How to Calculate a Subnet Mask

The five steps

1. Write the prefix as a binary mask. A /26 sets the first 26 bits to 1 and the rest to 0: 11111111.11111111.11111111.11000000, which in dotted decimal is 255.255.255.192.
2. Count the host bits. Host bits = 32 − prefix = 32 − 26 = 6 bits. These are the zero positions in the mask.
3. Compute the block size. Block size = 2^{host bits} = 2⁶ = 64 addresses. Every /26 covers a contiguous run of 64 addresses.
4. Find the network address. Bitwise-AND the IP with the mask (see the octet math below). 192.168.1.130 AND 255.255.255.192 = 192.168.1.128.
5. Broadcast and hosts. Broadcast = network + block size − 1 = 192.168.1.128 + 64 − 1 = 192.168.1.191. Everything strictly between is a usable host address.

The AND operation, octet by octet

Only the fourth octet differs between the IP and the mask here, so that is the only octet where the AND changes anything:

Reading down each column: wherever the mask has a 1, the IP bit passes through; wherever it has a 0, the result is forced to 0. That is how the host portion is erased and the network boundary appears.

Quick reference: common prefixes

*Shown for a network whose fourth octet is 0 (e.g. 192.168.1.0/24). The full table for every prefix lives on the subnet cheat sheet.

Common mistakes

• Off-by-one on usable hosts. A /26 holds 64 addresses and 62 usable hosts. People subtract 2 twice (getting 60) or forget to subtract at all (counting the network and broadcast as hosts). Subtract exactly once: total − 2.
• Forgetting that network and broadcast are reserved. If a VLAN needs exactly 62 devices, a /26 leaves zero headroom. Size up a prefix, or use the VLSM calculator to right-size multiple subnets at once.
• Assuming a /31 has zero usable hosts. Under the traditional rule, 2¹ − 2 = 0. But RFC 3021 explicitly defines two-address /31 subnets for point-to-point links, where both addresses are assigned — one per router interface. The same reasoning applies to /32 host routes, which carry exactly one address.
• Picking an unaligned network address. Blocks start only at multiples of their own size. The network for 192.168.1.130/26 is not 192.168.1.130 itself; /26 blocks in the last octet begin at .0, .64, .128 and .192, so the answer is 192.168.1.128.

Check your work

Hand calculations are great practice — verify them before they reach production:

Want the theory behind slash notation first? Start with CIDR notation explained, or see the deep dive on the /26 subnet mask.