Subnet Mask Beginner Guide (CIDR /24, /23 & /16)
Every IPv4 address on a network is paired with a 32-bit subnet mask that tells routers and endpoints where the shared network prefix ends and individual host addresses begin. Mastering CIDR shorthand—like /24 (255.255.255.0), /23 (255.255.254.0), and /30 point-to-point links—lets you scale growing LANs without creating routing blackholes.
- A Subnet Mask uses consecutive binary
1bits to mark the Network portion and0bits for Host addresses. - Standard home/small office
/24(255.255.255.0) networks provide 254 usable host IPs (.1to.254). - Changing a crowded
/24to a/23(255.255.254.0) doubles capacity to 510 usable hosts without adding a router hop. - Always build local networks strictly inside RFC 1918 private blocks (
10.0.0.0/8,172.16.0.0/12, or192.168.0.0/16).
How IPv4 Octets and Binary Bitmasking Work
An IPv4 address is a 32-bit binary number written as four 8-bit decimal octets separated by dots (each octet ranging from 0 to 255). When your workstation at 192.168.1.50 wants to send a packet to 192.168.1.200, how does its operating system decide whether to ARP for that destination directly over the local Ethernet switch (Layer 2) or forward the packet to the Default Gateway router (Layer 3)?
It performs a bitwise AND operation using its Subnet Mask. In a standard 255.255.255.0 mask, the first three octets are all binary ones (11111111.11111111.11111111.00000000), locking the first 24 bits (192.168.1) as the Network ID and leaving the last 8 bits for Host IDs. Because both .50 and .200 share the exact same 192.168.1.0 Network ID after masking, your PC transmits the frame directly across the local switch without touching the router.
CIDR Notation Explained: /24 vs. /23 vs. /16 & the 2^h - 2 Formula
Instead of typing out four decimal octets like 255.255.255.0, modern networking uses CIDR (Classless Inter-Domain Routing) slash notation, which simply counts the number of leading 1 bits in the subnet mask. To calculate how many devices fit inside any CIDR subnet, subtract the CIDR prefix from 32 to find the host bits ($h = 32 - \text{CIDR}$), then apply the usable host formula $2^h - 2$:
- Why subtract 2? Every IPv4 subnet reserves the very first address (all host bits
0, e.g.,192.168.1.0) as the Network Identifier and the very last address (all host bits1, e.g.,192.168.1.255) as the Layer 3 Directed Broadcast Address. /24(8 host bits): $2^8 - 2 = 256 - 2 =$ 254 usable hosts (.1to.254)./23(9 host bits,255.255.254.0): $2^9 - 2 = 512 - 2 =$ 510 usable hosts (spanning192.168.0.1through192.168.1.254in a single subnet).
RFC 1918 Private IP Address Ranges & Avoiding Squatting
When designing LANs or VLANs, you cannot invent arbitrary IP ranges like 20.0.0.0/24 or 192.169.1.0/24—those are public routable IP blocks owned by Microsoft and external ISPs, and using them internally will blackhole your ability to reach legitimate public servers hosted on those addresses. The IETF reserved three specific RFC 1918 Private IPv4 Ranges exclusively for internal networks behind NAT:
10.0.0.0/8(10.0.0.0–10.255.255.255): Mask255.0.0.0(16.7 million IPs). Ideal for structured multi-VLAN numbering like10... .0/24 172.16.0.0/12(172.16.0.0–172.31.255.255): Mask255.240.0.0(1.04 million IPs; note that172.32.x.xis public!). Frequently used by Docker bridges and WireGuard/IPsec VPN pools.192.168.0.0/16(192.168.0.0–192.168.255.255): Mask255.255.0.0(65,536 IPs across 256/24subnets). Standard for home and SOHO routers.
Your router's WAN interface translates these private RFC 1918 source addresses into your single public ISP IPv4 address using Port Address Translation (PAT/NAT masquerading).
Expanding a Full /24 Subnet: Supernetting (/23) vs. Adding VLANs
When an office or smart home outgrows the 254-address ceiling of 192.168.1.0/24, admins often consider changing the subnet mask to /16 (255.255.0.0, 65,534 hosts). While a /16 works on paper, placing thousands of IPs in a single flat Layer 2 broadcast domain floods every WiFi radio with continuous ARP, NetBIOS, and mDNS broadcast chatter.
If you only need 300–450 addresses on one network, widen the mask by a single bit to /23 (255.255.254.0) on an even-numbered boundary (192.168.0.0/23), remembering to update the mask on any hardcoded static IP devices so they can communicate across both the .0.x and .1.x halves. Better yet, keep each subnet at /24 and segment cameras, IoT devices, and guests onto separate 802.1Q VLANs (192.168.10.0/24, 192.168.20.0/24, 192.168.30.0/24).
Each /24 VLAN gets its own dedicated DHCP scope and broadcast boundary, keeping ARP tables lean and isolating high-chatter IoT multicast traffic from employee workstations.
Common IPv4 CIDR Prefixes, Subnet Masks & Usable Host Counts
| CIDR Prefix | Dotted Decimal Mask | Total IPs (Usable Hosts) | Primary Networking Use Case |
|---|---|---|---|
| /32 | 255.255.255.255 | 1 (1 Single Host) | Router loopback IP & single-host firewall rules |
| /30 | 255.255.255.252 | 4 (2 Usable Hosts) | Point-to-point router WAN links & VPN tunnels |
| /26 | 255.255.255.192 | 64 (62 Usable Hosts) | Small isolated server, DMZ, or management VLAN |
| /24 | 255.255.255.0 | 256 (254 Usable Hosts) | Standard home LAN and office department VLAN |
| /23 | 255.255.254.0 | 512 (510 Usable Hosts) | Medium office LAN or high-density conference WiFi |
| /16 | 255.255.0.0 | 65,536 (65,534 Usable) | Campus summary route (avoid as a single flat VLAN) |
Subnet Design & Verification Checklist
- Confirm all internal LAN and VLAN subnets fall strictly within RFC 1918 private blocks (10/8, 172.16/12, or 192.168/16).
- Avoid using 192.168.0.0/24 or 192.168.1.0/24 on office networks so remote workers' home routers do not collide over VPN.
- Align /23 subnets on even third-octet boundaries (e.g., 192.168.2.0/23 covers .2.1 through .3.254).
- Update the subnet mask on all hardcoded static IP devices (switches, printers, NAS) whenever resizing a subnet.
- Prefer creating multiple /24 VLANs over a single giant /16 subnet to contain Layer 2 ARP and multicast broadcast traffic.
- Never assign the first (Network ID) or last (Broadcast) IP of a subnet to any host interface.
Frequently Asked Questions
Why can't I use 192.168.1.255 as a valid IP address on a /23 (255.255.254.0) subnet?
Actually, on an even-aligned /23 subnet like 192.168.0.0/23 (which spans 192.168.0.0 to 192.168.1.255), both 192.168.0.255 and 192.168.1.0 ARE completely valid host IP addresses! Only the very first address (192.168.0.0) and the very last address (192.168.1.255) are reserved as Network and Broadcast addresses.
Why should I avoid 192.168.1.0/24 when setting up a small office network?
When employees work from home or coffee shops, their local WiFi almost always uses 192.168.1.0/24 or 192.168.0.0/24. If your office LAN also uses 192.168.1.0/24, split-tunnel WireGuard or OpenVPN clients will experience routing collisions and fail to reach office servers; use a unique subnet like 10.25.10.0/24 instead.
What is the 100.64.0.0/10 subnet mask range used for?
The 100.64.0.0/10 block (100.64.0.0 to 100.127.255.255, mask 255.192.0.0) is reserved by RFC 6598 for Carrier-Grade NAT (CGNAT) and is also used by Tailscale overlay networks. Do not manually assign 100.64.x.x to your local physical LAN.
Related Wired LAN Setup & Engineering Guides
- Small Business Network Setup Checklist — Build a reliable small business network with our checklist covering Dual-WAN failover, 4-VLAN segmentation, PoE budgets, UPS sizing, and WPA3 WiFi security.
- How to Fix Double NAT on Home and Office Networks — Diagnose and fix Double NAT from chained ISP modem-routers and mesh WiFi systems using Bridge Mode, IP Passthrough, or AP Mode, vs ISP CGNAT (100.64.x.x).
- IPv6 Router Settings Explained — Configure IPv6 router settings for Comcast Xfinity, AT&T Fiber, and Verizon Fios. Set up Native DHCPv6-PD, SLAAC, /56 or /60 prefix delegation, and firewalls.
- MikroTik Basic Setup for Beginners (RouterOS v7) — Configure MikroTik RouterOS v7 routers from scratch using WinBox or WebFig at 192.168.88.1, verify defconf firewall rules, enable FastTrack, and secure admin.