Subnetting Explained:
the math behind the calculator
The calculator gives you the answer instantly. This page covers the binary math behind it — useful once you want to subnet by hand, or just understand what's actually happening.
What a subnet mask actually does
An IPv4 address is 32 bits, normally written as four decimal numbers (octets) separated by dots — 192.168.1.10. A subnet mask is also 32 bits, and its job is to split those bits into two groups: a network portion and a host portion. Wherever the mask has a 1 bit, that bit belongs to the network. Wherever it has a 0 bit, that bit belongs to the host.
255.255.255.0 in binary is 11111111.11111111.11111111.00000000 — 24 ones followed by 8 zeros. That's exactly what CIDR notation (/24) is shorthand for: the number after the slash is simply a count of how many leading bits are 1.
The full CIDR-to-mask table
| CIDR | Subnet mask | Total addresses | Usable hosts |
|---|---|---|---|
| /24 | 255.255.255.0 | 256 | 254 |
| /25 | 255.255.255.128 | 128 | 126 |
| /26 | 255.255.255.192 | 64 | 62 |
| /27 | 255.255.255.224 | 32 | 30 |
| /28 | 255.255.255.240 | 16 | 14 |
| /29 | 255.255.255.248 | 8 | 6 |
| /30 | 255.255.255.252 | 4 | 2 |
| /31 | 255.255.255.254 | 2 | 2 (RFC 3021) |
| /32 | 255.255.255.255 | 1 | 1 (host route) |
Calculating the network address by hand
The network address is found with a bitwise AND between the IP address and the subnet mask — for every bit position, the result is 1 only if both the IP and the mask have a 1 there. Take 192.168.1.137/26 as a worked example:
| Octet 4 in binary | |
|---|---|
| IP address (.137) | 10001001 |
| Mask for /26 (.192) | 11000000 |
| AND result (.128) | 10000000 |
The first three octets of a /26 mask are all 1s (255.255.255), so they pass through unchanged. Only the last octet's math changes anything — the result is 192.168.1.128, the network address for that /26 block. The broadcast address is the same calculation but with every host bit forced to 1 instead of 0: 192.168.1.191.
Shortcut for the last octet: for any mask ending in a non-255, non-0 value (192, 224, 240, 248, 252, 254), subtract that number from 256 to get the "block size." For /26 (mask ends in 192), 256−192 = 64 — so networks land on multiples of 64: .0, .64, .128, .192. Find which multiple your IP falls into, and that's your network address.
Why /31 and /32 are special cases
Every subnet size from /0 through /30 reserves two addresses — network and broadcast — that can't be assigned to a device. A /30 (4 total addresses) therefore has exactly 2 usable hosts, which is why it was the traditional choice for point-to-point links.
RFC 3021 changed this for /31: on a link with only two devices and no need for a broadcast address, both addresses in the block are treated as usable host addresses. This effectively doubles addressing efficiency on point-to-point links compared to a /30, and most modern routing platforms, including RouterOS, support it.
A /32 isn't really a "subnet" in the traditional sense — it's a single host route, commonly used for loopback addresses or for routing traffic to one specific device.
Reading a subnet split
Splitting a network into N equal subnets always means increasing the CIDR prefix by log₂(N) bits. Splitting a /24 into 4 subnets means 24 + log₂(4) = 24 + 2 = /26 — each resulting block is a /26, and there are exactly 4 of them (.0/26, .64/26, .128/26, .192/26) because 2 bits can represent 4 distinct values (00, 01, 10, 11).
The same logic applies to any power of two: splitting into 8 adds 3 bits, into 16 adds 4 bits, and so on. If the number of subnets you need isn't a power of two, round up to the next one — you'll have a few unused blocks left over, which is normal and worth reserving for future growth rather than trying to eliminate.
Common mistakes and how to fix them
| Symptom | Likely cause | Fix |
|---|---|---|
| Assigned a device the network or broadcast address by accident | Miscounted the usable range, especially on smaller subnets like /29 or /30 | Usable hosts always run from network+1 to broadcast−1 — use the calculator to double-check on anything smaller than a /24 |
| Two "adjacent" subnets turn out to overlap | Didn't align the new subnet to its actual block size boundary | Networks must start on a multiple of their block size (a /26 must start at .0, .64, .128, or .192 — never .32 or .100) |
| Split a network expecting N subnets but got a different count | N wasn't a power of two, and rounding up wasn't accounted for | Round up to the next power of two, and expect some unused blocks left over |
| Point-to-point link "wastes" two addresses unexpectedly | Used a /30 out of habit instead of a /31 | If both endpoints are directly connected and only need one address each, a /31 is valid and saves 2 addresses per link |
Best practices
- Always align new subnets to their natural block-size boundary — never split at an arbitrary address.
- Use /31 for point-to-point links where both devices are directly connected, and /30 only where broadcast behavior is specifically needed.
- When splitting a block, round up to the next power of two rather than trying to force an odd number of equal-sized subnets.
- Double-check the first and last usable host on any subnet smaller than /28 — the margin for a counting mistake shrinks fast as blocks get smaller.
Skip the binary math
The calculator does all of this instantly, including the subnet splitter.
Open the IP Subnet Calculator →