LessInAILessInAI home

CIDR notation and subnet math

What /24 really means, how to read a CIDR block's size at a glance, and the handful of blocks every developer should recognize.

What the slash number means

CIDR (Classless Inter-Domain Routing) writes an IP range as an address plus a prefix length: 10.0.0.0/24. The number after the slash says how many of the 32 bits are fixed as the network part; the remaining bits vary across hosts. /24 fixes the first 24 bits — the first three octets — leaving 8 bits, which is 256 addresses.

The formula is always the same: 2^(32 − prefix) addresses in the block. /24 gives 256, /16 gives 65,536, /28 gives 16. Every step up in the prefix halves the block; every step down doubles it.

Blocks worth memorizing

  • /32 — exactly one address. A host route or a firewall rule for a single machine.
  • /24 — 256 addresses. The everyday LAN size; 192.168.1.0/24 covers 192.168.1.0–255.
  • /16 — 65,536 addresses. The whole 192.168.x.x private range is 192.168.0.0/16.
  • /8 — 16.7 million addresses. 10.0.0.0/8, the big private block.
  • /28 and /30 — 16 and 4 addresses. Typical cloud subnets and point-to-point links.

Network, broadcast, and usable hosts

In a traditional subnet the first address names the network itself and the last is the broadcast address, so a /24 has 254 usable hosts, not 256. For /31 and /32 the rules change: a /31 is a point-to-point link with two usable addresses and no broadcast (RFC 3021), and /32 is a single host.

Cloud environments steal more addresses: AWS reserves the first four and the last address of every subnet, so a /28 there yields 11 usable IPs, not 14. Always check your platform's reservation rules before sizing a subnet.

Alignment: why 10.0.0.5/24 is not a network address

A CIDR block must start at an address aligned to its size: a /24 starts where the last octet is 0, a /25 at 0 or 128, a /28 at multiples of 16. Writing 10.0.0.5/24 does not create a smaller network around .5 — the host bits are simply masked off, and the network is still 10.0.0.0/24. Most tools accept host-bits-set input and show you the masked result; knowing this saves a confusing debugging session with a firewall rule that 'should have matched'.

Private ranges and where CIDR shows up

The three RFC 1918 private ranges — 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 — plus 127.0.0.0/8 loopback and 169.254.0.0/16 link-local are the addresses you can use freely inside your own network. You will write CIDR in VPC subnets, Kubernetes pod and service CIDRs, security groups, firewall rules, and reverse-proxy allow-lists. In every case the skill is the same: read the prefix, know the size, check the alignment.

References

Related tools