CIDR Notation Explained — Subnetting, Host Counts, and Network Addresses
CIDR (Classless Inter-Domain Routing) notation — introduced in 1993 to replace the rigid class-based system — represents an IP address and its subnet mask as a single compact expression: 192.168.1.0/24. The prefix length after the slash specifies how many leading bits belong to the network, with the remaining bits available for hosts. This calculator takes any valid CIDR block and instantly computes all subnet parameters: network address, broadcast address, subnet mask, host range, and usable host count.
/24 → 254 hosts | /23 → 510 hosts | /22 → 1,022 hosts | /16 → 65,534 hosts | /8 → 16,777,214 hosts. Each step up in prefix length (smaller subnet) halves the host count. Network address = IP AND subnet_mask. Broadcast = network_address OR (NOT subnet_mask).
How CIDR Arithmetic Works
An IPv4 address is a 32-bit binary number, conventionally displayed as four decimal octets. The CIDR prefix length (the number after the slash) defines a bit mask: the first N bits are 1 (network bits), the remaining 32-N bits are 0 (host bits). The network address is computed by ANDing the IP with the mask — all host bits zeroed out. The broadcast address is the network address with all host bits set to 1. Every address in between is an assignable host address, except the network and broadcast addresses themselves.
Subnet Mask Decimal Equivalents
The subnet mask in dotted-decimal format is derived directly from the prefix length. Full octets of network bits produce 255; full octets of host bits produce 0. A split octet — where the boundary falls mid-octet — produces values like 128 (/25), 192 (/26), 224 (/27), 240 (/28), 248 (/29), 252 (/30), 254 (/31). Common subnet masks: /24 = 255.255.255.0 (254 hosts), /16 = 255.255.0.0 (65,534 hosts), /8 = 255.0.0.0 (16.7 million hosts). Modern practice uses prefix notation exclusively — subnet masks in dotted decimal are being phased out.
Subnetting: Dividing a Network
Subnetting splits a large IP block into smaller ones by extending the prefix length. A /24 split into two /25s gives two subnets of 126 usable hosts each. Split into four /26s: four subnets of 62 hosts. Each additional prefix bit halves the host count and doubles the subnet count. This is fundamental to cloud networking: AWS VPCs, GCP VPC networks, and Azure Virtual Networks all use CIDR for subnet planning, and getting the subnet sizes right upfront avoids painful renumbering later.
Special CIDR Blocks and Private Ranges
Beyond the RFC 1918 private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), several CIDR blocks have special meanings. 127.0.0.0/8 is the loopback range (127.0.0.1 = localhost). 169.254.0.0/16 is the APIPA link-local range — addresses self-assigned by hosts when DHCP is unavailable. 0.0.0.0/0 is the default route matching all addresses. /32 is a host route — a single IP address with no network or broadcast. /31 (RFC 3021) is used for point-to-point links where the minus-2 rule is waived.
Frequently Asked Questions
What does /24 mean in CIDR notation?
The /24 suffix means the first 24 bits of the 32-bit IP address are the network portion, and the remaining 8 bits identify individual hosts within the subnet. In binary, the subnet mask is 11111111.11111111.11111111.00000000, which converts to 255.255.255.0 in dotted decimal. A /24 subnet contains 256 total addresses — 254 usable host addresses after subtracting the network and broadcast addresses.
How many hosts does a /24 subnet support?
A /24 subnet has 8 host bits (32 - 24 = 8), giving 2^8 = 256 total addresses. Subtracting 2 reserved addresses (network address and broadcast address), there are 254 usable host addresses. This is the most common subnet size in corporate networks, often used for individual VLANs or building floors.
What is a subnet mask?
A subnet mask is a 32-bit number that divides an IP address into its network and host portions. In dotted-decimal notation (255.255.255.0), a '255' octet means all 8 bits are network bits; '0' means all 8 bits are host bits. Intermediate values like 255.255.255.128 (/25) split an octet between network and host bits. The subnet mask ANDed with any IP address in the subnet always produces the network address.
What is the broadcast address?
The broadcast address is the last address in a subnet — all host bits set to 1. Any packet sent to the broadcast address is delivered to every host on the subnet. For 192.168.1.0/24, the broadcast address is 192.168.1.255. Routers do not forward broadcast packets, which is why subnetting is used to control the scope of broadcast traffic on large networks.
What are the private IP address ranges?
RFC 1918 defines three private IP ranges reserved for internal networks, not routable on the public internet: 10.0.0.0/8 (10.0.0.0 – 10.255.255.255, Class A, ~16.7 million addresses), 172.16.0.0/12 (172.16.0.0 – 172.31.255.255, Class B range, ~1 million addresses), and 192.168.0.0/16 (192.168.0.0 – 192.168.255.255, Class C range, ~65,000 addresses). NAT (Network Address Translation) allows multiple devices sharing private IPs to access the internet through a single public IP.
Why do we subtract 2 from the number of hosts?
Two addresses in every subnet are reserved and cannot be assigned to hosts. The first address (all host bits = 0) is the network address — it identifies the subnet itself and is used in routing tables. The last address (all host bits = 1) is the broadcast address — packets sent here are delivered to all hosts on the subnet. These reservations apply to all standard IPv4 subnets; only point-to-point /31 links (RFC 3021) and loopback /32 addresses are treated differently.
What does 0.0.0.0/0 mean in a routing table?
The CIDR block 0.0.0.0/0 represents the default route — it matches every possible IPv4 address (prefix length 0 means no bits are fixed). Routers use this as the 'catch-all' rule: if no more specific route exists for a destination, send the packet to the default gateway. In cloud networking (AWS, GCP, Azure), adding 0.0.0.0/0 to a route table pointing to an internet gateway is what makes a subnet 'public' — able to reach and be reached from the internet.