# Subnetting explained: CIDR, masks and host counts > A CIDR prefix says how many leading bits identify the network. A /24 fixes the first 24 bits, leaving 8 for hosts - 256 addresses, of which 254 are usable because the first is the network address and the last is the broadcast address. The formula is 2^(32-prefix) - 2. Source: https://rankcert.com/blog/subnetting-explained Published: 2026-09-02 ยท Updated: 2026-09-02 --- An IPv4 address is 32 bits split into a network part and a host part. Subnetting is deciding where the split goes, and CIDR notation is how you write that decision down. ## Reading a prefix `192.168.1.0/24` means the first 24 bits identify the network and the remaining 8 identify hosts within it. | Prefix | Mask | Addresses | Usable hosts | | --- | --- | --- | --- | | /30 | 255.255.255.252 | 4 | 2 | | /29 | 255.255.255.248 | 8 | 6 | | /28 | 255.255.255.240 | 16 | 14 | | /26 | 255.255.255.192 | 64 | 62 | | /24 | 255.255.255.0 | 256 | 254 | | /16 | 255.255.0.0 | 65,536 | 65,534 | Every step down the prefix doubles the size. `/24` and `255.255.255.0` are the same statement in different notation. Free tool: [Subnet Calculator](https://rankcert.com/tools/subnet-calculator) - Enter any IPv4 address in CIDR notation to get the network and broadcast addresses, usable host range, subnet mask, wildcard mask and host count. ## Why two addresses are unusable The first address in any subnet is the **network address**, which names the subnet itself. The last is the **broadcast address**, which reaches every host at once. Neither can be assigned to a machine. That is where `- 2` in the formula comes from, and it is why a `/30` gives you exactly two usable addresses - the minimum for a point-to-point link. The exception is `/31`, defined in RFC 3021 specifically for point-to-point links where there is nowhere to broadcast to. Both addresses are usable. A `/32` is a single host route, used for loopbacks and for pinning a route to one machine. ## Splitting a network To divide a network, borrow bits from the host portion. Splitting `10.0.0.0/24` into four means moving to `/26`. Each new subnet has 64 addresses and 62 usable hosts: ``` 10.0.0.0/26 hosts 10.0.0.1 - 10.0.0.62 10.0.0.64/26 hosts 10.0.0.65 - 10.0.0.126 10.0.0.128/26 hosts 10.0.0.129 - 10.0.0.190 10.0.0.192/26 hosts 10.0.0.193 - 10.0.0.254 ``` The pattern is that subnet boundaries land on multiples of the block size, and the block size is `256 - the last octet of the mask`. For `/26` that is `256 - 192 = 64`, which is why the subnets start at 0, 64, 128 and 192. ## Wildcard masks A wildcard mask is the bitwise inverse of the subnet mask: `/24` becomes `0.0.0.255`. Cisco ACLs and OSPF use it rather than the subnet mask, which means a rule written with the wrong one silently matches a completely different range. There is no error - just traffic going somewhere unexpected. ## Private ranges - `10.0.0.0/8` - 16.7 million addresses - `172.16.0.0/12` - 1 million addresses - `192.168.0.0/16` - 65,536 addresses Also worth recognising: `100.64.0.0/10` is carrier-grade NAT, which is why a device behind some mobile networks has an address that looks public and is not. `169.254.0.0/16` is link-local - an address in that range means DHCP failed. Pick a private range with room to grow and subnet it deliberately. Most cloud VPC pain comes from someone choosing `10.0.0.0/24` for a first environment and then needing to peer it with another network that used the same block. ## IPv6 The exercise changes completely, because there is no scarcity and no broadcast address. A `/64` is the standard size for any single network regardless of how many devices sit on it - stateless address autoconfiguration assumes it. You subnet by taking prefixes shorter than `/64`: an ISP typically delegates a `/56` or `/48`, giving you 256 or 65,536 `/64` networks to hand out. Do not subnet below `/64` on a LAN. It works, and it breaks SLAAC and some neighbour discovery behaviour in ways that are tedious to diagnose. Work out any of this quickly with the [subnet calculator](/tools/subnet-calculator).