Subnetting guide
How a subnet mask splits an address into a network and a host part, how to work out any subnet by hand with the block-size method, and the arithmetic that every subnet calculator performs.
The one operation that defines a subnet
An IPv4 address is 32 bits. A subnet mask is also 32 bits, and it is a run of 1s followed by a run of 0s. Where the mask has a 1, the bit belongs to the network identifier; where it has a 0, the bit belongs to the host. Everything else in subnetting is a consequence of that division.
Address 192.168.1.100 11000000.10101000.00000001.01100100
Mask 255.255.255.224 11111111.11111111.11111111.11100000
AND ---------------- --------------------------------
Network 192.168.1.96 11000000.10101000.00000001.01100000
Broadcast = network OR (NOT mask)
192.168.1.127 11000000.10101000.00000001.01111111Two bitwise operations give you everything. The network address is the address AND the mask, which clears every host bit. The broadcast address is the network address with every host bit set, which is the same as the address OR the wildcard mask. Routers do exactly this on every forwarding decision.
The block-size method
Converting to binary every time is slow. The block-size method gives the same answer from decimal arithmetic alone, and once you have used it a few times you can subnet in your head.
1. Find the interesting octet — the one where the mask is neither 0 nor 255. 2. Block size = 256 − (mask octet in that position) 3. Subtract the block size repeatedly from the mask octet to get the subnet boundaries, or divide the address octet by the block size and round down. 4. Network = boundary (host bits all 0) Broadcast = boundary + block size − 1 (host bits all 1) Usable = network + 1 to broadcast − 1
Example: 172.16.45.200/26
The mask for a /26 is 255.255.255.192, so the fourth octet is the interesting one. The block size is 256 − 192 = 64, so subnets start at .0, .64, .128 and .192.
The address octet is 200. Dividing 200 by 64 gives 3 remainder 8, so the subnet starts at the third boundary: 3 × 64 = 192.
Network 172.16.45.192
First host 172.16.45.193
Last host 172.16.45.254
Broadcast 172.16.45.255
Usable 62 of 64 addresses
Note that the first three octets were never touched. A /26 never crosses an octet boundary, so only the last octet changes — which is why the method is so fast for the prefixes people use every day.
The block sizes worth memorising
There are only six to learn for the common prefixes. Each one is 256 minus the mask octet, and they halve as the prefix grows.
| Prefix | Mask octet | Block size | Addresses | Usable hosts | Boundaries in the last octet |
|---|---|---|---|---|---|
| /24 | 0 | 256 | 256 | 254 | One /24 per last octet |
| /25 | 128 | 128 | 128 | 126 | .0 and .128 |
| /26 | 192 | 64 | 64 | 62 | .0, .64, .128, .192 |
| /27 | 224 | 32 | 32 | 30 | .0, .32, .64, .96, .128, .160, .192, .224 |
| /28 | 240 | 16 | 16 | 14 | Every 16 addresses |
| /29 | 248 | 8 | 8 | 6 | Every 8 addresses |
| /30 | 252 | 4 | 4 | 2 | Every 4 addresses |
Note the pattern in the mask octets: 128, 192, 224, 240, 248, 252. Each is the previous value plus half the remaining space, and each adds one bit to the network portion. Recognising this sequence makes the masks as familiar as the prefixes.
Sizing a subnet from a host requirement
Work backwards from the requirement. Add two addresses for the network and broadcast, then find the smallest power of two that covers the total.
Example: sizing for 100 devices
- 100 devices needed
- Add 2 for network and broadcast: 102 addresses
- Smallest power of two ≥ 102 is 128
- 128 addresses means 7 host bits, so the prefix is 32 − 7 = /25
- Result: 126 usable hosts, 24 spare for growth
Subnet: 192.168.1.0/25 → hosts .1 to .126
Choosing a /24 instead would give 254 hosts and waste half the block. Choosing a /26 gives only 62 usable, which does not fit. The /25 is the correct answer, and the 24 spare addresses are exactly the growth headroom you want.
The VLSM planner performs this sizing across an entire requirement list at once and allocates the results largest-first so nothing overlaps.
Common subnetting mistakes
- Subnetting at exactly the requirement. A subnet sized for exactly the number of devices you have today leaves no room for a new printer, let alone a second switch. Always round up to the next power of two, then consider going one size larger for critical segments.
- Off-by-one on the host range. The first usable address is the network address plus one, and the last usable is the broadcast address minus one. For 192.168.1.96/27 that is .97 to .126 — not .96 to .127.
- Starting a subnet off its block boundary. A /27 must begin on a multiple of 32. 192.168.1.96/27 is valid; 192.168.1.100/27 is not, and it will overlap the .96 and .128 blocks simultaneously.
- Forgetting the two reserved addresses when counting. Ten /30 links consume 40 addresses (4 × 10) and provide 20 usable ones, not 40.
- Using a /24 for point-to-point links. Two routers on a /24 waste 252 addresses. A /31 per RFC 3021 wastes none, and a /30 wastes two.
- Mixing up the mask and the wildcard. The wildcard is the bitwise inverse. In a Cisco ACL only the bits where the wildcard is 0 must match, which is the opposite of the mask convention.
Where to go next
Practise with the subnet calculator — it shows the binary working alongside every result, so you can check your hand arithmetic against it. The CIDR reference table covers every prefix from /0 to /32, and the VLSM design guide picks up where this page stops: allocating subnets of different sizes from one block without overlaps.
Quick reference
| Quantity | Formula | Example for a /27 |
|---|---|---|
| Host bits | 32 − prefix | 32 − 27 = 5 |
| Total addresses | 2^host bits | 2^5 = 32 |
| Usable hosts | 2^host bits − 2 | 32 − 2 = 30 |
| Block size | 2^host bits | 32 |
| Subnet mask | prefix 1s then 0s | 255.255.255.224 |
| Wildcard mask | inverse of the mask | 0.0.0.31 |
| Network address | address AND mask | any address with host bits cleared |
| Broadcast address | network OR wildcard | any address with host bits set |
| Number of subnets | 2^borrowed bits | borrow 3 bits from a /24 → 8 /27s |
The relationship between total addresses and usable hosts is the one that trips people up most often: a /27 has 32 addresses and 30 usable hosts, and both numbers are needed depending on what you are doing. Sizing uses the address count; addressing uses the usable count.
Frequently asked questions
What does a subnet mask actually do?
It marks which bits of an address identify the network and which identify the host. The mask is a run of 1s followed by a run of 0s: the 1s line up with the network bits, the 0s with the host bits. Logically AND-ing an address with its mask clears the host bits and leaves the network address.
What is the block-size method?
It is a way to find subnet boundaries using decimal arithmetic. Block size is 256 minus the mask octet in the octet where the prefix ends — for a /27 that octet is 224, so the block size is 32. Subnets then start at every multiple of the block size, so the boundaries in the last octet are 0, 32, 64, 96 and so on.
Which is the interesting octet?
The octet the prefix length lands in. A /26, /27, /28, /29 and /30 all end inside the fourth octet, so the fourth octet is the interesting one. A /18 ends inside the third octet, so the third octet is interesting and the fourth is entirely host space — every /18 always ends in .0 through .255.
How do I work out the network and broadcast address?
Round the interesting octet down to the nearest multiple of the block size to get the network address. The broadcast address is the network address plus the block size minus one. Everything in between, excluding those two, is usable for hosts. For 192.168.1.100/27: the block size is 32, 100 rounds down to 96, so the network is 192.168.1.96 and the broadcast is 192.168.1.127.
Why can I not use the first and last address?
The first address of a block is the network address and identifies the subnet itself, and the last is the broadcast address that reaches every host in the subnet. Neither can be assigned to a single device. The exceptions are /31, where RFC 3021 removes the reservation for point-to-point links, and /32, which is a single host route.
How do I choose a subnet size?
Add two to the number of devices you need to address, then round up to the next power of two. That tells you the host bit count, and the prefix is 32 minus that. For 100 devices: 102 addresses, the next power of two is 128, which needs 7 host bits, so the prefix is /25.
Does subnetting change the number of addresses available?
No. Subnetting a block does not create or destroy addresses overall — it divides the same space into more, smaller pieces. What does change is the usable count, because every additional subnet reserves two more addresses for its network and broadcast. Splitting a /24 into four /26s turns 254 usable addresses into 4 × 62 = 248.