What is a /24? CIDR notation and subnet masks, finally clear

The 32 bits that decide everything

An IPv4 address is just a 32 bit number wearing a costume. We write 192.168.1.57 because four small decimals are friendlier than 11000000101010000000000100111001, but the router sees the bits.

The slash number draws one line through those 32 bits. Left of the line: network bits, identical for every machine on the subnet. Right of the line: host bits, the part that varies. That single line answers the two questions networking actually runs on: which network does this address belong to, and is that other address a neighbor I can reach directly or a stranger I must send through the gateway?

When your laptop wants to talk to 192.168.1.80 and it lives at 192.168.1.57/24, it masks both addresses, sees the same 192.168.1 network, and ARPs for the destination directly. Same laptop, destination 8.8.8.8: the masked comparison fails, so the packet goes to the default gateway. Every subnet design decision you’ll ever make is downstream of that comparison.

Why 254 and not 256

Two addresses in every ordinary subnet are spoken for. The all-zeros host part (192.168.1.0 here) names the subnet itself; it appears in routing tables and firewall rules, never on a network card. The all-ones host part (192.168.1.255) is the broadcast address, the megaphone that reaches every host at once; DHCP discovery still depends on it.

So the formula for usable hosts is 2^(host bits) minus 2. A /24 gives 2^8 - 2 = 254. A /26 gives 2^6 - 2 = 62. The two exceptions are deliberate: a /31 keeps both addresses for the two ends of a point-to-point link (RFC 3021 blessed this in 2000, and router vendors followed), and a /32 is a single host by definition.

One mask, four costumes

The same /24 shows up in four notations depending on which config file you’re staring at, and they encode identical information:

The wildcard trips people because it’s the bitwise inverse: 0 means “must match”, 1 means “don’t care”. Type 255.255.255.0 where an ACL wanted 0.0.0.255 and you’ve written a rule that matches almost nothing, an error every network engineer commits exactly once.

The slash notation comes from CIDR, Classless Inter-Domain Routing, defined in RFC 1519 back in 1993 when the old class A/B/C system was visibly running the internet out of addresses. Classes have been dead in routing for three decades. They survive in certification exams and in the habit of calling a /24 a “class C”, which works until someone hands you a /22 and the vocabulary collapses.

Sizing real networks without regret

The job is matching host bits to device counts, with growth room. A /24 fits a floor or a small office with margin. The awkward moment arrives at device 255, because resizing a live subnet means touching DHCP scopes, static assignments, firewall rules and at least one printer nobody documented.

My rule after years of moves and mergers: when in doubt, take the next size up inside RFC 1918 space. Private addresses cost nothing; renumbering costs weekends. The 10.0.0.0/8 block alone holds 65,536 separate /24s, so scarcity is never the real constraint inside.

If you want the arithmetic done for you, with the bit map drawn and every notation spelled out, our subnet calculator does exactly this and splits blocks into child subnets with a click.

Splitting a block, the part everyone fears

Subnetting a larger block is the skill interviews test and daily work trivializes. Take 10.10.0.0/22, which spans 10.10.0.0 through 10.10.3.255. Borrow two host bits and you get four /24s: 10.10.0.0/24, 10.10.1.0/24, 10.10.2.0/24, 10.10.3.0/24. Each borrowed bit doubles the subnet count and halves their size; the child networks always start at clean multiples of the block size.

That’s all VLSM is: cutting where you choose instead of where a class once told you to. Carve the /22 into one /23 for WiFi, a /24 for wired users and two /26s for servers and management, and you’ve reproduced the address plan of half the offices on earth.

The /24 keeps its crown anyway, because it’s the largest block where the human-readable boundary and the binary boundary coincide: the third octet is the network, the fourth is the host, and a tired engineer at 3 a.m. can read an address without computing anything. Never underestimate a notation optimized for tired engineers.

IPv6 changes the habits, not the logic

Everything above transfers to IPv6 with one mental adjustment: stop counting hosts. The slash notation works identically (the prefix length counts network bits, now out of 128), but the standard subnet size is a /64, which holds 18 quintillion addresses. Nobody sizes an IPv6 segment to its device count; every LAN gets a /64 because SLAAC, the stateless autoconfiguration mechanism from RFC 4862, expects exactly 64 host bits. Subnetting happens in the layer above: your site gets a /48 or a /56, and you carve it into /64s the way you’d deal cards from a deck you can never exhaust.

A few /24-era reflexes to unlearn. There’s no broadcast address in IPv6, so the subtract-two arithmetic dies; multicast groups took over that job. Subnet conservation, the instinct that made you fight for a /26 instead of a /24, becomes actively harmful: carving smaller than /64 breaks autoconfiguration for no benefit. And the network-versus-host comparison your laptop performs still runs the same way, just on 128 bits with the on-link determination rules of RFC 5942 layered on top.

The bit logic you built reading this article is the part that survives the transition untouched. Prefixes left, hosts right, one line through the address: that’s subnetting, in both protocols, for the rest of your career.

Frequently asked questions