Subnetting is where a lot of people decide networking is not for them. It looks like arbitrary maths, the notation is dense, and every explanation starts with binary conversion tables. It is genuinely simpler than that once you see what the numbers mean.

Work through examples with the Subnet Calculator as you read.

What the slash means

An IPv4 address is 32 bits, written as four numbers of 8 bits each. In 192.168.1.0/24, the /24 says: the first 24 bits identify the network, and the remaining 8 identify the host within it.

That is the entire concept. Everything else follows from it.

With 8 host bits you get 2^8 = 256 addresses, from 192.168.1.0 to 192.168.1.255. Two are reserved:

  • Network address — all host bits zero, here 192.168.1.0. Names the network itself.
  • Broadcast address — all host bits one, here 192.168.1.255. Reaches every host at once.

Which leaves 254 usable addresses. That is where the "minus two" in every subnetting formula comes from.

The table worth memorising

You do not need binary arithmetic for day-to-day work. You need this:

/30   4 addresses     2 usable    255.255.255.252
/29   8 addresses     6 usable    255.255.255.248
/28   16 addresses   14 usable    255.255.255.240
/27   32 addresses   30 usable    255.255.255.224
/26   64 addresses   62 usable    255.255.255.192
/25   128 addresses 126 usable    255.255.255.128
/24   256 addresses 254 usable    255.255.255.0
/23   512 addresses 510 usable    255.255.254.0
/22   1024 addresses 1022 usable  255.255.252.0
/16   65536 addresses            255.255.0.0

The pattern: each step down doubles the size. Every prefix from /24 to /30 lives inside the last octet, which is why those are the ones you meet most.

/31 is a special case — two addresses, no broadcast, used for point-to-point links. /32 is a single host, which is how you express "just this one address" in a firewall rule.

Working out which network an address belongs to

Take 10.0.5.130/26.

A /26 has 64 addresses, so networks start at multiples of 64 in the last octet: 0, 64, 128, 192.

130 falls between 128 and 191. So:

  • Network: 10.0.5.128
  • First usable: 10.0.5.129
  • Last usable: 10.0.5.190
  • Broadcast: 10.0.5.191

The trick is finding the block size (256 minus the last octet of the mask, or just 2^host-bits), then finding which multiple of it your address sits above. No binary required.

Private ranges

Three ranges are reserved for internal use and never routed on the public internet:

10.0.0.0/8          10.0.0.0     - 10.255.255.255
172.16.0.0/12       172.16.0.0   - 172.31.255.255
192.168.0.0/16      192.168.0.0  - 192.168.255.255

The 172 range is the one people get wrong. It is 172.16 through 172.31 — not all of 172.x. 172.32.0.0 is public address space belonging to somebody.

Also worth knowing: 127.0.0.0/8 is loopback (the whole range, not just 127.0.0.1), and 169.254.0.0/16 is link-local — an address in that range usually means DHCP failed.

Why this matters for security work

Firewall rules. A rule permitting 10.0.0.0/8 allows 16.7 million addresses. One permitting 10.0.5.0/24 allows 254. Those are very different rules, and the difference is one character.

Scope definitions. An engagement scoped to 192.168.1.0/24 covers 254 hosts. Reading it as /16 and testing 65,000 addresses puts you outside your authorisation — which is a legal problem, not a technical one. Confirm the prefix, in writing, before touching anything.

Log analysis. Recognising that an address falls inside a private range tells you immediately whether traffic was internal or came from outside.

Segmentation. Splitting a flat network into subnets is what stops one compromised machine reaching everything else. The design is expressed entirely in prefixes.

A common mistake

Assuming a /24 because it is familiar. Plenty of real networks use /22 or /23 for larger segments, and a scan configured for /24 quietly misses three quarters of the hosts. If the result seems too small, check the mask on an interface rather than assuming.

Common questions

How many hosts in a /24?
256 addresses, 254 usable — network and broadcast are reserved.

What does /26 mean?
26 network bits, 6 host bits, 64 addresses, 62 usable, mask 255.255.255.192.

Is 172.20.0.0 private?
Yes. The private range is 172.16 to 172.31 inclusive. 172.32 onwards is public.

Why subtract two?
The all-zeros address names the network and the all-ones address is broadcast. Neither can be assigned to a host.

Where to go next