What Is a Subnet Mask? Subnets, CIDR and Subnetting Explained

What a subnet and a subnet mask actually are

Every IPv4 address is a 32-bit number, normally written as four decimal numbers from 0 to 255 separated by dots, such as 192.168.1.10. On its own, that address does not say where the network ends and the host begins. The subnet mask supplies that boundary. It is also a 32-bit value, written the same dotted way, and its job is to mark which bits of the address belong to the network and which belong to the host.

The rule is simple: where the mask has a 1 bit, the matching bit of the address is part of the network; where the mask has a 0 bit, the matching bit is part of the host. The 1 bits are always contiguous and start from the left, so a valid mask is just a run of ones followed by a run of zeros.

A subnet is the block of addresses that all share the same network bits. Two devices are on the same subnet, and can talk to each other directly without going through a router, only if their addresses match across every network bit defined by the mask. Take the mask 255.255.255.0: it makes the first three octets the network and the last octet the host. So 192.168.1.10 and 192.168.1.200 are on the same subnet, while 192.168.2.10 is on a different one, even though only a single number changed.

Dotted-decimal vs CIDR (/24) notation

There are two ways to write the same boundary, and you will meet both constantly.

Dotted-decimal masks

The traditional form writes the mask as four decimal octets, for example 255.255.255.0. Each 255 is a fully set octet (11111111 in binary, eight network bits), and each 0 is a fully clear octet (00000000, eight host bits). So 255.255.255.0 is twenty-four 1 bits followed by eight 0 bits.

CIDR slash notation

CIDR (Classless Inter-Domain Routing) notation simply counts the network bits and writes that count after a slash. Because 255.255.255.0 has 24 network bits, it is written /24, and an address inside it looks like 192.168.1.10/24. The two notations are interchangeable:

• /8 equals 255.0.0.0
• /16 equals 255.255.0.0
• /24 equals 255.255.255.0
• /26 equals 255.255.255.192

CIDR is the modern standard because it is compact and supports any prefix length, not just the old class boundaries of /8, /16 and /24. If you ever need to convert a mask to a prefix or carve a block into smaller pieces, the CIDR Block Calculator does the conversion and the splitting for you.

Network bits and host bits in binary

Subnetting clicks into place once you look at the binary. Take the address 192.168.1.10 with a /26 mask (255.255.255.192) and line them up:

The mask has 26 ones, so the first 26 bits of the address are the network and the remaining 6 bits are the host. To find the network address, you keep every network bit of the address and set every host bit to 0 - that is a bitwise AND of the address and the mask. Here that gives 192.168.1.0. The host bits are what vary from one device to the next inside that subnet.

Two useful counts fall straight out of the split. The number of host bits is 32 minus the prefix, and the number of host addresses is 2 raised to that power. For our /26: 32 minus 26 is 6 host bits, and 2 to the power 6 is 64 total addresses.

How to calculate network, broadcast and usable hosts

Three formulas cover almost everything you will need:

• Network address. Keep the network bits, set all host bits to 0. It is the first address in the block.
• Broadcast address. Keep the network bits, set all host bits to 1. It is the last address in the block.
• Usable hosts. 2^(32 - prefix) - 2. The minus 2 removes the network and broadcast addresses, which cannot be assigned to a device.

The broadcast address is the all-host-bits-set address because a packet sent there reaches every host on the subnet at once. The network address, with all host bits clear, names the subnet itself. That is why both are reserved and why a block of 256 addresses only gives you 254 you can actually hand to machines.

A fully worked example: 192.168.1.10 /24

Suppose your laptop has the address 192.168.1.10 with a /24 mask (255.255.255.0), a very common home-network setup. Here is how to work out the whole subnet by hand:

1. Host bits. 32 minus 24 is 8 host bits.
2. Total addresses. 2 to the power 8 is 256 addresses in the block.
3. Network address. Set the 8 host bits to 0: the last octet becomes 0, giving 192.168.1.0.
4. Broadcast address. Set the 8 host bits to 1: the last octet becomes 255, giving 192.168.1.255.
5. Usable host range. Everything between the two reserved addresses: 192.168.1.1 to 192.168.1.254.
6. Usable hosts. 2 to the power 8, minus 2, is 254.

Now tighten the same address to a /26 (255.255.255.192). The block shrinks to 64 addresses: the network address is 192.168.1.0, the broadcast address is 192.168.1.63, the usable range is 192.168.1.1 to 192.168.1.62, and you get 62 usable hosts. Borrowing two bits from the host part split the old /24 into four smaller /26 subnets.

Common subnet masks at a glance

These are the masks you will see most often. Memorising the last octet values for /25 through /30 (128, 192, 224, 240, 248, 252) makes mental subnetting much faster.

The /30 is popular for point-to-point router links because it gives exactly two usable addresses, one for each end. A newer convention defined in RFC 3021, the /31, uses both addresses for the two ends of a point-to-point link and skips the network and broadcast reservation entirely, which is why the usual minus-2 rule does not apply to it.

Private IP address ranges (RFC 1918)

Subnet masks are most visible on the private ranges reserved by RFC 1918 for use inside home and corporate networks. These addresses are never routed on the public internet, so countless separate networks reuse the same blocks behind NAT (Network Address Translation):

Note the 172.16.0.0/12 range carefully: the /12 mask (255.240.0.0) makes the network span the second octet from 16 to 31, so the block runs all the way to 172.31.255.255, not 172.16.255.255. That is one of the most common subnetting mistakes. If you want to know what your own connection looks like to the outside world - your public address rather than the private one your device holds on the LAN - check it with our IP Lookup tool.

Why subnetting matters

Splitting a large network into smaller subnets is not busywork; it solves real problems:

• Efficient address use. Handing a point-to-point link a full /24 wastes 252 addresses. A /30 gives it exactly the two it needs.
• Smaller broadcast domains. Broadcast traffic stays inside its subnet, so a busy network does not flood every device with chatter it does not need.
• Security and segmentation. Putting guests, servers and staff on separate subnets lets firewalls control exactly what can talk to what.
• Cleaner routing. Routers make forwarding decisions on the network portion of an address, so well-planned subnets keep routing tables compact and predictable.

Related tools & reading

• IP Subnet Calculator - enter an address and prefix to get the mask, network, broadcast, host range and host count.
• CIDR Block Calculator - convert between masks and prefixes and split a block into smaller subnets.
• Subnet Cheat Sheet - a printable /8 to /32 table of every CIDR prefix, subnet mask, wildcard mask and host count.
• IP Lookup - see what your public IP address reveals about your connection.
• Understanding IP Addresses - how IPv4 and IPv6 addresses are structured.
• Back to the Learning Center