IPv4 Subnetting Guide: CIDR, Subnet Masks, Hosts & Worked Examples

Subnetting Reference

A prefix fixes the network bits of an IPv4 address; everything to the right of that boundary is address space inside the subnet. The arithmetic behind that boundary is simple. Applying it correctly, at speed, across CIDR, masks, host counts, VLSM allocations, and routing summaries without introducing an overlap or wasting a block of space is where the actual engineering work lives.

This guide treats subnetting as a production task, not a classroom exercise. It covers the shortcuts that are safe to use under time pressure, the edge cases that break the old “minus two” rule, and the checks that matter before a design reaches a router, a firewall, a DHCP server, or an IPAM record.

Standards note: CIDR is the modern addressing model — do not infer a mask from historical Class A/B/C boundaries. RFC 3021 permits /31 prefixes on point-to-point links, where both addresses are usable. A /32 is a single IPv4 address, commonly used as a host route or loopback prefix.

Network bits, host bits, and the CIDR boundary

An IPv4 address is 32 bits. A prefix length states how many of those bits belong to the network; the remaining bits identify addresses inside it. In 192.168.10.77/26, the first 26 bits identify the network and the last 6 bits vary inside that /26.

Once the prefix is known, the total address count, the subnet boundaries, the network address, and the broadcast address all follow from it. The inverse problem works the same way: given a host requirement, the number of host bits needed determines the prefix.

total addresses = 2^(32 - prefix)
child subnets after p -> q = 2^(q - p)
traditional usable hosts for prefix <= /30 = 2^(32 - prefix) - 2

Network and broadcast addresses

For a conventional subnet, the network address is the lowest address in the block — all host bits are zero. The broadcast address is the highest — all host bits are one. Addresses between those two endpoints form the traditional host range, and the familiar “subtract two” rule comes from reserving them.

That rule is useful, but it is not universal. A /31 point-to-point link deliberately removes the network/broadcast distinction, and a /32 represents a single address. Cloud platforms can also reserve additional addresses inside a subnet, so platform-specific usable capacity may be smaller than pure IPv4 arithmetic would suggest.

Do not confuse layers: a VLAN is a Layer 2 broadcast domain; a subnet is a Layer 3 address range. Networks commonly map one subnet to one VLAN, but neither construct mathematically implies the other.

CIDR notation and subnet masks

CIDR notation writes the prefix length directly — /24, /26, /20, and so on. A dotted-decimal subnet mask encodes the same boundary as contiguous one-bits followed by zero-bits. /26 is 255.255.255.192 because the fourth mask octet is 11000000 in binary.

The mask does not need converting to binary every time. The fastest operational method is to find the first mask octet that is not 255 or 0 — the interesting octet — and compute its block size as 256 minus that mask value.

/26 -> mask 255.255.255.192
interesting octet = 192
block size = 256 - 192 = 64
valid fourth-octet boundaries: 0, 64, 128, 192

Finding a subnet boundary fast

If the question is which subnet contains a given address, there is rarely a reason to write out all 32 bits. Work in the interesting octet, find the lower boundary, and expand the result back to the full address:

• Find the interesting octet — the first mask octet that is not 255 or 0.
• Compute block size: 256 minus that mask octet.
• Find the greatest valid boundary less than or equal to the address octet.
• That boundary is the network address in the interesting octet; the next boundary minus one is the broadcast address.
• For conventional prefixes through /30, usable hosts sit between those two endpoints.

Worked example: 192.168.10.77/26

/26 corresponds to 255.255.255.192, block size 64. The fourth-octet boundaries are 0, 64, 128, and 192; 77 falls in the 64–127 block. A binary AND confirms it: 77 AND 192 = 64 in the fourth octet — the block-size method is simply a faster way of locating the same boundary by hand.

Worked example: 10.34.77.201/20

A /20 mask is 255.255.240.0. The interesting octet is the third, block size 16; boundaries run 0, 16, 32, 48, 64, 80, and so on. 77 belongs to the 64–79 block.

A /20 advances in steps of 16 in the third octet. A network written as 10.34.77.0/20 is not possible, since 77 is not a /20 boundary — a quick check worth running on any address a tool or a colleague hands you.

Splitting a network into smaller subnets

Subnetting a parent prefix means extending it. Every bit borrowed from the host side doubles the number of child subnets and halves the size of each child block. Moving from /24 to /26 borrows two bits, so one /24 becomes four /26s.

parent /24 -> child /26
borrowed bits = 26 - 24 = 2
child subnets = 2^2 = 4
addresses per child = 2^(32 - 26) = 64

The first child, 192.168.50.0/26, is a valid subnet in its own right. Historical equipment once discouraged the all-zero and all-ones subnet numbers; that restriction has been obsolete for decades, and carrying it into a current design only wastes address space.

The same bit-doubling rule works at any scale. A /24 contains 2⁴ = 16 separate /28s, each with 16 addresses, boundaries at 0, 16, 32, 48, and on through 240. A /16 contains 256 /24s, because 24 − 16 = 8 and 2⁸ = 256. A /48 IPv6 allocation follows the identical prefix arithmetic, even though the address size is different — see IPv6 Subnetting Tools for the equivalent workflow on the larger address space.

Sizing a subnet to a host requirement

Capacity planning starts with host bits, not a favorite mask. Choose enough host bits h so that 2^h − 2 is at least the required number of assignable addresses; the prefix is then 32 − h.

Do not size only for the devices visible today. Include the gateway addressing convention, DHCP exclusions, infrastructure addresses, monitoring, printers, phones, access points, future growth, and an operational reserve. On the other hand, avoid defaulting every small segment to /24 — repeating oversized subnets across a large estate only makes later summarization and address conservation harder.

/31 and /32 are not broken subnets

A /31 contains exactly two addresses. On an RFC 3021 point-to-point link, both are valid interface addresses; there is no need for a network or broadcast address, because the link has only two endpoints. This saves half the space of a /30 and is standard practice in many routed infrastructures. Where supported, /31s are efficient for routed point-to-point links.

A /32 identifies a single address — common for loopbacks, host routes, tunnel endpoints, and policy routes. Applying the old subtract-two formula to /31 or /32 produces nonsense, so any serious calculator or IPAM system has to handle them explicitly rather than treating every prefix as a conventional subnet.

VLSM: one pool, different subnet sizes

Variable Length Subnet Masking allocates different prefix sizes from the same parent block. The safe workflow sorts requirements from largest to smallest, assigns each the smallest fitting prefix, and places every allocation on a valid boundary. Large allocations go first because they have fewer legal starting points.

Worked VLSM design

Suppose 10.10.20.0/24 must support four segments requiring 120, 60, 28, and 12 hosts. The smallest conventional prefixes are /25, /26, /27, and /28 respectively.

VLSM is not permission to start a subnet at any convenient address. 10.10.20.130/26 is not a valid /26 boundary, even though the addresses around it may look unused — a /26 inside this /24 can only start at .0, .64, .128, or .192. Allocate from largest to smallest, but reserve growth intentionally: leaving only tiny fragments can make a future requirement impossible even when the total free-address count looks sufficient.

The VLSM Calculator runs this exact largest-first workflow and checks every allocation against a valid boundary automatically.

Detecting subnet overlap

Two prefixes overlap when at least one address belongs to both ranges. Prefix lengths can differ and the textual network addresses can look unrelated while the overlap is still complete — the robust test is range intersection, not visual comparison.

overlap if: startA <= endB AND startB <= endA

10.20.32.0/20 spans 10.20.32.0 through 10.20.47.255. 10.20.40.0/21 spans 10.20.40.0 through 10.20.47.255 — fully contained in the first, so the two overlap even though their network addresses look unrelated. By contrast, 10.20.48.0/20 begins exactly where the first /20 ends: adjacent is not overlapping. That distinction is exactly why numeric range conversion is more reliable than reading addresses on sight.

Overlap matters well beyond IPAM tidiness. It can break route selection, VPN encryption domains, NAT policies, firewall objects, cloud peering, SD-WAN segmentation, and any merger between independently designed networks. A design review should check every proposed prefix against the authoritative inventory before deployment — the Subnet Overlap Checker runs the same range-intersection test described above.

Route summarization: subnetting in reverse

Summarization, or aggregation, replaces several more specific routes with one shorter prefix, reducing routing-table size and stabilizing advertisements without attracting traffic for networks that should not be reachable through the aggregate.

10.24.8.0/24 through 10.24.11.0/24 are contiguous, and the first network begins on a /22 boundary. Their common leading bits form the exact summary 10.24.8.0/22 — no extra /24 is pulled into the aggregate.

Covering summaries can include extra space

Not every route set has an exact single-prefix summary. Asking for the smallest prefix that covers two separated networks can pull in addresses between them — useful for analysis, but dangerous as an advertised route unless the summarizing router can safely discard or route that additional space.

172.16.0.0/24 and 172.16.4.0/24 fit inside the covering prefix 172.16.0.0/21, which spans third-octet values 0 through 7 — so it also covers .1/24, .2/24, .3/24, .5/24, .6/24, and .7/24. The aggregate is mathematically valid as a cover, but it is not an exact representation of the two original routes. Before advertising an aggregate, distinguish “exact summary” from “smallest covering prefix” — they are not interchangeable operationally. The Route Summarization Calculator reports both and flags the extra covered space explicitly.

Production planning considerations

A mathematically correct subnet can still be a poor network design. Production planning has to account for topology, fault domains, route hierarchy, security boundaries, growth, and operational ownership.

Build a hierarchy that can summarize

Allocate address space by site, region, VRF, function, or another stable hierarchy. If every site receives random fragments from a large pool, later summarization becomes difficult or impossible. A clean allocation plan lets routing policy express the physical or logical architecture instead of carrying thousands of unrelated host routes.

Separate infrastructure from user capacity

A “100-device subnet” is rarely just 100 client addresses. Gateways, FHRP virtual addresses, DHCP exclusions, network appliances, access points, printers, monitoring agents, and static reservations all consume space too. Define what counts as usable before choosing the prefix, especially when another team owns DHCP or the default gateway.

Do not infer masks from address classes

10.0.0.0 does not automatically mean /8 in a real design, 172.16.0.0 does not automatically mean /16, and 192.168.x.x does not automatically mean /24. Those classful defaults belong to historical routing behavior; modern networks are CIDR networks, and the prefix is part of the address definition.

Private space still needs governance

RFC 1918 gives organizations three private blocks — 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 — but it does not stop two teams from allocating the same subnets. Overlap becomes especially expensive during mergers, VPN interconnects, cloud extensions, and partner connectivity. A central source of truth is worth more than clever subnet math after the fact.

Know when the platform changes usable-address rules

Traditional IPv4 math reserves the network and broadcast addresses for prefixes through /30. Some cloud platforms reserve additional addresses in every subnet for platform services. The CIDR boundaries do not change, but the number of addresses available to workloads does — capacity calculations should separate protocol-level address count from platform-assignable address count.

Common subnetting mistakes that survive into production

• Treating the host address as the network address. 192.168.10.77/26 belongs to 192.168.10.64/26, not to itself, as a subnet identifier.
• Using a non-boundary network. A /27 advances by 32; valid fourth-octet boundaries are 0, 32, 64, 96, 128, 160, 192, and 224.
• Applying minus two to /31 and /32. The classic host formula is not valid for these edge prefixes.
• Assuming different ASNs or VLAN IDs imply different IP ranges. Layer 2 identifiers and routing ownership do not establish CIDR boundaries.
• Designing VLSM smallest-first. Small allocations can fragment the pool and block a later large, alignment-sensitive allocation.
• Summarizing non-contiguous routes without checking the cover. The result may attract traffic for unallocated or differently routed networks.
• Ignoring overlap with remote environments. Local IPAM can be clean while a VPN, partner, or cloud network uses the same space.
• Sizing only for today. A mathematically full subnet leaves no room for operational reserve or growth.
• Trusting a calculator without checking its inputs. A tool should reject malformed masks, conflicting prefix/mask combinations, and non-network-aligned inputs when a network address is required.

IPv4 CIDR cheat sheet

“Usable” follows traditional subnet semantics for /30 and larger blocks; /31 and /32 are listed with their modern operational behavior.

The most useful mental checkpoints are /24 = 256 addresses, /25 = 128, /26 = 64, /27 = 32, /28 = 16, /29 = 8, /30 = 4, /31 = 2, and /32 = 1. Moving one prefix bit right halves the address count; moving one bit left doubles it. For masks, the recurring partial-octet values are 128, 192, 224, 240, 248, 252, 254, and 255, with block sizes of 128, 64, 32, 16, 8, 4, 2, and 1 — once those pairs are familiar, most subnet questions resolve without binary conversion at all.

Which IPRevealed tool should you use?

Manual subnetting is worth knowing because it exposes bad inputs and makes design reviews faster. For repetitive work, validation, and large allocations, a calculator that shows its assumptions and the resulting address range is more useful than one that returns only a number.

FAQ

How many hosts are in a /24?

A /24 contains 256 addresses. Under traditional subnet semantics, 254 are usable host addresses, because the network and broadcast endpoints are reserved.

Why does a /26 have 62 usable hosts?

A /26 leaves 6 host bits. 2⁶ gives 64 total addresses; subtracting the conventional network and broadcast endpoints leaves 62.

Can a /31 really be used?

Yes. RFC 3021 defines /31 prefixes for IPv4 point-to-point links. Both addresses are usable, since there is no need for a separate network or broadcast address on a two-endpoint link.

What is a /32 used for?

A /32 identifies one IPv4 address. It is commonly used for loopbacks, host routes, tunnel endpoints, and routing policy.

Does a subnet have to match a VLAN?

No. VLANs are Layer 2 constructs and subnets are Layer 3 ranges. A one-subnet-per-VLAN model is common because it is operationally clean, not because the protocols require identical numbering.

When is route summarization safe?

When the more specific networks are contiguous, aligned to the aggregate boundary, and the aggregate does not attract traffic for space that should be routed elsewhere. If it covers extra space, treat it as a covering prefix rather than an exact summary.

Why can cloud usable-address counts differ from this guide?

Cloud providers can reserve additional addresses for platform functions. The CIDR block size remains mathematically correct, but fewer addresses may be assignable to workloads.

A practical way to think about subnetting

Engineers who subnet reliably do not memorize hundreds of combinations. They recognize powers of two, know the boundary sequence for the interesting octet, and verify that every proposed network starts where its prefix allows it to start. They also separate protocol math from design policy — a /26 may be mathematically correct and still be the wrong choice for a given site, VLAN, or cloud subnet.

At scale, the same principles hold: preserve alignment, allocate hierarchically, check overlap against the source of truth, summarize only when the covered space is understood, and document the intent behind reserved capacity. Good subnetting is less about arithmetic speed than about making address space predictable for the next engineer who has to operate it.