What the slash actually does
An IPv4 address is 32 bits. The prefix length says how many of those bits identify the network, leaving the rest to identify a host inside it. /24 means 24 network bits and 8 host bits, which written as a dotted mask is 255.255.255.0. The network address is the address ANDed with the mask; the broadcast is the same value with every host bit set to one. The wildcard mask is the mask inverted, and it exists because Cisco ACLs and OSPF network statements take it that way round.
Masks must be contiguous — a run of ones followed by a run of zeros, nothing else. 255.255.0.255 is a valid-looking dotted quad and is not a valid mask, which is why the tool rejects it rather than doing something creative with it.
Why two addresses are missing
The all-zeros host address names the subnet itself and the all-ones host address is the directed broadcast, so neither goes on an interface. A /24 has 256 addresses and 254 usable ones. Two exceptions matter. RFC 3021 allows a /31 on a point-to-point link, where both addresses are usable because there is nobody to broadcast to. A /32 is a single host — a loopback, a route target, an ACL entry for one machine.
Cloud providers take more. AWS reserves five addresses in every subnet: the network address, the VPC router, the DNS resolver, one held for future use, and the broadcast. So a /24 in a VPC gives 251 usable addresses, not 254, and a /28 gives 11 rather than 14. Azure reserves five as well, GCP four. If a subnet is sized so tightly that the difference matters, it is sized too tightly.
Prefix sizes worth memorising
| Prefix | Mask | Addresses | Usable |
|---|---|---|---|
| /16 | 255.255.0.0 | 65,536 | 65,534 |
| /20 | 255.255.240.0 | 4,096 | 4,094 |
| /22 | 255.255.252.0 | 1,024 | 1,022 |
| /23 | 255.255.254.0 | 512 | 510 |
| /24 | 255.255.255.0 | 256 | 254 |
| /25 | 255.255.255.128 | 128 | 126 |
| /26 | 255.255.255.192 | 64 | 62 |
| /27 | 255.255.255.224 | 32 | 30 |
| /28 | 255.255.255.240 | 16 | 14 |
| /29 | 255.255.255.248 | 8 | 6 |
| /30 | 255.255.255.252 | 4 | 2 |
| /31 | 255.255.255.254 | 2 | 2 — point-to-point |
| /32 | 255.255.255.255 | 1 | 1 — single host |
The last octet of the mask is the fastest way to read a prefix at a glance: 128, 192, 224, 240, 248, 252, 254 correspond to /25 through /31, and each step doubles the number of subnets while halving their size. Splitting 192.168.1.0/24 into /26s gives four blocks starting at .0, .64, .128 and .192, each with 62 usable hosts and a broadcast at .63, .127, .191 and .255.
Private ranges, and the one people get wrong
RFC 1918 sets aside 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16 for internal use. These are not routed on the public internet, which is why your home router hands out 192.168.something and why two companies can both use 10.0.0.0/8 without any conflict until the day they merge and have to renumber.
The 172 range is the one that trips people. It is 172.16 through 172.31 inclusive — a /12, not a /16. 172.15.x.x and 172.32.x.x are public addresses belonging to somebody else, and a firewall rule written as "172.x is internal" is a hole. Separately, 100.64.0.0/10 from RFC 6598 is shared address space for carrier-grade NAT; if your WAN address is in that range you are behind your ISP's NAT and inbound connections will not reach you regardless of what you configure. The old class A/B/C division predates CIDR and survives only as vocabulary — routing has looked at prefix length alone since 1993.
IPv4 only, and deliberately so
Everything on this page is 32-bit arithmetic. IPv6 uses the same idea with 128 bits, but almost nothing else carries over: there is no broadcast address, so nothing is subtracted from the host count; /64 is the standard LAN size and stateless address autoconfiguration expects it; link-local fe80::/10 is always present alongside whatever else an interface has; and the notation involves zero compression rules that are their own source of bugs. Running IPv6 through a mental model built for IPv4 produces confident wrong answers, so this tool declines the input rather than guessing.
Questions people ask
How many /26 subnets fit in a /24, and how big is each?
Four, of 62 usable hosts each. Going from /24 to /26 adds two network bits, and two bits give four combinations. The blocks are 192.168.1.0/26 (hosts .1 to .62, broadcast .63), 192.168.1.64/26 (.65 to .126, broadcast .127), 192.168.1.128/26 (.129 to .190, broadcast .191) and 192.168.1.192/26 (.193 to .254, broadcast .255). Each holds 64 addresses of which 62 are assignable.
The tool says my address is the network address. What do I do?
Pick a different one. In 192.168.1.0/24 the .0 names the subnet and cannot go on an interface; hosts run .1 to .254. This usually shows up when a prefix is changed without re-checking the addresses inside it — an address that was a perfectly good host in a /24 becomes a network or broadcast address when that /24 is split into /26s. Re-run every static address after a renumbering.
Can I use a /31 between two routers?
On modern equipment, yes, and it is standard practice on point-to-point links. RFC 3021 defines it: with only two addresses and no possibility of a third party, the broadcast address serves no purpose and both addresses become usable. It halves the address consumption of a /30. Older gear, and some embedded stacks, still reject a /31 on an interface, so verify before rolling it out fleet-wide rather than after.
Why does my VPC give fewer usable addresses than this shows?
Because cloud providers reserve addresses on top of the two the protocol takes. AWS holds five per subnet — network, router, DNS, one reserved, broadcast — so a /24 yields 251 and a /28 yields 11. Azure reserves five as well, GCP four. The figures here are the protocol maximum. Size cloud subnets with the provider reservation subtracted, and with room to grow, since resizing a subnet in place is generally not possible.