Subnet and CIDR Calculation: From /24 to Clean Network Segments

CIDR notation answers one question: how many leading bits of an address are the network, and how many remain for hosts? In 192.168.1.0/24, the first 24 bits are fixed and 8 bits belong to the host part: 256 addresses in total, of which two are reserved — the network address itself (all host bits zero) and the broadcast address (all host bits ones). That leaves 254 usable hosts. Every CIDR calculation is this same move with different numbers: 32 minus the prefix gives the host bits, and 2 to that power gives the block size.

The quick reference table

Each step down the table halves the block: 256, 128, 64, 16, 4. Note that a /31 is a special case (RFC 3021) that allows exactly 2 addresses on point-to-point links, and a /32 is a single host — common in firewall rules.

A worked example

Take 192.168.1.0/26. The block size is 2^6 = 64 addresses, starting at a multiple of 64: .0 through .63. Network address: 192.168.1.0. Broadcast: 192.168.1.63. Usable hosts: .1 through .62 — 62 of them. The netmask is 255.255.255.192 (the last octet is 11000000, the 26 fixed bits set to one). Every CIDR question reduces to those four answers, and writing the host bits out in binary — 6 bits, values .0 to .63 — resolves any doubt about a boundary. This is also how VLSM works when you carve a /24 into pieces: a /26 for servers, two /27s for departments, a /28 for network gear, each aligned on its own boundary inside the block.

Boundaries without a calculator

Two habits cover most real work. First, blocks always start on multiples of their own size: a /26 block starting at .0 covers .0–.63, the next covers .64–.127, then .128–.191, .192–.255. An address like .65 is legal inside the second /26 but .65/26 as a network start is not — it does not sit on a boundary. Second, for firewall rules, write the exact prefix instead of a loose range: allow 10.20.30.0/26 is auditable, while "the .60s and .70s" is how overlaps and accidental open rules happen.

Segmentation is where this pays off: separating servers, workstations, printers and guest Wi-Fi into different subnets lets your firewall make real decisions between them, and contains an incident instead of broadcasting it. A common plan for a small organisation: one /26 for servers, one /26 for workstations, one /26 for printers and devices, one /26 reserved for growth — all inside a single /24, with the guest network deliberately placed outside it. Keep a written IP plan; subnet addresses that exist only in someone’s memory are the ones that get reused by accident.

IPv6 changes the arithmetic but not the logic: a typical LAN gets a /64, which offers far more addresses than any IPv4 block, and sites commonly receive a /48 or /56 from their provider to subnet internally. The host-count anxiety disappears; the boundary discipline — every subnet aligned to its size, every firewall rule naming an exact prefix — matters even more, because the blocks are so large that a careless rule can expose an entire building’s worth of addresses.

Hand calculations under time pressure are exactly where wrong masks sneak in — one flipped bit and an entire VLAN stops talking to its gateway. The WhoDNS subnet calculator takes any address and prefix and returns network, broadcast, first and last host, mask and total hosts instantly, so you can verify a plan before it touches production.

🔗 Related tool: Open the subnet calculator