Start with "why is it 254, not 256"
People new to networking often get stuck on this: in a /24 subnet, why do we always say "254 usable hosts" instead of 256?
The answer is in binary. An IPv4 address is 32 bits; /24 fixes the first 24 bits as the network number, leaving 8 bits for the host number. Eight bits represent 0–255 (256 combinations), but two are reserved:
all-zero host bits → network address (identifies the whole subnet)
all-one host bits → broadcast address (sent to every host in the subnet)
Removing these 2 gives 256 − 2 = 254 usable hosts. The rule 2^(32−prefix) − 2 applies at any prefix and is the cornerstone of subnet math.
Two notations: mask vs prefix
| CIDR | Mask | Network bits | Usable hosts |
|---|---|---|---|
| /30 | 255.255.255.252 | 30 | 2 |
| /29 | 255.255.255.248 | 29 | 6 |
| /28 | 255.255.255.240 | 28 | 14 |
| /24 | 255.255.255.0 | 24 | 254 |
| /23 | 255.255.254.0 | 23 | 510 |
| /16 | 255.255.0.0 | 16 | 65,534 |
| /8 | 255.0.0.0 | 8 | 16,777,214 |
See /16 and you immediately know 65,534 usable; see /30 and you know it's a point-to-point link. Convert a mask to binary and count the 1s to get the prefix.
Three calculations you must master
1. Network address (AND)
IP 11000000.10101000.00000101.00100101 (192.168.5.37)
mask /26 11111111.11111111.11111111.11000000 (255.255.255.192)
──────────────────────────────────────────────
AND 11000000.10101000.00000101.00000000 → 192.168.5.0
Clearing the host bits yields the network address 192.168.5.0.
2. Broadcast address (network OR all-one host bits)
In the same subnet, set all host bits to 1:
192.168.5.0 + (63) → 192.168.5.63
The key at a non-byte boundary is "stride = 256 − last decimal octet of the mask". Mask 255.255.255.192 → stride 64 → the subnet spans 192.168.5.0–.63, with usable hosts .1–.62.
3. Usable host count
2^(32−prefix) − 2: /24 → 254; /26 → 62; /30 → 2.
From an IP to the valid host range
For 192.168.5.37/26:
network 192.168.5.0
first usable 192.168.5.1
last usable 192.168.5.62
broadcast 192.168.5.63
usable hosts 62
These lookups are quick by hand and easy to double-check with a subnet calculator—especially for non-octet boundary masks where bit juggling gets tedious.
Advice for cloud architecture
- Start a VPC with /16: leave room for multiple environments (dev/staging/prod) and subnets;
- /24 per environment: 254 hosts is plenty to start, easy to remember and manage;
- /30 for point-to-point (VPN/links): wastes only 2 addresses and barely occupies a range;
- Watch for reserved addresses: cloud vendors reserve the first few and last few of each subnet (gateway, DNS, NAT, spare)—account for them per their docs;
- Avoid /28 or smaller: they exhaust quickly and are hard to expand.
A mantra to remember
Network = IP AND mask; broadcast = network OR all-one host bits; usable = 2^(host bits) − 2.
Take a public or private IP, compute network/broadcast/usable range by hand, then confirm it with an online subnet calculator. Drill these three until they're second nature and the toughest part of network troubleshooting and cloud planning is done.