CIDR notation and subnet masks explained
CIDR notation writes a network as an address followed by a slash and a number, such as 192.0.2.0/24. The number says how many bits at the start of the address identify the network, and the rest identify the devices inside it.
Reading a prefix
An IPv4 address has 32 bits. In 192.0.2.0/24, the first 24 bits are the network and the last 8 bits are for hosts. A bigger number after the slash means a smaller network. /24 holds 256 addresses, /25 holds 128 and /16 holds 65,536.
The subnet mask
The older way to write the same thing is a subnet mask. A /24 is 255.255.255.0, a /16 is 255.255.0.0 and a /30 is 255.255.255.252. Each 255 means eight bits belonging to the network.
Worked example
For 192.0.2.0/24:
- Network address: 192.0.2.0
- Broadcast address: 192.0.2.255
- Usable hosts: 192.0.2.1 to 192.0.2.254, which is 254 addresses
IPv6 works the same way
IPv6 uses the same slash notation out of 128 bits. A home connection is commonly given a /56 or /64, which contains an enormous number of addresses.
Why it matters
CIDR is used in firewall rules, cloud networks, router settings and allow-lists. Reading the prefix quickly tells you how wide a range you are trusting or blocking.
Common questions
What does /24 mean?
The first 24 bits identify the network, which leaves 8 bits for devices: 256 addresses, 254 of them usable.
Why are two addresses unusable in a network?
The first is the network address and the last is the broadcast address. Neither can be given to a device in the usual setup.
How do I split a network into smaller ones?
Add to the prefix. A /24 splits into two /25 networks or four /26 networks. The subnet calculator does it for you.