Someone hands you a sticky note that says 192.168.1.0/24. You are supposed to do something with it. Maybe configure a router, request a virtual private cloud, set up a firewall rule, or just understand why your office Wi-Fi can support so many laptops. The notation looks like a fraction. It is not. It is two pieces of information glued together, and once you see how, the rest of subnetting stops feeling secret.
This guide takes the notation apart, then puts it back together with examples a network engineer would actually use.
An IP address is a number that looks like a sentence
An IPv4 address, the kind that looks like 192.168.1.42, is really just a 32-bit number written in four 8-bit chunks. Each chunk runs from 0 to 255 because that is the range an 8-bit binary number can represent. The dots are punctuation for humans, nothing more.
Under the hood, 192.168.1.42 is the same as:
11000000.10101000.00000001.00101010
That is the same number written in binary, with dots kept in the same places. The Internet does not see the decimal version; routers see the binary. Everything that follows in this guide is just decimal-vs-binary in different costumes.
If you ever want to read an IP in binary without doing it by hand, the Number Base Converter translates between decimal and binary one octet at a time. The Binary Calculator lets you check the math by adding, AND-ing, and OR-ing the chunks directly.
A subnet is a range of those numbers
A subnet is a contiguous block of IP addresses that belong to the same logical network. Devices inside a subnet can usually reach each other directly; to reach anything outside, traffic has to go through a router.
The size of a subnet is what changes from one network to another. A small home network might only need a couple of dozen addresses. A medium business might need a few hundred. A cloud account hosting a microservices platform might want to slice its address space into many smaller chunks so different teams can use their own ranges without colliding.
That is the entire purpose of subnetting: dividing a big range of addresses into smaller, manageable groups.
CIDR notation is the size and starting point in one line
CIDR (Classless Inter-Domain Routing) is the modern way to write a subnet. The format is <starting-address>/<prefix-length>. The slash and the number after it tell you how many bits at the start of the address are fixed.
In 192.168.1.0/24, the /24 says the first 24 bits identify the network. The remaining 8 bits, 32 − 24, are free to vary, and every combination of those 8 bits is a valid host address in this subnet.
8 free bits give you 2⁸ = 256 possible addresses, from 192.168.1.0 to 192.168.1.255. The whole range belongs to the same logical network.
A /16 would mean 16 bits are fixed, leaving 16 bits free: 65,536 addresses. A /30 means 30 bits fixed, only 2 bits free: 4 addresses. Each step in the prefix length doubles or halves the size of the subnet. That single number captures the entire shape of the network.
The subnet mask is the same idea, written differently
Before CIDR became standard, networks were described using a separate subnet mask: a second IP-style number whose binary form was a string of 1s followed by a string of 0s. The 1s lined up with the network bits and the 0s lined up with the host bits.
For /24, the mask in binary is 11111111.11111111.11111111.00000000. In decimal, that is 255.255.255.0. So 192.168.1.0/24 and 192.168.1.0 with mask 255.255.255.0 are two ways of saying the same thing.
You will still see both notations in router interfaces, firewall configs, and old documentation. CIDR is shorter and usually clearer once you know it; masks are still common in legacy systems. Translating between them is mechanical: count the 1s in the mask, and that is the prefix length.
Network address, broadcast address, and the usable range
Inside a subnet, two addresses always have special meaning.
The network address is the very first address, with all host bits set to 0. It identifies the subnet itself and is not assigned to any device. For 192.168.1.0/24, the network address is 192.168.1.0.
The broadcast address is the very last address, with all host bits set to 1. It is reserved for "send this packet to everyone in the subnet." For 192.168.1.0/24, the broadcast address is 192.168.1.255.
That means out of 256 total addresses in a /24, only 254 are usable for actual hosts: .1 through .254. Forgetting this is the most common subnetting mistake.
The formula for usable hosts in IPv4 is 2^(32 − prefix) − 2. The −2 accounts for the network and broadcast addresses. There is one exception worth knowing: /31 and /32, used in point-to-point links and single-host routes, follow special rules where both addresses are usable or only one address exists.
Why binary actually matters
A common worry from newcomers is that subnetting requires fluent binary arithmetic. It does not, but spending five minutes with the binary view clears up something that decimal hides.
Look again at 192.168.1.0/24 in binary:
11000000.10101000.00000001.00000000
The first 24 bits are the network identity. The last 8 bits, all zero here, are the host slot. Every device in this subnet has the same first 24 bits. They differ only in the last 8.
Now consider 192.168.1.0/26. Only the first 26 bits are fixed. The last 6 bits are free. That gives 2⁶ = 64 addresses per subnet. A /26 carves the original /24 into four equal pieces:
192.168.1.0/26covers.0to.63192.168.1.64/26covers.64to.127192.168.1.128/26covers.128to.191192.168.1.192/26covers.192to.255
The breakpoints sit at multiples of 64 because 64 is 2⁶. That is the only kind of "math" subnetting requires: recognizing powers of two. The Binary Calculator makes the AND operation between an address and a mask explicit, which is the operation a router actually does to decide which subnet an address belongs to.
A worked example: planning office Wi-Fi
Suppose a small office has been assigned the block 10.20.30.0/24. There are three departments, engineering, design, and finance, and the network team wants each on a separate subnet for cleaner firewall rules.
A /24 has 256 addresses. Split into four equal /26 blocks, each subnet has 64 addresses (62 usable). Three departments fit comfortably with one spare block held in reserve.
- Engineering:
10.20.30.0/26→ usable10.20.30.1to10.20.30.62 - Design:
10.20.30.64/26→ usable10.20.30.65to10.20.30.126 - Finance:
10.20.30.128/26→ usable10.20.30.129to10.20.30.190 - Reserved:
10.20.30.192/26→ usable10.20.30.193to10.20.30.254
If finance has only 12 people, you might tighten that subnet to a /28 (16 addresses, 14 usable) to free up room. The numerical exercise, "does this department fit in this prefix?", is the daily form of subnetting work. The Subnet Calculator is exactly the tool for that question: enter the block, change the prefix, see the usable range.
Private versus public address space
Most internal networks use the private ranges defined for IPv4: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. These addresses are not routable across the public Internet. They are reserved for use inside organizations, and routers are configured to drop or NAT them at the boundary.
Public addresses are the ones your Internet service provider assigns to the gateway facing the outside world. They are globally unique. If you ever need to see what public address an external service sees you from, the IP Address Finder is the quick check.
Inside the private ranges, you are free to subnet however suits your environment. That is why most home routers ship with something like 192.168.1.0/24 out of the box. It is the smallest convenient block from a private range, large enough for most homes.
Common mistakes worth correcting
Counting addresses instead of usable hosts. A /29 has 8 addresses but only 6 usable hosts. The network and broadcast addresses always cost two seats.
Treating CIDR like a fraction. The number after the slash is a count of fixed bits, not a denominator. The smaller the number, the larger the subnet; /16 is far bigger than /24.
Picking subnet sizes by gut feel and regretting it later. Subnets are hard to resize once devices are using them. A small office often runs into trouble when a /28 was chosen because the team had ten devices on launch day; by year two there are forty.
Forgetting that overlapping subnets do not route. If two networks share any address space, traffic between them will misbehave at the gateway. When designing for cloud VPC peering, plan ranges so they cannot collide.
Assuming the router always uses the first address. Many setups default the gateway to the first usable host (.1), but it can sit anywhere in the range. Always check rather than assume.
Mixing up the mask and the wildcard. Some access control lists, especially older Cisco-style ACLs, use a wildcard mask (the inverse of the subnet mask). Be sure which one a tool expects before pasting.
FAQ
What does the /24 in an IP address mean? The number after the slash is the prefix length: the count of bits at the start of the address that identify the network. A /24 fixes the first 24 bits, leaving 8 bits free for hosts, which is 256 addresses (254 usable).
How is the subnet mask related to CIDR notation? They describe the same boundary in different formats. A subnet mask is a 32-bit number whose binary form is a run of 1s followed by 0s. The prefix length in CIDR equals the count of 1s. A mask of 255.255.255.0 is /24.
Why is the first and last address in a subnet unusable? The first address is reserved as the network identifier and the last is the broadcast address. Most subnets follow this rule, with rare exceptions like /31 and /32 used in point-to-point links and single-host routes.
Are private IP ranges different from public ones? Yes. 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 are private and only routable inside the organization. Public addresses are globally unique and routable across the Internet.
How small can a subnet realistically be? A /30 gives 2 usable hosts and is common for point-to-point links. /31 is two-host with special handling. /32 is a single-host route, often used in routing tables but not as a working LAN.
Do I need to memorize binary to understand subnets? No, but skimming the binary once for a few example addresses is the fastest way to make the logic click. After that, you can usually work in decimal and powers of two.
A final framing
Subnetting feels arcane because the notation hides the simple thing underneath: an IP address is a number, a subnet is a contiguous range of those numbers, and CIDR is a compact way to say where the range starts and how big it is. Spend a few minutes drawing the boundaries in binary, then come back to the decimal world. From that point on, a sticky note that reads 10.0.0.0/14 is just a street with a clearly marked block, and you know which houses fit on it.