Subnets and CIDR explained: prefixes, masks and usable hosts

A network address on its own does not say how big the network is. CIDR notation adds that: 192.168.1.0/24 means “the network that starts at 192.168.1.0, where the first 24 bits are the network and the rest number the devices on it”. Once you can read that number, subnet masks, host counts and address plans stop being guesswork. This guide covers the notation, the common sizes, and how to split one network into several.

What the number after the slash means

An IPv4 address is 32 bits. The prefix length — the number after the slash — says how many of those bits, counted from the left, identify the network. The bits that remain identify a device on it.

• /2424 network bits, 8 host bits: 2⁸ = 256 addresses.
• /2626 network bits, 6 host bits: 2⁶ = 64 addresses.
• /1616 network bits, 16 host bits: 65,536 addresses.

Each step of one in the prefix halves or doubles the network: a /25 is half a /24, and a /23 is two /24s side by side.

Before CIDR, networks came in three fixed sizes — class A, B and C, the equivalents of /8, /16 and /24. CIDR replaced those classes in 1993 so that networks could be any size. That slowed the exhaustion of IPv4 addresses and let providers announce many small networks to the rest of the internet as one larger block.

Subnet masks: the same thing, written out

A subnet mask is the prefix length written as an address: one bits for the network part, zero bits for the host part. A /24 is 24 ones followed by 8 zeros, which is 255.255.255.0. Older equipment and many operating system settings ask for the mask; newer ones accept the prefix. They mean exactly the same thing.

Some router and firewall configurations use a wildcard mask instead, which is the mask inverted: 0.0.0.255 for a /24.

The common sizes

Why two addresses are missing

In every IPv4 subnet up to /30, two addresses cannot be given to a device. The first, with all host bits at zero, is the network address: the name of the subnet itself. The last, with all host bits at one, is the broadcast address: a packet sent to it reaches every device on the subnet.

Take 192.168.10.34/26. The /26 leaves 6 host bits, so the subnet holds 64 addresses:

• 192.168.10.0Network address.
• 192.168.10.1First usable host.
• 192.168.10.62Last usable host.
• 192.168.10.63Broadcast address.

Two sizes are exceptions. A /31 has only two addresses, and on a link between two routers both can be used, because such a link needs neither a network address nor a broadcast. A /32 is a single address, used for a route to one host or a firewall rule that matches one machine exactly.

CIDR / subnet calculator

Splitting a network into subnets

To divide a network, move the prefix to the right. Each bit you borrow from the host part doubles the number of subnets and halves the size of each one.

Say you have 192.168.0.0/24 and need eight separate networks. Eight is 2³, so borrow three bits: 24 + 3 = /27. Each /27 holds 32 addresses, 30 of them usable, and a new one starts every 32 addresses:

• 192.168.0.0/27Hosts .1 to .30.
• 192.168.0.32/27Hosts .33 to .62.
• 192.168.0.64/27Hosts .65 to .94 — and so on, up to 192.168.0.224/27.

Working from the other end: to fit 50 devices you need at least 52 addresses — 50 plus the network and broadcast addresses. The smallest power of two that covers that is 64, a /26, with 62 usable hosts. Leave room for growth: a network that is exactly full today is too small next year.

The calculator does both: it splits a base network into a number of subnets, or finds the prefix that fits a number of hosts.

CIDR in IPv6

IPv6 uses the same slash notation, but the sizes look different in practice. The standard size for a single network is a /64: 64 bits for the network and 64 for the devices on it — about 18 quintillion addresses. Automatic address configuration relies on that split, so IPv6 networks are not made smaller to save space.

Providers give each customer a block of several /64s to divide up. A /56, common for homes, holds 256 of them; a /48, common for businesses, holds 65,536. IPv6 has no broadcast, so no address is set aside for one.

Frequently asked questions

Is 192.168.1.0/24 the same as 192.168.1.0 with the mask 255.255.255.0?

Yes. The prefix and the mask are two ways of writing the same size.

Why can I not use 192.168.1.0 or 192.168.1.255 for a device on a /24?

They are the network and broadcast addresses of that subnet. Some devices accept them anyway, but traffic to and from them behaves unpredictably.

What does 0.0.0.0/0 mean?

Every IPv4 address: a prefix of zero bits matches everything. It is how a default route and “allow from anywhere” firewall rules are written. The IPv6 equivalent is ::/0.

Does a bigger prefix number mean a bigger network?

No, the reverse. A /28 is much smaller than a /24: the larger the prefix, the fewer bits are left for hosts.

Related guides

• IP addresses explained: IPv4, IPv6 and the reserved ranges
• DNS records explained: A, AAAA, CNAME, MX, TXT and NS
• Unix timestamps and time zones explained
• Image formats explained: JPEG, PNG, WebP, AVIF and HEIC