Subnet Mask Explained: the /8–/32 Table and How to Calculate It Without a Tool

Short answer. A subnet mask splits an IP address into two parts: which network it belongs to and which host inside it. The notations /24 and 255.255.255.0 mean exactly the same thing — the first 24 bits identify the network and the remaining 8 identify devices. Two addresses in every ordinary subnet are reserved, so a /24 holds 254 usable hosts rather than 256.

What a subnet mask actually is

An IPv4 address is 32 bits, written as four numbers for convenience: 192.168.10.25. The address alone does not say where the "street" ends and the "house number" begins. The mask draws that line.

A mask is 32 bits too, but strictly ordered: ones first, then zeros, never mixed. Ones mark network bits, zeros mark host bits. Hence two equivalent notations:

• Prefix (CIDR) notation: 192.168.10.25/24 — "the first 24 bits are the network".
• Dotted-decimal notation: mask 255.255.255.0 — the same 24 ones, spelled out per octet.

The practical consequence is singular: devices sharing the network part talk directly, everything else goes through the gateway. Get the mask wrong and two machines sitting next to each other stop seeing one another.

Subnet mask table: /8 to /32

This is the table most people came for. "Addresses" is the total in the subnet; "hosts" is how many you can actually assign to devices.

Prefix	Mask	Addresses	Hosts	Where you meet it
/8	255.0.0.0	16,777,216	16,777,214	The whole 10.0.0.0/8 private range
/12	255.240.0.0	1,048,576	1,048,574	The 172.16.0.0/12 private range
/16	255.255.0.0	65,536	65,534	The 192.168.0.0/16 private range
/20	255.255.240.0	4,096	4,094	An ISP or data-centre segment
/22	255.255.252.0	1,024	1,022	A large office network
/23	255.255.254.0	512	510	Two consecutive /24 subnets
/24	255.255.255.0	256	254	The typical office and home network
/25	255.255.255.128	128	126	Half of a /24
/26	255.255.255.192	64	62	A quarter of a /24, one department
/27	255.255.255.224	32	30	A small group of devices
/28	255.255.255.240	16	14	A rack or a set of servers
/29	255.255.255.248	8	6	An access point, a tiny segment
/30	255.255.255.252	4	2	A point-to-point link, the classic choice
/31	255.255.255.254	2	2	A point-to-point link per RFC 3021
/32	255.255.255.255	1	1	A single address: firewall rule, host route

Note the last two rows breaking the "minus two" rule. That is not a typo — see below.

Why two addresses are subtracted

Every ordinary subnet reserves two addresses that are never handed to devices:

• The network address — the very first one, all host bits zero. For 192.168.10.0/24 that is 192.168.10.0. It names the subnet itself and appears in routing tables.
• The broadcast address — the very last one, all host bits set: 192.168.10.255. A packet sent there reaches every device in the subnet at once.

Hence the rule: hosts = 2^{(32 − prefix)} − 2. For /24 that is 256 − 2 = 254; for /29, 8 − 2 = 6.

There are exactly two exceptions. A /31 for router-to-router links allocates neither a network nor a broadcast address — both addresses are usable, which is the point of it. And a /32 is not really a subnet at all but one specific address: a host route or a firewall rule.

The classic beginner mistake is "I need 30 devices, so I'll take a /30". The prefix number is not the device count: a /30 gives two hosts, while thirty fit into a /27 — and only just, with no room for growth and no allowance for the gateway. Read the table instead of trusting intuition.

Calculating the network, broadcast and host range

Take 192.168.10.25/27 and work it through — this is the interview question and the server-configuration task in one.

1. Find the subnet step. A /27 is mask 255.255.255.224. Step = 256 − 224 = 32, so subnets start at 0, 32, 64, 96, 128, 160, 192, 224.
2. Locate your subnet. The last octet is 25, which falls in the 0–31 block. Network address: 192.168.10.0.
3. Broadcast is the last address of that block: 192.168.10.31.
4. Host range is everything between: 192.168.10.1 through 192.168.10.30 — thirty addresses.

Checking by command beats checking in your head, and most systems can do it out of the box:

# Linux: show network, broadcast and range
ipcalc 192.168.10.25/27

# No ipcalc installed? The same thing with python3
python3 -c "import ipaddress as i; n=i.ip_network('192.168.10.25/27', strict=False); \
print(n, n.network_address, n.broadcast_address, n.num_addresses)"

# Is an address inside a subnet?
python3 -c "import ipaddress as i; \
print(i.ip_address('192.168.10.25') in i.ip_network('192.168.10.0/27'))"

The same calculation without a terminal is what the IP calculator does: enter an address with its prefix and get the mask, network address, broadcast and host range immediately.

Private ranges and addresses with special meaning

Not every address can be assigned freely. Several ranges are reserved, and they are the ones you meet in configuration files.

Range	What it is	In practice
10.0.0.0/8	Private network	Corporate networks, clouds, Docker environments
172.16.0.0/12	Private network	Frequently the default for Docker and virtualisation
192.168.0.0/16	Private network	Home routers and small offices
127.0.0.0/8	Loopback	127.0.0.1 is the host itself; never leaves the machine
169.254.0.0/16	Link-local self-assignment	Seeing one means DHCP never answered
100.64.0.0/10	Carrier-grade NAT	Your "public" address is in fact shared with other subscribers

That last row explains the common "why does my external IP differ from what the site shows". If your ISP handed you an address from 100.64.0.0/10, you reach the internet under a shared address and inbound connections never arrive. What the outside world actually sees is shown by the IP lookup, and the difference between address families is covered in IPv4 vs IPv6.

Where masks matter to site owners, not just network engineers

Subnetting looks like an administrator's topic, yet /24-style notation shows up in places where nobody thinks about networks.

• Restricting admin access. Allowing only the office means a CIDR rule, not a list of individual addresses. The Apache syntax is in the .htaccess guide, the nginx one in nginx configuration.
• Blocking unwanted traffic. Bots rarely arrive from a single address; blocking them one by one is pointless.
• Allow-lists from payment and mail providers. Their addresses are published as subnets and must be transferred into your config exactly.
• SPF records. The ip4: mechanism accepts a whole subnet: ip4:203.0.113.0/24. How that affects delivery is in SPF records explained.
• Rate limiting. Counting the limit per subnet rather than per address is a working defence against distributed brute force; approaches are in rate limiting strategies.

# The same office across different configurations
# nginx: admit only the office subnet to the admin area
location /admin/ {
    allow 203.0.113.0/24;
    deny  all;
}

# Apache 2.4: the same thing
<RequireAll>
    Require ip 203.0.113.0/24
</RequireAll>

# SPF: authorise the whole subnet to send mail
example.com.  IN  TXT  "v=spf1 ip4:203.0.113.0/24 -all"

A wrong mask in an access rule is more dangerous than it looks. Write /16 instead of /24 and instead of your office you have opened the admin panel to sixty-five thousand addresses, most of them strangers'. Calculate the range before saving the rule and confirm it contains what you meant.

Choosing a mask for the job

The rule is simple: take the nearest fitting subnet with a little headroom, but do not grab an enormous one "just in case" — surplus addresses complicate routing and incident analysis.

• A link between two routers — /30 or /31. More than two addresses are never needed there.
• A small set of servers — /28 (14 hosts) or /29 (6 hosts).
• A department of 20–30 machines — /27 gives 30 hosts with no headroom; if growth is likely, start at /26 with 62.
• An ordinary office network — /24: 254 hosts, familiar addresses, easy diagnostics.
• Separation by purpose — rather than stretching one large subnet, cut several: staff, guests, printers, cameras. Safer, and far clearer in the logs.

And remember the gateway: it occupies an address from the host range too. A /29 with six addresses really leaves five devices.

Masks in IPv6: the same idea, shorter

IPv6 has no dotted-decimal masks at all — only prefixes. The logic is identical: /64 means the first 64 bits are the network. The difference is scale: a typical end-user /64 holds so many addresses that nobody economises, and providers hand out entire /56 or /48 blocks. Counting hosts by hand there is pointless; the protocol comparison is in IPv4 vs IPv6.

What to check it with

• IP calculator — mask, network address, broadcast, host range and address count from a prefix.
• IP lookup — which address the outside world sees, whose ISP it belongs to and which autonomous system it sits in.
• Ping and port check — whether a host inside the chosen range answers.
• Traceroute — which networks the traffic crosses on its way.

Frequently asked questions

What is the subnet mask for 192.168.1.1?

By default in home networks, 255.255.255.0 — a /24. But that is a convention, not a property of the address: the same machine can live in a /25 or a /23. Check the actual mask in the connection properties or with ip addr.

What does 255.255.255.255 mean?

As a mask it is a /32 — exactly one address, used for host routes and single-address firewall rules. As a destination address it means a broadcast within the local segment.

How is /24 different from 255.255.255.0?

It is not: the same mask in two notations. The prefix form is shorter and standard in configuration files and documentation; the decimal form appears in operating-system dialogs.

How many devices fit in a /24?

254. There are 256 addresses, but the first is the network address and the last is the broadcast. One of the rest is almost always the gateway, leaving 253 for devices.

Why can two machines on the same network not see each other?

The classic cause is different masks behind similar-looking addresses. If one has a /24 and the other a /25, they disagree on where the network ends, and traffic goes to the gateway instead of the neighbour. Compare the masks on both machines first.

What is a 169.254.x.x address?

The device never got an address from DHCP and assigned itself a temporary one. There will be no internet on it. Look at the DHCP server, the cable or the Wi-Fi settings — not at the mask.

Subnet mask checklist

• Prefix and dotted-decimal mask match (verified against the table).
• Host count computed as 2^{(32 − prefix)} − 2, with the gateway accounted for.
• Every device in a subnet carries the same mask.
• The chosen range does not overlap subnets already in use.
• Point-to-point links use /30 or /31 rather than a larger subnet.
• Prefixes in access and firewall rules were verified by calculating the range, not by eye.
• Private ranges are not confused with public ones, and no host sits on 169.254.0.0/16.
• Subnets in SPF records and allow-lists were copied without changing the prefix.