13 d up · CPU 15% · RAM 44% · Storage 20% All systems operational 99.79% uptime (30 days) View status →
Guides

Subnets and CIDR explained

An IP address alone isn’t enough: your device also has to know which other addresses are “nearby” and which have to go through the router. That’s what a subnet takes care of. In this article you’ll learn step by step how a subnet works, what that /24 behind an address means, and how to work it out yourself. Handy if you’re setting up a VLAN, linking two networks, or just want to understand what your router shows.

An IPv4 address has two parts

An IPv4 address like 192.168.1.130 is a 32-bit number, written as four groups of 8 bits (0 through 255). Some of those bits say which network you’re in, the rest say which device you are. The subnet mask shows where that boundary lies.

You can write the mask in two ways:

  • As numbers: 255.255.255.0.
  • As CIDR notation, with a slash: /24. The number after the slash is the number of bits that belong to the network. Here that’s 24 of the 32 bits, leaving 8 for devices.

So 192.168.1.0/24 is the same as “network 192.168.1.0 with mask 255.255.255.0”. That’s the most common home network.

How many addresses does it hold?

With 8 bits for devices there are 28 = 256 addresses. Two of them can’t be used: the first is the network address (the name of the network itself) and the last is the broadcast address (“everyone in this network”). That leaves 254 addresses for devices. The rule: 2(32 − prefix) − 2.

CIDR Subnet mask Addresses Usable for devices
/8 255.0.0.0 16,777,216 16,777,214
/16 255.255.0.0 65,536 65,534
/24 255.255.255.0 256 254
/25 255.255.255.128 128 126
/26 255.255.255.192 64 62
/27 255.255.255.224 32 30
/28 255.255.255.240 16 14
/29 255.255.255.248 8 6
/30 255.255.255.252 4 2

A /30 is handy for a link between two devices: exactly two usable addresses. A /32 is a single address.

Working it out yourself: an example

Say your device has 192.168.1.130/26. Which network is it in, and which addresses belong to it?

  1. Work out the block size. A /26 leaves 6 bits for devices, so 26 = 64 addresses per block.
  2. Divide the last number into blocks of 64: 0–63, 64–127, 128–191, 192–255.
  3. See which block 130 falls in: 128–191.

So:

  • Network address: 192.168.1.128
  • First usable address: 192.168.1.129
  • Last usable address: 192.168.1.190
  • Broadcast address: 192.168.1.191

Check your answer with the Subnet Calculator, or practice with Practice Subnetting.

Splitting a network

Dividing a large network into smaller pieces is called subnetting. You borrow bits from the device part. A /24 in four equal parts becomes four times a /26:

192.168.1.0/26     (addresses .0   to .63)
192.168.1.64/26    (addresses .64  to .127)
192.168.1.128/26   (addresses .128 to .191)
192.168.1.192/26   (addresses .192 to .255)

The Subnet Splitter does this for you. Do you need networks of different sizes, for example 50 computers, 30 smart-home devices and a few servers? Then divide the largest one first, and the smaller ones after. That’s called VLSM (variable length subnet masking). The VLSM Planner makes such a layout and shows what’s still free.

Which addresses can you use?

At home and in the office you use private addresses. They only work inside your own network and aren’t routed on the internet:

Block Range Commonly used for
10.0.0.0/8 10.0.0.0 – 10.255.255.255 Large networks and companies
172.16.0.0/12 172.16.0.0 – 172.31.255.255 Docker (by default), smaller company networks
192.168.0.0/16 192.168.0.0 – 192.168.255.255 Home networks

You can see your own public address with What is my IP?.

Where it goes wrong in practice

  • Two networks with the same range. 192.168.1.0/24 at home and at the office or at a relative’s as well. As soon as you link them with a VPN, your computer no longer knows which way an address should go. For your home network, choose something less common, such as 192.168.42.0/24, and check for overlap with CIDR overlap.
  • Chosen too tight. A /28 only holds 14 devices. Be generous for smart home and wifi: devices keep being added.
  • Forgetting the mask with a fixed IP address. Without the right mask a device can’t talk to the rest. The gateway (usually your router, often .1) must be within the subnet.
  • Docker quietly takes its own range from 172.16.0.0/12. If you come across that in your network, it can clash.

And IPv6?

IPv6 addresses are 128 bits long and are written differently, but the principle is the same: a prefix that points to the network. A home network almost always uses a /64, which holds far more addresses than there are devices. Look at an address with the IPv6 Calculator.

In short

  • The number after the slash is the number of bits for the network. The bigger the number, the smaller the network.
  • Number of addresses: 2(32 − prefix). Usable: two fewer.
  • Working out the block size and placing the address in the right block gives the network and broadcast address.
  • Choose a separate range for every network, so a VPN or extra VLAN doesn’t clash later.