For a CIDR that lands on an octet boundary, like /24 or /16, the network address is just "keep the matching octets as-is, zero out the rest." Decimal intuition works fine. But once the prefix splits in the middle of an octet — /26, /27, and the like — that decimal intuition stops working. Take 192.168.1.130/26 as an example and look at just the last octet (130) in binary to see exactly how the network and broadcast addresses come out.

Writing the subnet mask in binary

/26 means "the first 26 bits are 1, the remaining 6 are 0." The first three octets (24 bits) are entirely 1s, giving 255.255.255. The last octet has only its first 2 bits set — 11000000 in binary, which is 192 in decimal. So the subnet mask is 255.255.255.192. Nothing unusual here; most explanations stop at this point.

AND gives you the network address

The network address comes from a bitwise AND between the IP address and the subnet mask. Looking only at the last octet: the IP address 130 is 10000010 in binary, and the mask 192 is 11000000. ANDing them bit by bit:

  10000010  (130: IP address)
& 11000000  (192: subnet mask)
-----------
  10000000  (128: network address)

AND only produces a 1 when both bits are 1, so wherever the mask is 0 (the host portion), the result is forced to 0 regardless of the IP address — and wherever the mask is 1 (the network portion), the IP address's bit passes through unchanged. The result is 128, so the network address of 192.168.1.130/26 is 192.168.1.128. In decimal, jumping from 130 to 128 looks arbitrary, but at the bit level it's nothing more than zeroing out the 6 host bits.

OR gives you the broadcast address

The broadcast address is the network address with every host bit flipped to 1. That's exactly what ORing with the host mask (the inverted subnet mask) does. Inverting the subnet mask 192 gives 00111111, or 63 in decimal — the host mask.

  10000000  (128: network address)
| 00111111  (63:  host mask = inverted subnet mask)
-----------
  10111111  (191: broadcast address)

OR produces a 1 if either bit is 1, so wherever the host mask is 1 (the host portion), the result is forced to 1 regardless of the network address — and wherever the host mask is 0 (the network portion), the network address's bit passes through unchanged. The result is 191, so the broadcast address is 192.168.1.191. That leaves 192.168.1.129 through 192.168.1.190 — 62 addresses — as usable hosts (2^6-2=62).

Why bitwise operations instead of decimal arithmetic

For octet-aligned prefixes like /24 or /16, decimal reasoning works fine: "this octet is fixed, everything after is 0 or 255." But once the boundary falls inside an octet, as with /26, decimal addition and subtraction can't cleanly separate the network portion from the host portion. AND and OR operate bit by bit, so the same procedure works no matter where the prefix length happens to split an octet. ip-cidr-calculator works the same way internally — it converts the IP address to a 32-bit integer and runs the same AND/OR operations, with no special-casing for octet boundaries at all.

If you want to check the network address, broadcast address, and usable host count for a real IP address and CIDR — including the binary representation — the tool below covers it.