What CIDR notation means
CIDR — Classless Inter-Domain Routing — writes a network as an address followed by a slash and a number: 192.168.10.0/24. The number is the prefix length: how many of the 32 bits identify the network, leaving the rest to identify hosts within it.
11000000.10101000.00001010.10000010 address
11111111.11111111.11111111.00000000 mask (24 ones)
┌──── 24 network bits ────┐┌ 8 host bits ┐
Everything else follows from that one number. The subnet mask is simply the prefix written as a dotted quad. The network address is the address with all host bits set to zero. The broadcast address is the same with all host bits set to one. Total addresses is 2 raised to the number of host bits.
Broadcast = network OR wildcard
Total = 2(32 − prefix)
Usable = total − 2 (except /31 and /32)
Why you lose two addresses
In an ordinary subnet, two addresses are structurally reserved and cannot be assigned to any host:
- The network address — all host bits zero. It names the subnet itself and appears in routing tables.
- The broadcast address — all host bits one. Traffic sent here reaches every host on the segment.
So a /24 has 256 total addresses and 254 usable ones. This is the source of the constant off-by-two confusion when sizing networks: if you need 254 hosts a /24 works, but if you need 255 you must move up to a /23 and jump straight to 510 usable.
A worked example
Analysing 192.168.10.130/26:
- Prefix 26 means 26 network bits and 6 host bits.
- Mask: 26 ones then 6 zeros = 255.255.255.192
- Block size: 2⁶ = 64, so subnets start at .0, .64, .128, .192
- Network: 130 falls in the .128 block → 192.168.10.128
- Broadcast: 128 + 64 − 1 = 192.168.10.191
- Usable range: 192.168.10.129 to 192.168.10.190
- Usable hosts: 64 − 2 = 62
The shortcut experienced network engineers use is the block size: 256 minus the interesting octet of the mask. Here 256 − 192 = 64, so subnet boundaries fall every 64 addresses. Find which block your address lands in and you have the network and broadcast immediately, without any binary.
Prefix reference
| Prefix | Mask | Total | Usable | Typical use |
|---|---|---|---|---|
| /8 | 255.0.0.0 | 16,777,216 | 16,777,214 | Very large private range |
| /16 | 255.255.0.0 | 65,536 | 65,534 | Campus / large site |
| /22 | 255.255.252.0 | 1,024 | 1,022 | Large office VLAN |
| /23 | 255.255.254.0 | 512 | 510 | Medium VLAN |
| /24 | 255.255.255.0 | 256 | 254 | Standard LAN segment |
| /25 | 255.255.255.128 | 128 | 126 | Split /24 |
| /26 | 255.255.255.192 | 64 | 62 | Small department |
| /27 | 255.255.255.224 | 32 | 30 | Small VLAN, DMZ |
| /28 | 255.255.255.240 | 16 | 14 | Server rack, firewall zone |
| /29 | 255.255.255.248 | 8 | 6 | Small server group |
| /30 | 255.255.255.252 | 4 | 2 | Traditional point-to-point link |
| /31 | 255.255.255.254 | 2 | 2 | Modern point-to-point (RFC 3021) |
| /32 | 255.255.255.255 | 1 | 1 | Single host route |
Reserved and special ranges
The calculator identifies which special-purpose range an address belongs to, because using the wrong one causes routing problems that are tedious to diagnose.
| Range | Name | Notes |
|---|---|---|
| 10.0.0.0/8 | Private (RFC 1918) | 16.7M addresses, not routed on the internet |
| 172.16.0.0/12 | Private (RFC 1918) | 172.16 through 172.31 only — not the whole 172 block |
| 192.168.0.0/16 | Private (RFC 1918) | The home-router default |
| 100.64.0.0/10 | CGNAT (RFC 6598) | Carrier-grade NAT; do not use internally |
| 127.0.0.0/8 | Loopback | An entire /8 for localhost |
| 169.254.0.0/16 | Link-local | Self-assigned when DHCP fails — a diagnostic signal |
| 224.0.0.0/4 | Multicast | Not assignable to hosts |
Wildcard masks
A wildcard mask is the bitwise inverse of a subnet mask — a /24 mask of 255.255.255.0 has a wildcard of 0.0.0.255. Cisco ACLs and OSPF network statements use wildcards rather than masks, and mixing them up is a classic configuration error that either blocks everything or permits everything.
Frequently asked questions
Why does a /24 give 254 hosts, not 256?
What is the difference between a subnet mask and a prefix?
Can I use 255.0.255.0 as a mask?
How do I split a /24 into smaller subnets?
Does this handle IPv6?
What is the 169.254 address my machine picked up?
Splitting a network: a VLSM example
Variable-length subnet masking means sizing each subnet to what it actually needs rather than carving everything into equal blocks. Suppose you have 192.168.1.0/24 and four requirements: 100 hosts, 50 hosts, 20 hosts and a point-to-point link.
The method is always the same — allocate largest first, so smaller blocks fit into the gaps rather than fragmenting the space.
| Need | Smallest fit | Subnet | Usable range | Hosts |
|---|---|---|---|---|
| 100 hosts | /25 (126) | 192.168.1.0/25 | .1 – .126 | 126 |
| 50 hosts | /26 (62) | 192.168.1.128/26 | .129 – .190 | 62 |
| 20 hosts | /27 (30) | 192.168.1.192/27 | .193 – .222 | 30 |
| Point-to-point | /30 (2) | 192.168.1.224/30 | .225 – .226 | 2 |
That consumes up to .227 and leaves 192.168.1.228 through 192.168.1.255 free for future growth. Had you allocated smallest first, the /25 would no longer have fitted anywhere and the whole plan would have needed redoing.
Paste each of those four networks into the calculator above to confirm the boundaries. The block-size shortcut makes it quick: a /25 has block size 128, a /26 has 64, a /27 has 32 and a /30 has 4, so each subnet starts at the previous one's start plus its block size.
Supernetting and route summarisation
The reverse operation combines adjacent networks into one advertisement. Four contiguous /24s starting on a /22 boundary — 10.1.4.0, 10.1.5.0, 10.1.6.0 and 10.1.7.0 — summarise into 10.1.4.0/22, replacing four routing table entries with one.
Two conditions must hold: the networks must be contiguous, and the block must start on a boundary that is a multiple of its own size. 10.1.5.0 through 10.1.8.0 cannot summarise into a /22 despite being four consecutive /24s, because 5 is not a multiple of 4. This is why address plans that allocate on power-of-two boundaries from the start stay summarisable, and improvised ones do not.