Subnet Masks and CIDR Notation Made Simple

A subnet mask tells a device which part of an IP address identifies the network and which part identifies the individual host, and CIDR notation writes the same thing as a slash followed by the number of network bits. For example, 255.255.255.0 and /24 both mean "the first 24 bits are the network", leaving 254 usable host addresses.

Why subnets exist

An IPv4 address is 32 bits long. Every address is split into two parts: a network prefix, shared by all devices on the same subnet, and a host part, unique to each device. When your laptop wants to send a packet, it compares the destination with its own network prefix. If they match, it delivers the packet directly on the local network. If they do not, it sends the packet to the default gateway (your router) to be forwarded.

Splitting address space into subnets lets organisations size networks to fit, keep broadcast traffic contained, and apply security rules between groups of devices. If you are new to addressing in general, start with what an IP address is.

How a subnet mask works in binary

A subnet mask is also a 32-bit number, written in the same dotted format as an IP address. It always consists of a run of 1 bits followed by a run of 0 bits. The 1s mark the network portion, and the 0s mark the host portion.

255.255.255.0  = 11111111.11111111.11111111.00000000   (24 ones)
255.255.255.192 = 11111111.11111111.11111111.11000000  (26 ones)

To find the network an address belongs to, a device performs a bitwise AND between the address and the mask. Each bit stays 1 only if it is 1 in both. Take the host 192.168.10.77 with mask 255.255.255.192. The first three octets pass through unchanged, and the last octet works out as:

77  = 01001101
192 = 11000000
AND = 01000000 = 64

So the host lives on network 192.168.10.64. The IP Address Converter can show any address in binary if you want to practise this by hand.

CIDR notation

Writing out masks is clumsy, so modern networking uses Classless Inter-Domain Routing (CIDR) notation: the network address followed by a slash and the number of 1 bits in the mask. 192.168.10.0/24 means the mask has 24 ones, which is 255.255.255.0.

CIDR was introduced in 1993 to replace the original "classful" system, in which networks came in only three sizes: Class A (/8), Class B (/16) and Class C (/24). Fixed sizes wasted huge numbers of addresses; an organisation that needed 300 addresses had to take a Class B with 65,534. CIDR allows a prefix of any length, and it is described today in RFC 4632. You will still hear people say "a Class C" when they mean a /24.

CIDR to subnet mask reference table

The number of addresses in a subnet is 2 raised to the number of host bits (32 minus the prefix length). In a normal subnet, two of those addresses are reserved: the first is the network address and the last is the broadcast address, so usable hosts equal the total minus two.

The most common subnet on home networks is /24, which is why so many routers hand out addresses from 192.168.1.2 to 192.168.1.254.

Worked example: 192.168.10.0/26

Suppose you need to split 192.168.10.0/24 into four equal subnets for different departments. Borrowing 2 bits from the host part gives a /26.

1. Subnet mask: 26 ones means three full octets of 255 plus 11000000 in the fourth octet, which is 192. The mask is 255.255.255.192.
2. Block size: 32 − 26 = 6 host bits, and 2⁶ = 64 addresses per subnet. A quick shortcut is 256 minus the last non-255 mask octet: 256 − 192 = 64.
3. Network address: 192.168.10.0 (the first address).
4. Broadcast address: 192.168.10.63 (the last address, 0 + 64 − 1).
5. Usable host range: 192.168.10.1 to 192.168.10.62, which is 62 hosts.
6. Wildcard mask: 0.0.0.63, the inverse of the subnet mask, used in some router access lists.

The four subnets that make up the original /24 are:

This matches the binary example above: host 192.168.10.77 falls in the second subnet, whose network address is 192.168.10.64.

Special cases: /31 and /32

/31 for point-to-point links

Under the normal rules, a /31 would have two addresses and zero usable hosts. RFC 3021 changed that for point-to-point links, such as a cable between two routers: since there are only ever two devices on the link, there is no need for a network or broadcast address, and both addresses can be assigned. This saves half the addresses compared with using a /30 for every link. Most modern router operating systems support it.

/32 for a single address

A /32 describes exactly one address. You will see it in firewall rules ("allow 203.0.113.5/32"), routing tables for host routes, loopback interfaces on routers, and cloud security groups. It is not a subnet you can put several devices on.

A brief note on IPv6

IPv6 uses the same prefix-length idea but never uses dotted subnet masks. Addresses are 128 bits, and the standard size for a single LAN segment is a /64: 64 bits of network prefix and 64 bits for hosts. Features like Stateless Address Autoconfiguration (SLAAC) depend on that 64-bit host part, so splitting a LAN smaller than /64 is discouraged. A single /64 contains 2⁶⁴ addresses, about 18.4 quintillion. IPv6 has no broadcast address (it uses multicast instead), so the "minus two" rule does not apply. ISPs typically delegate a larger prefix, such as a /56 or /48, so customers can create many /64 subnets. Read more in IPv4 vs IPv6.

Frequently asked questions

What subnet mask should I use at home?

255.255.255.0 (/24) is the default on almost every home router and gives 254 usable addresses, which is plenty for most households. Larger homes or small offices with many devices sometimes use a /23 or /22.

Why are two addresses unusable in a subnet?

The first address identifies the network itself and the last is the broadcast address used to reach every host at once. Neither can be assigned to a device, except in the /31 and /32 special cases.

Is a subnet mask like 255.255.0.255 valid?

No. A valid mask must be a continuous run of 1 bits followed by 0 bits. Values such as 255.255.0.255 or 255.255.255.100 are not valid subnet masks.

What is the difference between a subnet mask and a wildcard mask?

A wildcard mask is the bitwise inverse of a subnet mask, so 255.255.255.0 becomes 0.0.0.255. Some router configurations, notably access control lists and OSPF on Cisco devices, use wildcard masks instead of subnet masks.