for a table.

Not every address is meant for the public internet. RFC 1918 sets aside three ranges for private use that anyone can deploy on an internal network without registration: 10.0.0.0/8 (10.0.0.0 to 10.255.255.255), 172.16.0.0/12 (172.16.0.0 to 172.31.255.255), and 192.168.0.0/16 (192.168.0.0 to 192.168.255.255). These are the addresses you see behind home routers and inside corporate LANs, and they are translated to a public address by NAT when traffic leaves the network.

Because these ranges are not routable on the public internet, the same private addresses are reused on millions of separate networks. That is why your home laptop and a stranger's can both be 192.168.1.50 without conflict. If you want to confirm what your network looks like from the outside (your public, routable address rather than the private one), the IP Information tool shows the address the wider internet actually sees.

Subnetting means borrowing host bits to create several smaller networks out of one larger block. Every bit you borrow doubles the number of subnets and halves the hosts in each. Suppose you have been given 192.168.10.0/24 (256 addresses) and need four separate departments. Borrowing 2 bits turns the /24 into four /26 networks, because 2 borrowed bits give 2 to the 2nd = 4 subnets.

A /26 has 6 host bits, so each holds 64 addresses and 62 usable hosts. The four resulting subnets are 192.168.10.0/26 (hosts .1 to .62, broadcast .63), 192.168.10.64/26 (hosts .65 to .126, broadcast .127), 192.168.10.128/26 (hosts .129 to .190, broadcast .191), and 192.168.10.192/26 (hosts .193 to .254, broadcast .255). Each block starts on a multiple of 64, which is the block size you get from a /26. The block size for any subnet is simply 256 minus the value of the last non-255 octet in the mask, so for /26 (mask .192) the size is 256 - 192 = 64. To verify a plan like this without doing the binary arithmetic by hand, drop each prefix into the Subnet Calculator calculator and confirm the boundaries line up.

IPv6 uses the same CIDR idea but on a much larger scale. An IPv6 address is 128 bits instead of 32, and prefixes are written exactly the same way, such as 2001:db8::/32 or a /64 for a single LAN. The convention is that /64 is the standard size for an individual network segment, leaving a full 64 bits for hosts, which is an effectively unlimited amount of address space per subnet. Internet providers typically delegate something like a /48 or /56 to a customer, who then splits it into many /64 segments.

Because IPv6 addresses are long, they are written in hexadecimal and compressed by collapsing runs of zeros with a double colon. If you are working with verbose IPv6 addresses, the IPv6 Compress tool shrinks them to their canonical short form (and expands them back) so the prefix boundaries are easier to read. The core concept, though, is identical to IPv4: the number after the slash tells you how many leading bits identify the network.

Is /24 the same as 255.255.255.0? Yes. The /24 simply counts the twenty-four network bits, and 255.255.255.0 writes those same bits out as a dotted-decimal mask. They are two notations for one boundary.

Why does a /24 have 254 usable hosts and not 256? Of the 256 total addresses, the first is reserved as the network address and the last as the broadcast address, leaving 254 that you can assign to devices.

How do I know how many subnets I get when I borrow bits? Each borrowed host bit doubles the subnet count: borrow 1 bit for 2 subnets, 2 bits for 4, 3 bits for 8, and so on. The hosts per subnet halve at the same rate.

What is the fastest way to check my math? Enter the address and prefix into the Subnet Calculator calculator to see the network, broadcast, usable range, and host count, and use IP to Dec / Bin / Hex if you want to inspect the underlying binary.