"CIDR Subnetting Without the Headache: Masks, Ranges, and Host Counts"

CIDR notation looks like a secret handshake — 10.0.5.0/24, 192.168.1.128/26 — but it is describing something simple: a block of IP addresses and where its boundaries are. Once you can read the /n part, subnetting stops being a memorization exercise and becomes arithmetic you can do (or verify) in seconds.

What the slash actually means

An IPv4 address is 32 bits. The number after the slash is how many of those bits are fixed as the network portion; the rest identify hosts inside the block.

• /24 → 24 network bits, 8 host bits → 2^8 = 256 addresses.
• /26 → 26 network bits, 6 host bits → 2^6 = 64 addresses.
• /30 → 30 network bits, 2 host bits → 4 addresses (the classic point-to-point link).

The pattern: host bits = 32 − prefix, and total addresses = 2^(host bits). Bigger slash number = smaller block.

The five numbers you usually want

For any block, these are the values that matter:

• Network address — the first address, all host bits zero. It names the block; it is not assignable to a host.
• Broadcast address — the last address, all host bits one. Also not assignable.
• First usable host — network + 1.
• Last usable host — broadcast − 1.
• Usable host count — total − 2 (you lose the network and broadcast addresses). So a /24 holds 256 addresses but 254 usable hosts.

The CIDR / IP Converter prints all of these from a single a.b.c.d/n input, which is the fastest way to check your work or answer a "does this IP fall in that subnet?" question.

Why binary makes it obvious

The reason subnet math feels slippery in decimal is that the boundary rarely lands on a dot. In binary it is obvious: the prefix is just "how many leading bits are locked." A /26 locks 26 bits, so the last octet splits into blocks of 64 — .0, .64, .128, .192. That is why 192.168.1.128/26 covers .128 through .191. Seeing the address in binary makes the network/host line visible; the IP Address Converter shows any address in binary so you can spot the boundary directly. The CIDR Subnetting Explained guide walks through this bit by bit.

Common places it bites

• Off-by-one on usable hosts. A /24 is 256 addresses but 254 hosts. Firewall rules and DHCP pools that assume 256 usable will collide with the network or broadcast address.
• Overlapping ranges. Before you add a route or an allowlist entry, confirm the new block does not overlap an existing one. Convert both to their network/broadcast bounds and compare.
• The /31 and /32 exceptions. A /32 is a single host (used for loopbacks and allowlist entries); a /31 is a special two-address point-to-point block with no separate network/broadcast. Do not apply the "minus 2" rule to those.

Putting it to work

Say a log shows traffic from 10.4.7.201 and your allowlist entry is 10.4.0.0/20. Is that address inside it? A /20 locks 20 bits — the third octet splits into blocks of 16 (0-15, 16-31, …), so 10.4.0.0/20 covers 10.4.0.0 through 10.4.15.255. 10.4.7.201 is inside. To confirm without counting on your fingers, drop both into the CIDR / IP Converter and read the range; to attribute the address itself, follow up with IP Lookup.

Subnetting is one of those skills that feels like arcana until the mask clicks into place — then it is just "how many bits are locked, and what range does that leave." Read the slash, count the host bits, and let a converter check the edges.