Subnetting Without the Headache: CIDR, Masks, Host Counts
How CIDR prefixes map to subnet masks, why a /24 gives 254 hosts, and the block-size shortcut that beats memorising a table of masks.
The single most common subnetting mistake I see isn’t bad arithmetic. It’s assuming the network ends where the third octet changes.
Take 10.0.5.200/23. The instinct says the network is 10.0.5.0. It isn’t. A /23 spans two octet-three values, so the network is 10.0.4.0 and the broadcast is 10.0.5.255. Get that wrong in a firewall rule and you’ve either opened twice the range you meant to or blocked half your own hosts. Paste the address into the IP Subnet Calculator and it tells you in one line.
Where the two missing addresses go
A /24 holds 256 addresses but only 254 usable ones. The first is the network address, which identifies the subnet itself. The last is the broadcast address, which reaches every host on the segment at once. Neither can be assigned to an interface.
This subtraction applies from /0 all the way down to /30. A /30 has four addresses and gives you two, which is why point-to-point links traditionally burn a /30 to connect two routers.
The block-size shortcut
Memorising the mask table works until someone asks you something at 2am. The shortcut that actually holds up: subtract the interesting mask octet from 256.
A /26 is 255.255.255.192. 256 − 192 = 64, so the subnets start at .0, .64, .128, and .192. Any address between .64 and .127 belongs to the .64 network. That’s it — no binary conversion, no counting bits on your fingers.
Same trick for a /20: the mask is 255.255.240.0, and 256 − 240 = 16, so third-octet boundaries land on 0, 16, 32, 48, and so on. 172.16.37.9/20 sits in 172.16.32.0.
The two prefixes that break the rules
/31 and /32 don’t follow the minus-two rule.
RFC 3021 made /31 legal on point-to-point links in December 2000. With exactly two endpoints there’s nothing to broadcast to, so both addresses are assignable and you save an address per link. On a network with a few hundred WAN links, that adds up. Some older gear still refuses a /31, so check before rolling it out.
A /32 is a single host route. One address, no network address, no broadcast. You’ll see them in loopback interfaces, static routes, and BGP announcements of individual IPs.
Read the scope, not just the number
Knowing an address is 169.254.14.203 matters more than knowing its mask. That’s APIPA — a self-assigned link-local address from 169.254.0.0/16, and it means the host asked for DHCP and got nothing back. When a machine “has an IP but no network,” this is usually why.
A few others worth recognising on sight:
- 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 are RFC 1918 private space and never routed on the public internet
- 100.64.0.0/10 is carrier-grade NAT, so if your WAN address is in here, your ISP is NATing you and inbound connections won’t reach you
- 127.0.0.0/8 is loopback, and yes, the whole /8 is reserved for it, not just 127.0.0.1
- 192.0.2.0/24, 198.51.100.0/24, and 203.0.113.0/24 exist purely for documentation, which is why they show up in every RFC example
CIDR itself is younger than a lot of the people using it. RFC 1519 formalised it in 1993, when Class B networks were being handed out so fast the registry was heading for exhaustion. Classful addressing wasted enormous space: an organisation needing 300 addresses got a Class B with 65,534.
Drop an address and prefix into the IP Subnet Calculator and copy the whole block straight into your ticket.