What a prefix length actually does
An IPv4 address is 32 bits. The prefix length says how many of those bits, counted from the left, identify the network; everything after them identifies a host inside it. /24 means 24 network bits and 8 host bits, which is why a /24 holds 2^8 = 256 addresses.
The subnet mask is the same information written as an address: 24 ones followed by 8 zeros is 255.255.255.0. The wildcard mask is its bitwise inverse, 0.0.0.255, and it is what Cisco ACLs and OSPF network statements expect. Three notations, one number.
The network address is the address with every host bit set to 0, and the broadcast address is the same with every host bit set to 1. That is why they sit at the two ends of the block and why neither can be given to a host.
Why usable hosts is two fewer
A /24 has 256 addresses but 254 usable ones, because the first is the network address and the last is the broadcast address. Neither can be assigned to an interface.
The same subtraction applies at every size from /1 to /30. A /26 has 64 addresses and 62 usable; a /22 has 1,024 and 1,022.
A common misreading: the .0 and .255 addresses are not reserved in general. In a /23 such as 10.0.0.0/23, 10.0.0.255 is an ordinary host address. It is the position in the block that matters, not the last octet.
/31 and /32: the two exceptions
RFC 3021 defines /31 for point-to-point links. On a link with exactly two ends there is no need for a broadcast address, so both addresses are usable. A /31 therefore has 2 addresses and 2 usable hosts, not zero.
Calculators that blindly compute total minus two report 0 usable hosts for a /31 and -1 for a /32. That is the quickest way to spot an outdated calculator.
A /32 is a host route: one address, used for loopbacks, single-host firewall rules and routing entries. The IPv6 equivalents are /127 for links and /128 for host routes.
Private, CGNAT and the ranges you must not invent
RFC 1918 reserves three ranges for private use: 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. Note the middle one: it is 172.16 through 172.31, not all of 172.x.
100.64.0.0/10 is carrier-grade NAT space. Your ISP may place it between your router and the internet. Do not use it for your own LAN.
169.254.0.0/16 is link-local. A device assigns itself an address there when DHCP fails, so seeing one is usually a diagnosis, not a plan.
- 192.0.2.0/24, 198.51.100.0/24 and 203.0.113.0/24 are reserved for documentation.
- 198.18.0.0/15 is for benchmarking, and 240.0.0.0/4 is reserved public space.
Splitting a block without wasting it
Splitting is just moving the prefix boundary right. Every bit you add doubles the number of subnets and halves their size: a /24 split at /26 gives 4 subnets of 62 usable hosts.
Size each subnet from the hosts it must hold, then round up to the next power of two and subtract two. A segment for 50 devices needs a /26, not a /27.
When segments differ in size, do not cut everything to the same prefix. Allocate the biggest blocks first so the boundaries stay aligned.
Leave gaps on purpose. A block that is exactly full today has no room for the next VLAN.
IPv6 subnetting: why everything is a /64
In IPv6 you stop counting hosts. A /64 holds 18,446,744,073,709,551,616 addresses, and you assign one to a LAN whether it has three devices or three thousand. There is no broadcast address and no reason to subtract two.
The /64 boundary is not a convention you can ignore. SLAAC builds an address from a 64-bit prefix and a 64-bit interface identifier, so a prefix longer than /64 breaks regular LAN autoconfiguration.
The real planning happens above the subnet. A /48 gives a site 65,536 /64 subnets; a /56 gives a home 256 of them.
2001:db8::/32 is for documentation, fc00::/7 is unique-local space, and fe80::/10 is link-local on every IPv6 interface.
Wildcard masks, CIDR lists and reverse DNS
A wildcard mask is the bitwise inverse of a subnet mask: /26 is 255.255.255.192 as a mask and 0.0.0.63 as a wildcard. Cisco ACLs and OSPF network statements take the wildcard form.
Firewalls and cloud security groups usually want CIDR blocks, not ranges. Converting a range to CIDR walks greedily from the start address through the largest aligned blocks that still fit.
Reverse DNS follows byte boundaries in IPv4 and nibble boundaries in IPv6. A /26 has no reverse zone of its own, which is why blocks smaller than /24 need RFC 2317 delegation.