Every device that speaks to the Internet wears a numeric name badge: an IP address. You have seen them — 192.168.1.42, 8.8.8.8. They look like four friendly numbers, but that dotted-decimal costume hides what an address really is: a single 32-bit binary number, and — this is the whole game — a number split into two halves. The left half says which network you are on; the right half says which host you are within it. Master that split and you can look at any address-and-mask and instantly answer the questions a router lives by: what network is this? are these two machines neighbours or strangers? how many hosts fit here?

This page is about reading and computing on IP addresses like the router in the previous lesson does — as bits, not decimals. It is one of the few places in networking where a little clean bit-arithmetic replaces a lot of hand-waving, so we will lean into the binary and let a runnable calculator do the sums.

32 bits in a trench coat

An IPv4 address is 32 bits. To make it human-readable we chop it into four 8-bit octets, write each as a decimal 0–255, and join them with dots. So 192.168.1.42 is really:

Because each octet is one byte, each ranges 0–255, and the whole 32-bit space holds 2^{32} = 4{,}294{,}967{,}296 addresses — about 4.3 billion. (That this "huge" number turned out to be far too small is the story of the next lesson.) The dots are pure decoration for our eyes; the router sees one 32-bit integer and does everything with bitwise AND.

The line in the sand: network bits and host bits

Here is the pivotal idea. An address is divided into a network portion (the leading bits, shared by everyone on the same network) and a host portion (the trailing bits, unique to each machine). Where is the dividing line? Wherever the subnet mask puts it.

A subnet mask is another 32-bit pattern: a run of 1s covering the network bits, followed by 0s covering the host bits. CIDR notation just writes the count of 1s after a slash. So /24 means "the first 24 bits are network, the last 8 are host":

To find the network address of any host, you AND the address with the mask — this zeroes out the host bits, leaving only the network part. To find the broadcast address (the "everyone on this network" address), you set all the host bits to 1. And the number of usable hosts follows a clean formula from the count of host bits:

The −2 is the classic trap and deserves a moment: the all-host-bits-zero address is the network address itself (a name for the block, not a host), and the all-host-bits-one address is the broadcast address. Neither can be handed to an actual machine. So a /24 has 2^{8} = 256 addresses but only 256 - 2 = 254 usable host addresses.

Notice each extra network bit halves the block: a /25 is half a /24, a /26 a quarter. That /30 at the bottom — 2 usable hosts — is exactly what you put on a point-to-point link between two routers, where you need precisely two addresses and nothing wasted.

A worked example, done in binary

Take the host 192.168.10.130 with mask /26. Let us find its network address, broadcast, and whether it shares a subnet with 192.168.10.100. A /26 means 26 network bits, so 6 host bits — and only the last octet is interesting (the first three octets are fully network). In binary the last octet is 130 = 10000010, and the mask's last octet is 11000000 (the top 2 bits of this octet are network, the bottom 6 are host).

• Network address = address AND mask. The last octet: 10000010 AND 11000000 = 10000000 = 128. So the network is 192.168.10.128. (The blocks step every 64: …0, 64, 128, 192 — and 130 lands in the 128 block.)
• Broadcast = set the 6 host bits to 1: 10111111 = 191. So broadcast is 192.168.10.191.
• Usable range = 192.168.10.129 … 192.168.10.190 (2^{6}-2 = 62 hosts), skipping the .128 network and .191 broadcast.
• Same subnet as 192.168.10.100? AND 100 (01100100) with the mask (11000000) → 01000000 = 64, i.e. network 192.168.10.64. That is a different network (.64 ≠ .128), so no — .130 and .100 are on different /26 subnets and cannot talk directly; they need a router.

The two-addresses-same-subnet test is just: AND both with the mask and compare the results. Equal ⇒ same subnet ⇒ deliver directly on the link. Different ⇒ send it to the router. That single comparison is how every host decides "is this local or do I hand it off?" on every packet it sends.

Compute it live

The calculator below takes an address and a prefix length and does the whole job in pure bit arithmetic — exactly the operations a host or router performs. Change the numbers, hit Run, and watch the mask, network, broadcast and host count fall out. Try a /26 on 192.168.10.130 to reproduce the worked example, then try a /30 or a /16.

CIDR, aggregation, and the private ranges

The slash notation is not just tidy — it is what lets the Internet's routing tables stay (barely) manageable. Because prefixes nest, a router can advertise one coarse block instead of many fine ones. If an ISP owns 200.23.16.0/23 and 200.23.18.0/23 and they are numerically adjacent, it can advertise the single supernet 200.23.16.0/22 to the rest of the world — one route where there were two. This is route aggregation (a.k.a. supernetting), and it is the reason longest-prefix match exists: distant routers carry the aggregate, nearby routers carry the specifics, and the longest match naturally prefers the specific route when it is available.

These ranges are reserved for use inside private networks and are never routed on the public Internet — which is why the same 192.168.1.1 lives behind millions of home routers at once with no conflict. How a whole house full of 192.168.x.x devices shares one public address is the job of NAT, the star of the next lesson.