You're staring at "192.168.1.0/24" in a router config or a cloud VPC setup, and you have a rough sense that it means something about how many devices can live on that network. But when someone asks you to actually work out the range, or explain why a /26 isn't just "a smaller /24," the confidence disappears. This isn't a knowledge gap so much as a translation gap. Subnetting is simple arithmetic wearing a binary costume, and once you see the mechanics, the notation stops looking like a code you have to memorize.
Why This Trips Up People Who Understand the Concept Fine
Most people can explain subnetting in plain English without much trouble: it's splitting one network into smaller pieces. The part that breaks down is doing the actual math under time pressure, because the math happens in binary and almost nobody thinks in binary by default. You end up converting decimal octets to binary, doing bitwise arithmetic, converting back, and hoping you didn't drop a bit somewhere in the middle. One wrong digit and a firewall rule silently excludes the one server it was supposed to cover.
The fix isn't memorizing a giant cheat sheet of every possible mask. It's understanding the handful of moving parts well enough that you can reconstruct any of it on demand.
What a Subnet Mask Actually Does
An IPv4 address is 32 bits, written as four decimal octets separated by dots. A subnet mask is also 32 bits, and its only job is to say which of those bits belong to the network portion of the address and which belong to the host portion. Where the mask has a 1, that bit is part of the network identifier. Where it has a 0, that bit is available to number individual devices.
A mask of 255.255.255.0 in binary is twenty-four consecutive 1 bits followed by eight 0 bits. That means the first three octets identify the network, and the last octet, eight bits, is left to number hosts inside it. Wikipedia's overview of subnetting lays out the binary mechanics in more depth if you want to see the bit-by-bit version rather than take the summary on faith.
Reading CIDR Notation Without Translating in Your Head
CIDR notation, the slash number after an address like /24, is just a shorthand for how many of those 32 bits are set to 1 in the mask. A /24 means the first 24 bits are network bits, which is exactly the same statement as "mask of 255.255.255.0." A /26 means the first 26 bits are network bits, leaving only 6 bits for hosts instead of 8.
Once that mapping clicks, you don't need to memorize a slash-to-mask table at all. You can derive it: a /27 means 27 network bits, so the mask is 255.255.255.224, because 224 is what you get from setting the top three bits of that final octet. Wikipedia's page on Classless Inter-Domain Routing covers how this notation replaced the older fixed-class system, which is useful context for why the slash number exists as its own convention rather than everyone just writing out the mask.
Finding the Network Address and Broadcast Address
Every subnet has two addresses that can't be assigned to a device: the network address, which is the lowest address in the range, and the broadcast address, which is the highest. Both get reserved automatically by the math, not by convention someone decided on top of it.
Take 192.168.1.130/26. A /26 leaves 6 host bits, meaning each subnet in this block spans 64 addresses (2 to the power of 6). Dividing the last octet into chunks of 64 gives you 0, 64, 128, and 192 as the starting points of each subnet. 130 falls inside the block that starts at 128, so the network address is 192.168.1.128, and the broadcast address is one less than the next block's start, 192.168.1.191.
Photo by Brett Sayles on Pexels
That's the entire method: figure out the block size from the host bits, find which block your address lands in, and the network and broadcast addresses fall out automatically at the bottom and top of that block.
How Many Usable Hosts a Subnet Actually Has
The formula is 2 raised to the number of host bits, minus 2. The subtraction accounts for the network and broadcast addresses, which are reserved and can't be assigned to a device. A /24 has 8 host bits, so 2 to the 8th is 256, minus 2 gives 254 usable addresses. A /26 has 6 host bits, giving 64 minus 2, or 62 usable addresses.
This is where the most common mistake happens. People assume a /24 means "256 devices" because that's the number that pops out of the calculation before anyone subtracts the reserved pair. Off by two doesn't sound like much until it's the reason a network was provisioned two hosts short of what it actually needed.
There's one notable exception worth knowing: /31 networks, used almost exclusively for point-to-point links, skip the reservation entirely and use both addresses as hosts, which is a deliberate carve-out rather than an error in the general formula.
Working the formula backward is just as useful as working it forward. If you're told a segment needs to fit 40 devices with a little headroom for growth, you need enough host bits so that 2 to that power, minus 2, clears 40. Five host bits gives 30 usable addresses, which falls short. Six host bits gives 62, which clears it comfortably. That means the smallest block that fits is a /26, since 32 minus 6 host bits equals 26 network bits. Sizing a subnet almost always starts from a headcount requirement like this rather than from picking a prefix length first and hoping it fits.
Private Address Ranges You'll See Constantly
Three blocks are set aside for private networks and never routed on the public internet: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. Nearly every home router, office network, and internal cloud subnet uses addresses from one of these three ranges, which is why 192.168.1.1 shows up as a router login address on an enormous number of unrelated networks without any conflict. The IETF's document on these reserved ranges is the original specification defining exactly which blocks are set aside and why.
Recognizing these ranges on sight saves time when you're reading a network diagram or a firewall rule, since an address inside one of them is almost never going to be a public-facing endpoint.
Photo by Suki Lee on Pexels
Splitting One Network Into Several Without Wasting Addresses
Real networks rarely need one uniform subnet size everywhere. A department with 100 people needs a bigger block than a point-to-point link between two routers that only ever needs two addresses. Variable Length Subnet Masking, VLSM, is the practice of carving a larger address block into subnets of different sizes based on what each segment actually needs, instead of forcing every subnet to the same fixed size and wasting addresses on the small segments.
The general approach is to sort your required subnets from largest to smallest, then allocate each one the smallest block that still covers its host requirement, working through the address space in order so nothing overlaps. ARIN, the regional registry responsible for IP address allocation across North America, publishes guidance on efficient address planning that's aimed at ISPs and large networks but explains the same underlying logic that applies at a much smaller scale inside a single office network.
Photo by Startup Stock Photos on Pexels
The Mistakes That Actually Cause Outages
A handful of errors account for most subnetting problems in practice. Assuming a /24 gives you 256 usable hosts instead of 254 is the most common one already covered above. A second is misreading which octet a shorter prefix like /16 or /8 actually affects, and accidentally overlapping two subnets that were meant to be separate. A third is forgetting that a /30, commonly used for router-to-router links, only has 2 usable addresses after the subtraction, which is exactly enough for the two ends of the link and nothing more.
The fourth, and probably the most expensive when it happens in production, is calculating a subnet correctly on paper and then transposing a digit when typing it into a router or firewall configuration. The math being right doesn't help if what actually gets entered is a single character off from what was calculated.
A fifth, quieter mistake shows up during network growth rather than initial setup. A team subnets a block correctly for the headcount it has today, then adds a new floor or a new service six months later and discovers the neighboring subnet already claims the addresses that would have made room for it. Planning a small amount of headroom into each block up front, rather than sizing exactly to the current count, avoids a re-numbering project down the line that's far more disruptive than the few wasted addresses would have been.
A Quick Note on IPv6, Since Some of This Doesn't Carry Over
IPv6 uses 128-bit addresses instead of 32-bit ones, and the address space is large enough that the tight host-count optimization driving a lot of IPv4 subnetting mostly disappears. IPv6 also doesn't reserve a broadcast address the same way IPv4 does, since it replaced broadcast with a more targeted multicast model. The prefix notation still works the same way conceptually, a /64 is the standard subnet size for most IPv6 networks, but the "how many hosts can I actually fit" question that drives so much IPv4 subnetting decision-making is far less pressing. IANA, the organization responsible for global IP address space coordination, maintains the registry for both IPv4 and IPv6 allocation if you want to see how blocks get assigned at the top of the hierarchy.
Running the Numbers Without Doing the Binary by Hand
Once you understand the mechanics above, the math itself is still tedious to do manually every time, especially under the kind of time pressure that shows up during an actual network incident. The IP Subnet Calculator at EvvyTools takes any IP address and CIDR notation and returns the network address, broadcast address, usable host range, wildcard mask, and a binary breakdown of the whole calculation, so you can check your own math or skip the manual work entirely when you just need the answer.
Photo by panumas nikhomkhai on Pexels
Where This Leaves You
Subnet masks, CIDR notation, network and broadcast addresses, and usable host counts are all the same handful of binary rules applied consistently, not a separate fact to memorize for every possible prefix length. Once the block-size and reservation logic is second nature, reading or writing any subnet, from a /30 point-to-point link to a /16 covering an entire department, becomes a quick calculation instead of a guess.
For more tools built the same way, browse the EvvyTools tools directory, or check the EvvyTools blog for more breakdowns like this one. Start from the EvvyTools homepage to see the full catalog of free tools.
