IPv4 subnetting step by step: CIDR, masks and usable hosts
8 min read · Updated 4 October 2026
Subnetting looks intimidating because it is usually explained in binary from the first line. In practice you only need binary to understand why it works. To actually calculate a subnet, one short method, the "block size" method, gets you the network address, broadcast address and usable host range in a few seconds, for any prefix length.
This guide explains the idea, then works through several examples with real numbers. You can check every answer with the subnet calculator.
The parts of an IPv4 address
An IPv4 address is 32 bits, written as four decimal numbers (octets) from 0 to 255: 192.168.10.77. Every address in a subnet is split into two parts:
- the network part: the bits that are the same for every device in the subnet;
- the host part: the bits that identify individual devices.
The prefix length says how many leading bits belong to the network part. In CIDR notation it is written after a slash: 192.168.10.77/26 means the first 26 bits are the network and the remaining 6 bits are the host part.
The subnet mask says the same thing in dotted form. It has a 1 for every network bit and a 0 for every host bit. For /26, that is 26 ones followed by 6 zeros:
11111111.11111111.11111111.11000000 = 255.255.255.192
Two addresses in every subnet are special:
- the network address, where all host bits are 0, identifies the subnet itself;
- the broadcast address, where all host bits are 1, reaches every device in it.
So a subnet with 6 host bits has 2⁶ = 64 addresses, of which 62 can be given to devices.
The reference table
These are the prefixes you will meet most often. "Usable" subtracts the network and broadcast addresses.
| Prefix | Subnet mask | Addresses | Usable hosts |
|---|---|---|---|
| /16 | 255.255.0.0 | 65,536 | 65,534 |
| /20 | 255.255.240.0 | 4,096 | 4,094 |
| /22 | 255.255.252.0 | 1,024 | 1,022 |
| /23 | 255.255.254.0 | 512 | 510 |
| /24 | 255.255.255.0 | 256 | 254 |
| /25 | 255.255.255.128 | 128 | 126 |
| /26 | 255.255.255.192 | 64 | 62 |
| /27 | 255.255.255.224 | 32 | 30 |
| /28 | 255.255.255.240 | 16 | 14 |
| /29 | 255.255.255.248 | 8 | 6 |
| /30 | 255.255.255.252 | 4 | 2 |
| /31 | 255.255.255.254 | 2 | 2 (point-to-point links only) |
| /32 | 255.255.255.255 | 1 | 1 (a single host) |
The general formula is: addresses = 2^(32 − prefix), and usable hosts = addresses − 2. A /31 is the exception: it is used for links between exactly two routers, where no network or broadcast address is needed.
The block size method
- Find the "interesting" octet: the first octet of the mask that is not 255. For /26, the mask is 255.255.255.192, so it is the fourth octet.
- Calculate the block size: 256 minus that mask octet. For /26: 256 − 192 = 64.
- List the multiples of the block size in that octet: 0, 64, 128, 192. Each multiple is the start of a subnet.
- Find which block contains your address. That block's start is the network address.
- The broadcast address is one less than the next block's start.
- Usable hosts are everything in between.
Octets to the left of the interesting octet are copied from the address unchanged. Octets to the right are 0 in the network address and 255 in the broadcast address.
Worked example 1: 192.168.10.77/26
- Mask: 255.255.255.192. Interesting octet: the fourth.
- Block size: 256 − 192 = 64. Blocks start at 0, 64, 128 and 192.
- 77 is between 64 and 127, so it is in the block starting at 64.
| Item | Value |
|---|---|
| Network address | 192.168.10.64 |
| First usable host | 192.168.10.65 |
| Last usable host | 192.168.10.126 |
| Broadcast address | 192.168.10.127 |
| Usable hosts | 62 |
Why it works in binary. The network address is the address with every host bit forced to 0, which is what a bitwise AND with the mask does:
77 = 01001101
192 = 11000000
AND = 01000000 = 64
The block size method is just a shortcut for that AND operation.
Worked example 2: 10.20.30.200/27
- Mask: 255.255.255.224. Block size: 256 − 224 = 32.
- Blocks start at 0, 32, 64, 96, 128, 160, 192 and 224.
- 200 is between 192 and 223.
| Item | Value |
|---|---|
| Network address | 10.20.30.192 |
| Usable range | 10.20.30.193 to 10.20.30.222 |
| Broadcast address | 10.20.30.223 |
| Usable hosts | 30 |
A device configured as 10.20.30.200/27 with a default gateway of 10.20.30.1 would not work: 10.20.30.1 is in a different subnet (the block starting at 0), so the device cannot reach it directly. The gateway must be inside 10.20.30.193 to 10.20.30.222.
Worked example 3: 172.16.37.5/20 (when the third octet matters)
Prefixes shorter than /24 work exactly the same way; the interesting octet simply moves left.
- Mask: 255.255.240.0. The interesting octet is the third.
- Block size: 256 − 240 = 16. Blocks in the third octet start at 0, 16, 32, 48, …
- The third octet of the address is 37, which is between 32 and 47.
| Item | Value |
|---|---|
| Network address | 172.16.32.0 |
| First usable host | 172.16.32.1 |
| Last usable host | 172.16.47.254 |
| Broadcast address | 172.16.47.255 |
| Usable hosts | 4,094 |
The fourth octet is 0 in the network address and 255 in the broadcast address, because it lies entirely to the right of the interesting octet. Check the count: a /20 has 12 host bits, 2¹² = 4,096 addresses, minus 2 = 4,094.
Splitting a network into equal subnets
Each extra prefix bit halves the subnet size and doubles the number of subnets. Splitting a /24 into /26 subnets borrows 2 bits, giving 2² = 4 subnets. Splitting it into /27 subnets borrows 3 bits, giving 2³ = 8.
Splitting 192.168.50.0/24 into four /26 subnets:
| Subnet | Usable range | Broadcast |
|---|---|---|
| 192.168.50.0/26 | .1 to .62 | .63 |
| 192.168.50.64/26 | .65 to .126 | .127 |
| 192.168.50.128/26 | .129 to .190 | .191 |
| 192.168.50.192/26 | .193 to .254 | .255 |
Splitting the same /24 into eight /27 subnets gives networks starting at .0, .32, .64, .96, .128, .160, .192 and .224, each with 30 usable hosts.
Choosing a prefix for a number of hosts
To fit a given number of devices, find the smallest number of host bits h where 2^h − 2 is at least that number, then the prefix is 32 − h.
- 25 devices: 2⁵ − 2 = 30 is enough, so /27.
- 30 devices: also /27, with no spare addresses at all.
- 31 devices: 30 is too few, so you need 2⁶ − 2 = 62, a /26.
- 100 devices: 2⁷ − 2 = 126, a /25.
Remember the router's own interface uses one of those addresses, and networks tend to grow. Leaving room for 30 to 50% more devices than you have today avoids renumbering later.
Worked example 4: different sizes from one range
Suppose you have 172.16.0.0/24 and need four networks: an office with 100 devices, a warehouse with 50, a guest Wi-Fi with 20, and a link between two routers. Subnets of different sizes from one range are called variable-length subnet masking (VLSM).
The rule is to allocate the largest subnet first, so each one starts on a boundary of its own block size:
| Network | Needs | Prefix | Subnet | Usable range |
|---|---|---|---|---|
| Office | 100 | /25 (126) | 172.16.0.0/25 | .1 to .126 |
| Warehouse | 50 | /26 (62) | 172.16.0.128/26 | .129 to .190 |
| Guest Wi-Fi | 20 | /27 (30) | 172.16.0.192/27 | .193 to .222 |
| Router link | 2 | /30 (2) | 172.16.0.224/30 | .225 to .226 |
That leaves 172.16.0.228 to 172.16.0.255 free for later use. If you had started with the small subnets, the larger ones would no longer fit on valid boundaries and you would waste space.
Private and special ranges
These ranges are reserved and never routed on the public internet:
| Range | Use |
|---|---|
| 10.0.0.0/8 | Private networks |
| 172.16.0.0/12 (172.16.0.0 to 172.31.255.255) | Private networks |
| 192.168.0.0/16 | Private networks, most home routers |
| 100.64.0.0/10 | Carrier-grade NAT, used by some internet providers |
| 169.254.0.0/16 | Link-local; a device gives itself one of these when DHCP fails |
| 127.0.0.0/8 | Loopback (the device itself) |
If a computer shows an address starting 169.254, it usually means it never got an address from the DHCP server, which points to a cable, Wi-Fi or router problem rather than a subnetting one.
A common trap is that 172.16.0.0/12 covers 172.16 to 172.31 only. An address such as 172.32.0.1 is a public address.
Wildcard masks
Some router access lists and routing configurations use a wildcard mask, which is the subnet mask inverted: 255 minus each octet. For /26, the mask 255.255.255.192 becomes the wildcard 0.0.0.63. For /20, 255.255.240.0 becomes 0.0.15.255. The calculator shows both, which avoids an easy mix-up when copying values into a configuration.
Common mistakes
- Assigning the network or broadcast address to a device. In 192.168.10.64/26, neither .64 nor .127 can be used by a host.
- Gateway outside the subnet. The default gateway must be inside the device's own usable range.
- Mismatched masks. If one device thinks it is in a /24 and another in a /26, they may disagree about whether they are on the same network, and traffic fails in one direction only.
- Overlapping subnets. 10.0.0.0/23 already includes 10.0.1.0/24; using both on different sites causes routing confusion, especially over VPNs.
- Forgetting provider reservations. Some cloud platforms reserve extra addresses in every subnet (often five), so a /28 there may give you 11 usable addresses rather than 14.
FAQ
Why do I lose two addresses per subnet? The all-zeros host value names the network and the all-ones value is the broadcast address. Only /31 and /32 avoid this, for special uses.
Is 255.255.255.0 the same as /24? Yes. Both describe 24 network bits. CIDR notation is just shorter.
Does any of this apply to IPv6? The idea of a prefix is the same, but IPv6 has no broadcast address and ordinary LANs almost always use a /64 subnet, so host counting rarely matters. The subnet calculator handles IPv6 prefixes as well.
How do I find which IP address a website uses? Look up its A and AAAA records with the DNS lookup tool. Bear in mind large sites often return addresses that vary by location.