Core answer: A subnet mask splits an IP address into network bits and host bits. /24 (255.255.255.0) means the first 24 bits identify the network, leaving 8 host bits = 2⁸−2 = 254 usable devices. Usable hosts = 2^(32−prefix) − 2.
What a subnet mask does
An IPv4 address is 32 bits (e.g., 192.168.1.100); the mask is 32 bits of ones followed by zeros:
- Where the mask is 1 → that IP bit belongs to the network (which street)
- Where the mask is 0 → that bit belongs to the host (the house number)
Two devices with the same network portion are on the same subnet and talk directly; otherwise traffic must pass through a router.
CIDR cheat sheet (/8–/30)
| Prefix | Mask | Total addresses | Usable hosts | Typical use |
|---|---|---|---|---|
| /8 | 255.0.0.0 | 16.78M | 16.78M−2 | 10.0.0.0 private range |
| /16 | 255.255.0.0 | 65,536 | 65,534 | 172.16 private, campus networks |
| /24 | 255.255.255.0 | 256 | 254 | Home/small-office default |
| /25 | 255.255.255.128 | 128 | 126 | Department-level |
| /26 | 255.255.255.192 | 64 | 62 | Small teams / VLANs |
| /27 | 255.255.255.224 | 32 | 30 | Server zones |
| /28 | 255.255.255.240 | 16 | 14 | Device zones |
| /29 | 255.255.255.248 | 8 | 6 | Point-to-point / firewall links |
| /30 | 255.255.255.252 | 4 | 2 | Router point-to-point links |
Counting usable hosts
Usable hosts = 2^(host bits) − 2
The two removed:
- Network address: host bits all 0 (e.g., 192.168.1.0) — names the subnet itself
- Broadcast address: host bits all 1 (e.g., 192.168.1.255) — shouts to the whole segment
Example: /26 has 6 host bits → 2⁶−2 = 62 hosts.
Example: splitting 192.168.1.0/24 into four
Divide a /24 equally among 4 departments, ≤62 devices each → use /26:
| Subnet | Network address | Usable range | Broadcast |
|---|---|---|---|
| Dept A | 192.168.1.0/26 | .1 – .62 | .63 |
| Dept B | 192.168.1.64/26 | .65 – .126 | .127 |
| Dept C | 192.168.1.128/26 | .129 – .190 | .191 |
| Dept D | 192.168.1.192/26 | .193 – .254 | .255 |
Pattern: each time the subnet count doubles, the prefix grows by 1 and per-subnet capacity halves (256 → 128 → 64).
Are two IPs on the same subnet?
Method: AND each address with its own mask; equal network addresses mean same subnet.
Example: A = 192.168.1.60/26, B = 192.168.1.100/26
- A AND 255.255.255.192 → 192.168.1.0
- B AND → 192.168.1.64
- Different → not the same subnet; they need a layer-3 device to communicate
This is the classic cause of "the IP looks right but ping fails": mismatched masks — one side thinks the peer is local, the other doesn't.
Public, private, and special ranges
| Block | Purpose |
|---|---|
| 10.0.0.0/8 | Private (enterprise LANs) |
| 172.16.0.0/12 | Private |
| 192.168.0.0/16 | Private (home-router default) |
| 127.0.0.0/8 | Loopback (127.0.0.1 = this machine) |
| 169.254.0.0/16 | Link-local (fallback when DHCP fails) |
| 100.64.0.0/10 | Carrier-grade NAT (common inside ISP networks) |
Private addresses cannot route on the public internet — they reach it via NAT.
Common mistakes and myths
- "/24 gives 256 usable hosts" — 254; .0 is the network address and .255 the broadcast, neither assignable.
- "Masks must be whole octets" — CIDR allows any prefix (/23, /27); classful A/B/C thinking is pre-1993 history.
- "Widening the mask expands the LAN" — /24 → /23 does merge 192.168.0.x–192.168.1.x, but every device, gateway, and DHCP scope must change in sync; editing one machine creates half-broken connectivity.
- "Any gateway address works" — the gateway must lie inside this subnet's usable range and actually forward; otherwise all off-subnet traffic is silently dropped.
Use the [Subnet Calculator](/c/dev/subnet) to get network address, broadcast, and usable range from any IP/prefix, and the [Base Converter](/c/dev/base-convert) to verify the bitwise AND.