Guide
Subnet masks and CIDR explained
A subnet mask splits an IP address into network and host parts. Learn to read 255.255.255.0 and /24, and count addresses per prefix.
On this page
A subnet mask looks like a second IP address, and most people ignore it until something breaks. It answers a simple question every device asks before sending a packet: is the destination on my network, or do I send it to the router?
What a subnet mask does
An IP address has two parts: the network portion, shared by every device on the segment, and the host portion, unique per device. The mask marks where the split happens.
Take 192.168.1.24 with mask 255.255.255.0. Written as bits, the first 24 bits are 1s (network) and the last 8 are 0s (host). So the network is 192.168.1.0 and this device is host 24. Anything else in 192.168.1.x is a neighbour reached directly through the switch; anything else is handed to the default gateway — the router's IP.
CIDR notation
Instead of writing 255.255.255.0, the world writes /24 — the number of leading 1 bits. CIDR (Classless Inter-Domain Routing) also allows blocks that do not sit on old octet boundaries, such as /22 or /26, which is how ISPs carve addresses efficiently.
Two addresses in every block are special: the network address (all host bits zero) and the broadcast address (all host bits one), which is why usable hosts are always two fewer than the raw count. Modern point-to-point links can use /31, and a single host is /32.
Prefix cheat sheet
| CIDR | Mask | Total addresses | Usable hosts | Typical use |
|---|---|---|---|---|
/30 | 255.255.255.252 | 4 | 2 | Point-to-point router links |
/29 | 255.255.255.248 | 8 | 6 | Small DMZ segments |
/28 | 255.255.255.240 | 16 | 14 | Server racks |
/24 | 255.255.255.0 | 256 | 254 | Home and small-office LANs |
/16 | 255.255.0.0 | 65,536 | 65,534 | Large campuses, Docker networks |
/8 | 255.0.0.0 | 16,777,216 | 16,777,214 | Very large private networks |
IPv6 uses the same notation but with an important convention: end-user networks are almost always /64, leaving 64 bits for host addressing, because stateless autoconfiguration and privacy extensions assume it. A typical home connection is delegated a /56 or /48, i.e. 256 or 65,536 separate /64 subnets.
Private and special ranges to recognise
| Range | CIDR | What it is |
|---|---|---|
10.0.0.0 – 10.255.255.255 | 10.0.0.0/8 | Private (RFC 1918) — most common on business and ISP-managed gear |
172.16.0.0 – 172.31.255.255 | 172.16.0.0/12 | Private (RFC 1918) — Docker's default bridge lives here |
192.168.0.0 – 192.168.255.255 | 192.168.0.0/16 | Private (RFC 1918) — home routers |
100.64.0.0 – 100.127.255.255 | 100.64.0.0/10 | Carrier-grade NAT — you share this with strangers |
127.0.0.0 – 127.255.255.255 | 127.0.0.0/8 | Loopback — your own device |
169.254.0.0 – 169.254.255.255 | 169.254.0.0/16 | Link-local — the "APIPA" address Windows shows when DHCP fails |
If your device shows 169.254.x.x, it never got an address from the router. That, not the internet, is why nothing loads — a faster diagnosis than anything a call centre will give you.
Why it matters even if you never subnet anything
- Reading network settings. "Router 192.168.1.1, device 192.168.1.24, mask 255.255.255.0" now tells you the whole neighbourhood at a glance.
- Spotting the private/public split. Any
10.,172.16–31.or192.168.value is local, not internet-facing — see public vs private IP. - Recognising CGNAT at a glance, which explains failed port forwards and shared reputation.
- Setting up a guest network or VLAN without accidentally merging it into the main one.
- Working with cloud and container networks, where CIDR blocks are used for security-group rules and VPN routes.
Bottom line: the mask is a map of where your network ends. Read it and you can tell whether a device will talk directly to a neighbour or send the packet to the router — and you can spot the private, loopback and CGNAT ranges that explain a surprising amount of everyday network behaviour.
Frequently asked questions
What does /24 mean in an IP address?
It is CIDR shorthand for a subnet mask of 255.255.255.0: 24 network bits, 8 host bits, 256 total addresses and 254 usable hosts. Home routers almost always use /24.
How many IP addresses are in a /24?
256 total, of which 254 can be assigned to hosts. The network address and the broadcast address are reserved.
What is the subnet mask of 192.168.1.1?
Whatever the network is configured with — overwhelmingly 255.255.255.0 (/24) on consumer routers, which is why devices get addresses in 192.168.1.2–254.
Keep reading
- What is 127.0.0.1?
- How to fix an IP address conflict
- MAC address vs IP address
- How to tell if someone is using your Wi-Fi
- What is port forwarding?
- Is an IP address personal data?
- What is a DNS server?
- Check your IP address from the command line
- Tor vs VPN
- Why is my IP location wrong?
- Does a VPN slow down your internet?
- Are free VPNs safe?
- Browse all IP guides
- Check my public IP address
Check any other IP address
Investigating a suspicious login, a spam email header or a server log entry? Run any IPv4 or IPv6 address through the same geolocation and proxy checks.