CIDR Notation and Subnetting, Explained

By Udit Agarwal · Updated October 18, 2026

CIDR notation writes an IP network as an address, a slash and a number, such as 192.168.1.0/24. The number is the prefix length: how many of the address's 32 bits identify the network, with the remaining bits left to number the devices on it. A /24 leaves 8 bits for hosts, which makes 256 addresses, and 254 of them can be assigned to devices. Once you can read that one number, the subnet mask, the address range and the host count all follow from simple arithmetic.

An IPv4 address is 32 bits

An IPv4 address is a 32-bit number. It is written as four 8-bit groups called octets, each shown in decimal and separated by dots, so every octet runs from 0 to 255. That allows 2^32, or 4,294,967,296, addresses in total.

Every address has two parts. The leading bits identify the network and are the same for every device on it. The trailing bits identify one host on that network. Routers forward traffic by looking at the network part, and CIDR notation is simply a way of saying where the split falls.

What the number after the slash means

The number after the slash is the prefix length. In 192.168.1.0/24 the first 24 bits are the network and the last 8 are for hosts. The same split can be written as a subnet mask, 24 ones followed by 8 zeros:

/24 mask:  11111111.11111111.11111111.00000000  =  255.255.255.0

A prefix of p leaves 32 − p host bits, so the block holds 2^(32 − p) addresses. Every extra bit of prefix halves the block, and every bit fewer doubles it: a /24 holds 256 addresses, a /25 holds 128 and a /23 holds 512.

You will also meet the wildcard mask, the inverse of the subnet mask (0.0.0.255 for a /24). Cisco access lists and OSPF configuration use it to mark the bits that may vary.

CIDR stands for Classless Inter-Domain Routing. It replaced the old class system in 1993, when a network had to be a Class A (/8), B (/16) or C (/24), and it is now specified in RFC 4632. Today any prefix from /0 to /32 is valid.

How to find the network address, broadcast address and host range

Two addresses in every block are special. The network address is the first, where all host bits are 0, and it names the subnet itself. The broadcast address is the last, where all host bits are 1, and a packet sent to it reaches every host on the subnet. Everything in between can be given to a device, which is where the usual formula comes from:

usable hosts = 2^(32 − prefix) − 2

Here is 10.20.37.130/26, an address that does not sit on a boundary:

1. A /26 mask is 255.255.255.192. Only the last octet is partly masked, so 10.20.37 belongs to the network unchanged.
2. In binary, 130 is 10000010 and 192 is 11000000. Keeping only the bits where the mask has a 1 gives 10000000, which is 128. The network address is 10.20.37.128.
3. The block holds 2^(32 − 26) = 64 addresses, so it ends 63 later, at the broadcast address 10.20.37.191.
4. The hosts run from 10.20.37.129 to 10.20.37.190: 64 − 2 = 62 usable addresses.

A shortcut skips the binary. Subtract the partly masked octet from 256 to get the block size (256 − 192 = 64). Blocks start at multiples of that size, here 0, 64, 128 and 192, and 130 falls in the block that starts at 128.

The /31 and /32 exceptions

The minus-two rule breaks down at the bottom of the scale. A /32 is a single address that describes one host, as in a firewall rule or a static route, so there is nothing to subtract.

A /31 holds two addresses. The minus-two rule would leave it no hosts at all, but a link between exactly two routers needs neither a network address nor a broadcast address. RFC 3021 (2000) therefore lets both addresses of a /31 be used on point-to-point links. Before that, such links used a /30, which spends four addresses to number two devices.

In full, a block has 2^(32 − prefix) − 2 usable addresses up to /30, two at /31 and one at /32.

CIDR cheat sheet: /8 to /32

Each row holds half the addresses of the row above it.

Cloud networks take a little more. AWS and Microsoft Azure both reserve five addresses in every subnet, the first four and the last, so a /24 subnet there leaves 251 for your own resources.

Private IPv4 ranges

RFC 1918 sets aside three blocks for private networks. Anyone can use them inside a home, office or cloud network, and they are not routed on the public internet. A router doing network address translation (NAT) sits between them and the outside world.

The middle block catches people out because a /12 ends partway through the second octet: 172.20.5.1 is private, but 172.32.0.1 is public. A few other ranges are reserved as well. 127.0.0.0/8 is for loopback (127.0.0.1 means "this computer"), 169.254.0.0/16 holds the link-local addresses a device gives itself when DHCP fails, and 100.64.0.0/10 is set aside by RFC 6598 for carrier-grade NAT inside internet providers.

How to split a network into subnets

Subnetting means lengthening the prefix. Each bit you add doubles the number of subnets and halves their size, and every subnet starts on a boundary of its own size. Splitting 192.168.1.0/24 into /26 blocks gives 2^(26 − 24) = 4 subnets of 64 addresses:

Because blocks split in halves, the number of equal subnets is always a power of two. If you need six, round up to eight: a /24 cut into eight /27s gives 30 usable hosts each.

Real networks rarely want equal pieces, which is what variable length subnet masking (VLSM) is for. Size each subnet for its own hosts and place the largest first, so each block starts on a boundary its size allows. A /24 for 100 engineering devices, 50 in sales, 25 in a warehouse and one router-to-router link comes out like this:

• Engineering, 100 hosts: 192.168.1.0/25 (126 usable)
• Sales, 50 hosts: 192.168.1.128/26 (62 usable)
• Warehouse, 25 hosts: 192.168.1.192/27 (30 usable)
• Point-to-point link: 192.168.1.224/31 (2 usable)

That leaves 30 addresses, 192.168.1.226 to 192.168.1.255, for later. The Subnet Splitter works out a layout like this from host needs, or splits a block evenly by new prefix or by subnet count, with a CSV download for even splits.

Going the other way, an arbitrary run of addresses rarely fits one block. The 16 addresses from 10.0.0.5 to 10.0.0.20 need five: 10.0.0.5/32, 10.0.0.6/31, 10.0.0.8/29, 10.0.0.16/30 and 10.0.0.20/32. IP Range to CIDR finds the smallest such set for any start and end address.

IPv6 prefixes

IPv6 addresses are 128 bits long, written as eight groups of four hexadecimal digits separated by colons. Leading zeros in a group can be dropped and one run of all-zero groups can be shortened to ::, so 2001:0db8:0000:0000:0000:0000:0000:0001 becomes 2001:db8::1.

Prefixes work exactly as in IPv4: 2001:db8::/32 fixes the first 32 bits. (RFC 3849 reserves that block for documentation, which is why examples use it.) The difference is scale. The standard size for one IPv6 subnet is a /64, which holds 2^64 addresses, about 18.4 quintillion. Providers commonly give a home or business a /56 or a /48, which contain 256 and 65,536 of those /64 subnets. IPv6 has no broadcast address, since RFC 4291 replaces it with multicast, so there is no minus-two rule. In IPv6 you count subnets, not hosts.

The CIDR / Subnet Calculator handles IPv4 only. For an IPv6 block, the CIDR to Range mode of IP Range to CIDR shows the first and last address and the exact count: 2001:db8:abcd:12::/64 runs from 2001:db8:abcd:12:: to 2001:db8:abcd:12:ffff:ffff:ffff:ffff, which is 18,446,744,073,709,551,616 addresses.

Check a block with the CIDR / Subnet Calculator

The CIDR / Subnet Calculator takes one IPv4 block and shows its network and broadcast addresses, netmask, wildcard mask, first and last host, prefix, total hosts and usable hosts, updating as you type. Enter 10.0.0.0/20 and it reports the network 10.0.0.0, the broadcast address 10.0.15.255, the mask 255.255.240.0 and 4,094 usable hosts. Any address inside a block works: 192.168.1.42/24 is reported with the network 192.168.1.0. Its "Total hosts" figure counts every address in the block, network and broadcast included. A /31 is treated as a two-address point-to-point link, as RFC 3021 allows, and a /32 as a single host, with every address counted as usable. It accepts prefixes from 0 to 32 and does not take IPv6. The arithmetic runs in your browser, and the addresses you enter are not uploaded.

Frequently asked questions

What does /24 mean in an IP address? It means the first 24 of the address's 32 bits identify the network, leaving 8 bits for hosts. The matching subnet mask is 255.255.255.0, and the block holds 256 addresses, for example 192.168.1.0 to 192.168.1.255.

How many usable IP addresses are in a /24? 254. The block holds 256 addresses, and the first (the network address) and the last (the broadcast address) cannot be assigned to devices. AWS and Azure reserve three more in each subnet, which leaves 251.

How do I calculate the number of hosts from a prefix? Subtract the prefix from 32, raise 2 to that power and subtract 2. A /27 gives 2^5 − 2 = 30 usable hosts. The exceptions are /31, where both addresses are usable on a point-to-point link, and /32, which is a single address.

What is the subnet mask for /27? 255.255.255.224. A /27 mask is 27 ones followed by 5 zeros, and the last octet, 11100000, is 224 in decimal. Each /27 holds 32 addresses.

Why can't the first and last addresses of a subnet be used? The first, with every host bit set to 0, is the network address that names the subnet. The last, with every host bit set to 1, is the broadcast address that reaches every host on it. Neither can belong to a single device, except in /31 and /32 blocks.

Is 172.20.0.0 a private IP address? Yes. It falls inside 172.16.0.0/12, the RFC 1918 block that runs from 172.16.0.0 to 172.31.255.255. Addresses from 172.32.0.0 upward are public.

Keep going

• CIDR / Subnet Calculator — network, broadcast, masks and host range for any IPv4 block.
• Subnet Splitter — divide a block by new prefix, by subnet count or by host needs.
• IP Range to CIDR — turn a start and end address into CIDR blocks, or expand a block, for IPv4 and IPv6.
• IPv6 ↔ IPv4 Converter — expand, compress and map IPv6 addresses.
• IP Address to Integer Converter — see any address as a decimal, hex and binary number.
• Internet Speed Test Results, Explained — what Mbps, ping and jitter mean for your connection.

Calculadora de CIDR / subredes

More guides

• Base64 Encoding, Explained — Base64 explained: how it turns binary into text, the alphabet and padding, the URL-safe variant, size overhead, use cases, and why it isn't encryption.
• Linux File Permissions and chmod, Explained — What chmod 755, 644 and 777 mean: owner, group and others, read, write and execute, octal and symbolic modes, umask, setuid, setgid and the sticky bit.
• DMS and Decimal Degrees, Explained — How to convert DMS to decimal degrees and back, how DD, DMS and DDM differ, how many decimal places you need, and which formats Google Maps and GPS accept.
• Date Calculations, Explained: Counting and Adding Days — How to count the days between two dates, add days, weeks or months to a date, and why calculators disagree: inclusive counts, month ends and leap years.
• How to Add, Subtract, Multiply and Divide Fractions — How to add fractions with a common denominator, subtract, multiply, divide and simplify them, and convert mixed numbers and decimals, with worked examples.
• HTTP Status Codes and MIME Types, Explained — What HTTP status codes mean, from 200 to 504: 301 vs 302, 401 vs 403, 404 vs 410, soft 404s and redirects for SEO, plus MIME types and Content-Type.

All Network tools · All guides

---