Subnetting Made Simple: What the Slash Number Actually Means
By the UtilityForge Editorial Team · Published October 22, 2026 · 6 min read
Subnetting has a reputation for being painful, and honestly, the way it's often taught doesn't help. People get handed a big table of masks and told to memorise it. You don't need to. Once you see what the slash number is doing, the rest is mostly counting.
An IPv4 address is just 32 bits
An address like 192.168.10.77 looks like four numbers, but it's really 32 binary digits split into four groups of eight. Each group (called an octet) can hold a value from 0 to 255. That's all.
A network needs to say which part of those 32 bits identifies the network and which part identifies the device inside it. CIDR notation does this with a slash. /24 means "the first 24 bits are the network; the remaining 8 are for hosts."
From prefix length to host count
Here's the part worth remembering. If the prefix is /n, you have 32 - n bits left for hosts, and that gives you 2^(32-n) addresses in total.
/24leaves 8 bits: 256 addresses/26leaves 6 bits: 64 addresses/28leaves 4 bits: 16 addresses/30leaves 2 bits: 4 addresses
Each time the prefix grows by one, the block is cut in half. A /25 is half a /24. A /26 is a quarter. That halving idea is really all of subnetting.
Why usable hosts are two fewer
In an ordinary subnet, the first address is the network address (all host bits zero) and the last is the broadcast address (all host bits one). You can't assign either to a device. So a /24 has 256 addresses but only 254 usable ones. A /26 has 62. A /30 has just 2, which is why it's been popular for links between two routers.
There are two exceptions. A /31 is allowed on point-to-point links (RFC 3021) and gives you both addresses with no broadcast. A /32 is a single host, used a lot for loopback addresses and firewall rules.
Working an example
Take 192.168.10.77/26. A /26 means blocks of 64 in the last octet: 0-63, 64-127, 128-191, 192-255. The number 77 falls in the 64-127 block. So:
- Network address:
192.168.10.64 - Broadcast address:
192.168.10.127 - First usable host:
192.168.10.65 - Last usable host:
192.168.10.126 - Subnet mask:
255.255.255.192
The "block size" trick is the fastest way to do it in your head. Subtract the interesting octet of the mask from 256 (256 − 192 = 64) and you've got your step size.
Subnet mask vs wildcard mask
The subnet mask for a /26 is 255.255.255.192. The wildcard mask is its inverse: 0.0.0.63. You'll meet wildcard masks in Cisco access lists and OSPF configuration, where a 0 bit means "must match" and a 1 means "don't care". It's easy to mix them up, so it helps to know which one a given device expects.
Private ranges you should know
Three blocks are reserved for private networks and aren't routed on the public internet:
10.0.0.0/8172.16.0.0/12(172.16.0.0 to 172.31.255.255)192.168.0.0/16
If you're planning a cloud network, pick ranges that won't overlap with your office or with a partner you might connect to later. Overlapping ranges are one of the most annoying things to fix after the fact, because you usually have to renumber live systems.
Planning a real network
A practical approach: list the groups of devices (servers, staff, guests, cameras), estimate the largest each will grow to, round up to the next power of two, and add a bit of headroom. Then allocate the biggest subnets first so the blocks line up neatly. If you want a quick check on any block, our CIDR subnet calculator shows the network, broadcast, mask and host range in one go.
That's it. The slash number tells you how many bits are fixed, every extra bit halves the block, and two addresses go to housekeeping. The rest is just practice.