Subnetting & CIDR Explained With Real Examples
Table of Contents
"Just put everything on a /24." That's the advice every small office network gets, and it works — until the day the guest Wi-Fi user with a misconfigured printer starts a broadcast storm that takes down the point-of-sale terminals, or the security auditor asks why the IoT door locks can reach the finance server. A /24 gives you 254 usable addresses on one flat network, which is plenty of space — but space was never the problem. Segmentation was.
Subnetting is the art of dividing that space into smaller networks with boundaries between them. And CIDR notation — the `/24`, `/16`, `/8` you see everywhere — is just a compact way of saying where the boundary sits. This guide builds it up from a real office so the numbers stick.
Meet the Office: 200 Devices, One /24
Picture a 40-person company: 40 laptops, 40 phones, 8 printers, 12 security cameras, 6 smart TVs in meeting rooms, a couple of servers, and assorted IoT gadgets — call it 120 devices today, growing toward 200. The office router hands out addresses in `192.168.1.0/24`.
That `/24` means the first 24 bits of the 32-bit address are the network portion (fixed: `192.168.1`), and the remaining 8 bits are the host portion (yours to assign: 0–255). Two addresses in every subnet are unusable: the all-zeros address (`.0`) identifies the network itself, and the all-ones address (`.255`) is the broadcast address that shouts to every device. So 2^8 = 256 addresses minus 2 = 254 usable hosts, from `192.168.1.1` to `192.168.1.254`. That's the /24 = 254 hosts rule, and now you know exactly where the 254 comes from.
Everything works. But everything is also flat: the intern's malware-infected laptop can ARP-spoof the finance PC, the cameras' chatty firmware can flood the whole broadcast domain, and there's no way to write a firewall rule that says "guests can reach the internet but not the servers" — because guests and servers are on the same network. This is why subnetting matters, and it's not about running out of addresses. It's about blast radius: when something goes wrong (or hostile) in one segment, the boundary contains it.
Reading CIDR Notation: The Slash Decoded
The slash number is simply a count of network bits. `/24` = 24 network bits, 8 host bits. `/16` = 16 network bits, 16 host bits = 65,534 usable hosts. `/8` = 8 network bits, 24 host bits = 16.7 million hosts. Bigger slash, smaller network — the slash counts what's fixed, so more fixed bits means fewer addresses left for hosts.
The old classful system (Class A/B/C) died in the 1990s; CIDR replaced it precisely because classes were wasteful — you either got 254 hosts (Class C) or 65,534 (Class B) with nothing in between. CIDR lets you carve any size: a `/28` gives 14 usable hosts (perfect for a point-to-point link or a tiny VLAN), a `/23` gives 510 (for the office that's outgrowing its /24), a `/30` gives exactly 2 usable hosts (the standard for router-to-router links — nothing wasted).
The subnet mask is the same information in dotted-decimal: `/24` = `255.255.255.0`, `/16` = `255.255.0.0`, `/25` = `255.255.255.128`. The mask's 1-bits mark the network portion. You'll still see masks in older equipment and Windows dialogs, but CIDR is the modern lingua franca — learn to read the slash and you'll rarely need the mask.
The Math in 60 Seconds
You only need one formula: usable hosts = 2^(32 − slash) − 2. The `−2` is the network and broadcast addresses. So `/24`: 2^8 − 2 = 254. `/28`: 2^4 − 2 = 14. `/23`: 2^9 − 2 = 510. `/30`: 2^2 − 2 = 2.
To find a subnet's range, the network address is the base with all host bits zero; the broadcast is all host bits one; usable addresses are everything between. For `192.168.1.0/25`: the /25 splits the last octet in half — network `192.168.1.0`, usable `.1`–`.126`, broadcast `.127`. The second half becomes `192.168.1.128/25`: network `.128`, usable `.129`–`.254`, broadcast `.255`. One /24, cleanly halved into two /25s of 126 hosts each.
Rather than doing binary arithmetic by hand every time, punch the network into the CIDR & IPv4 Subnet Mask Calculator — it shows the range, broadcast, mask, and host count instantly, which is how you double-check your mental math until the patterns become automatic.
Carving Subnets: Dev, Guest Wi-Fi, and IoT
Back to our office. The flat /24 works but it's one big blast radius, so let's carve it into segments with a purpose. We keep `192.168.1.0/24` as the parent and split it:
- Staff network: `192.168.1.0/25` (126 hosts) — laptops, phones, printers, the things employees need to reach each other.
- Guest Wi-Fi: `192.168.1.128/26` (62 hosts) — visitors' phones and laptops. Plenty for guests, and firewalled so it can only reach the internet, never the staff or server subnets.
- IoT: `192.168.1.192/26` (62 hosts) — cameras, TVs, door locks, thermostats. These devices have the worst security track record in the building, so they get their own segment with no path to anything except the internet and the specific server ports they need.
Notice what we did: a /25 plus two /26s exactly fills the /24 (128 + 64 + 64 = 256). No wasted space, and each segment now has a policy: guests can't see servers, IoT can't see staff, staff can see what they need. The router (or a firewall) enforces the boundaries with rules like "allow guest → internet, deny guest → 192.168.1.0/25."
Two practical notes. First, size for growth, not for today: that /26 for guests holds 62 devices, which is fine for a 40-person office but tight if you host a 200-person event. When in doubt, go one slash smaller (bigger subnet) than the math suggests. Second, document the plan: a one-page table of subnet → purpose → VLAN → gateway saves the next person (possibly future you) from reverse-engineering the design at 2 AM during an outage.
Why Subnetting Actually Matters
Strip away the binary and subnetting is about three things. Security: boundaries let you write firewall rules that mean something — "this segment can't reach that segment" is only enforceable if the segments exist. Performance: broadcasts stay within a subnet, so a chatty device or a broadcast storm is contained instead of flooding every device in the building. Organization: subnets map to purposes (staff, guests, servers, IoT), which makes the network readable — `192.168.1.200` tells you "that's IoT" at a glance, the same way area codes tell you roughly where a phone number lives.
You don't need to be a network engineer to use this. If you run a home lab, a small office, or cloud VPCs, the same logic applies: carve by purpose, size for growth, firewall the boundaries. And when someone says "just put everything on a /24," you'll know exactly what they're giving up — and when it's actually fine (a dozen trusted devices) versus when it isn't (anything with guests, IoT, or compliance requirements).
Try it free — no sign-up
Run the numbers yourself in seconds. Everything happens in your browser.
Open the CIDR & IPv4 Subnet Mask CalculatorFrequently Asked Questions
What does /24 mean in CIDR notation?
It means the first 24 of the 32 address bits identify the network, leaving 8 bits for hosts: 2^8 = 256 addresses, minus the network and broadcast addresses, giving 254 usable hosts. `/24` is the most common subnet size for small LANs.
How many hosts are in a /16, /28, or /30 subnet?
A /16 has 65,534 usable hosts (2^16 − 2), a /28 has 14 (2^4 − 2), and a /30 has exactly 2 (2^2 − 2) — the standard size for point-to-point router links. The formula is always 2^(32 − slash) − 2.
Why are the network and broadcast addresses unusable?
The all-zeros host address identifies the subnet itself (used in routing tables), and the all-ones address is the broadcast address that delivers to every host in the subnet. Assigning either to a device would create ambiguity — routers and hosts treat those addresses specially, so they're reserved in every subnet.
When should I subnet instead of using one flat network?
When you need boundaries: separating untrusted devices (guest Wi-Fi, IoT) from trusted ones, containing broadcast traffic, or enforcing firewall policies between groups. A dozen trusted devices on a flat /24 is fine; anything with guests, cameras, or compliance requirements deserves segmentation.
What is the difference between a subnet mask and CIDR notation?
They express the same thing: which bits are network vs host. `255.255.255.0` and `/24` are identical — the mask writes the 24 one-bits as a dotted-decimal number. CIDR is more compact and the modern standard; you'll still encounter masks on older equipment.
Can two subnets overlap?
They can exist in the configuration, but overlapping ranges cause routing ambiguity — a router can't tell which subnet an address belongs to, and traffic goes to the wrong place (or nowhere). When carving subnets from a parent range, verify each new subnet's range doesn't intersect the others; a subnet calculator shows the exact ranges so you can check.