Networking10 min readUpdated

CIDR Notation and Subnetting Explained

An IP range like 10.0.4.0/22 packs the network, its size and its boundaries into one short string. Once you can read it in binary, every subnetting question — host counts, masks, valid starting points, merging ranges — comes down to the same arithmetic.

Rahul KumarEditor

CIDR notation describes an IP network as an address followed by a slash and a number, such as 192.168.10.64/26. The number is the prefix length: how many leading bits are fixed as the network, with the rest left for hosts. Everything else — the subnet mask, the number of addresses, the first and last host, where the block may start — follows from that one number.

Addresses Are 32-Bit Numbers

An IPv4 address is a single 32-bit number. The dotted form is just the four bytes written in decimal, so 192.168.10.77 is:

text
192 .168 .10 .77 11000000 10101000 00001010 01001101

A prefix length draws a line through those 32 bits. Everything to the left is the network portion and is the same for every address in the block. Everything to the right is the host portion and can take any value. A /26 puts the line after bit 26, leaving 6 host bits:

text
192.168.10.77/26 11000000.10101000.00001010.01|001101 └──────── network: 26 bits ──┘└host: 6┘

From Prefix to Network, Broadcast and Hosts

Three operations on the host bits give you everything about the block:

  • Network address — set every host bit to 0. 01001101 becomes 01000000 = 64, so the network is 192.168.10.64.
  • Broadcast address — set every host bit to 1. 01111111 = 127, so the broadcast is 192.168.10.127.
  • Usable hosts — everything in between: 192.168.10.65 to 192.168.10.126.

The size of the block is 2 raised to the number of host bits. Six host bits give 2⁶ = 64 addresses; subtract the network and broadcast addresses and 62 are left for devices. The general formula is 2(32 − prefix) − 2.

bash
# ipcalc (Debian/Ubuntu: apt install ipcalc) ipcalc 192.168.10.77/26 # Python's standard library, available almost everywhere python3 -c "import ipaddress as i; n=i.ip_network('192.168.10.77/26', strict=False); \ print(n, n.netmask, n.broadcast_address, n.num_addresses)" # 192.168.10.64/26 255.255.255.192 192.168.10.127 64
The two exceptions: /31 and /32A /31 has only two addresses, and reserving both would leave nothing. RFC 3021 lets point-to-point links use both, with no network or broadcast address. A /32 is a single host — used for loopbacks, firewall rules and route entries that point at exactly one address.

Subnet Masks Are the Same Line, Written Differently

A subnet mask is the prefix written as 32 bits: 1s over the network, 0s over the hosts, shown in dotted decimal. A /26 is 26 ones followed by 6 zeros, and the last byte 11000000 is 192, so the mask is 255.255.255.192. Masks and prefixes carry exactly the same information; CIDR notation is simply shorter.

A wildcard mask is the inverse — 1s over the host bits — so a /26 is 0.0.0.63. You meet it in Cisco access lists and OSPF configuration. To convert, subtract each octet of the subnet mask from 255.

PrefixSubnet maskWildcardAddressesUsable hosts
/8255.0.0.00.255.255.25516,777,21616,777,214
/16255.255.0.00.0.255.25565,53665,534
/20255.255.240.00.0.15.2554,0964,094
/22255.255.252.00.0.3.2551,0241,022
/23255.255.254.00.0.1.255512510
/24255.255.255.00.0.0.255256254
/25255.255.255.1280.0.0.127128126
/26255.255.255.1920.0.0.636462
/27255.255.255.2240.0.0.313230
/28255.255.255.2400.0.0.151614
/29255.255.255.2480.0.0.786
/30255.255.255.2520.0.0.342
/31255.255.255.2540.0.0.122 (point-to-point)
/32255.255.255.2550.0.0.011 (single host)

The full table for every prefix is on the Subnet Mask Cheat Sheet.

Blocks Must Start on Their Own Boundary

This is the rule people trip over. A block of size n can only start at a multiple of n, because its network address must have every host bit set to 0. A /26 holds 64 addresses, so in the last octet a /26 can start at 0, 64, 128 or 192 — never at 100.

For prefixes shorter than /24 the same rule applies one octet up. A /22 spans four values of the third octet, so it must start where the third octet is a multiple of 4:

text
10.0.4.0/22 valid → 10.0.4.0 – 10.0.7.255 10.0.8.0/22 valid → 10.0.8.0 – 10.0.11.255 10.0.6.0/22 invalid → really 10.0.4.0/22 (6 is not a multiple of 4)
Misaligned input is silently correctedMost tools treat 10.0.6.0/22 as "an address inside a /22" and give you 10.0.4.0/22 back without comment. If you typed it into a firewall rule or a route, the rule now covers 10.0.4.0–10.0.5.255 as well — 512 addresses you never meant to include. Check the network address the tool reports, not the one you typed.

A shortcut for any prefix: the block size in the octet where the line falls is 256 minus that octet of the mask. A /22 mask is 255.255.252.0, and 256 − 252 = 4, so /22 networks step by 4 in the third octet.

Subnetting: Splitting a Block

Lengthening the prefix by one bit halves the block. A /24 becomes two /25s, four /26s, eight /27s, and so on — each extra bit doubles the count and halves the size:

text
192.168.10.0/24 split into /26 (2 extra bits → 4 subnets of 64) 192.168.10.0/26 hosts .1 – .62 broadcast .63 192.168.10.64/26 hosts .65 – .126 broadcast .127 192.168.10.128/26 hosts .129 – .190 broadcast .191 192.168.10.192/26 hosts .193 – .254 broadcast .255

Equal splits are the simple case. Real networks rarely need equal sizes — an office LAN needs 100 addresses and a router link needs 2 — and giving each a /25 wastes most of the space. VLSM (variable-length subnet masking) sizes each subnet to fit; the VLSM planning guide walks through it step by step.

Supernetting: Merging Blocks

The reverse works too. Shortening the prefix by one bit merges two neighbouring blocks into one, which is how ISPs keep routing tables small: one announcement of 203.0.112.0/22 instead of four /24s. The catch is alignment again. Two /24s merge only if the lower one starts on a /23 boundary:

text
192.168.0.0/24 + 192.168.1.0/24 → 192.168.0.0/23 ✓ 192.168.1.0/24 + 192.168.2.0/24 → no single /23 ✗ (needs two entries)

The CIDR Aggregator takes a list of ranges and returns the fewest valid blocks that cover them, and the subnet calculator's range mode converts any start–end range into CIDR blocks.

Where Classes A, B and C Went

Before 1993, the boundary was fixed by the first octet: class A (1–126) was always a /8, class B (128–191) a /16 and class C (192–223) a /24. An organisation that needed 300 addresses had to take a class B with 65,534 of them. CIDR (RFC 1518 and 1519, now RFC 4632) removed the fixed boundary so a prefix can be any length, which slowed IPv4 exhaustion and made route aggregation possible.

The class names live on as shorthand — "a class C" still means a /24 to most people — but nothing routes by class any more.

Common Mistakes

  • Forgetting the reserved addresses. A /24 holds 256 addresses but only 254 hosts, and the gateway takes one of those. In AWS and Azure, five addresses per subnet are reserved, so a /28 gives you 11, not 14.
  • Misaligned blocks. Writing 10.0.6.0/22 or 192.168.10.100/26 as a network. The address is valid; the network is a different one.
  • Overlapping subnets. 10.0.0.0/23 and 10.0.1.0/24 overlap — the second sits inside the first. Overlaps cause asymmetric routing and VPN failures that are hard to trace.
  • Confusing the mask with the wildcard. Pasting 0.0.0.255 where a mask is expected, or 255.255.255.0 into an ACL.
See the bits for your own rangeThe Subnet Calculator shows the network and host bits, splits blocks, plans by host count and checks whether an address falls inside.
Calculate a subnet

Frequently Asked Questions

1. What does the /24 in 192.168.1.0/24 mean?

It is the prefix length: the first 24 of the 32 bits identify the network and the remaining 8 identify hosts inside it. Eight host bits give 2⁸ = 256 addresses, and on an ordinary LAN two of them — the network address 192.168.1.0 and the broadcast address 192.168.1.255 — are reserved, leaving 254 for devices. The same prefix written as a mask is 255.255.255.0.

2. How do I work out how many hosts a subnet holds?

Take 32 minus the prefix length, raise 2 to that power, and subtract 2 for the network and broadcast addresses: a /26 has 2⁶ − 2 = 62 usable hosts. The two exceptions are /31, which RFC 3021 lets you use for both addresses on a point-to-point link, and /32, which is a single address. Cloud providers reserve more — AWS and Azure keep 5 addresses in every subnet.

3. Why is 10.0.6.0/22 not a valid network?

A /22 covers 1,024 addresses, which is four values of the third octet, so a /22 network must start where the third octet is a multiple of 4: 10.0.0.0, 10.0.4.0, 10.0.8.0 and so on. 10.0.6.0 sits inside the block that starts at 10.0.4.0, so most tools quietly normalise it to 10.0.4.0/22. Routers and firewalls may reject it, or apply the rule to a different range than you meant.

4. What is the difference between a subnet mask and a wildcard mask?

They are bitwise inverses. A subnet mask has 1s over the network bits (255.255.255.192 for a /26); a wildcard mask has 1s over the host bits (0.0.0.63). Subnet masks configure interfaces; wildcard masks appear in Cisco ACLs and OSPF network statements, where a 1 bit means "any value here is fine". Subtract each octet of the subnet mask from 255 to convert.

5. Are classes A, B and C still used?

Not for routing. Classful addressing fixed the boundary at /8, /16 or /24 based on the first octet, which wasted huge amounts of space, and CIDR replaced it in 1993. The terms survive as shorthand — people still call a /24 "a class C" — and some old software infers a default mask from the class, but every modern router and operating system works with an explicit prefix length.

6. Can I combine two subnets into one bigger one?

Only when they are the same size, adjacent, and the lower one starts on the boundary of the bigger block. 192.168.0.0/24 and 192.168.1.0/24 merge into 192.168.0.0/23. 192.168.1.0/24 and 192.168.2.0/24 are adjacent but cannot — a /23 has to start on an even third octet. The CIDR Aggregator merges a list of ranges into the fewest valid blocks.