Work out a subnet from CIDR notation
192.168.1.10/24 contains everything you need to know about the network — but only after arithmetic that nobody should be doing mentally at the point they need the answer.
What the slash actually means
The number after the slash is how many leading bits are the network. A /24 fixes the first 24 bits and leaves 8 for hosts, giving 256 addresses of which 254 are usable — the first is the network address and the last is broadcast.
Every step down the prefix doubles the size: /25 is 128 addresses, /23 is 512. The pattern is regular, which is why it feels like it should be easy, and error-prone, which is why it is worth checking.
The sizes worth memorising
- /30 — 4 addresses, 2 usable. Point-to-point links.
- /29 — 8 addresses, 6 usable.
- /24 — 256 addresses, 254 usable. The classic small network.
- /16 — 65,536 addresses. 10.0.0.0/16 and similar.
- /8 — 16,777,216 addresses. The whole of 10.0.0.0/8.
Private ranges under RFC 1918
Three ranges are reserved for private use and are never routed on the public internet:
10.0.0.0/8 10.0.0.0 – 10.255.255.255
172.16.0.0/12 172.16.0.0 – 172.31.255.255
192.168.0.0/16 192.168.0.0 – 192.168.255.255The middle one is the one people get wrong: 172.16 to 172.31, not all of 172.
The other reserved ranges
- 127.0.0.0/8 — loopback. The whole range, not just 127.0.0.1.
- 169.254.0.0/16 — link-local. An address here usually means DHCP failed.
- 100.64.0.0/10 — carrier-grade NAT, which is why it appears in some ISP and VPN setups.
How to check the claim rather than trust it
Bellows is signed without a network entitlement. That is not a policy someone wrote down — it is a permission the binary does not have, and macOS enforces it whether the app wants to connect or not. You can read the entitlements it was signed with:
codesign -d --entitlements - /Applications/Bellows.appNeither com.apple.security.network.client nor com.apple.security.network.server appears in the output. Without them the sandbox refuses to open a socket.
IP / Subnet is one of 41 tools in Bellows
A native Mac app that ships with no network entitlement, so macOS blocks it from connecting at all. One-time purchase, every future update included.
What Bellows is →Questions
How many usable hosts are in a /24?
254. A /24 holds 256 addresses; the first is the network address and the last is the broadcast address, so neither can be assigned to a host.
Is 172.20.0.1 a private address?
Yes. RFC 1918 reserves 172.16.0.0/12, which covers 172.16.0.0 through 172.31.255.255. Only that span of the 172 range is private.
What does a 169.254 address mean?
It is a link-local address, self-assigned when a device cannot reach a DHCP server. It almost always indicates a network configuration failure rather than a working setup.