Subnetting Math: Why /24 Gives 254 Hosts, How VLSM Works, and What the Slash Actually Means

A /24 subnet gives you 256 addresses — but only 254 of them are usable for hosts, because subnetting reserves the first and last address of every subnet for reasons rooted in the original design of IP networking

The previous articles on this site covered subnetting basics, cloud VPC design, and IPv6 address types. This article addresses subnetting math — specifically the reserved addresses, how to calculate host counts correctly, and the VLSM (Variable Length Subnet Masking) technique for efficiently dividing address space.

Why /24 gives 254 usable hosts, not 256

A /24 subnet has 2^8 = 256 addresses (the last 8 bits of the 32-bit IPv4 address are the "host portion," giving 2^8 possible values).

Two of those 256 addresses are always reserved:

Network address (first address): the address with all host bits set to 0. For 192.168.1.0/24, the network address is 192.168.1.0. This address identifies the subnet itself in routing tables — no host can be assigned this address.

Broadcast address (last address): the address with all host bits set to 1. For 192.168.1.0/24, the broadcast address is 192.168.1.255. Sending a packet to this address delivers it to all hosts on the subnet simultaneously. This address cannot be assigned to a specific host.

The formula for usable hosts: 2^n − 2 (where n is the number of host bits in the subnet mask):

• /24 = 8 host bits: 2^8 − 2 = 254 usable hosts
• /25 = 7 host bits: 2^7 − 2 = 126 usable hosts
• /26 = 6 host bits: 2^6 − 2 = 62 usable hosts
• /27 = 5 host bits: 2^5 − 2 = 30 usable hosts
• /28 = 4 host bits: 2^4 − 2 = 14 usable hosts
• /29 = 3 host bits: 2^3 − 2 = 6 usable hosts
• /30 = 2 host bits: 2^2 − 2 = 2 usable hosts (the smallest practical subnet for point-to-point links)
• /31 = 1 host bit: 2^1 − 2 = 0 (special case — RFC 3021 permits using /31 for point-to-point links without reserving network/broadcast)
• /32 = 0 host bits: a single host address (no network, no broadcast — used for host routes)

VLSM: matching subnet sizes to actual needs

VLSM (Variable Length Subnet Masking) allows dividing an address space into subnets of different sizes — rather than cutting everything into equal-sized blocks.

Example: you have 192.168.1.0/24 (254 usable addresses) and need to provision:

• 1 subnet for 100 hosts (needs at least 102 addresses including network + broadcast → /25 gives 126)
• 2 subnets for 25 hosts each (needs at least 27 each → /27 gives 30)
• 4 subnets for 10 hosts each (needs at least 12 each → /28 gives 14)

VLSM allocation:

1. 192.168.1.0/25 → 126 usable hosts (for the 100-host subnet)

   • Network: 192.168.1.0, Broadcast: 192.168.1.127
   • Remaining: 192.168.1.128/25 (128 addresses)

2. Split 192.168.1.128/25 into /26s:

   • 192.168.1.128/26 → 62 usable hosts
   • 192.168.1.192/26 → 62 usable hosts (remaining)

3. Use one /26 for the first /27 pair, splitting 192.168.1.128/26:

   • 192.168.1.128/27 → 30 usable hosts (subnet 2)
   • 192.168.1.160/27 → 30 usable hosts (subnet 3)

4. Split 192.168.1.192/26 for the four /28s:

   • 192.168.1.192/28 → 14 usable
   • 192.168.1.208/28 → 14 usable
   • 192.168.1.224/28 → 14 usable
   • 192.168.1.240/28 → 14 usable (plus 0 remaining — fully allocated)

Total used: the entire /24, efficiently divided into 7 subnets of appropriate sizes. Without VLSM (all-equal-size subnet requirement), you'd need to use /25s for everything — wasting 26 of the 30 available addresses in each "small" subnet.

Supernetting (route summarization): the reverse operation

Subnetting divides a large block into smaller pieces. Supernetting combines multiple contiguous smaller blocks into a single, larger aggregate for routing purposes.

Example: you have four /26 subnets:

• 192.168.1.0/26
• 192.168.1.64/26
• 192.168.1.128/26
• 192.168.1.192/26

These four /26s, taken together, constitute exactly 192.168.1.0/24 — a router can advertise the single /24 route rather than four separate /26 routes. This reduces the routing table size — important at internet scale where BGP routing tables contain hundreds of thousands of entries.

The condition for summarization: the subnets must be contiguous and aligned — they must collectively constitute exactly a single, larger block. You can summarize the four /26s above into one /24 because they're the four consecutive /26s that make up that /24 — you couldn't summarize 192.168.1.0/26 and 192.168.2.0/26 into a single route (they're not contiguous in the same /24).

CIDR notation: what the slash number actually represents

The /24 in CIDR notation means: the first 24 bits of the 32-bit IPv4 address are the network portion (the part shared by all addresses in this subnet), and the remaining 32 - 24 = 8 bits are the host portion (the part that varies per host).

In binary:

• 192.168.1.0/24 = 11000000.10101000.00000001.00000000 — first 24 bits fixed, last 8 variable
• 192.168.1.0/26 = 11000000.10101000.00000001.00000000 — first 26 bits fixed, last 6 variable

Subnet mask (the dotted-decimal equivalent):

• /24 → 255.255.255.0 (24 ones followed by 8 zeros in binary)
• /26 → 255.255.255.192 (26 ones followed by 6 zeros: 11111111.11111111.11111111.11000000)

Many network engineers work primarily with CIDR notation and convert to subnet masks only when specific equipment requires the dotted-decimal form.

How to use the Subnet Calculator on sadiqbd.com

1. Enter any IP address and prefix length — the calculator returns the network address, broadcast address, usable host range, and host count
2. For planning VLSM allocations: calculate the smallest prefix that fits each requirement (2^n ≥ required hosts + 2), then allocate largest subnets first from your available block
3. For verifying cloud VPC design: check that your planned subnets don't overlap, that each fits within the VPC CIDR, and that the host count matches your expected capacity needs

Frequently Asked Questions

Why are /31 and /32 special cases? /31 technically has 0 usable hosts by the traditional 2^n − 2 formula — but RFC 3021 recognized that point-to-point links (connecting exactly two devices) don't need a network address or broadcast address, and allows /31 for this purpose (giving 2 usable addresses for the two endpoints). /32 is a "host route" — a route to a single specific IP address. Used in routing tables when you need to route to a specific host address that isn't part of a broader subnet (common in firewall rules, loopback addresses, and anycast routing). Neither /31 nor /32 can be used for general host assignments but both have legitimate, specific uses.

Is the Subnet Calculator free? Yes — completely free, no sign-up required.

Try the Subnet Calculator free at sadiqbd.com — calculate network address, host range, and host count for any IPv4 or IPv6 subnet.