Subnetting Without the Headache: A Practical CIDR Guide

Subnetting trips up even experienced engineers, because a single wrong bit in the mask silently changes the network address, the broadcast address, and how many hosts you can actually assign. Here's a practical mental model — and the edge cases that bite.

CIDR in one sentence

CIDR notation like 192.168.1.0/24 means "the first 24 bits are the network, the remaining 8 bits are the host." That /24 is the prefix length. The mask 255.255.255.0 is just those 24 one-bits written in dotted decimal.

192.168.1.0/24
  network bits │ host bits
  11111111 11111111 11111111 │ 00000000

With 8 host bits you get 2⁸ = 256 addresses. But two are reserved:

• Network address (all host bits 0) — 192.168.1.0, names the subnet.
• Broadcast address (all host bits 1) — 192.168.1.255, reaches every host.

So 254 usable hosts, 192.168.1.1 through 192.168.1.254.

Deriving the network from any host address

Given 172.16.5.130/22, what's the network? A /22 mask covers the third octet only partially (11111100), so:

• Network: 172.16.4.0
• Broadcast: 172.16.7.255
• Range spans four full /24 blocks (4, 5, 6, 7)

Doing this by hand is error-prone — paste it into the Subnet Calculator and read the network, broadcast, mask and wildcard at a glance, with a bit map that shows exactly where the split falls.

The edge cases everyone forgets

/31 — point-to-point links. Normally you'd say a /31 has "no usable hosts" (2 addresses, both reserved). But RFC 3021 explicitly allows both addresses on point-to-point links, giving you 2 usable hosts. This is the standard sizing for a router-to-router connection and saves address space.

/32 — host routes. A /32 is a single address — a "host route." You'll see these in firewall rules, loopback interfaces, and BGP advertisements for a single IP.

A good calculator handles both correctly instead of blindly subtracting 2 for the network and broadcast.

Wildcard masks

ACLs (and OSPF) often want the inverse of the subnet mask — the wildcard mask. For /24 that's 0.0.0.255. It's just the mask with every bit flipped:

subnet mask   255.255.255.0   → 11111111.11111111.11111111.00000000
wildcard mask 0.0.0.255       → 00000000.00000000.00000000.11111111

A word on IPv6

IPv6 drops broadcast entirely and uses enormous prefixes. A /64 — the standard for a single LAN — contains 2⁶⁴ addresses (about 18 quintillion). You rarely subnet for host counts; you subnet for structure. The Subnet Calculator's IPv6 mode shows the compressed and expanded prefix and the total address count so you can sanity-check an allocation.

Quick reference

Prefix	Mask	Usable hosts
/24	255.255.255.0	254
/25	255.255.255.128	126
/26	255.255.255.192	62
/30	255.255.255.252	2
/31	255.255.255.254	2 (RFC 3021)
/32	255.255.255.255	1 (host route)

Keep the table handy — or skip the arithmetic entirely and let the Subnet Calculator do it, right in your browser.