IPv4 subnetting tutorial — masks, networks and hosts

By the end of this guide, you will be able to find the subnet an address belongs to and decide which addresses can be assigned to devices. From 192.168.1.70/26, for example, you will derive network 192.168.1.64, broadcast 192.168.1.127, and host range .65–.126. Broadcast is the final address of a conventional IPv4 subnet and is used to reach all hosts on it; a host here means a device interface that can receive an address. A subnet is one contiguous block of addresses, and the prefix after the slash sets its size. IPv4 addresses are 32 bits long. Here the first 26 bits identify the block and the remaining 6 distinguish addresses inside it. This guide follows RFC 791, classless addressing in RFC 4632, and the current IANA registry.

Address, mask, and prefix

The four octets contain 8 bits each and range from 0 to 255. 192.168.1.10 is 11000000.10101000.00000001.00001010 in binary. A contiguous subnet mask consists of ones followed only by zeroes; the count of ones is the prefix length.

For a conventional /0 through /30 subnet, the total is 2^(32 − prefix). The first address identifies the network, the last is broadcast, and the addresses between them can usually be assigned to hosts. A prefix does not specify a default gateway; choosing the first or last host is only an administrative convention.

A /24 example

For 192.168.1.10/24, eight bits remain outside the prefix. The network is 192.168.1.0, broadcast is 192.168.1.255, and the conventional host range is 192.168.1.1–192.168.1.254.

Calculating 192.168.1.70/26

1. /26 leaves 6 bits, so the block contains 2^6 = 64 addresses.
2. The mask is 255.255.255.192; the increment in the last octet is 256 − 192 = 64.
3. Block boundaries are 0, 64, 128, and 192. The value 70 falls in 64–127.
4. The network is 192.168.1.64, broadcast is 192.168.1.127, and hosts are .65–.126.

The bitwise method gives the same answer: 70 AND 192 = 64. Check your work with the IPv4 calculator.

The /31 and /32 exceptions

RFC 3021 permits both addresses in a /31 to be used as the endpoints of a point-to-point link; there is no separate network or directed broadcast address in that use. A /32 describes exactly one address, such as a host route or loopback. The “minus two” rule does not apply to these cases.

Private and special-purpose addresses

RFC 1918 defines 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. A private address is not a security mechanism. NAT (Network Address Translation) translates addresses between networks but is not implied by a mask. IANA also lists shared space 100.64.0.0/10, loopback 127.0.0.0/8, link-local 169.254.0.0/16, documentation blocks 192.0.2.0/24, 198.51.100.0/24, and 203.0.113.0/24, and multicast 224.0.0.0/4. “Not private” does not necessarily mean globally reachable.

Checks that prevent common mistakes

• Keep the prefix with the address. Without it, the subnet is ambiguous and there is no reason to assume /24.
• Separate an interface address from a block boundary: 192.168.1.70/26 sits inside network 192.168.1.64/26.
• Use the stated prefix rather than historical A/B/C classes, which no longer determine the mask.
• Check what the wildcard represents. For a contiguous /26 mask it is 0.0.0.63; it selects bits for matching and is neither a subnet mask nor a broadcast address.

IPv4 as binary, hexadecimal, and decimal

Address 203.0.113.9 is 11001011.00000000.01110001.00001001 in binary and 0xCB007109 in hexadecimal. As one unsigned integer, it is 203 × 256³ + 0 × 256² + 113 × 256 + 9 = 3405803785. The place values come from each octet’s eight bits. These are different representations of the same 32 bits; conversion does not assign a new mask or network role. Check them in the IPv4 decimal, hexadecimal, and binary converter.

Continue with CIDR and aggregation or VLSM planning.