← Blog · May 20, 2026 · networking, subnet
Subnet Masks Explained: What a /24 Actually Means
Open any networking guide and you'll find a sentence like "a /24 has 256 IPs." That's the kind of half-truth that gets you into trouble when you try to put 254 real machines into a /24 and then realize the gateway has to go somewhere too. Let's do this properly.
The slash is a bit count
An IPv4 address is 32 bits — four octets of 8 bits each. The slash in192.168.1.0/24 says: the first 24 bits identify the network, the remaining 8 bits identify the host. A /24 leaves 8 host bits, so 28 = 256 total addresses.
The same idea written three different ways:
- CIDR:
192.168.1.0/24 - Subnet mask:
255.255.255.0 - Binary mask:
11111111.11111111.11111111.00000000
The 1s mark network bits, the 0s mark host bits. That's all a mask is.
Why 256 ≠ 254
Of those 256 addresses in a /24, two are reserved and cannot be assigned to a host:
- Network address — all host bits 0. For
192.168.1.0/24, that's192.168.1.0. - Broadcast address — all host bits 1. For
192.168.1.0/24, that's192.168.1.255.
That leaves 254 usable host addresses (192.168.1.1 through 192.168.1.254). And in any LAN, one of those 254 is typically the default gateway, so plan capacity at 253.
Wildcards: the same mask, inverted
Access lists in routers (Cisco IOS, especially) use a wildcard mask — the bitwise NOT of the subnet mask. The wildcard for 255.255.255.0 is0.0.0.255. A 0 in the wildcard means "this bit must match," a 1 means "don't care." Same information, opposite encoding.
What changes when you change the prefix
Every step in the prefix doubles or halves the size:
/24— 256 total, 254 usable/25— 128 total, 126 usable/26— 64 total, 62 usable/27— 32 total, 30 usable/28— 16 total, 14 usable/29— 8 total, 6 usable (typical for point-to-point links)/30— 4 total, 2 usable (classic point-to-point)/31— 2 total, 2 usable (point-to-point per RFC 3021)/32— 1 address (host route)
The full table for every prefix from /0 to /32 is in the netmask cheatsheet.
The /31 surprise
RFC 3021 (2000) carved out an exception for point-to-point links: a /31 gives you 2 total addresses and both are usable. The two reserved-address rule was originally for shared media (Ethernet) where you needed a broadcast. On a point-to-point link there's no broadcast destination — just "the other end." So both addresses are fine to assign. Most modern routers support it. Old gear chokes.
How to do subnet math without thinking
Three shortcuts that cover 90% of real-world subnetting:
- Subtract the prefix from 32 to get host bits.
32 − 26 = 6host bits → 26 = 64 addresses, 62 usable. - To find which /24 an address lives in, set the last octet to 0.
10.7.42.55→ network10.7.42.0/24. - To find the broadcast of any subnet, OR the network address with the wildcard.
10.7.42.0OR0.0.0.255=10.7.42.255.
Or just paste a CIDR into the subnet calculator and read off network, broadcast, mask, wildcard, and usable range.