CIDR Notation and Subnetting Explained

When you assign a static address, configure a firewall rule, or divide a private network, you will encounter values such as 192.168.10.0/24. The address identifies the network, while the number after the slash tells you how much of the address is fixed and how much remains available for hosts.

This guide explains how CIDR prefixes map to subnet masks, how to find network and broadcast addresses, and how to divide an IPv4 block into smaller subnets.

For instant calculations and a visual binary split, use the subnet calculator .

What CIDR Notation Means #

CIDR stands for Classless Inter-Domain Routing. It replaced the older class-based system with variable-length prefixes, allowing networks to be sized and routed more precisely.

An IPv4 CIDR block contains an address followed by a slash and a prefix length:

192.168.10.0/24

An IPv4 address contains 32 bits. The /24 prefix means the first 24 bits identify the network, leaving 8 bits for addresses inside that network. A longer prefix fixes more network bits and creates a smaller block. A shorter prefix leaves more host bits and creates a larger block.

The prefix can range from /0, which covers the entire IPv4 address space, to /32, which identifies one address. CIDR notation is used for both network allocation and routing, so the same format can describe a LAN subnet, a firewall source range, or a single host route.

Network Bits and Host Bits #

To see the /24 boundary, write the address and mask in binary:

Address: 11000000.10101000.00001010.00000000
Mask:    11111111.11111111.11111111.00000000
         <------ network ------><-- host -->

Every 1 in the mask belongs to the network prefix. Every 0 leaves a bit that can vary within the block. Because /24 leaves 8 host bits, the block contains 2^8, or 256, addresses.

The network portion stays constant for every address in the block. Only the last 8 bits change, producing the range 192.168.10.0 through 192.168.10.255.

Convert a CIDR Prefix to a Subnet Mask #

A subnet mask expresses the same boundary as a CIDR prefix, but in dotted-decimal form. A /24 has 24 one bits followed by 8 zero bits:

11111111.11111111.11111111.00000000
255.255.255.0

Prefixes that end on an octet boundary are easy to recognize: /8 is 255.0.0.0, /16 is 255.255.0.0, and /24 is 255.255.255.0.

For a prefix such as /26, the first two bits of the final octet also belong to the network:

11111111.11111111.11111111.11000000
255.255.255.192

The binary value 11000000 equals 192, so /26 maps to 255.255.255.192. The remaining six host bits provide 2^6, or 64, total addresses per subnet.

Calculate the Number of Addresses and Hosts #

For a normal IPv4 subnet, calculate the total number of addresses with this formula:

Total addresses = 2^(32 - prefix length)

A /27 leaves five host bits, so it contains 2^5 = 32 addresses. The first address is normally reserved as the network address, and the last is the broadcast address, leaving 30 addresses for host interfaces.

Two prefixes need separate treatment:

• A /31 contains two addresses. On a point-to-point link, RFC 3021 treats both as host addresses because that link has no need for a separate network or broadcast address.
• A /32 contains one address and represents a host route, not a conventional multi-host subnet.

The familiar total minus 2 rule therefore applies to conventional IPv4 subnets from /0 through /30, not blindly to every prefix.

Find the Network and Broadcast Addresses #

Consider the address 192.168.10.34/27. A /27 mask is 255.255.255.224, which creates blocks of 32 addresses in the final octet:

0-31, 32-63, 64-95, 96-127, 128-159, 160-191, 192-223, 224-255

The address .34 falls in the 32-63 block. That gives us:

• Network address: 192.168.10.32
• First usable address: 192.168.10.33
• Last usable address: 192.168.10.62
• Broadcast address: 192.168.10.63

You can find the block size by subtracting the changing mask octet from 256. For /27, 256 - 224 = 32. Starting at zero, count in increments of 32 until you find the range that contains the address.

On Linux, the ip command displays each interface address together with its CIDR prefix:

ip -brief address

lo               UNKNOWN        127.0.0.1/8 ::1/128
eth0             UP             192.168.10.34/27

The output shows that eth0 uses the /27 network calculated above.

Subnet a /24 Network into /26 Blocks #

Suppose you have 192.168.10.0/24 and need four equal networks. Moving from /24 to /26 borrows two host bits for subnetting. Two borrowed bits produce 2^2 = 4 subnets.

Each /26 contains 64 total addresses and 62 conventional host addresses:

The subnet boundaries increase by 64 because /26 leaves six host bits and 2^6 = 64. A network address must start on one of these boundaries. For example, 192.168.10.64/26 is valid, but 192.168.10.70/26 is an address inside that network rather than the network identifier.

Combine Networks with Route Aggregation #

CIDR also lets routers summarize adjacent networks into one larger route. For example, these four /24 networks are contiguous:

192.168.0.0/24
192.168.1.0/24
192.168.2.0/24
192.168.3.0/24

They can be advertised as the single route 192.168.0.0/22. A /22 contains 1024 addresses, exactly the same total as four /24 blocks.

Aggregation works only when the networks are contiguous and aligned on the larger prefix boundary. The four networks from 192.168.1.0/24 through 192.168.4.0/24 cannot form one /22, even though their total size is the same, because the range does not start on a /22 boundary.

CIDR Notation in IPv6 #

IPv6 uses CIDR prefixes over a 128-bit address. For example:

2001:db8:1234:5600::/64

The /64 prefix fixes the first 64 bits and leaves the remaining 64 bits for the interface identifier. A /64 is the common size for an IPv6 LAN, especially when Stateless Address Autoconfiguration (SLAAC) is used, although routing prefixes can have other lengths.

IPv6 has no broadcast address. Multicast replaces broadcast behavior, and all-zero or all-one values are legal within address fields unless a specific rule says otherwise. See the IPv4 vs IPv6 comparison for the broader differences between the protocols.

Quick Reference #

Conclusion #

The CIDR prefix tells you exactly where the network bits end and the host bits begin. Once you can convert that boundary to a mask and block size, you can calculate ranges, divide networks, and check firewall rules without relying on the old address classes.

About the authors

Dejan Panovski

Dejan Panovski is the founder of Linuxize, an RHCSA-certified Linux system administrator and DevOps engineer based in Skopje, Macedonia. Author of 800+ Linux tutorials with 20+ years of experience turning complex Linux tasks into clear, reliable guides.

View author page