How to Calculate Usable Hosts in a Subnet (Formula + Why You Subtract 2)

Here is how to calculate usable hosts in a subnet: usable hosts = 2^(32 - prefix) - 2. You take 32, subtract the prefix length to get the number of host bits, raise 2 to that power to get the total addresses, then subtract 2. The 2 you remove are the network address and the broadcast address. Neither one can be assigned to a device.

That is the whole rule. The rest of this page explains why it works, when it does not apply, and how to run it backwards to pick a subnet size. If you want the answer without the arithmetic, the IP Subnet Calculator does it instantly.

What is the formula for usable hosts?

Three steps, in order.

Step 1: find the host bits. An IPv4 address is 32 bits. The prefix (the number after the slash) tells you how many of those bits belong to the network. Everything left over belongs to hosts. So host bits = 32 - prefix.

Step 2: find the total addresses. Each host bit doubles the count. Total addresses = 2^(host bits).

Step 3: subtract 2. Usable hosts = 2^(host bits) - 2.

A worked example: /26

Take 192.168.1.0/26.

• Host bits: 32 - 26 = 6
• Total addresses: 2^6 = 64
• Usable hosts: 64 - 2 = 62

So a /26 holds 62 devices. The first of the 64 addresses is the network address. The last is the broadcast address. The 62 in between are yours.

Why do you subtract 2 from the number of hosts?

Because two of the addresses in every ordinary subnet already have jobs. They are not reserved by convention or by a vendor. They fall out of the bit math itself.

The all-zeros address is the network address

Set every host bit to 0 and you get the lowest address in the range. That address does not name a device. It names the subnet itself. It is what you write in a routing table, what you say out loud when you tell someone which network a machine is on, and what shows up on the left side of the slash. In our /26 example that is 192.168.1.0. Assign it to a laptop and you have created an address that means "this entire network," which is not a place a packet can be delivered.

The all-ones address is the broadcast address

Set every host bit to 1 and you get the highest address in the range. That is the broadcast address. Traffic sent there goes to every host on the subnet at once. In the /26 example that is 192.168.1.63. It is a delivery mechanism, not a destination you can own.

So: one address at the bottom, one at the top, both spoken for. That is the entire reason the rule is minus 2 and not minus 1 or minus 0. People sometimes assume the gateway is one of the two subtracted addresses. It is not. The gateway is a normal usable host that happens to be a router, and it eats into your 62, not into your reserved pair.

How do I do the powers of 2 in my head?

You only need to know a handful of them. Host bits map to total addresses like this:

• 1 bit = 2
• 2 bits = 4
• 3 bits = 8
• 4 bits = 16
• 5 bits = 32
• 6 bits = 64
• 7 bits = 128
• 8 bits = 256
• 9 bits = 512
• 10 bits = 1,024
• 16 bits = 65,536

Memorize up to 8 and you can handle almost every subnet you will meet on a LAN. Everything else is doubling. If you want the mask, the CIDR, and the range side by side, the subnet mask cheat sheet lays them out.

What is the hosts per subnet table?

Run the formula across the common prefixes and you get the table every network engineer eventually knows by heart. Format is prefix / host bits / total addresses / usable hosts:

• /24 = 8 host bits = 256 total = 254 usable
• /25 = 7 host bits = 128 total = 126 usable
• /26 = 6 host bits = 64 total = 62 usable
• /27 = 5 host bits = 32 total = 30 usable
• /28 = 4 host bits = 16 total = 14 usable
• /29 = 3 host bits = 8 total = 6 usable
• /30 = 2 host bits = 4 total = 2 usable
• /31 = 1 host bit = 2 total = 2 usable (exception)
• /32 = 0 host bits = 1 total = 1 usable (exception)

Notice the pattern. Every step up in prefix halves the space. A /25 is half a /24. A /26 is half a /25. That halving is why subnetting feels clean once it clicks. The two exceptions at the bottom get their own section below, because the minus-2 rule breaks there.

What size subnet do I need for 50 hosts?

This is the question you actually get asked at work. Nobody hands you a prefix and asks for the host count. They hand you a host count and ask for a prefix.

Run the formula backwards. Find the smallest host-bit count where 2^bits - 2 is greater than or equal to your required number of hosts. Then prefix = 32 - bits.

Worked reverse examples

• 50 hosts: 5 bits gives 30 usable, too small. 6 bits gives 62 usable. That fits. 32 - 6 = /26.
• 100 hosts: 6 bits gives 62, too small. 7 bits gives 126. 32 - 7 = /25.
• 10 hosts: 3 bits gives 6, too small. 4 bits gives 14. 32 - 4 = /28.
• 2 hosts: 2 bits gives 2 usable. Exactly enough. 32 - 2 = /30.

That last one is the classic router-to-router link. Two usable addresses, one for each end, nothing wasted. See what is a /30 subnet for why it became the default for point-to-point.

Size for growth

The 50-host example is a trap worth naming. A /26 gives you 62 usable, which is 12 spare. That sounds fine until the team adds printers, phones, access points, and a dozen contractors. Now you are at 63 and out of room.

Renumbering a live subnet later is painful. You touch DHCP scopes, static assignments, firewall rules, ACLs, monitoring, and documentation, and you usually do it during a maintenance window at night. Picking one prefix larger on day one costs you nothing but address space. Pick the size you need in two years, not the size you need today. When you are comparing options, the IP Subnet Calculator shows the usable count for each candidate prefix side by side.

Does a /31 have 0 usable hosts?

No. This is where the minus-2 rule stops working, and it trips up people who apply it mechanically.

A /31 has 1 host bit, so 2 total addresses. Apply minus 2 and you get zero, which would make the prefix useless. It is not useless. Under RFC 3021, both addresses in a /31 are usable on point-to-point links. The reasoning is straightforward: a link with exactly two endpoints does not need a network address to identify itself and does not need a broadcast address, because anything one end sends reaches the other end by definition. So there is nothing to reserve, and you get 2 usable addresses out of 2 total.

A /32 is the other exception. Zero host bits, 1 total address, 1 usable. It is a single host address, a host route. You see it on loopback interfaces, in routing tables pointing at one specific machine, and in firewall rules that match exactly one IP. Minus 2 would give you negative one, which is nonsense.

The rule to carry: apply minus 2 from /30 and wider. Do not apply it to /31 or /32.

Bottom line

Usable hosts = 2^(32 - prefix) - 2. Subtract the prefix from 32 to get host bits, raise 2 to that power for total addresses, then remove the all-zeros network address and the all-ones broadcast address. Run it backwards to size a subnet: find the smallest bit count where 2^bits - 2 covers your host requirement, then subtract from 32. The only exceptions are /31, where RFC 3021 makes both addresses usable on point-to-point links, and /32, which is a single host route. Do the math once by hand so you understand it, then let the IP Subnet Calculator handle it at speed.