Understanding IP Subnetting and Network Math
How subnet masks, CIDR notation, and usable host counts are calculated, with a real subnetting example.
Subnetting intimidates a lot of people learning networking, but it's entirely binary arithmetic dressed up in dotted-decimal notation — once you see the bits, the rest follows mechanically.
What a CIDR prefix actually means
An address like 192.168.1.10/24 says "the first 24 bits of this 32-bit address identify the network; the remaining 8 bits identify the host." Since 8 bits can represent 2⁸ = 256 values, a /24 network has 256 total addresses. Two of those are always reserved — the lowest address is the network address, the highest is the broadcast address — leaving 254 usable host addresses.
Working through a real example
Take 192.168.1.10/24. The subnet mask for a /24 is 255.255.255.0 (24 ones followed by 8 zeros, in binary). Applying that mask to the IP address (a bitwise AND) zeroes out the host portion, giving a network address of 192.168.1.0. The broadcast address flips all host bits to 1, giving 192.168.1.255. Everything from .1 through .254 in that range is a usable host address — 254 addresses in total.
Why usable hosts is always "total minus 2"
This holds for any prefix length: a /26 network has 2^(32-26) = 2⁶ = 64 total addresses, so 64 − 2 = 62 usable hosts. A /30 (common for point-to-point links) has 2² = 4 total addresses, leaving just 2 usable — exactly enough for two routers connected directly to each other, which is exactly why /30 is the traditional choice for that specific use case.
Wildcard masks: the inverse of a subnet mask
Cisco access control lists (ACLs) use wildcard masks instead of subnet masks — literally the bitwise inverse. A /24 subnet mask of 255.255.255.0 has a wildcard mask of 0.0.0.255. Where a subnet mask says "these bits must match," a wildcard mask says "these bits can be anything," which gives ACLs more flexible (non-contiguous) matching patterns than a plain subnet mask allows.
Binary really is the whole story
Every part of this — network addresses, broadcast addresses, host counts — comes from treating the 32-bit IPv4 address as pure binary and applying standard bitwise operations (AND, OR, NOT). Converting an address like 192.168.1.1 to binary (11000000.10101000.00000001.00000001) makes every subnetting rule visually obvious instead of feeling like memorized trivia.
- The subnet calculator performs the full network/broadcast/host-count calculation above automatically
- The IP to binary converter shows the bit-level view referenced throughout this guide
- The hosts per subnet calculator and wildcard mask calculator cover the two supporting calculations above