Skip the math entirely — paste an IP and mask into our free Subnet Calculator and get network range, broadcast, gateway options, and usable hosts instantly, right in your browser.
If you have ever stared at something like 192.168.1.0/24 and wondered what the /24 actually decides, this guide is for you. By the end you will be able to look at any CIDR block, know exactly how many devices fit inside it, where it starts and ends, and how to carve bigger networks into smaller ones without a calculator.
We will build up from zero: what a subnet physically is, what each part of the notation means, the single piece of math that powers all of it, worked examples you can follow with pen and paper, and the mistakes that take down real production networks. If you just need an answer immediately, the IPv4 Subnet Calculator computes all of it for you locally in your browser — but understanding the mechanics below will save you hours of debugging later.
1. What Is Subnetting, Really?
Imagine an apartment building with 256 mailboxes in one giant lobby. Every letter arrives at the same building, then someone must walk the lobby checking every box. Now imagine splitting that lobby into four wings of 64 boxes each, with a sorter at the entrance who forwards each letter straight to the correct wing. That is subnetting: taking one large flat network and dividing it into smaller, self-contained sections so traffic stays local and routers only move packets between sections when needed.
A subnet (short for sub-network) is one of those sections. Devices inside the same subnet talk to each other directly through a switch. Traffic between different subnets must pass through a router, which is where you can apply firewall rules, isolate departments, or contain problems. Subnetting exists because flat networks do not scale: broadcasts get louder, security boundaries disappear, and one misbehaving device can choke everyone else.
2. Anatomy of an IP Address
An IPv4 address is really just a 32-bit number displayed as four decimal numbers for human readability. Each of the four parts (called octets) represents 8 bits:
192.168.1.130 → 11000000.10101000.00000001.10000010The trick of subnetting is that this address carries two meanings at once: which network the device belongs to, and which device it is within that network. The split point between those two meanings is decided by the subnet mask — and this is exactly what the /24 style notation controls.
Think of a postal address: "Main Street" is the network, "house number 130" is the device. Two houses can share the house number 130 as long as they are on different streets. Likewise, 192.168.1.130 and 10.0.0.130 are different devices because their network portions differ.
3. CIDR Notation Demystified
CIDR (Classless Inter-Domain Routing, pronounced "cider") is simply a shorthand that says how many bits, counting from the left, are locked in as the network portion. That is the entire meaning of the slash number:
192.168.1.0/24 ← first 24 bits are the network, last 8 bits belong to devices| CIDR | Mask (dotted) | Total addresses | Usable hosts | Typical use |
|---|---|---|---|---|
| /8 | 255.0.0.0 | 16,777,216 | 16,777,214 | Huge ISP-level blocks |
| /16 | 255.255.0.0 | 65,536 | 65,534 | Large company / VPC |
| /20 | 255.255.240.0 | 4,096 | 4,094 | Mid-size cloud subnet |
| /24 | 255.255.255.0 | 256 | 254 | Classic office LAN |
| /26 | 255.255.255.192 | 64 | 62 | Small department / DMZ |
| /30 | 255.255.255.252 | 4 | 2 | Point-to-point router link |
| /32 | 255.255.255.255 | 1 | — | A single host (firewall rule) |
The old dotted mask (255.255.255.0) and CIDR (/24) are the same statement in two languages. The mask spells out the network bits in binary 1s; CIDR just counts them. Cloud consoles prefer CIDR; older routers often want the dotted form. You should be fluent reading both.
4. The Only Formula You Need
Every subnet calculation reduces to one line:
host bits = 32 − prefix
total addresses = 2 ^ host bits
usable hosts = total − 2 (network name + broadcast)Two addresses are always subtracted. The very first address in a range names the network itself (like the street sign) and the very last is the broadcast address used to talk to every device in the section at once. Neither can belong to a real machine.
Quick sanity checks you can do in your head:
- /24 → 32−24 = 8 host bits → 2⁸ = 256 → 254 usable
- /25 → 7 host bits → 128 → 126 usable
- /26 → 6 host bits → 64 → 62 usable
- /28 → 4 host bits → 16 → 14 usable
- /30 → 2 host bits → 4 → 2 usable (perfect for a router-to-router link)
Memorize the ladder 256 → 128 → 64 → 32 → 16 → 8 → 4 → 2 and you can derive any of these in seconds. Each step right in the prefix halves the size; each step left doubles it.
5. Worked Example: Splitting a /24 into Four Teams
Your company owns 192.168.1.0/24 (254 usable hosts) and wants separate networks for Engineering, Sales, Support, and Guests. Splitting into quarters means borrowing 2 bits from the host portion, moving from /24 to /26.
Step 1 — How many subnets? Borrowing 2 bits gives 2² = 4 subnets.
Step 2 — Where does each start? With 6 remaining host bits, each section is 2⁶ = 64 addresses wide. Start points land every 64 addresses: .0, .64, .128, .192.
Step 3 — Ranges and broadcasts:
| Team | CIDR | Range | Broadcast | Usable |
|---|---|---|---|---|
| Engineering | 192.168.1.0/26 | .1 – .62 | 192.168.1.63 | 62 |
| Sales | 192.168.1.64/26 | .65 – .126 | 192.168.1.127 | 62 |
| Support | 192.168.1.128/26 | .129 – .190 | 192.168.1.191 | 62 |
| Guests | 192.168.1.192/26 | .193 – .254 | 192.168.1.255 | 62 |
Notice the pattern: each range stops one address before the next start point — that skipped address is the broadcast. Once you see the rhythm, you can slice any block by hand. Verify yourself against our Subnet Calculator: enter 192.168.1.64/26 and confirm the range and broadcast match the table.
Reverse direction works too. Given 10.0.37.201/22, ask: what network contains it? A /22 means blocks of 1,024 addresses aligned on multiples of 1,024 in the third-and-fourth octet pair. 37 × 256 + 201 = 9,673; floor(9673 / 1024) × 1024 = 9,216 → third octet 36, so the containing network is 10.0.36.0/22 with range 10.0.36.1 – 10.0.39.254. This "which block am I in?" question is the one tools, firewalls, and routing tables answer constantly.
6. Which Mask Do I Need? Sizing From the Host Count
Working backward from requirements is the task you will do most in cloud consoles. Count your devices, add growth headroom (typically 50–100%), then pick the smallest prefix whose usable-host count covers it:
| You need… | Pick | You get |
|---|---|---|
| Up to 2 (router link) | /30 | 2 hosts |
| Up to 6 (tiny DMZ) | /29 | 6 hosts |
| Up to 14 (camera rack) | /28 | 14 hosts |
| Up to 62 (small office) | /26 | 62 hosts |
| Up to 254 (standard LAN) | /24 | 254 hosts |
| Up to 1,022 (campus floor) | /22 | 1,022 hosts |
| Up to 16,382 (large VPC) | /19 | 16,382 hosts |
Azure users beware: Azure reserves 5 addresses per subnet (network, gateway, DNS×2, broadcast), so a /29 there yields only 3 usable machines, not 6. AWS reserves the first four and the last address of each subnet for similar reasons. Always check the platform's reservation rules before sizing tightly.
7. Real-World Scenarios You Will Actually Hit
Cloud VPC planning
When creating a VPC you choose one supernet (say 10.40.0.0/16) and then carve per-tier subnets from it — public 10.40.1.0/24, private app 10.40.10.0/23, database 10.40.20.0/24. The golden rule is to leave unallocated gaps between allocations. If you fill the space completely and later need a new subnet for Kubernetes or a peered network, you are forced into an ugly migration. Leave whole /20-sized holes empty for the future.
Docker and Kubernetes defaults
Docker's default bridge lives in 172.17.0.0/16; many Kubernetes distributions default their service CIDR to 10.96.0.0/12 and pod CIDRs nearby. If your company LAN already uses 172.17.x.x or 10.96.x.x, containers will happily grab addresses that become unreachable over the VPN. This collision is one of the most common "it works on my machine, fails on VPN" bugs in modern development.
Home lab mapping
Mapping custom domains to local services uses your hosts file with entries like 192.168.1.50 homelab.local. Our Hosts File Generator builds correctly formatted entries for whole batches of devices, which pairs naturally with a freshly planned home subnet.
8. Seven Mistakes That Break Real Networks
| Mistake | What happens | Correct approach |
|---|---|---|
| Treating .0 and .255 as assignable hosts | Mysterious timeouts for whoever gets those IPs | Usable range always excludes network and broadcast |
| Off-by-one on ranges ("ends at .63") | Last usable host (.62) missed in DHCP scopes | Range ends one before the next subnet's start |
| Overlapping VPC/subnet CIDRs | Routes become ambiguous; cloud API rejects or traffic blackholes | Plan a non-overlapping IP map before provisioning |
| Mask mismatch across the same wire | One side thinks neighbors are remote; half traffic dies | Identical prefix length on every device in a segment |
| Sizing exactly to current count | Next hire triggers emergency re-subnetting | Add 50–100% growth headroom at creation time |
| Ignoring cloud-reserved addresses | "We have room for 6" fails at 3 on Azure | Check AWS/Azure/GCP reservation rules when sizing |
| Container defaults colliding with LAN | VPN clients lose access to internal services | Move Docker/K8s CIDRs away from company ranges |
9. Troubleshooting Subnet Problems
Symptom: can ping across subnets, TCP fails back
Cause: asymmetric routing or a stateful firewall expecting return traffic on the same path. Fix: verify the default gateway on both sides and confirm the firewall allows the return direction; ICMP succeeding while HTTP fails is almost never a subnet error alone.
Symptom: new device gets no lease
Cause: DHCP scope exhausted — classic when a /24 serves more MACs than expected (phones + laptops + containers). Fix: shorten leases, or migrate that segment to a larger block such as a /23, using the sizing table above.
Symptom: some devices reachable, others in the "same" network are not
Cause: mixed masks on one wire — e.g., half the devices configured /25 while the router runs /24. The /25 crowd considers part of the LAN remote and sends it to the gateway. Fix: standardize the prefix on every interface in the segment.
Symptom: everything breaks after a cloud subnet change
Cause: reserved-address assumptions or stale route tables referencing old ranges. Fix: re-read the platform's reserved list, update routes, then re-test from the smallest unit (one instance) outward.
10. Subnetting Best Practices for 2026
- Document the IP plan before touching devices. A spreadsheet of block → purpose → owner prevents 90% of collisions. When documentation lives only in someone's head, outages follow their vacation.
- Leave expansion holes. Allocate sibling subnets with deliberate gaps (e.g., skip from .0/26 to .128/26) so a future team slot fits without renumbering anything.
- Separate trust zones, not just sizes. Guest Wi-Fi, printers, servers, and management interfaces belong in different subnets regardless of device counts — the boundary is your firewall's enforcement point.
- Standardize on private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and keep container/service CIDRs in a written registry so VPN and mesh overlays never collide.
- Learn /64 for IPv6 now. Every IPv6 subnet in practice is a /64 — the allocation habit transfers, only the numbers change, and dual-stack day arrives faster than planned.
- Verify with tools, not memory. Even veterans double-check boundary math; a wrong octet in a firewall rule is invisible until it isn't. The browser-based Subnet Calculator shows network, broadcast, first/last host, and wildcard mask instantly with zero upload.
Conclusion
Subnetting looks intimidating only until the moment the slash-number clicks: it is nothing more than "how many bits name the street vs. the house." From there everything follows one formula — halve or double as the prefix moves, subtract two for the unusable endpoints, align starts on the block size. Master the /24-to-/26 split above and you hold the skill that cloud architects, sysadmins, and security engineers all lean on daily.
When a live decision needs numbers — sizing a new VPC tier, settling a firewall rule argument, scoping a DHCP pool — open the IPv4 Subnet Calculator, punch in the candidate block, and read the answer instead of trusting mental arithmetic under pressure. And once the plan is set, drop your device map into the Hosts File Generator so friendly names resolve everywhere on the new network.
Frequently Asked Questions
- What does /24 mean in an IP address?
- The /24 is CIDR notation for how many bits are fixed as the network portion. A /24 fixes the first 24 bits as the network and leaves 8 bits for devices, producing 256 total addresses and 254 usable hosts.
- How do I calculate usable hosts from a CIDR prefix?
- Subtract the prefix from 32 to get host bits, raise 2 to that power for total addresses, then subtract 2 for the network and broadcast addresses. For example, /26 gives 32−26 = 6 host bits, 2⁶ = 64 total, 62 usable.
- Why does a /24 have 254 usable hosts and not 256?
- The first address names the network itself and the last is the broadcast address. Neither can be assigned to a device, so a 256-address /24 offers 254 usable hosts.
- What is the difference between a subnet mask and CIDR?
- They are two spellings of the same fact. 255.255.255.0 writes the network bits as a dotted mask; /24 counts those bits. Routers accept either, and converting between them is mechanical.
- Can two subnets overlap in the cloud?
- No. AWS, Azure, and Google Cloud reject overlapping CIDRs within a VPC and peering fails silently or outright when ranges collide. Draft a non-overlapping IP map before creating resources, especially when VPN or peering is possible later.
- How many subnets does splitting a /24 into /26s create?
- Borrowing two bits creates 4 subnets of 64 addresses each — 62 usable hosts apiece — starting at .0, .64, .128, and .192.
- Is 127.0.0.1 part of any subnet?
- No external one. The entire 127.0.0.0/8 block is loopback: traffic never leaves the machine, so it plays no role in network subnet planning.
- Does subnetting apply to IPv6 the same way?
- The bit-splitting concept is identical, but practically every IPv6 LAN is a single /64, giving effectively unlimited hosts. Planning effort shifts from host-counting to allocation hierarchy.