What Is a Subnet? Formula, CIDR Chart & Calculation Examples [2026]

1. The Fundamentals: Anatomy of an IPv4 Address and Subnet Mask

Every Internet Protocol version 4 (IPv4) address is a 32-bit numerical label assigned to an interface on a computer network. To make these binary values readable by humans, IPv4 addresses are formatted in dotted-decimal notation consisting of four 8-bit octets separated by periods (for example, 192.168.1.50).

Crucially, an IP address by itself does not specify which portion identifies the overarching network and which portion identifies the specific device interface on that network. To resolve this ambiguity, TCP/IP networking requires a companion value known as a Subnet Mask.

A subnet mask is also 32 bits in length. It uses contiguous binary 1s from left to right to designate the network identifier (prefix), while the remaining binary 0s designate individual host endpoints. In a standard classful /24 network with a subnet mask of 255.255.255.0, the first 24 bits belong to the network prefix and the final 8 bits are reserved for host addressing.

IP Address:    192.168.1.50   -> 11000000.10101000.00000001.00110010
Subnet Mask:   255.255.255.0  -> 11111111.11111111.11111111.00000000
-------------------------------------------------------------------------
Bitwise AND:
Network ID:    192.168.1.0    -> 11000000.10101000.00000001.00000000
Host Identifier:  .50         -> 00000000.00000000.00000000.00110010

2. How Routers Use Bitwise AND Logic to Direct Packets

Whenever an operating system or router prepares to transmit an IP packet, it must determine whether the target IP address resides on the local area network (LAN) or whether the packet must be forwarded upstream to the default gateway router.

To accomplish this, the host performs a bitwise logical AND operation between its own IP address and its subnet mask to derive its local Network ID. Next, it performs the identical bitwise AND operation between the target destination IP address and its own subnet mask.

If the resulting Network IDs match exactly, the sender knows the destination is on the local wire and transmits an ARP (Address Resolution Protocol) request directly to discover the recipient's MAC address. If the Network IDs differ, the sender forwards the packet to the Default Gateway (router), which inspects its routing table to bridge across subnets.

3. CIDR Notation vs. Legacy Classful Addressing

Prior to 1993, the Internet operated under rigid 'Classful' addressing schemes (Class A, Class B, and Class C). This rigid structure led to massive IP address waste: an organization needing 500 addresses had to receive a Class B block containing 65,536 addresses, stranding over 65,000 usable IPs.

The IETF solved this scaling bottleneck through RFC 4632 by establishing Classless Inter-Domain Routing (CIDR). In CIDR notation, a forward slash followed by an integer (e.g., /24, /28, /16) denotes the precise count of leading binary 1s in the network prefix, allowing network architects to size subnets to exact capacity specifications.

4. The 2^(32 - Prefix) - 2 Usable Host Calculation Rule

In every standard IPv4 subnet, exactly two addresses within the block are strictly reserved and cannot be assigned to any individual host, server, or virtual machine interface:

1. Network Identifier Address (First IP): When all host bits are set to binary 0, this address serves as the identity of the entire subnet within routing tables.

2. Broadcast Address (Final IP): When all host bits are set to binary 1, this address broadcasts packets to every active device listening on that local physical or virtual wire.

Consequently, calculating usable host capacity follows the mathematical formula: Usable Hosts = 2^(32 - Prefix) - 2. For instance, in a /26 subnet: 32 - 26 = 6 host bits. 2^6 = 64 total addresses. Subtracting the network and broadcast addresses yields 62 usable host endpoints.

5. Practical Subnet Inspection Commands for Sysadmins

To audit current network interface configurations, subnet masks, and default gateways on client machines and production servers, utilize the standard operating system diagnostic commands below:

# Linux: Inspect IP address, CIDR prefix, and interface status
ip -4 addr show

# Linux / Unix: Display active kernel routing table
ip route show

# macOS: Display interface addressing and netmask in hex
ifconfig en0 | grep "inet "

# Windows (Command Prompt / PowerShell): Full IP configuration
ipconfig /all

# Test subnet gateway reachability via ARP table
arp -a

6. Security Benefits: Why Network Segmentation Is Essential

Limiting Broadcast Domains: In flat, unsegmented networks, broadcast storms generated by ARP floods, DHCP discoveries, and rogue multicast traffic degrade overall network throughput. Dividing networks into subnets confines broadcasts to local boundaries.

Zero Trust & Firewall Zoning: Subnetting enables network security teams to construct defensive rings. By isolating public web servers into a Demilitarized Zone (DMZ), database clusters into private subnets, and employee workstations into corporate VLANs, Access Control Lists (ACLs) can filter and inspect all lateral traffic.

Incident Containment: If a workstation in the guest Wi-Fi subnet is compromised by malware, granular firewall rules between subnets prevent horizontal propagation to core database repositories or internal management interfaces.