IP Subnetting Explained: CIDR, Subnet Masks and Usable Hosts, With Worked Examples

Every device on a network, whether a laptop, phone, printer, CCTV camera or server, needs an IP address. Behind those addresses sits a simple but often confusing idea: subnetting, the way a block of addresses is divided into smaller networks. It decides how many devices fit on a network, which devices can talk to each other directly, and how firewall and router rules are written.

This guide explains IP addresses, CIDR notation, subnet masks and usable hosts in plain English, then walks through real subnetting examples. Every result shown here was produced by our free IP Calculator & Subnet Calculator, so you can type the same inputs in and check them yourself.

What an IPv4 address really is

An IPv4 address like 192.168.1.10 looks like four numbers, but to a computer it is a single 32-bit binary number. Each of the four parts, called an octet, is 8 bits and can hold a value from 0 to 255:

32 bits allow 2³² = 4,294,967,296 possible addresses. That sounded like plenty when IPv4 was designed, but the central pool of IPv4 addresses ran out in 2011. That is why private addresses, address sharing and IPv6 all exist, as we will see below.

Network part and host part

Every IP address has two parts. The network part says which network the device belongs to. The host part identifies the individual device on that network. Devices with the same network part are on the same subnet and can reach each other directly; anything else goes through a router.

Where the split falls is not fixed. It is set by the prefix length or the subnet mask, which are two ways of writing the same thing.

CIDR notation and subnet masks

CIDR notation writes the address followed by a slash and the number of network bits: 192.168.1.10/24 means the first 24 bits are the network, and the remaining 8 bits are for hosts. CIDR (Classless Inter-Domain Routing) replaced the older class system in 1993.

A subnet mask expresses the same split as an address: 1s for network bits, 0s for host bits. A /24 is 11111111.11111111.11111111.00000000, which is written as 255.255.255.0. The wildcard mask is its exact opposite, 0.0.0.255; it is used in places such as router access-control lists.

Here is what the IP Calculator returns for 192.168.1.10/24, the kind of network most home and small-office routers create:

The formula: how many hosts fit in a subnet?

Two numbers answer almost every subnetting question:

• Total addresses = 2^(32 − prefix). A /24 leaves 8 host bits, so 2⁸ = 256. A /26 leaves 6, so 2⁶ = 64.
• Usable hosts = total − 2, because the first address (network) and last address (broadcast) are reserved.

This cheat sheet covers the prefixes you will meet most often:

Notice the pattern: each step up in prefix length halves the size of the network.

Private, public and special addresses

Not every address is meant for the public internet. The IP Calculator checks every address against the official special-purpose ranges and tells you its type. The ones you will see most:

• Private addresses (RFC 1918): 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. Anyone can use them inside their own network. Your router translates them to a public address (NAT) when traffic goes out to the internet.
• Carrier-grade NAT (RFC 6598): 100.64.0.0/10. Some internet providers use this range to share one public address among many customers. If your router's internet address starts with 100.64 to 100.127, this is probably why.
• Link-local (RFC 3927): 169.254.0.0/16. A device gives itself one of these when it cannot get an address from the network's DHCP server. Seeing 169.254.x.x on a computer usually means it is not getting a proper address.
• Loopback: 127.0.0.0/8, where 127.0.0.1 always means "this machine".
• Documentation ranges: such as 203.0.113.0/24, reserved for examples in guides and manuals.
• Public addresses: everything that is globally routable, such as 8.8.8.8.

Worked example 1: splitting one network into equal subnets

Say a small company has 192.168.1.0/24 and wants four separate networks of equal size, one per department. Four subnets need 2 extra network bits (2² = 4), so the /24 becomes four /26 networks. In the calculator, use Divide into subnets, choose Number of subnets, and enter 4:

If you ask for a number of subnets that is not a power of two, such as 5, the calculator rounds up to the next power of two (8) and tells you so, because subnets have to split the address space evenly. You can also divide by New prefix length or by Hosts per subnet, and copy the result with Copy subnet table (CSV) to paste into a spreadsheet.

Worked example 2: different-sized subnets with VLSM

Equal subnets waste space when needs are uneven. VLSM (Variable-Length Subnet Masking) gives each group a subnet sized to fit. Imagine an office with 192.168.10.0/24 that needs: 100 staff devices, 50 guest Wi-Fi devices, 20 CCTV cameras, 10 servers, and a link between two routers. The calculator's Variable-length subnets (VLSM) section allocates the largest first, so that every block lines up correctly:

Each group gets the smallest subnet that fits, with some room to grow, and 14 addresses remain free for later. If a requirement does not fit, the calculator lists it with a reason instead of silently dropping it. Putting guests and cameras on their own subnets is also good security practice: it lets you write firewall rules that keep guest devices away from your cameras and servers.

A quick introduction to IPv6

IPv6 was created because IPv4 ran out of addresses. An IPv6 address is 128 bits, written as eight groups of four hexadecimal digits, for example 2001:0db8:abcd:0012:0000:0000:0000:0001. Two rules make it shorter: leading zeros in each group can be dropped, and one run of all-zero groups can be replaced with ::. So the same address is written 2001:db8:abcd:12::1. The IP Calculator shows both the full and the compressed form.

• /64 is the standard size for one network. The first 64 bits identify the network and the last 64 identify the device. A single /64 holds 2⁶⁴ = 18,446,744,073,709,551,616 addresses.
• There is no broadcast address in IPv6, so there is no "minus 2". The last address of a prefix is an ordinary address.
• Special ranges exist here too: fe80::/10 is link-local, fc00::/7 is for private use (unique local addresses), and 2001:db8::/32 is reserved for documentation.

How to use the IP Calculator

1. Open the IP Calculator and choose the IPv4 or IPv6 tab.
2. Enter an address in CIDR form, such as 192.168.1.10/24, or enter the address and put the prefix (24) or mask (255.255.255.0) in the separate field. You can also click one of the Examples, such as "Home LAN" or "Point-to-point link".
3. Click Calculate. You get the network and broadcast addresses, host range, total and usable hosts, both masks, the address type, the binary view, and a plain-English "What this means" explanation.
4. Plan subnets with Divide into subnets (by new prefix, number of subnets, or hosts per subnet) or with VLSM for different-sized groups.
5. Copy any value, or the whole subnet table as CSV, into your notes, spreadsheet or router configuration.

Every calculation runs in your browser. Nothing you enter is sent to a server, and the calculator never reads or fills in your own IP address.

Common subnetting mistakes

• Assigning the network or broadcast address to a device. In 192.168.1.0/24, .0 and .255 are reserved. The calculator shows the usable range so you do not have to work it out.
• Overlapping subnets. 192.168.1.0/25 and 192.168.1.64/26 overlap, which causes confusing routing problems. Plan all subnets from one table, as the divide and VLSM tools do.
• Sizing for today only. A subnet that exactly fits 30 devices is full on day one. Leave room to grow.
• Writing octets with leading zeros. 192.168.01.1 is ambiguous, because some systems read a leading zero as an octal number. The calculator rejects it and asks you to write 192.168.1.1.
• Relying on address classes. A 10.x.x.x address is not automatically a /8. Always check the actual prefix length.

Related tools

• Hexadecimal to Decimal Converter: convert between hex, decimal, binary and octal. Handy for reading IPv6 groups or checking an octet in binary.
• SSL/TLS Checker: check that a domain answers over HTTPS and look up its certificate history.

The bottom line

Subnetting comes down to one idea: the prefix length splits an address into a network part and a host part. From that, everything follows. Total addresses are 2 to the power of the host bits, usable hosts are two fewer (except for /31 and /32), and each extra prefix bit halves the network. Learn those rules, keep the cheat sheet handy, and let a calculator do the arithmetic and catch mistakes before they reach a router.