An IP Address Is Two Numbers Wearing a Trenchcoat

"192.168.1.10" looks like one number, but it's really answering two different questions at once: which network is this device on, and which specific device is it on that network? An IP address alone can't tell you where the boundary between those two answers falls — that's exactly what the subnet mask (or its shorthand, the CIDR prefix) exists to specify.

The mask is a dividing line, not a separate address

A subnet mask like 255.255.255.0 isn't really "another address" the way it looks — it's 32 bits used as a stencil: every 1-bit marks a "network" bit in the address above it, and every 0-bit marks a "host" bit. Written in CIDR shorthand, /24 means "the first 24 bits are network bits," which is just a more compact way of writing the same 255.255.255.0 mask. Once you know where that dividing line falls, splitting any address into its network portion and host portion is pure bitwise AND: keep the network bits, zero out the host bits, and you've found which subnet the address belongs to.

Why the first and last addresses are special

Zeroing out every host bit gives the network address — a way of naming the subnet itself rather than any device on it. Setting every host bit to 1 instead gives the broadcast address, reserved for "send this to every device on the subnet at once." Both addresses are structurally part of the address range but aren't assignable to an individual device, which is why a /24 subnet with 256 total addresses only has 254 usable ones — the first and last are spoken for by convention, not because of any technical limitation on assigning them.

The two exceptions that don't follow this rule

That "first and last are reserved" rule quietly breaks down at the very smallest subnet sizes, for a straightforward reason: a /32 has exactly one address, so there's no room to set aside a separate network and broadcast address — the single address has to serve as all three roles at once. A /31 has exactly two addresses, and reserving one of them as an unusable broadcast address would waste half the block for no benefit, which is precisely why RFC 3021 carves out an explicit exception: both addresses in a /31 are usable, intended for point-to-point links like a direct connection between two routers where there's no need for a broadcast address in the first place.

Why the math works the way it does

All of this reduces to three bitwise operations once the mask is known: AND the address with the mask for the network address, OR the network address with the mask's bitwise complement (the wildcard mask) for the broadcast address, and everything numerically between those two is the usable host range. It's mechanical once you see an IP address for what it actually is — two concatenated numbers with an agreed-upon dividing line — which is exactly the arithmetic anIP subnet calculator runs to turn that dividing line into a full, human-readable breakdown.