Subnet Masks and CIDR, Explained

A subnet mask is the part of an IP configuration people copy from a tutorial without quite understanding. This guide explains what the mask actually does, how to read the CIDR notation that has largely replaced it, and how to work out the network, broadcast, and usable host range for yourself.

An IP address is two numbers joined together

When a host sends a packet, it has to answer one question first: is the destination on my local network, or is it somewhere else that I should hand to a router? The subnet mask is what answers it.

An IPv4 address is 32 bits, usually written as four decimal octets (192.168.1.37). The mask says how many of those bits are the network portion and how many are the host portion. A mask of 255.255.255.0 in binary is 24 ones followed by 8 zeros, so the first 24 bits identify the network and the last 8 identify the host on it.

CIDR notation, and why it replaced the dotted mask

Because masks are always a run of ones followed by a run of zeros, the dotted form carries no information beyond the count. CIDR notation keeps just the count: 192.168.1.37/24 means the same as 192.168.1.37 with mask 255.255.255.0. The table below covers the prefix lengths you will actually meet.

Two addresses per subnet are not usable by hosts: the lowest is the network address and the highest is the broadcast address. That is why a /24 has 256 addresses but only 254 usable ones. A /31 is a special case (RFC 3021) used on point-to-point links, where both addresses are usable.

Working out a subnet by hand

Take 192.168.4.130/26. The prefix is 26, so the mask is 26 ones: 255.255.255.192. The interesting octet is the fourth, where the mask is 11000000 — that leaves 6 host bits.

1. Block size. 2⁶ = 64. Subnets step in blocks of 64 in the last octet: 0, 64, 128, 192.
2. Network address. 130 falls in the block starting at 128, so the network is 192.168.4.128.
3. Broadcast address. One less than the next block: 192.168.4.191.
4. Usable range. Everything between them: 192.168.4.129 to 192.168.4.190 — 62 hosts, since 64 addresses minus network and broadcast.

The shortcut worth remembering: the block size is 256 minus the value of the mask octet. A mask of 192 gives 256 − 192 = 64.

Why the mask must match on both ends

A host decides “local or routed?” by comparing the destination against its own network. If two hosts on the same physical switch disagree about the mask, they can still fail to talk. Host A at 192.168.1.10/24 thinks 192.168.1.200 is local and will send an ARP request for it. If host B at 192.168.1.200/25 believes 192.168.1.10 is on a different subnet, it will send its replies to the router instead. Traffic goes one way and not the other, which is a confusing failure to debug if you have not seen it before.

Overlapping subnets

Two subnets overlap when one contains addresses that also belong to the other. 10.0.0.0/24 and 10.0.0.128/25 overlap, because the second is entirely inside the first. Overlaps break routing in ways that are hard to diagnose: a router may have two routes to the same address and pick the wrong one. This is most often seen after a VPN is introduced, when the VPN’s remote range collides with the local one. If a host becomes unreachable only while the VPN is up, suspect an overlap before anything else.

Doing it without the arithmetic

The IPBay subnet calculator takes an address in CIDR form and returns the network address, broadcast address, usable host range, and total host count for both IPv4 and IPv6. It also flags overlapping ranges. It runs entirely in your browser, which matters if you are working with internal addressing you would rather not paste into a third-party service.

IPv6, briefly

The same idea applies with a much larger address: IPv6 is 128 bits, and prefixes are almost always /64 for a normal network segment. Hosts are usually configured by router advertisement rather than by hand, so you will meet the prefix far less often — but the concept of a network portion and a host portion is unchanged.