DevYou have seen addresses written like 192.168.1.0/24 in router settings, cloud consoles and firewall rules. The part after the slash is CIDR notation, and once it clicks, half of networking documentation stops looking like numerology. This guide builds it from the ground up: what the number counts, how it relates to the older netmask notation, and how subnetting — carving one network into several smaller ones — actually works. Every example can be checked with our subnet calculator as you read.
An IP address is two addresses in a trench coat
An IPv4 address is 32 bits, written as four numbers (192.168.1.10) purely for human convenience. Every network divides those 32 bits into two parts:
- The network prefix — the leading bits, identical for every device on the same network. It answers “which network are you on?”
- The host part — the remaining bits, which name one device inside that network.
When two devices share a prefix, they can talk directly. When they don’t, traffic must go through a router. Everything in subnetting — masks, ranges, address counts — is arithmetic on where the boundary between those two parts sits.
CIDR: counting the network bits
CIDR (Classless Inter-Domain Routing) writes the boundary as a single number: the count of network bits. 192.168.1.0/24 means “the first 24 bits are the network; the last 8 bits are hosts”. The same fact can be written as a netmask — 24 one-bits followed by 8 zero-bits, i.e. 255.255.255.0. The two notations are interchangeable; CIDR is simply shorter.
A few prefixes worth recognising on sight:
| CIDR | Netmask | Total addresses | Usable hosts | Typical use |
|---|---|---|---|---|
| /8 | 255.0.0.0 | 16,777,216 | 16,777,214 | The whole 10.x.x.x private block |
| /16 | 255.255.0.0 | 65,536 | 65,534 | A large office or campus network |
| /24 | 255.255.255.0 | 256 | 254 | A home or small-office LAN |
| /26 | 255.255.255.192 | 64 | 62 | One department carved out of a /24 |
| /30 | 255.255.255.252 | 4 | 2 | A point-to-point link between routers |
| /32 | 255.255.255.255 | 1 | 1 | A route to exactly one host |
Two formulas generate the whole table: total addresses = 2^(32 − prefix), and usable hosts = total − 2 for classic subnets. The missing two are the network address (host bits all zero — it names the network itself) and the broadcast address (host bits all one — it reaches every device at once). The exceptions are /31, where RFC 3021 lets both addresses be used on point-to-point links, and /32, a single host.
A worked example: 192.168.1.0/24
Take the network most home routers create:
- Network address:
192.168.1.0— host bits all zero. - Broadcast address:
192.168.1.255— host bits all one. - Usable range:
192.168.1.1–192.168.1.254— the 254 addresses DHCP hands out and you may assign manually. - Netmask:
255.255.255.0; wildcard mask (used by some Cisco gear):0.0.0.255.
Any address from 192.168.1.0 to 192.168.1.255 belongs to this subnet, whatever the last number is on your device — the /24 boundary says only the first three numbers decide “same network”.
Subnetting: splitting one network into several
Move the boundary right and one network becomes several smaller ones. Carve 192.168.1.0/24 into /26s (two more network bits) and you get four subnets of 62 usable hosts:
| Subnet | Network | Usable range | Broadcast |
|---|---|---|---|
| 1 | 192.168.1.0/26 | .1 – .62 | .63 |
| 2 | 192.168.1.64/26 | .65 – .126 | .127 |
| 3 | 192.168.1.128/26 | .129 – .190 | .191 |
| 4 | 192.168.1.192/26 | .193 – .254 | .255 |
Each step right doubles the subnet count and halves the size — that trade-off is the entire game. Organisations subnet to isolate departments, contain broadcast traffic and match address space to need. The cost of guessing wrong is asymmetric: too large wastes addresses you can’t reclaim without renumbering everything; too small runs out mid-project. Running the real numbers (the calculator shows the binary view, which makes the boundary visible) beats memorising the table.
Three beginner traps
- “My address is 192.168.1.10/24, so my network is 192.168.1.10.” No — your device is .10; the network it sits on is .0/24. The address after the slash convention is always written with host bits zeroed when naming a network.
- Counting 256 hosts in a /24. It’s 254 usable; the network and broadcast addresses are spoken for (except /31 and /32, above).
- Assuming masks must end in .0. A netmask is any run of 1s followed by 0s: 255.255.255.192 (/26) and 255.240.0.0 (/12 — the second private range, 172.16.0.0/12) are both ordinary. What a mask cannot be is non-contiguous, like 255.0.255.0 — no prefix length describes it.
If you are working with addresses rather than designing networks, the companion piece is our guide to public vs private IP addresses — the /8, /12 and /16 private blocks in the table above are exactly the ranges it explains.