An address written as 10.0.4.0/22 describes a range, not a single machine. The part before the slash is an address. The number after it says how much of that address names the network and how much is left over for the hosts inside it. Once you can read that number, the rest of subnetting is arithmetic.
What the slash number means
An IPv4 address is 32 bits, written as four numbers from 0 to 255. Each number is one byte, or eight bits. The number after the slash is the prefix length: how many of the 32 bits, counted from the left, are fixed for every address in the network. The remaining bits are free to vary, and each combination is one address.
So a /24 fixes the first 24 bits (the first three numbers) and leaves 8 bits, which gives 28 = 256 addresses. A /22 leaves 10 bits, which gives 210 = 1,024. Every step down in the prefix doubles the size of the network, and every step up halves it. This way of writing networks is called CIDR notation.
The mask is the same thing in another notation
A subnet mask is the prefix written as an address: a 1 for every network bit, a 0 for every host bit. A /24 is 24 ones followed by 8 zeros, which reads as 255.255.255.0. A /22 is 22 ones and 10 zeros:
11111111.11111111.11111100.00000000
255. 255. 252. 0Because the ones are always on the left, each number in a mask can only be one of nine values: 0, 128, 192, 224, 240, 248, 252, 254 or 255.
Working through 10.0.4.0/22
You can do this without writing out any binary. The method is to find the one number in the mask that is neither 255 nor 0 and work only there.
- Mask. 22 bits is two full bytes (16 bits) plus 6 bits of the third. Six ones followed by two zeros is 252, so the mask is
255.255.252.0. - Block size. Subtract that number from 256: 256 − 252 = 4. Networks of this size start at multiples of 4 in the third position: 0, 4, 8, 12 and so on.
- Network address. Round the third number down to a multiple of 4 and set everything after it to 0. The third number is 4, already a multiple, so the network address is
10.0.4.0. - Broadcast address. The next network starts at
10.0.8.0. One address before that is10.0.7.255, the last address in this network. - Usable host range. Everything between the two:
10.0.4.1through10.0.7.254. - Host count. 32 − 22 = 10 host bits, 210 = 1,024 addresses. Take away the network and broadcast addresses and 1,022 are left for hosts.
The first and last addresses are set aside because they have jobs. The network address, with all host bits 0, names the network itself. The broadcast address, with all host bits 1, reaches every host on it.
The same steps work when the address you start with is not the network address. Take 10.0.6.77/22: the third number, 6, rounds down to 4, so this host lives in 10.0.4.0/22. Note that 10.0.5.0 and 10.0.6.255 are ordinary host addresses here, even though they look like a network and a broadcast address to an eye used to /24s.
To check your work, enter the network in the subnet calculator. It accepts an address with a prefix or with a mask (10.0.4.0/22, 10.0.4.0/255.255.252.0, or 10.0.4.0 255.255.252.0) and shows the network and broadcast addresses, the first and last usable addresses, the mask and wildcard mask, and the total and usable counts, with a binary view that highlights the network bits. The calculation runs in your browser.
Common prefix lengths
Prefix Mask Addresses Usable hosts /8 255.0.0.0 16,777,216 16,777,214 /16 255.255.0.0 65,536 65,534 /20 255.255.240.0 4,096 4,094 /22 255.255.252.0 1,024 1,022 /23 255.255.254.0 512 510 /24 255.255.255.0 256 254 /25 255.255.255.128 128 126 /26 255.255.255.192 64 62 /27 255.255.255.224 32 30 /28 255.255.255.240 16 14 /29 255.255.255.248 8 6 /30 255.255.255.252 4 2 /32 255.255.255.255 1 1
A /32 is a single address, the form you see in firewall rules and routing tables. A /30 has long been used for a link between two routers, since it holds exactly two hosts. A /31 has only two addresses and no room for a separate network and broadcast address; on point-to-point links both addresses are used for the two ends, and the calculator reports it that way.
Splitting a /24 into four /26s
Subnetting means borrowing host bits to make more, smaller networks. Each borrowed bit doubles the number of networks and halves their size. Going from /24 to /26 borrows two bits: four networks of 64 addresses each. The mask becomes 255.255.255.192, and 256 − 192 = 64 gives the block size, this time in the last position.
For 192.168.1.0/24 the four subnets are:
Subnet Usable hosts Broadcast 192.168.1.0/26 192.168.1.1 - 192.168.1.62 192.168.1.63 192.168.1.64/26 192.168.1.65 - 192.168.1.126 192.168.1.127 192.168.1.128/26 192.168.1.129 - 192.168.1.190 192.168.1.191 192.168.1.192/26 192.168.1.193 - 192.168.1.254 192.168.1.255
Each subnet has 62 usable addresses, 248 in total, against 254 in the undivided /24. The difference is the three extra pairs of network and broadcast addresses. That overhead is the price of separating traffic, for example keeping guest wi-fi, printers and servers apart.
The pieces do not have to be the same size. You could split the same /24 into one /25 (126 hosts) and two /26s (62 each), as long as every piece starts on a multiple of its own block size and none overlap.
The private ranges
Three blocks are reserved for private networks. Anyone may use them internally, and they are not routed on the public internet.
10.0.0.0/8: 10.0.0.0 through 10.255.255.255.172.16.0.0/12: 172.16.0.0 through 172.31.255.255.192.168.0.0/16: 192.168.0.0 through 192.168.255.255.
The middle one catches people out. A /12 fixes only the first four bits of the second number, so the block size there is 16 and the range runs from 172.16 to 172.31. An address such as 172.32.0.1 is public.
Devices on these ranges reach the internet through a router that translates their addresses to a public one, which is why the address your laptop shows in its settings is not the one websites see. The guide on what your IP address reveals covers the public side, and the network info page shows the public address your connection is using now.
How IPv6 prefixes differ
IPv6 uses the same slash notation with 128-bit addresses, so the prefix can run from 0 to 128. The idea is identical and the habits are different.
- There are no dotted masks. IPv6 networks are always written with a prefix length, such as
2001:db8::/32. - There is no broadcast address. IPv6 uses multicast for that job, so you don't subtract two when counting hosts.
- A subnet is normally a /64. Half the address names the network and half names the device. Automatic address configuration expects that split, so you plan how many /64 networks you need, not how many hosts fit in each.
- Scarcity is not the constraint. A single /64 holds 264 addresses, far more than any network will use. Providers hand customers a shorter prefix, commonly a /56 or a /48, to be divided into many /64s.
The subnet calculator accepts IPv6 networks in CIDR form and reports the network address, the expanded form, the address type and the total number of addresses. It does not list a host range, because at that size a range isn't useful.