CIDR subnets explained: masks and why /31 is special

What the slash means

192.168.1.0/24 says: the first 24 bits of the 32-bit address identify the network, and the remaining 8 identify hosts. In binary:

192.168.1.0   = 11000000.10101000.00000001.00000000
/24 mask      = 11111111.11111111.11111111.00000000
                └──── 24 network bits ────┘└ 8 host ┘

A prefix of 24 means 8 host bits, so the block contains 2⁸ = 256 addresses. The prefix can be anything from 0 to 32, which is why the notation is compact: the whole range is implied by the address and one number.

Network and broadcast address

Two addresses in every block (for prefixes /30 and shorter) are not usable by a host:

• Network address — every host bit zero. 192.168.1.0.
• Broadcast address — every host bit one. 192.168.1.255.

That leaves 2^{host bits} − 2 usable addresses. A /24 therefore has 254 usable hosts, not 256. The arithmetic is the most common mistake: people size a subnet for 256 devices and end up two short.

Why /31 and /32 are different

For a /30 and larger, the network and broadcast addresses are reserved, so the −2 rule applies. But RFC 3021 defines /31 for point-to-point links: the two addresses are the endpoints, and there is no broadcast. A /32 is a single host route — one address, nothing reserved. Applying the −2 rule to these gives a negative or zero host count, which is why a correct calculator must special-case them.

This is also why some tools report “0 usable hosts” for a /31: they apply the general rule without the exception. On a modern point-to-point link, both addresses are usable.

Computing the network address by hand

Bitwise-AND the address with the mask. For 192.168.1.130/26:

address  192.168.1.130  = 11000000.10101000.00000001.10000010
mask /26               = 11111111.11111111.11111111.11000000
AND                    = 11000000.10101000.00000001.10000000
                       = 192.168.1.128

So 192.168.1.130/26 is in the 192.168.1.128/26 block, which spans .128–.191, with usable hosts .129–.190.

Dividing a block

To split a /24 into four subnets, borrow two bits: /26 each. The blocks are aligned to their own size — .0, .64, .128, .192. Alignment is what people get wrong when splitting by hand: a /26 cannot start at .32, because 32 is not a multiple of 64.

Private ranges and what “belongs” means

RFC 1918 reserves three blocks for private use: 10.0.0.0/8, 172.16.0.0/12 (which is 172.16–172.31, not all of 172.x) and 192.168.0.0/16. The 172 range is the one that trips people: 172.32.0.1 is public. Whether an address is “in” a subnet is a bitwise test — mask both and compare — not a string prefix check.

Choosing a prefix size

The prefix is a size decision, and the useful ones cluster. A /24 is the default for a single LAN because it is small enough to keep broadcast traffic down and large enough for 254 devices. A /22 or /21 is common for guest networks and container pools. A /30 (or /31 on modern point-to-point links) is the usual choice for the link between a router and an upstream. A /32 is a single host route, used for anycast and for pinning one address.

Overlapping blocks and how to spot them

Two blocks overlap when one contains the other. Because every block is aligned to its own size, testing that is cheap: convert the address to a 32-bit integer, mask both with the longer prefix, and compare the results. If they are equal, one contains the other. String comparison does not work — 10.0.0.10 sorts before 10.0.0.2 as text.

10.0.0.0/24  vs  10.0.0.128/25
mask both with /25:
  10.0.0.0   → 10.0.0.0
  10.0.0.128 → 10.0.0.128
different → the /25 is inside the /24

Overlap matters in practice when two VPNs, two cloud VPCs, or a home network and a corporate network are joined: the routing table has two entries for the same range, and traffic goes to whichever wins, which is rarely the one you intended.

Supernetting: going the other way

A supernet is the smallest block that contains two or more given blocks. Two adjacent /25s (.0 and .128) combine into a /24. Two /24s combine into a /23 only if they are an aligned pair — 10.0.0.0/24 and 10.0.1.0/24 make 10.0.0.0/23, while 10.0.0.0/24 and 10.0.2.0/24 do not, because they are not adjacent. The alignment requirement is the same one that governs splitting; it is just read backwards.

The arithmetic that catches people

• Subtracting two from an aligned block. A /24 has 256 addresses and 254 usable. A /23 has 512 and 510, not 508 — the −2 applies once per subnet, not once per 128.
• Counting in octets. A /26 is not 26 addresses; it is 64. The prefix is a bit count, not an element count. Mixing the two is the most common mental slip.
• Assuming a subnet can start anywhere. A /26 starts on a multiple of 64 — .0, .64, .128, .192. A block at .32 is not a valid /26.
• Assuming 172.16/12 means all of 172.x. It is 172.16 through 172.31; 172.32.0.0 is public.
• Treating an address as a member by string prefix. 10.0.0.1 is in 10.0.0.0/24, but 10.0.0.100 is not in 10.0.0.10/24 in the way a prefix match would suggest — always mask, never compare text.

IPv6, briefly

The same notation works with a 128-bit address and a larger prefix range. A typical LAN is a /64, which is the size the standards assume for stateless address autoconfiguration — a /64 has 2⁶⁴ addresses, which is why there is no meaningful “usable host count” to subtract two from at that scale. Prefixes shorter than /64 are allocations to be subdivided; longer ones exist for point-to-point links and are unusual on a LAN. The mental model carries over, but the host-count arithmetic stops being the thing you reason about.

Worked example: sizing a network from requirements

Suppose you need three segments: an office LAN for about 40 devices, a guest network for about 90, and a link to the upstream router. Start from the largest requirement and work down:

Laid out inside a /24, the guest subnet must take an aligned /25 — .0 or .128. The office /26 can then take .128 only if the guest took .0. The link /30 takes the next aligned block, .192. The remaining space is unused and available for later growth — which is the point of allocating aligned blocks rather than packing tightly.

192.168.10.0/25     guest      .0   – .127
192.168.10.128/26   office     .128 – .191
192.168.10.192/30   uplink     .192 – .195
192.168.10.196/30   reserved   .196 – .199
…                  spare      .200 – .255

Masks, wildcards and the inverse relationship

The mask has 1s where the network bits are; the wildcard is its bitwise inverse, with 1s where the host bits are. They are two notations for the same boundary, and the wildcard is what ACLs and routing platforms often ask for.

The host bits and the wildcard are the same idea in two forms: 2^{host bits} − 1 is the last octet of the wildcard, and 2^{host bits} is the block size. A /26 is a block of 64, so the wildcard's last octet is 63. That single relationship is enough to check any prefix by hand.

Host bits to block size, without arithmetic

People who work with subnets daily do not compute 2ⁿ; they use the ladder. Each step down halves the block: /24 is 256, /25 is 128, /26 is 64, /27 is 32, /28 is 16, /29 is 8, /30 is 4, /31 is 2, /32 is 1. Going up doubles: /23 is 512, /22 is 1024, /21 is 2048. Once the ladder is memorised, the question “what does /27 mean” is answered without a calculator, and the usable count is the block size minus two (except at /31 and /32).

Check it yourself

The subnet calculator gives the network, broadcast, mask, wildcard, first and last host, and usable count for any block, plus supernet and equal-split views. Every example in this guide was produced by that calculator. The number base converter is handy when you need an octet in binary.