Understand subnet prefixes and masks, calculate an unfamiliar IPv4 range, and follow a verified /24-to-/26 split without misusing the subtract-two rule.
A subnet is a defined block of IP addresses that share the same network prefix. The prefix separates the bits that identify the network from the bits available for addresses inside it; for example, 192.0.2.0/26 contains 64 total IPv4 addresses from 192.0.2.0 through 192.0.2.63.
The practical purpose of subnetting is control. It lets an administrator divide a larger address block into smaller, predictable ranges for different locations, device groups, security zones, or routing boundaries. The arithmetic is exact: once the address and prefix length are known, the network address, range, and broadcast address can all be derived.
Read a subnet as a prefix boundary
An IPv4 address contains 32 bits. CIDR notation adds a slash and a prefix length from 0 to 32. As defined in RFC 4632, that number says how many leading bits form the prefix. A larger prefix number leaves fewer address bits available inside the subnet.
For 192.0.2.0/26:
/26means 26 of the 32 bits identify the network.- 6 bits remain, so the block contains
26 = 64total addresses. - The equivalent mask is
255.255.255.192. Its final octet is11000000in binary: two prefix bits followed by six address bits. - For an ordinary IPv4 broadcast subnet, 62 addresses are conventionally assignable to hosts. The first address identifies the network and the last is the broadcast address.
A subnet mask and a CIDR prefix express the same boundary in different forms. CIDR is usually faster to read; dotted-decimal masks still appear in operating systems and network equipment.
| Prefix | Subnet mask | Total IPv4 addresses | Conventional assignable hosts |
|---|---|---|---|
| /24 | 255.255.255.0 | 256 | 254 |
| /25 | 255.255.255.128 | 128 | 126 |
| /26 | 255.255.255.192 | 64 | 62 |
| /27 | 255.255.255.224 | 32 | 30 |
| /28 | 255.255.255.240 | 16 | 14 |
| /30 | 255.255.255.252 | 4 | 2 |
| /31 | 255.255.255.254 | 2 | Special point-to-point use |
| /32 | 255.255.255.255 | 1 | One address or host route |
The formula is useful, but the last column is deliberately not “total minus two” for every row. The exceptions matter and are covered below.
Worked example: split one /24 into four /26 subnets
Start with 192.0.2.0/24. The 192.0.2.0/24 block is reserved for documentation by RFC 5737, so it is appropriate for an example and should not be treated as a real public destination.
Moving the prefix from /24 to /26 borrows two more bits for the subnet boundary. Two bits create 22 = 4 equal subnets. Each /26 contains 64 addresses, so the ranges begin at increments of 64 in the final octet.
| Subnet | Network address | Conventional host range | Broadcast |
|---|---|---|---|
| 192.0.2.0/26 | 192.0.2.0 | 192.0.2.1–192.0.2.62 | 192.0.2.63 |
| 192.0.2.64/26 | 192.0.2.64 | 192.0.2.65–192.0.2.126 | 192.0.2.127 |
| 192.0.2.128/26 | 192.0.2.128 | 192.0.2.129–192.0.2.190 | 192.0.2.191 |
| 192.0.2.192/26 | 192.0.2.192 | 192.0.2.193–192.0.2.254 | 192.0.2.255 |
Those boundaries were cross-checked locally with Python 3.9.6 and its standard-library ipaddress module. That calculation verifies the address arithmetic; it does not prove how a particular router, DHCP server, firewall, or cloud provider will implement the design.
Calculate the subnet containing an unfamiliar address
Suppose a device shows 192.0.2.141/26. You can find its subnet without memorizing every possible range:
- Count the remaining bits.
32 - 26 = 6. - Calculate the block size.
26 = 64addresses. - Find the containing multiple. The /26 boundaries in the final octet are 0, 64, 128, and 192. The number 141 falls between 128 and 191.
- Mark the endpoints. The network is
192.0.2.128; the broadcast is192.0.2.191; the conventional host range is192.0.2.129through192.0.2.190.
The binary operation underneath that shortcut is a bitwise AND between the IP address and the subnet mask. In the final octet:
| Value | Decimal | Binary final octet |
|---|---|---|
| Address | 141 | 10001101 |
| /26 mask | 192 | 11000000 |
| Address AND mask | 128 | 10000000 |
The result, 128, is the network value in that octet. Combining it with the unchanged first three octets gives 192.0.2.128/26.
Use the same-subnet test instead of guessing by appearance
Two IPv4 addresses are in the same subnet when applying the relevant prefix produces the same network address. With a /26:
192.0.2.141and192.0.2.190both resolve to192.0.2.128/26, so they are in the same subnet.192.0.2.141resolves to192.0.2.128/26, while192.0.2.200resolves to192.0.2.192/26, so they are in different subnets.
Do not decide from the dots alone. The first three octets can match while the addresses are separated by a /26 boundary. Conversely, a prefix shorter than /24 can place addresses with different third octets in the same subnet.
A host normally treats an on-link destination differently from a destination reached through a router. Actual forwarding also depends on the host’s routing table, interface settings, and network configuration, so “same mathematical subnet” is necessary context—not a guarantee that two devices can communicate. Firewall rules, client isolation, duplicate addresses, incorrect gateways, and physical or virtual segmentation can still block traffic.
Subnet, VLAN, and route are related but not interchangeable
| Term | What it defines | What it does not prove |
|---|---|---|
| Subnet | An IP prefix and its address range | That every address is assigned, reachable, or on one Ethernet segment |
| VLAN | A Layer 2 broadcast domain identified by switching configuration | The IP prefix used on that VLAN |
| Route | A forwarding choice for a destination prefix | That the destination is locally attached |
| DHCP scope | A pool and options offered to clients | The complete subnet; some addresses may be excluded or assigned another way |
A common design maps one IPv4 subnet to one VLAN, gives that subnet a gateway interface, and creates a DHCP scope inside the usable range. That is a design convention, not a definition. Document all four objects separately so a later change to a pool, VLAN, or route does not silently alter the intended boundary.
Choose a subnet size from requirements, not the nearest familiar mask
Before assigning addresses, count more than the devices visible today. Include gateway interfaces, access points, printers, phones, cameras, infrastructure, static assignments, DHCP reservations, expected growth, and any platform-reserved addresses. Cloud networks can reserve addresses according to provider-specific rules, so their usable counts may differ from the conventional IPv4 table.
Then make the boundary operational:
- Record the prefix, mask, network address, broadcast address where applicable, gateway, and intended purpose.
- Keep the DHCP pool inside the subnet and outside addresses reserved for infrastructure.
- Configure routing between subnets only where the policy requires it.
- Apply firewall or access-control rules to the actual source and destination prefixes.
- Test one local destination, one routed destination, name resolution, and the expected blocked path.
If certain devices need stable assignments after the ranges are planned, see our guide to static IP addresses, DHCP reservations, and address conflicts. A stable address is an assignment decision inside a subnet; it does not replace the subnet design.
Do not apply the “subtract two” rule blindly
The familiar host formula—total addresses minus the network and broadcast addresses—describes ordinary IPv4 broadcast subnets. It is not a universal IP rule.
- /31: RFC 3021 permits both addresses on an IPv4 point-to-point link. There is no need to spend separate network and broadcast addresses for that two-endpoint case.
- /32: a /32 represents one IPv4 address and is commonly used as a host route or loopback route, not as a conventional multi-host LAN.
- IPv6: IPv6 subnets are also prefix-based, but IPv6 has no broadcast address. RFC 4291 defines multicast instead, so the IPv4 “network plus broadcast” subtraction should not be carried over.
- Cloud platforms: a provider may reserve additional addresses inside a subnet. Use the provider’s current documentation when sizing a deployment.
Common subnet questions
What is a subnet mask?
A subnet mask is a 32-bit IPv4 value whose leading 1 bits mark the network prefix and whose trailing 0 bits mark the remaining address field. For example, 255.255.255.192 contains 26 leading 1 bits, so it is the dotted-decimal form of /26.
How many subnets can a /24 make?
It depends on the new prefix. Splitting a /24 into /25s creates two subnets; /26s create four; /27s create eight; and /28s create sixteen. Each added prefix bit doubles the number of equal subnets and halves the addresses in each.
Does every subnet need a router?
A subnet does not require a router merely to exist or for hosts on the same local network to exchange traffic. It needs a suitable Layer 3 forwarding path when devices must reach other subnets. That path may be a physical router, a multilayer switch, a firewall, a virtual appliance, or a cloud gateway.
Is a subnet a security boundary?
It can support a security boundary, but the prefix alone does not enforce policy. Filtering comes from firewalls, access-control lists, host controls, cloud security rules, or other enforcement points. Treat the subnet as a named traffic zone only when the corresponding controls are configured and tested.
Use the math as a plan, then verify the implementation
For IPv4, begin with the prefix: calculate 2(32 - prefix), find the aligned block boundary, and identify the special endpoint rules that apply. That produces the intended range. Before relying on it, confirm the mask on the host and gateway, the DHCP scope, the route, the VLAN mapping, and the security policy. Subnet arithmetic tells you where an address belongs; configuration decides whether the network behaves that way.
