CIDR Subnetting Explained

Subnetting looks intimidating because it mixes decimal, binary and a slash-number that seems to come from nowhere. It is really just one idea repeated: an IPv4 address is 32 bits, and the prefix tells you where the network part stops and the host part begins. This guide walks through the arithmetic with worked examples you can check by hand — no memorising required.

An IPv4 address is 32 bits

Every IPv4 address is a 32-bit number. We write it as four decimal octets — 192.168.1.10 — purely because four groups of 0–255 are easier to read than 11000000.10101000.00000001.00001010. Each octet is 8 bits, four octets make 32 bits, and the whole address space is therefore 2^32 ≈ 4.3 billion addresses. Subnetting is the act of slicing that 32-bit number into a network part that every device on the same link shares, and a host part that is unique to each device.

What the /prefix means

CIDR — Classless Inter-Domain Routing — replaced the old rigid Class A/B/C system in 1993 so networks could be sized to fit. The notation is address/prefix, and the prefix is simply how many leading bits belong to the network. In 192.168.1.0/24 the /24 says the first 24 bits are the network, leaving 32 − 24 = 8 bits for hosts. Those 8 host bits give 2^8 = 256 addresses in the block. The rule that drives everything else is:

Each extra bit of prefix halves the block, and each bit you give back doubles it. A /25 is half a /24; a /23 is two /24s glued together. Once that clicks, the rest is bookkeeping.

How /24, /26 and /30 partition a block

Take the last octet of 192.168.1.x and watch how the prefix carves it up. A /24 uses the whole final octet for hosts, so the block runs .0 through .255 — one subnet of 256 addresses. A /26 borrows the top 2 bits of that octet for the network, splitting it into 2^2 = 4 equal blocks of 64. A /30 borrows 6 bits, splitting the octet into 2^6 = 64 tiny blocks of 4.

The block boundaries are never arbitrary: a /26's blocks start at multiples of 64 because 64 is its block size, and a /30's start at multiples of 4. The first address of every block is its network address and the last is its broadcast address.

Network, broadcast and usable-host math

Inside any block, two addresses are reserved. Setting all host bits to 0 gives the network address — the name of the subnet, never assigned to a machine. Setting all host bits to 1 gives the broadcast address, which reaches every host at once. Everything strictly between them is usable. So:

Worked example: 192.168.1.0/26

The prefix is 26, so the first 26 bits are the network and the last 6 are host bits. All 6 host bits sit in the final octet, whose top 2 bits (value 00) belong to this block. Fill the 6 host bits with zeros for the network address and ones for the broadcast:

So 192.168.1.0/26 gives the network .0, broadcast .63, and usable range .1–.62 — 62 hosts. The next /26 up starts where this one's broadcast leaves off, at 192.168.1.64/26 (network .64, broadcast .127), and so on for .128/26 and .192/26. Four /26 subnets exactly fill one /24, which matches 2^(26−24) = 4.

Common subnet sizes

Almost all day-to-day subnetting lives in the last octet, between /24 and /32. It is worth being able to read this table at a glance — the usable column is the one people get wrong.

The netmask is just the prefix written as an address: the leading one-bits filled in, the rest zero. A /26 is 255.255.255.192 because 26 one-bits is three full octets of 255 then 11000000 = 192. * The /31 and /32 rows break the "minus two" rule: RFC 3021 makes both addresses of a /31 usable for point-to-point links, and a /32 is a single-host route (loopbacks, firewall rules).

Private address ranges (RFC 1918)

Three blocks are reserved for private use and are never routed on the public internet — they are what your home and office LANs use behind NAT. Knowing their exact spans stops the common error of assuming 172.16.x through 172.31.x are separate networks (they are one /12) or that all of 172.x is private (only 172.16–172.31 is).

Three scenarios, worked end to end

1. "I have ~100 devices. What mask do I need?"

Find the smallest block whose usable count is at least 100. A /26 gives 62 — too few. A /25 gives 2^7 − 2 = 126 — enough, with headroom. So you use a /25, netmask 255.255.255.128. Applied to 192.168.10.0/25: network .0, broadcast .127, usable .1–.126. Always size up to the next power of two and leave room to grow — the second /25 (192.168.10.128/25) is free for the next VLAN.

2. "A link between two routers."

A point-to-point link only ever needs two addresses, one per end. The traditional fit is a /30: 2^(32−30) = 4 total, minus network and broadcast, leaves exactly 2 usable. On 10.0.0.0/30 that is .1 (router A) and .2 (router B), with .0 and .3 reserved. Modern gear often uses a /31 instead — under RFC 3021 both of its two addresses are usable, so the same link fits with zero waste.

3. "Split a /24 among four departments of ~50 hosts each."

Each department needs 50 usable hosts; a /26 provides 62, which fits. And a /24 holds exactly 2^(26−24) = 4 /26 subnets, so the split is clean with none left over:

If one department later needed 100 hosts you could not stretch its /26 in place — you would carve that department a /25 from a different /24, because subnets must fall on their natural power-of-two boundary. That boundary rule is the whole discipline of subnetting in one sentence.

The honest limits of doing it by hand

Hand arithmetic is perfect for the last octet, where the host bits stay inside one number. When a prefix falls on a non-octet boundary in a different octet — say a /12 or /20 — you are masking bits in the second or third octet, and the "block size" trick still works but is easier to slip on. That is exactly where a calculator earns its keep: it masks the host bits off for you and shows the network, broadcast, range and masks with no off-by-one. This guide is IPv4 only; IPv6 has no broadcast address and no netmask, and its /64 host boundary deserves its own treatment.

Open the IP Subnet Calculator → to check any of these blocks, or browse all Polyatic tools.