Subnetting for Beginners: Subnet Mask & CIDR Made Easy

Short answer: subnetting splits one big network into smaller networks. The subnet mask (or the slash number, like /24) tells every device where the network part of its IP address ends and the host part begins. Take 192.168.10.0/24: the first 24 bits are the network and the last 8 bits are for devices. Borrow 2 host bits and you get /26: four smaller networks (.0, .64, .128, .192), each with 62 usable addresses.

This guide goes with my video Subnetting Explained: Subnet Mask & CIDR Made Easy. It starts with a short look at IP addressing (classful and classless), then subnets a real office network step by step, and ends with the four mistakes I see most on the help desk.

What an IP address really is

An IPv4 address like 192.168.10.25 is 32 bits. We write it as four numbers called octets, because each one is 8 bits. That’s why each number goes from 0 to 255.

Each octet uses these eight bit values:

128	64	32	16	8	4	2	1
0	0	0	1	1	0	0	1

So 25 is 16 + 8 + 1, or 00011001 in binary. Remember this row: it is almost all the math you need for subnetting.

Every address has two parts:

Network part: like the street name. Devices on the same “street” talk to each other directly.
Host part: like the house number. It identifies one device.

To reach another network, a device sends the traffic to the router. Your computer calls that router the default gateway.

Classful vs classless addressing

Classful addressing (the old way)

In the early internet, the first number of an address decided its class, and the class decided the size of the network:

Class	First octet	Default mask	Usable hosts per network
A	1 – 126	/8 (255.0.0.0)	16,777,214
B	128 – 191	/16 (255.255.0.0)	65,534
C	192 – 223	/24 (255.255.255.0)	254
D	224 – 239	multicast	not for devices
E	240 – 255	experimental	not for devices

127.x.x.x is skipped because it is loopback: your own machine (127.0.0.1).

The problem: the sizes were fixed. A company that needed 300 addresses was too big for a class C (254), so it got a class B and wasted more than 65,000 addresses.

Classless addressing: CIDR

In 1993 the internet moved to CIDR (Classless Inter-Domain Routing). Now the network size comes from the slash number, not the first octet. /23, /26, anything from /0 to /32 is allowed. You’ll still see classes in exams (and people still say “a class C” when they mean a /24), but real networks today are classless.

Private IP ranges

These ranges are for inside your network and are never routed on the public internet (RFC 1918):

10.0.0.0/8 (10.x.x.x)
172.16.0.0/12 (172.16.x.x to 172.31.x.x)
192.168.0.0/16 (192.168.x.x)

Subnet mask and CIDR notation

A subnet mask is also 32 bits. The ones mark the network part and the zeros mark the host part.

255.255.255.0  =  11111111.11111111.11111111.00000000  =  /24

Count the ones and you get the CIDR number. 255.255.255.0 and /24 are the same mask written two ways. You can see both on your own machine:

C:\> ipconfig
   IPv4 Address. . . . . . . . . . . : 192.168.10.25
   Subnet Mask . . . . . . . . . . . : 255.255.255.0

$ ip a
    inet 192.168.10.25/24 brd 192.168.10.255 scope global eth0

When you borrow host bits, the last octet of the mask climbs the bit row:

CIDR	Mask	Host bits	Usable hosts
/24	255.255.255.0	8	254
/25	255.255.255.128	7	126
/26	255.255.255.192	6	62
/27	255.255.255.224	5	30
/28	255.255.255.240	4	14
/29	255.255.255.248	3	6
/30	255.255.255.252	2	2

Usable hosts = 2^(host bits) − 2. For /26: 32 − 26 = 6 host bits, 2^6 = 64, and 64 − 2 = 62.

Why minus two? The first address of every subnet is the network address and the last one is the broadcast address. You can’t give either one to a device. (One exception you may meet later: /31 links between two routers use both addresses, per RFC 3021.)

Subnet an office network step by step

Here is the network for the mouhimen.dev office: 192.168.10.0/24. I want four separate networks:

Department	Devices
Staff	45
IT	20
Guests	50
Cameras	30

Step 1: find the host bits

Take the biggest group: 50. Find the smallest power of two that, minus 2, covers it:

2^5 − 2 = 30. Too small.
2^6 − 2 = 62. Fits.

So keep 6 host bits. That leaves 32 − 6 = 26 network bits: /26, or 255.255.255.192.

Step 2: get the block size (the shortcut)

Take 256 minus the mask number in the octet that isn’t 255 or 0:

256 − 192 = 64

Every subnet is 64 addresses long.

Step 3: count in blocks

Count up in blocks of 64: 0, 64, 128, 192. Those are your four network addresses.

Step 4: fill in each subnet

The broadcast is one before the next network, and everything in between is usable. I give the router the first usable address in each subnet, so everyone on the team knows where the gateway is without checking.

Subnet	Network	Usable range	Broadcast	Gateway
Staff	192.168.10.0/26	.1 – .62	.63	.1
IT	192.168.10.64/26	.65 – .126	.127	.65
Guests	192.168.10.128/26	.129 – .190	.191	.129
Cameras	192.168.10.192/26	.193 – .254	.255	.193

A real story from my own work: one office I supported had staff PCs, guest phones, printers and cameras all on one flat /24. One morning DHCP ran out of addresses and new laptops got no IP at all. Splitting it into subnets like this fixed it, and made it safer too, because guests could no longer see the cameras.

Find the subnet of any IP address

This is what you’ll do most on the help desk. A ticket comes in: “My laptop can’t reach the printer.”

Laptop: 192.168.10.150/26
Printer: 192.168.10.70

The block size for /26 is 64. 150 falls in the 128 – 191 block: the Guests subnet. 70 falls in the 64 – 127 block: the IT subnet. Different subnets, so the traffic must go through the router, and the firewall blocks guests from IT. The printer isn’t broken: the network is doing its job. The fix is to connect the laptop to the staff network.

One more quick drill: 192.168.10.100/27. /27 ends in 224, and 256 − 224 = 32. Count by 32: 0, 32, 64, 96, 128. 100 sits between 96 and 128, so the network is .96, the broadcast is .127, and the usable range is .97 to .126.

Errors and fixes

1. “The combination of IP address and subnet mask is invalid”
You typed the network or broadcast address for a device, for example .63 on a /26. Windows shows: “The combination of IP address and subnet mask is invalid. All of the bits in the host address portion of the IP address are set to 1.” Fix: use an address from the usable range (.1 to .62).

2. “The default gateway is not on the same network segment (subnet)”
The IP is .70/26, but the gateway is .1. .70 is in the 64 block and .1 is in the 0 block. Fix: use the router address in your own block (.65 here), or correct the mask.

3. Some devices work, some don’t (wrong mask on one device)
Every device is /26, but one PC still has 255.255.255.0. It thinks the whole /24 is local, so it reaches some devices but not others. When a problem looks random like that, check the mask first: ipconfig on Windows or ip a on Linux.

4. VPN connects but the office is unreachable (overlapping subnets)
The office uses 192.168.1.0/24, and so does the user’s home router. Their laptop sends office traffic to the home network. My tip: plan office networks in the 10.x range with uncommon numbers, like 10.47.10.0/24, so they never clash with home routers.

FAQ

What is subnetting in simple words?
Subnetting splits one network into smaller networks. The subnet mask decides where the network part of an address ends and the host part begins.

What does /24 mean in an IP address?
The first 24 bits are the network. It is the same as the mask 255.255.255.0 and gives 254 usable addresses.

How do I calculate usable hosts in a subnet?
2 to the power of the host bits, minus 2. A /26 has 6 host bits: 2^6 − 2 = 62.

What is the difference between classful and classless addressing?
Classful addressing used fixed sizes (class A /8, B /16, C /24) based on the first octet. Classless addressing (CIDR, since 1993) lets you use any prefix length from /0 to /32.

Why do we subtract 2 from the number of hosts?
The first address is the network address and the last is the broadcast address. Neither can be assigned to a device.

Keep learning

One DNS Zone, 5 Subdomains with Nginx
Lock Down Ollama: Close Port 11434
From IT support: Active Directory Tutorial for Beginners
Next in the networking series: DHCP vs Static IP Explained (coming Fri 25 Dec)

Sources

RFC 791, Internet Protocol (address classes): https://www.rfc-editor.org/rfc/rfc791
RFC 1519, Classless Inter-Domain Routing (CIDR), September 1993: https://www.rfc-editor.org/rfc/rfc1519
RFC 4632, CIDR (current version): https://www.rfc-editor.org/rfc/rfc4632
RFC 1918, Address Allocation for Private Internets: https://www.rfc-editor.org/rfc/rfc1918
RFC 3021, Using 31-Bit Prefixes on IPv4 Point-to-Point Links: https://www.rfc-editor.org/rfc/rfc3021

Checked on 2 Nov 2026.