Subnetting Explained Simply: CIDR, Masks and Host Counts
A practical guide to IPv4 subnetting: what /24 really means, how to count hosts, how to split a network and plan VLSM, with the shortcuts network engineers actually use.
Subnetting has a reputation for being exam material that nobody uses after certification. In reality it comes up every time you set up a VLAN, a VPN, a cloud network or a firewall rule. The good news is that you only need a few ideas and two or three shortcuts. This guide covers them, and you can check every example in the IPv4 subnet calculator.
An address is 32 bits with a line drawn through it
An IPv4 address like 192.168.10.37 is four bytes, 32 bits in total. A subnet is simply a decision about where to draw a line: bits to the left identify the network, bits to the right identify the device. The prefix after the slash says where the line is. In 192.168.10.37/24, the first 24 bits (192.168.10) are the network and the last 8 bits identify hosts.
The subnet mask is the same line written differently: 24 ones followed by 8 zeros, or 255.255.255.0. /24 and 255.255.255.0 are two notations for exactly the same thing.
Counting hosts
With h host bits there are 2h addresses. Two of them are reserved in a normal subnet: the first (all host bits 0) is the network address, and the last (all host bits 1) is the broadcast address. So the usable hosts are 2h minus 2.
- /24: 8 host bits, 256 addresses, 254 hosts
- /26: 6 host bits, 64 addresses, 62 hosts
- /28: 4 host bits, 16 addresses, 14 hosts
- /30: 2 host bits, 4 addresses, 2 hosts (a classic router link)
The shortcut worth memorising: every time the prefix grows by one, the subnet halves. /25 is half of a /24, /26 is a quarter.
The magic number
To find which subnet an address belongs to without binary, subtract the interesting octet of the mask from 256. For a /26 the mask is 255.255.255.192, and 256 minus 192 is 64. Subnets therefore start at multiples of 64: .0, .64, .128, .192. The address 192.168.10.37 is in the .0 subnet, whose broadcast is .63. The address .100 would be in the .64 subnet, with broadcast .127. This one trick answers most real questions in seconds.
Splitting a network: equal or VLSM
Suppose you have 10.10.0.0/24 for a small office. You could split it into four equal /26 networks with 62 hosts each. But real needs are rarely equal: perhaps 100 staff devices, 40 guests on Wi-Fi, 12 printers and phones, and one router link. Variable length subnet masking (VLSM) gives each segment the smallest block that fits:
- Staff: /25 (126 hosts), 10.10.0.0 to 10.10.0.127
- Guests: /26 (62 hosts), 10.10.0.128 to 10.10.0.191
- Devices: /28 (14 hosts), 10.10.0.192 to 10.10.0.207
- Router link: /30 (2 hosts), 10.10.0.208 to 10.10.0.211
The rule is to allocate the largest subnet first so every block stays aligned. The subnet splitter does this for you and exports the plan as CSV.
Private ranges and why they collide
Three ranges are reserved for private networks by RFC 1918: 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. Because everyone uses them, they clash. The most common case is a VPN: if your office uses 192.168.1.0/24 and the employee’s home router uses the same range, traffic to the office goes nowhere. Choosing a less common block, such as something inside 10.0.0.0/8 or 172.16.0.0/12, avoids years of support tickets.
Our take
From years of running office and field networks, three habits matter more than any subnetting trick. First, plan for growth: a subnet that is 90 percent full on day one will be a re-addressing project within a year. Size for at least double. Second, keep related subnets together, for example all of one site inside one /20, so you can summarise them into a single route and a single firewall rule later. The range to CIDR tool shows what can be merged. Third, write the plan down the day you make it. An IP plan in a spreadsheet, kept up to date, is worth more than any monitoring system when something breaks at 2 a.m.