Understanding IP addresses and subnetting: what nobody explains properly
Type 192.168.1.10 into a browser and it does nothing. Type it into a terminal and you get an answer instantly. Same string of numbers, two completely different reactions — and that gap is exactly where most beginners give up on networking. The address itself isn't hard. What's hard is that nobody shows you what those four numbers are actually doing.
I remember the first time a colleague asked me to "just carve a /26 out of the /24" and I nodded like I understood. I didn't. I spent that evening with a notebook, converting decimal to binary by hand, because clicking a subnetting calculator felt like cheating and I wanted to actually know why the answer was 62 and not 64. That night taught me more than any course did.
This article is that notebook, cleaned up. By the end you'll be able to read an IP address, understand what a subnet mask is telling you, and split a network without guessing.
Key Takeaways
- An IP address has two jobs: identify a network and identify a device on it.
- The subnet mask is what draws the line between those two jobs.
- CIDR notation like /24 is just a compact way of writing that line.
- Usable hosts per subnet = 2n − 2, where n is the number of host bits. The two you subtract are the network address and the broadcast address.
- Subnetting isn't about saving addresses. It's about containing noise.
- You can do all of this in your head once binary clicks — and it does click.
What an IP address actually is, stripped of the jargon
An IPv4 address is 32 bits. That's it. The reason it looks like 172.16.4.20 is purely for humans — we split those 32 bits into four groups of eight, convert each group to decimal, and separate them with dots. Four groups, 0 to 255 each, done.
Why 0 to 255? Because eight bits can represent 256 distinct values (28), and since we start counting at zero, the range runs from 0 to 255. No mystery, no magic.
The two halves of every address
Here's the part that trips people up. An IP address isn't a single piece of information. It's always two pieces glued together: a network portion and a host portion. The network portion says "which neighborhood am I in." The host portion says "which house on this street."
The postal analogy holds up well. If I give you a letter addressed to a street in your city, you don't need the country or the region to route it — you just need the street and the house number. Routers work the same way. Once a packet is inside the right network, the only thing left to figure out is the specific machine.
What defines where the network portion ends and the host portion begins? The subnet mask. That's the whole job.
Why this matters before you touch subnetting
Every subnetting mistake I've seen — and I've made a few — comes from losing track of that split. You start moving bits around without knowing which side you're moving them to, and suddenly your "new subnet" overlaps the old one.
So before any math: an address is network bits + host bits. Keep that sentence in your head.
Subnet masks and CIDR notation without the headache
A subnet mask looks like an IP address because it uses the same format. 255.255.255.0 is the classic one. What it really says is: the first 24 bits are network, the last 8 bits are yours to assign.
Count the ones in that mask in binary. 255 is eight ones. Three of them is 24 ones. That's where the "/24" in CIDR notation comes from — it's literally a count of consecutive one-bits from the left. 192.168.1.0/24 means "192.168.1.0, with 24 network bits."
The mask-to-CIDR cheat sheet
You'll use this table constantly. Print it, stick it near your desk, and after a week you won't need it.
| CIDR | Subnet mask | Total addresses | Usable hosts |
|---|---|---|---|
| /24 | 255.255.255.0 | 256 | 254 |
| /25 | 255.255.255.128 | 128 | 126 |
| /26 | 255.255.255.192 | 64 | 62 |
| /27 | 255.255.255.224 | 32 | 30 |
| /28 | 255.255.255.240 | 16 | 14 |
| /30 | 255.255.255.252 | 4 | 2 |
Notice the pattern. Every time you add one to the CIDR number, you halve the address count. /24 has 256. /25 has 128. /26 has 64. That doubling and halving is the entire rhythm of subnetting.
Why you always subtract two
The formula for usable hosts is 2n − 2, and beginners always ask about the minus two. Fair question.
In any subnet, two addresses are reserved. The first one — where all host bits are zero — is the network address, used to name the subnet itself. The last one — where all host bits are one — is the broadcast address, used to talk to every device in that subnet simultaneously. Neither can be assigned to a real machine.
For a /26, that's 26 = 64 total, minus 2, giving you 62 devices. If you're subnetting for point-to-point links between two routers, /30 is the classic choice: 22 − 2 = exactly 2 usable addresses. One for each end, nothing wasted.
How to actually subnet a network, step by step
Enough theory. Let's take a real network and break it apart.
You have 192.168.1.0/24. That's 256 addresses, 254 usable. Now suppose you need four separate departments, each isolated from the others. You want four subnets, each as large as possible.
Step one: decide how many bits you need
Four subnets means you need to borrow enough host bits to produce four combinations. Two bits give you 22 = 4. So you borrow 2 bits from the host portion.
Your /24 becomes a /26. Twenty-four plus two equals twenty-six.
Step two: calculate the block size
The block size tells you how far apart your subnet boundaries sit. It comes from the last borrowed bit position. A /26 mask is 255.255.255.192, and 256 − 192 = 64. Block size: 64.
So your four subnets start at multiples of 64:
192.168.1.0/26— usable 192.168.1.1 to 192.168.1.62, broadcast 192.168.1.63192.168.1.64/26— usable .65 to .126, broadcast .127192.168.1.128/26— usable .129 to .190, broadcast .191192.168.1.192/26— usable .193 to .254, broadcast .255
Each subnet holds 62 devices. Four times 62 is 248, and the 8 missing addresses are the four network addresses and four broadcast addresses. Nothing vanished.
Step three: verify before you deploy
Check two things. First, no subnets overlap — they don't, because each starts exactly one block after the previous one ends. Second, count that the last subnet's broadcast lands on .255, the top of your original /24.
It does. That's how you know the split is clean.
I'll admit the first time I did this manually I got the block size wrong and produced subnets that overlapped by 32 addresses. The network worked fine until two devices on opposite sides of the overlap tried to talk. Then it didn't. Verification isn't optional.
Why bother subnetting at all?
The honest answer most tutorials skip: in the IPv4 era, subnetting was originally about conserving addresses. With roughly 4.3 billion IPv4 addresses total and far more devices on the planet, every address counted.
But that's not the main reason anymore, and anyone telling you it is hasn't run a real network.
The real reason: contain broadcast traffic
A broadcast is a packet sent to every device in a network. One device sends it, every device must process it. In a /24 with 254 devices, that's 254 machines waking up to look at a packet that probably wasn't for them.
Now imagine a flat network with 2,000 devices and no subnetting. Every broadcast hits all 2,000. You can watch performance fall apart in real time — the network becomes a machine that spends its day delivering irrelevant traffic.
Split that same network into eight /27 subnets and each broadcast reaches 30 devices instead of 2,000. That's the payoff. Subnetting is a noise-reduction technique that happens to also organize things.
The security angle (and the boring-but-real organization angle)
Subnets separate traffic. A device in the guest subnet can't reach a device in the finance subnet without going through a router, and that router can be configured to say no. You get a natural firewall boundary for free, just from how you divided the space.
The less glamorous benefit is documentation. When someone tells you "the printer is on 10.0.20.x," you know exactly which subnet they mean, which router handles it, and roughly what else lives there. Flat networks are anonymous. Subnetted networks have addresses that mean something.
Do you need to memorize all this?
Here's where I'll take a firm position: learn the math, then let tools do the arithmetic.
A subnetting calculator will give you the right answer every time, and you should use one in production. Nobody hand-converts binary while provisioning a live network. But if you can't sanity-check the tool's output — if you can't look at a proposed /27 and immediately feel that 30 hosts is too few for a 40-device floor — you're not engineering, you're trusting.
Spend a week doing it by hand. Convert a few addresses to binary, work out three or four splits on paper, verify against a calculator. That week is the whole investment. After it, the numbers stop being arbitrary.
Where practice pays off most
The skill shows up in interviews, in troubleshooting, and in the quiet moment when a colleague proposes a subnet scheme and you spot the overlap before anyone configures anything. That last one is worth the effort by itself.
The habit that makes it stick
Every network you touch, ask one question: what's the CIDR, and how many hosts does it hold?
Your home router is probably handing out something on a /24. The coffee shop Wi-Fi is likely a /24 too, which is why it gets sluggish when fifty people connect. The link between two switches in an office is often a /30 — two addresses, nothing wasted, because there's nothing to plug in besides the two switches.
Keep asking that question and subnetting stops being a topic you studied. It becomes the way you see networks. And the day you instinctively know that a /26 means 62 before anyone says it out loud — that's the day you stop being a beginner.
