Addresses and subnets
An IP address is two numbers wearing one coat: a network and a host. The split is arithmetic, and it decides what is local.
- You can read
192.168.10.77/27and say which network it is in, what the range is, and how many hosts fit. - You can tell whether two addresses need a router between them, without a calculator.
Your laptop is 192.168.1.42. The printer is 192.168.1.60. Everything works. You take the laptop to the office, it gets 10.20.4.17, and it still reaches the internet — but not the printer at home, which is correct, and not the printer at the office, which is not, because that one is on 10.20.7.x.
All of that behavior follows from one question the operating system answers before every packet: is the destination inside my network or outside it? That is what a subnet mask is for.
3.1Two numbers in one
An IPv4 address is 32 bits. A prefix length says how many of those bits are the network's, and the rest identify the host inside it.
192.168.10.77/27
192 . 168 . 10 . 77 ← dotted decimal
11000000.10101000.00001010.00100111
└──────── 27 bits ───────┘└ 5 bits ┘
network hostThe mask is just those 27 bits written out: 255.255.255.224. The last octet of the mask has 3 bits set (128+64+32 = 224), which leaves 5 bits for hosts — 32 addresses, 30 of them usable.
| Prefix | Mask octet | Block size | Usable hosts |
|---|---|---|---|
| /25 | 128 | 128 | 126 |
| /26 | 192 | 64 | 62 |
| /27 | 224 | 32 | 30 |
| /28 | 240 | 16 | 14 |
| /29 | 248 | 8 | 6 |
| /30 | 252 | 4 | 2 |
| /31 | 254 | 2 | 2 (point-to-point) |
To find the network, round the address down to the nearest multiple of the block size in that octet. 77 with a block of 32 falls between 64 and 96, so the network is 192.168.10.64, the broadcast is 192.168.10.95, and usable addresses run from .65 to .94.
3.2The gateway rule that people break
A host compares each destination against its own prefix. Inside the prefix, it sends directly using the destination's hardware address. Outside, it sends to its gateway — the router's address — and lets the router worry about the rest.
The gateway therefore must be inside the host's own subnet. If a machine is 192.168.10.77/27 and its gateway is 192.168.10.1, the host believes .1 is on another network and ARPs for an address it cannot reach directly. Depending on the operating system it either fails immediately or learns the gateway's MAC from a proxy reply and then behaves oddly for months.
The second most expensive address mistake, after overlapping private ranges across a VPN, is the same subnet used twice. It happens when two teams each take 10.0.0.0/24 because nobody owns a plan. Routing then has no way to express intent: half the destinations are ambiguous, and neither fix (NAT, or renumbering) is cheap. The remedy costs nothing at design time and a quarter of a year afterwards.
3.3Which ranges are yours to use
| Range | Name | Reality |
|---|---|---|
10.0.0.0/8 | Private (RFC 1918) | Yours to plan, never routable on the internet |
172.16.0.0/12 | Private | The one people forget, because it starts at 172.16, not 172.0 |
192.168.0.0/16 | Private | Home and small office; overlapping it is a classic VPN failure |
169.254.0.0/16 | Link-local | What a device self-assigns when DHCP fails — a diagnosis, not an address |
127.0.0.0/8 | Loopback | The machine talking to itself; 127.0.0.1 is always up |
100.64.0.0/10 | Carrier-grade NAT | What your provider may put you behind; useful as spare private space |
If a machine shows an address starting 169.254., it did not get DHCP. That is a one-glance diagnosis in a support conversation, and it is the reason the address is worth memorising.
Host A is 10.0.5.10/25. Host B is 10.0.5.200/25. They are on the same switch. Can A reach B without a router?
60-second recap
- Prefix splits network from host. Block size = 256 − the mask octet; round down to the multiple.
- Gateway must be local. A gateway outside the subnet is a silent, permanent fault.
- Private space is reusable, which is why it collides. Plan the whole estate before the first VPN.