IP Addresses and Subnet Masks: CIDR, Hosts and Ranges

An IPv4 address is a 32-bit number

Every IPv4 address is a 32-bit binary number. To make it readable, the 32 bits are split into four groups of eight, called octets, and each octet is written in decimal. Because eight bits can represent 0 to 255, each of the four numbers in an address like 192.168.10.100 must fall in that range.

Writing that address in binary gives 11000000.10101000.00001010.01100100. The first octet, 192, is 128 + 64, so the two highest bits are set. 168 is 128 + 32 + 8, 10 is 8 + 2, and 100 is 64 + 32 + 4. Getting comfortable with this place-value breakdown (128, 64, 32, 16, 8, 4, 2, 1) is the single most useful skill for subnetting by hand.

With 32 bits there are 2^32, or 4,294,967,296, possible addresses. You can also treat an address as one integer: 192.168.10.100 is 3,232,238,180 in decimal and c0a80a64 in hexadecimal. Tools, firewalls and databases sometimes store addresses this way, so it helps to recognise both forms.

Subnet masks and CIDR notation

An address is divided into two parts. The network portion, on the left, identifies which network the device belongs to. The host portion, on the right, identifies the device within that network. The subnet mask marks the boundary: it is another 32-bit value whose bits are 1 for the network portion and 0 for the host portion.

The familiar mask 255.255.255.0 is 11111111.11111111.11111111.00000000 in binary, meaning the first 24 bits are network and the last 8 are host. A valid mask is always a solid run of ones followed by a solid run of zeros; a mask like 255.0.255.0 is not valid.

CIDR notation simply counts those leading ones and writes the number after a slash. So /24 is 255.255.255.0, /26 is 255.255.255.192 because the last octet is 11000000 (128 + 64), and /20 is 255.255.240.0 because the third octet is 11110000. The smaller the prefix number, the larger the network.

• /8 = 255.0.0.0, 16,777,216 addresses
• /16 = 255.255.0.0, 65,536 addresses
• /24 = 255.255.255.0, 256 addresses
• /26 = 255.255.255.192, 64 addresses
• /30 = 255.255.255.252, 4 addresses

Finding the network, broadcast and usable hosts

The network address is what you get when you set every host bit to 0. Mechanically, it is a bitwise AND of the address and the mask. The broadcast address is the opposite: every host bit set to 1. It is used to reach all devices on that network at once. Neither of these two addresses can be assigned to an ordinary device, so a standard subnet has 2^(32 - n) - 2 usable hosts, where n is the prefix length.

Worked example: 192.168.10.100/26. Only the last octet is affected by the mask. 100 in binary is 01100100 and the mask octet is 11000000. ANDing them leaves 01000000, which is 64, so the network address is 192.168.10.64. Setting the six host bits to 1 gives 01111111, or 127, so the broadcast address is 192.168.10.127. The usable range is 192.168.10.65 to 192.168.10.126, which is 2^6 - 2 = 62 hosts.

A larger example: 172.20.5.10/20. The mask is 255.255.240.0, so the boundary falls inside the third octet. 5 is 00000101 and 240 is 11110000; their AND is 0. The network address is therefore 172.20.0.0 and, with the 12 host bits all set, the broadcast address is 172.20.15.255. That block holds 2^12 = 4,096 addresses, of which 4,094 are usable.

Two edge cases are worth knowing. A /31 is commonly used for point-to-point links where both addresses are assigned to the two ends, and a /32 identifies a single host. In both cases the usual minus-two rule is not applied.

Splitting a network into subnets

Each extra bit you add to the prefix doubles the number of subnets and halves the size of each one. Splitting 192.168.10.0/24 into /26 blocks borrows two bits, giving four subnets: .0 to .63, .64 to .127, .128 to .191 and .192 to .255. Each has 62 usable hosts. Notice that every subnet starts on a multiple of its block size, 64 here, which is a quick sanity check when reviewing an address plan.

To size a subnet from a requirement, add two to the number of hosts you need and round up to the next power of two. Thirty hosts need at least 32 addresses, which is 2^5, so five host bits and a /27 with exactly 30 usable addresses. Because that leaves no room for growth, many planners would choose a /26 instead. The arithmetic gives you the minimum; judgment about future needs sets the final size.

Private ranges and other special addresses

Home and office networks normally use private addresses that are not routed on the public internet. RFC 1918 reserves three ranges for this, listed below. A router performing network address translation (NAT) maps these to a public address when traffic leaves the network.

Several other ranges have special meanings. 127.0.0.0/8 is loopback, with 127.0.0.1 referring to the local machine. 169.254.0.0/16 is link-local, the range a device assigns itself when it cannot obtain an address from DHCP, which is often a sign of a network problem. 100.64.0.0/10 is shared address space used by carriers for carrier-grade NAT; it is not part of RFC 1918, even though it is not publicly routed either.

For quick checks, the IP Address Calculator (Subnet) on this site takes an address and a prefix length (chosen from a /0 to /32 list that shows the matching mask) and returns the network and broadcast addresses, the usable host range and count, the wildcard mask and the binary form of each value, along with a reference flag for private and loopback addresses. If you want to practise the binary and hexadecimal conversions octet by octet, the Base-N Number Converter handles any base from 2 to 36.

• 10.0.0.0/8: 10.0.0.0 to 10.255.255.255 (16,777,216 addresses)
• 172.16.0.0/12: 172.16.0.0 to 172.31.255.255 (1,048,576 addresses)
• 192.168.0.0/16: 192.168.0.0 to 192.168.255.255 (65,536 addresses)