A laptop joins the office Wi-Fi and receives 192.168.1.47. The shared printer sits at 192.168.1.200. Neither device was told the other's name, yet the print job arrives. That quiet reliability rests on an addressing scheme you can work out with a pencil and the back of an envelope. Read an address and its mask correctly, and everyday problems start explaining themselves: why one machine reaches the file server but not the label printer, why two laptops on the same switch ignore each other, and why home routers hand out addresses beginning with 192.168.
Subnetting has a reputation as the dry part of networking, the bit you memorise for an exam and never touch again. The opposite is true. Once you can move between dotted decimal, binary and CIDR notation, network faults stop being mysteries and become arithmetic.
An IPv4 address is 32 bits in a friendly costume
Every IPv4 address is a 32-bit number written as four decimal values separated by dots. Each value, called an octet, runs from 0 to 255, because eight bits hold 256 possible combinations. The address 192.168.10.25 looks like this in binary:
11000000.10101000.00001010.00011001
Check it by hand: 128 + 64 = 192, 128 + 32 + 8 = 168, 8 + 2 = 10, and 16 + 8 + 1 = 25. The place values in an octet double from left to right — 128, 64, 32, 16, 8, 4, 2, 1. If you can add those eight numbers in different combinations, you can subnet.
Nobody types that at a command prompt, but the binary matters. An address splits into two parts: a network portion that identifies the segment, and a host portion that identifies one device on it. The split is not fixed. It moves depending on the mask, which is why the same address can sit inside four different networks depending on what follows it.
Subnet masks draw the line
A mask is always 32 bits: a run of 1s, then a run of 0s. Written in decimal it looks like 255.255.255.0, because 255 is simply eight 1s in a row. So 255.255.255.0 means twenty-four 1s followed by eight 0s. Where the mask has 1s, read the network portion. Where it has 0s, read the host portion.
The critical property is that the 1s never break and the 0s never break. You will never see 255.255.240.255 used as a mask, because it would be a jumble. That contiguity is exactly what lets the slash shorthand work.
Same subnet or not?
A host uses its own mask to decide. It lines up its address and the destination address, applies the mask to both, and compares the results.
Take 192.168.1.20 and 192.168.1.140 with a mask of 255.255.255.0. Both reduce to 192.168.1.0, so they are on the same subnet. Traffic goes directly, wrapped in a frame addressed to the destination's MAC address. Now compare 192.168.1.20 with 192.168.2.20 under the same mask. You get 192.168.1.0 against 192.168.2.0. Different networks, so the packet goes to the default gateway and a router decides what happens next.
That single comparison is the heart of local networking. It also explains a whole family of support tickets, because a host with the wrong mask will confidently believe the machine next to it is across the internet.
CIDR notation: the slash does the work
CIDR notation replaces the written mask with a slash and the count of 1 bits. This is the shorthand you will see in router configs, cloud consoles and documentation.
- /24 — 255.255.255.0 — 256 addresses, 254 usable. The classic home or small-office LAN.
- /25 — 255.255.255.128 — 128 addresses, 126 usable.
- /26 — 255.255.255.192 — 64 addresses, 62 usable.
- /27 — 255.255.255.224 — 32 addresses, 30 usable.
- /30 — 255.255.255.252 — 4 addresses, 2 usable. The traditional choice for a router-to-router link.
- /31 — 255.255.255.254 — 2 addresses, both usable on point-to-point links.
- /32 — 255.255.255.255 — a single address, used for host routes.
Notice the pattern: each step to the right halves the block and adds 128, then 64, then 32 to the final octet. Learn the sequence 128, 192, 224, 240, 248, 252, 254, 255 and you can convert almost any mask on sight.
Network, broadcast and usable hosts
Inside every subnet, two addresses are spoken for.
- The network address has every host bit set to 0. It names the subnet itself and can never be assigned to a device.
- The broadcast address has every host bit set to 1. Traffic sent there reaches every host on the subnet.
That leaves the addresses in between for devices, which is why a /24 gives 254 usable hosts rather than 256. In 192.168.1.0/24, the network is 192.168.1.0, the broadcast is 192.168.1.255, and usable hosts run from 192.168.1.1 to 192.168.1.254. For a /26 beginning at 192.168.1.64, the network is .64, the broadcast is .127, and hosts range from .65 to .126.
Rule of thumb: usable hosts = 2 raised to the power of the host bits, minus 2. Eight host bits give 256 - 2 = 254. Five host bits give 32 - 2 = 30.
Subnetting by hand in four steps
You can carve a block into smaller pieces without any tooling. Work through it in this order.
- Count the hosts you need. Add headroom for printers, phones and future kit.
- Find the host bits. Choose the smallest power of two that covers those hosts plus the two reserved addresses. Thirty devices need 32 addresses, so five host bits.
- Derive the prefix. Subtract the host bits from 32. Five host bits leave 27 network bits, so the mask is /27, or 255.255.255.224.
- List the subnets using the block size. Subtract the interesting octet from 256: 256 - 224 = 32. A 192.168.1.0/24 therefore splits into /27s starting at .0, .32, .64, .96, .128, .160, .192 and .224.
For 192.168.1.32/27, the network is .32, the broadcast is .63, and hosts are .33 through .62. Do this a few times on paper and the arithmetic becomes automatic.
Private addresses and why 192.168.x.x feels familiar
Three ranges are reserved for private use and are never routed on the public internet:
- 10.0.0.0/8 — roughly 16.7 million addresses, common in large enterprises.
- 172.16.0.0/12 — 172.16.0.0 through 172.31.255.255, frequently used in cloud virtual networks.
- 192.168.0.0/16 — the range your home router almost certainly hands out.
Because these addresses are not globally unique, your router rewrites them as traffic leaves, a trick called NAT. That is why your laptop can hold 192.168.1.47 while thousands of other laptops worldwide hold the very same address.
Common beginner mistakes
- One host with the wrong mask. A device set to /24 in a /25 world sees half its neighbours as remote and sends their traffic to the gateway.
- Duplicate addresses. Two hosts sharing one IP produce intermittent, maddening failures rather than a clean outage.
- Burning a /24 on four devices. A point-to-point link needs a /30 or /31, not 254 idle addresses.
- Forgetting the gateway. A correct address and mask with no gateway reaches local peers and nothing else.
A host showing 169.254.x.x has not been misconfigured by hand — it failed to reach a DHCP server and assigned itself a link-local address. Spotting that one detail shortcuts a great deal of troubleshooting.
Where to go next
IPv6 replaces the 32-bit address with a 128-bit one and drops broadcast in favour of multicast, but the underlying idea is unchanged: a prefix length marks the boundary between network and host. The habits you build here — reading masks, counting host bits, identifying the network and broadcast addresses — carry straight over.
Grab the address and mask from your own machine, write them out in binary, and work out which of your devices share a subnet. It takes five minutes and turns an abstract topic into something you can watch working on the desk in front of you.
Photo: Chris F / Pexels
