A while back I wrote Subnets Without the Scary Maths, and I stand by every word: for a great many days you really can get by on “slash twenty-four means about 254 devices” and never touch a bit of binary. But there is always a day. Someone asks you to carve one network into four, or whether 192.168.1.130 lives in this subnet or the next one along — and the hand-waving quietly stops working. This is that day’s post: the binary I politely hid from you last time. It is, I promise, just counting in twos.
An IP address is thirty-two switches
Everything clicks the moment you stop seeing 192.168.1.10 as four numbers and start seeing it as what it actually is: 32 on/off switches, arranged in four groups of eight. Each group of eight — an octet — is just a number written in binary, and each of its eight bits is worth a fixed power of two:
| Bit position | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 |
|---|---|---|---|---|---|---|---|---|
| Worth | 128 | 64 | 32 | 16 | 8 | 4 | 2 | 1 |
To read an octet, switch on the bits that are 1 and add up their worth. 11000000 is 128 + 64 = 192. 10101000 is 128 + 32 + 8 = 168. To go the other way, take the number and greedily subtract the biggest power of two that still fits: 168 → yes 128 (40 left) → no 64 → yes 32 (8 left) → no 16 → yes 8 (0 left) → 10101000. That is the entire trick. Eight switches, powers of two, add them up. Do it a dozen times and it turns into muscle memory.
Tidbit: why 255 is the ceiling
All eight bits on — 11111111 — is 128+64+32+16+8+4+2+1 = 255. That is why every octet tops out at 255, and why a full IPv4 address runs 0–255 in each of its four parts. There is no 256; you have simply run out of switches in that octet and rolled over into the next.
The mask is a line in the sand
A subnet is just an address with a line drawn through it: everything to the left of the line is the network (fixed, shared by everyone in the subnet), everything to the right is the host (free to change, one per device). The mask is what draws that line. Write it in binary and it is simply a run of ones followed by a run of zeros — ones over the network part, zeros over the host part:
/24 = 11111111.11111111.11111111.00000000 = 255.255.255.0
/26 = 11111111.11111111.11111111.11000000 = 255.255.255.192The number after the slash — the prefix — is nothing more mysterious than how many ones, counted from the left. /24 is 24 ones, which lands exactly on an octet boundary and gives the friendly 255.255.255.0. /26 is 26 ones: two extra bits borrowed into the last octet, and that is precisely where subnetting stops being tidy and starts needing a post like this one.
Counting the hosts (and the famous minus two)
Once you know the prefix, the size of the subnet falls straight out. The host part is whatever bits the mask left as zero — that’s 32 minus the prefix — and each of those bits doubles the count. Total addresses = 2 to the power of (32 − prefix). A /24 leaves 8 host bits, so 2^8 = 256 addresses; a /26 leaves 6, so 2^6 = 64. Straightforward — except you never get to use all of them.
The minus two
Two addresses in every ordinary subnet are spoken for and can never be assigned to a device: the network address (all host bits 0 — the subnet’s own name) and the broadcast address (all host bits 1 — “everyone on this subnet at once”). So usable hosts = total − 2. A /24 is 256 − 2 = 254; a /26 is 64 − 2 = 62. Forgetting the minus two is the single most common subnetting slip there is, and it is always wrong by exactly two.
| Prefix | Mask (last octet) | Block size | Usable hosts |
|---|---|---|---|
/24 | 255.255.255.0 | 256 | 254 |
/25 | 255.255.255.128 | 128 | 126 |
/26 | 255.255.255.192 | 64 | 62 |
/27 | 255.255.255.224 | 32 | 30 |
/28 | 255.255.255.240 | 16 | 14 |
/29 | 255.255.255.248 | 8 | 6 |
/30 | 255.255.255.252 | 4 | 2 |
The magic number
Here is the shortcut every field engineer eventually internalises — the one that answers subnet questions in your head, on the back of a ticket, without drawing a single binary digit. It has a name, the magic number (or block size), and it is one subtraction:
256 − the mask’s interesting octet = the block size.
For a /26 the mask is 255.255.255.192, so 256 − 192 = 64. That 64 is both the size of each subnet and the spacing between them — which means subnets can only ever begin at multiples of 64 in that octet: .0, .64, .128, .192. Nothing starts at .30 or .100; the boundaries are locked to the block size.
Now the party trick. “Which subnet is 192.168.1.130/26 in?” Block size 64, so the boundaries are 0, 64, 128, 192. 130 falls between 128 and 192, so its network is 192.168.1.128, its broadcast is one below the next boundary at 192.168.1.191, and the usable range is .129 through .190. No binary, no calculator — one subtraction and a little counting.
Tip
The “interesting octet” is just the last one in the mask that isn’t 255 or 0. For a /26 it’s the fourth octet; for a /18 (255.255.192.0) it’s the third — 256 − 192 = 64 again, so those subnets step 64 apart in the third octet: x.x.0.0, x.x.64.0, x.x.128.0, and so on. The magic number works in whichever octet the mask happens to be busy.
One network, four subnets — worked by hand
Let’s put the whole lot together. Say you’ve been handed 192.168.1.0/24 and asked to split it into four equal subnets — one each for staff, guests, phones and cameras. Four subnets means borrowing two host bits (2 bits = 4 combinations), which takes you from /24 to /26. Block size is 256 − 192 = 64, so the four subnets step 64 apart and everything else simply falls into the columns:
| Subnet | Network | First host | Last host | Broadcast |
|---|---|---|---|---|
| Staff | 192.168.1.0 | .1 | .62 | 192.168.1.63 |
| Guests | 192.168.1.64 | .65 | .126 | 192.168.1.127 |
| Phones | 192.168.1.128 | .129 | .190 | 192.168.1.191 |
| Cameras | 192.168.1.192 | .193 | .254 | 192.168.1.255 |
Read it down the columns and it is almost mechanical: each network sits on a multiple of 64, each broadcast is one below the next network, and the usable hosts are everything in between. Sixty-two devices per subnet, four subnets, no overlap, no guesswork. That is subnetting — the thing that sounded like arcane maths turns out to be repeated addition of the block size.
The two-address links: /30 and /31
One special case worth knowing, because you’ll meet it constantly on the wires between routers. A point-to-point link only ever has two ends, so handing it a whole /24 would be absurd. The traditional answer is a /30: block size 4, two usable addresses (minus two, remember) — exactly enough for the two router interfaces. The modern refinement is the /31, a deliberate special case that skips the minus-two rule and gives you both addresses for the two ends, on the logic that a link with only two possible devices has no need for a broadcast address at all. If a /31 on a router link ever makes you flinch, that’s why it’s allowed.
The one-sentence version
An IP address is 32 bits; the prefix says how many left-hand bits are the fixed network and the rest are hosts; a subnet holds 2^(32−prefix) addresses, minus two for the network and broadcast; and the magic number — 256 minus the busy mask octet — hands you the block size, the boundaries, and the answer to “which subnet is this?” without a lick of binary. The Subnet calculator on the Tools page will check any of it for you — but now you can also do it on the back of a ticket.
That’s genuinely the whole of it. The networking series has now carried us from a single web request all the way down to counting bits in a mask; next I think we swing back to Linux and teach the machine to keep things running on its own — services and systemd. Bring a coffee; there are units involved.