Subnet mask and CIDR explained, without the binary

Subnetting gets taught backwards. It usually starts with binary conversion tables and ends, forty minutes later, with a student who can calculate a network address but has no idea why anyone would want one.

So let us start from the other end: what a subnet is for, why the mask exists, and how to read one at a glance. The arithmetic is genuinely simple once the purpose is clear, and for the handful of cases where it is not, a calculator does it in a second.

Why subnets exist

Every device on a network needs to answer one question constantly: is this address local, or does it need to go through the router?

If the destination is local, the device talks to it directly. If not, it hands the packet to the gateway and lets the router figure it out. That single decision happens before every packet you send, and the subnet mask is the rule the device uses to make it.

The second reason is broadcast traffic. Devices announce themselves, look each other up, and discover services by shouting to everyone on the local network. That works beautifully with 50 devices and becomes a problem with 5,000. Splitting a large network into subnets keeps those broadcasts contained, which is also why AirPlay and Chromecast stop working across subnets: the discovery messages deliberately do not cross the boundary.

So a subnet is two things at once: a definition of "local" for routing purposes, and a fence around broadcast traffic.

What the mask actually does

An IPv4 address is 32 bits, written as four numbers of 8 bits each. The mask marks where the network part ends and the host part begins.

Take 192.168.1.50 with a mask of 255.255.255.0, which is the same thing as /24. The 24 means "the first 24 bits identify the network." That is three of the four numbers, so:

• 192.168.1 is the network. Every device on it shares those three numbers.
• .50 is the host. That part is unique to this device.

Now the routing decision is easy. Sending to 192.168.1.80? First three numbers match, so it is local, talk to it directly. Sending to 192.168.2.80? They do not match, so send it to the router.

That is the entire concept. The prefix length says how many leading bits are shared, and everything else is a host on that network.

The only part that gets fiddly is when the boundary falls inside one of the four numbers rather than neatly between them, which is what a mask like 255.255.255.192 (a /26) means. That is where a subnet calculator earns its place: type the address and prefix, get the network address, broadcast address, usable range and host count without doing binary in your head.

The table worth memorising

Most real world work uses a handful of prefixes. Knowing these by sight covers almost everything.

Prefix	Mask	Total addresses	Usable hosts	Typical use
/30	255.255.255.252	4	2	A point to point link between two routers
/29	255.255.255.248	8	6	A small block of static addresses from an ISP
/28	255.255.255.240	16	14	A small server segment
/27	255.255.255.224	32	30	A small office or a guest VLAN
/26	255.255.255.192	64	62	A department
/25	255.255.255.128	128	126	Half of a /24
/24	255.255.255.0	256	254	The standard home and small office network
/23	255.255.254.0	512	510	A larger office floor
/22	255.255.252.0	1024	1022	A campus segment
/16	255.255.0.0	65,536	65,534	A whole private range, rarely used as one network

Two patterns make the rest of the table predictable. Each step down the prefix doubles the size, and the usable host count is always the total minus two.

Network, broadcast and the two you lose

In every IPv4 subnet, two addresses are reserved and cannot be assigned to a device.

The network address is the lowest one, with every host bit set to zero. In 192.168.1.0/24 that is 192.168.1.0. It names the subnet itself, which is why you write the range that way.

The broadcast address is the highest, with every host bit set to one. In the same subnet that is 192.168.1.255. A packet sent there goes to every device on the network at once. This is the address you use when sending a Wake-on-LAN magic packet, because the sleeping machine has no working network stack to receive a directed packet.

That leaves 192.168.1.1 through 192.168.1.254, which is 254 usable addresses. Hence "total minus two."

One consequence catches people out: a /31 has only two addresses and therefore zero usable hosts under the normal rule. It exists anyway, because point to point links between routers use a special case where both addresses are assignable. You will not meet one on a home network.

Private ranges and what they are for

Three ranges are reserved for private use. They are never routed on the public internet, which is why everyone can use the same ones at the same time.

Range	Size	Where you see it
10.0.0.0/8	16.7 million addresses	Large corporate networks, some ISPs, container platforms
172.16.0.0/12	1 million addresses	Business equipment, Docker's default bridge
192.168.0.0/16	65,536 addresses	Almost every home router on earth

Two more ranges are worth recognising because of what they tell you:

169.254.0.0/16 is link-local. If a device has an address here, it asked for one by DHCP and nothing answered. It is a self assigned fallback and a reliable sign that the DHCP server is unreachable, which is a common cause of Wi-Fi that connects but has no internet.

100.64.0.0/10 is carrier grade NAT space. Seeing it on your router's WAN side means your ISP is sharing one public address among many customers, and inbound connections cannot reach you. That single observation explains most cases of port forwarding that refuses to work.

Choosing a subnet for a home network

Most people never change the default, and mostly that is fine. There is one good reason to change it, though, and it is not obvious.

Avoid 192.168.1.0/24 and 192.168.0.0/24 if you ever use a VPN to connect to another network. Those two are the most common defaults in the world, which means the office or home you are connecting to very likely uses one of them too. When both ends of a VPN use the same range, your device has no way to decide whether 192.168.1.50 means the printer next to you or the server at the far end. The tunnel connects and half of it does not work.

Picking something unusual costs nothing and avoids the problem entirely. 192.168.37.0/24, 10.42.7.0/24 or anything else nobody would choose by default works fine.

Two other practical notes. A /24 is plenty for a home: 254 addresses covers a lot of smart plugs. And if you do split your network into segments, remember that discovery does not cross the boundary, so a phone on the main network will not see a speaker on the IoT one unless the router forwards multicast between them.

Mistakes that cause real problems

Mismatched masks on the same network

One device configured /24 and another /16 on the same wire produces a beautifully confusing fault: A can reach B, and B cannot reach A, because they disagree about what counts as local. Always check both ends when traffic works in one direction only.

Overlapping subnets

Two networks that should be separate using ranges that overlap. Routing becomes ambiguous and the symptoms are intermittent and bizarre. This is the VPN problem above, and it also appears when two offices merge or when a container network collides with the host's.

Scanning the wrong range

If your network is a /22 and you scan a /24, you see a quarter of your devices and wonder where the rest went. Check the mask on your own device before running a LAN scan, and feed the correct prefix to the scan.

Assuming the router is always .1

It is a convention, not a rule. Plenty of networks put the gateway at the top of the range instead, such as 192.168.1.254. Read the gateway address from your device rather than guessing.

Forgetting the DHCP pool is smaller than the subnet

A /24 has 254 usable addresses but the router may only hand out 50 of them. Static addresses assigned inside the pool will eventually collide with a lease. Put static assignments outside the pool, or use DHCP reservations instead.

The short version

The mask tells a device how much of an address identifies the network, which is how it decides whether to talk directly or go through the router. Subnets also contain broadcast traffic, which is why discovery stops at the boundary. Learn the /24 to /30 range by sight, remember that you always lose two addresses, and pick something other than 192.168.1.0/24 at home if you ever use a VPN. For everything else, a calculator is faster and more reliable than doing binary in your head.