IPv4 Subnetting Explained: Subnet Masks, CIDR, Host Ranges
September 11, 2026 · 7 min read
Every device on the internet carries an address, and IPv4 is the addressing system behind most of the traffic you have ever sent. This guide explains how IPv4 addresses are built, what a subnet mask actually does, why you see addresses written like 192.168.1.0/24, and how to work out which hosts belong to which network. By the end you will be able to read any subnet and compute its usable host range by hand.
What is an IPv4 address?
An IPv4 address is a 32-bit number that identifies a single network interface, such as a laptop's Wi-Fi adapter, a server's network card, or a phone's mobile data modem. The full value is a string of 32 ones and zeros, but nobody reads it that way. The bits are split into four groups of 8, called octets, and each octet is shown in decimal with dots between the groups. That is why a normal address such as 192.168.1.10 looks the way it does.
Because an octet contains 8 bits, each one can hold any value from 0 to 255. With four octets, the system offers 2 multiplied by itself 32 times, about 4.3 billion, combinations in total. That seemed like an inexhaustible supply in the 1980s and is nowhere near enough today, which is exactly why IPv6 was created as a successor. Even so, the internet still runs mostly on IPv4, so the practical question for every network operator is how those 32 bits are divided between the network identity and the individual device.
What is a subnet mask and why it matters
A 32-bit address tells you who a device is, but not which network it belongs to. The subnet mask answers that: a second 32-bit number that separates an address into a network part and a host part. Written as 255.255.255.0, a mask always looks like a run of 255s followed by zeros, because in binary it is a run of ones followed by zeros. The ones mark the bits that identify the network; the zeros mark the bits that identify a particular host inside it.
The mask matters because every routing decision depends on it. When a router receives a packet, it applies the mask to the destination address and to its own networks: if the network parts match, the destination is local and the packet is delivered directly; if they do not match, the packet is forwarded toward another router. Firewall rules, DHCP leases, and VLAN designs all rely on the same boundary. Masks also keep broadcast traffic contained: a well-chosen mask splits a large flat network into smaller segments, so a broadcast from one device reaches fewer neighbors and the network stays responsive as it grows.
CIDR notation: what /24 actually means
Writing 255.255.255.0 everywhere is tedious, so modern networks use CIDR notation instead. CIDR stands for Classless Inter-Domain Routing, and the notation is a slash and a number appended to an address: 192.168.1.0/24. The number after the slash is the prefix length, and it simply counts how many of the address's 32 bits belong to the network part. A /24 reserves the first 24 bits for the network and leaves the last 8 bits for hosts.
The same idea works at every size. A /8 leaves 24 bits for hosts, a /16 leaves 16, and a /30 leaves just 2. The slash form and the dotted form say exactly the same thing: 255.255.255.0 is identical to /24, 255.255.0.0 is identical to /16, and 255.0.0.0 is identical to /8, so you can convert freely in either direction. CIDR won because routers summarize routes by prefix length: one /16 entry can replace 256 /24 entries, which is how the global routing table stays small enough to work.
How to calculate network and broadcast addresses
Every subnet is bracketed by two addresses that belong to no single device. The network address is the first address in the block and names the subnet itself; the broadcast address is the last address and targets every host in the block at once, which is how ARP and DHCP announce themselves.
To find both by hand, convert the address and the mask to binary and AND them bit by bit. The result zeros out every host bit, leaving the network address. Flip those host bits to ones and you have the broadcast address. For 192.168.1.37/24, the network is 192.168.1.0 and the broadcast is 192.168.1.255. For 10.0.0.5/29, the last 3 bits are host bits, so the network is 10.0.0.0 and the broadcast is 10.0.0.7. Every address between them is a valid member of the subnet. The math is quick with small prefixes, and with larger ones it is worth letting a calculator do the steps.
Usable host ranges and common subnet sizes
The usable range sits between them: the first usable host is the network address plus one, the last is the broadcast address minus one. For 192.168.1.0/24 that means 192.168.1.1 through 192.168.1.254: 254 usable hosts from a block of 256. The two subtracted addresses are never available, because the network address identifies the subnet and the broadcast is reserved for one-to-all traffic. In general, a subnet with prefix length N contains 2 raised to the power of (32 minus N) addresses, and exactly that total minus 2 is usable.
Two prefixes are exceptions. A /31 block holds only two addresses, and RFC 3021 permits both as point-to-point endpoints with no broadcast. A /32 block contains one address and pins a route to a single host, such as a loopback or a static route. Outside those special cases, always subtract 2. The table lists the prefixes you will meet most often.
| Prefix | Subnet mask | Total addresses | Usable hosts | Typical use |
|---|---|---|---|---|
| /30 | 255.255.255.252 | 4 | 2 | Point-to-point link |
| /29 | 255.255.255.248 | 8 | 6 | Small router network |
| /28 | 255.255.255.240 | 16 | 14 | Small workgroup |
| /24 | 255.255.255.0 | 256 | 254 | Office LAN |
| /16 | 255.255.0.0 | 65536 | 65534 | Large campus network |
| /8 | 255.0.0.0 | 16777216 | 16777214 | Carrier-scale block |
Every step down the prefix column doubles the block: a /28 is 16 addresses, a /27 is 32, and so on. The /30 is the standard block for a WAN link between two routers, while the /24 is the workhorse of office networking.
A worked /30 example: four addresses, two usable hosts
The /30 is the clearest place to see where the two reserved addresses go, because the whole block is small enough to write out in full. Take 10.0.0.4/30. The prefix leaves 2 host bits, so the block holds 2² = 4 addresses in total, spanning 10.0.0.4 to 10.0.0.7:
- Network address —
10.0.0.4, the first address, naming the subnet itself and assigned to no device - Usable hosts —
10.0.0.5and10.0.0.6, exactly 2 usable hosts - Broadcast address —
10.0.0.7, the last address, reaching both hosts at once
Four addresses minus the reserved network and broadcast leaves two, which is exactly why a /30 suits a point-to-point link between two routers and nothing more. The arithmetic is the same in binary but easier to see here: the mask 255.255.255.252 zeroes all but the last 2 bits, so those 2 bits can only count 0 through 3 — four values. If you need a third device on that segment the block is already too small, so step up to a /29, which gives 8 addresses and 6 usable hosts.
FAQ
What is the difference between a subnet mask and CIDR notation?
They are two formats for the same information. A subnet mask is a 32-bit number such as 255.255.255.0 that marks which bits are network bits and which are host bits. CIDR notation, such as /24, counts the network bits directly. Both say the first 24 bits belong to the network, and neither carries any information the other lacks.
Why are usable hosts always two fewer than the total addresses?
Because every subnet reserves two addresses. The first address, the network address, identifies the subnet itself, and the last address, the broadcast address, reaches every host at once. Neither can be assigned to a device, so a 256-address /24 network has 254 usable hosts. The exceptions are /31 and /32 prefixes, which are used for point-to-point links without a broadcast.
What subnet should I use for a small office network?
A /24 subnet, such as 192.168.1.0/24, is the safe default for a small office. It offers 254 usable addresses, enough for staff devices, printers, phones, and a guest network, and it matches the default setting of most standard routers. If you need only a handful of devices, a /28 provides 14 usable hosts and a /29 provides 6.
Need the numbers right now, without the binary? Open the free IPv4 subnet calculator: paste your address and prefix, and it lists the network address, broadcast address, and every usable host in seconds. All of the tools on AITool.red are free, and you will find more plain-English explainers in the AITool.red blog.