Dev Basics · 5 min read
Subnetting and CIDR Notation Explained
Whether you are configuring a cloud VPC, a firewall rule, or a home router, you will meet addresses like 10.0.0.0/16. CIDR notation looks cryptic but rests on one idea: splitting a 32-bit address into a network part and a host part.
Try it yourself with the related tool.
Calculate a subnet →Advertisement
What the slash means
An IPv4 address is 32 bits, written as four numbers from 0 to 255. The number after the slash is how many leading bits identify the network. In 192.168.1.0/24, the first 24 bits (192.168.1) are the network and the last 8 bits number the hosts. The same thing as a subnet mask is 255.255.255.0.
Counting addresses
A prefix of /n leaves 32 − n host bits, so the block holds 2^(32 − n) addresses. A /24 has 256, a /16 has 65,536, and a /28 has 16. In a traditional subnet, the first address is the network address and the last is the broadcast address, so usable hosts are two fewer — 254 in a /24. Cloud providers often reserve a few more.
Splitting a network
Each extra bit of prefix halves the block. A /24 splits into two /25s of 128 addresses, four /26s of 64, and so on. To find which subnet an address belongs to, apply the mask with a bitwise AND. Plan subnets on these boundaries — a /26 must start at .0, .64, .128, or .192.
Private ranges to know
Three ranges are reserved for private networks and never routed on the internet: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. 127.0.0.0/8 is loopback, and 0.0.0.0/0 in a route or firewall rule means "everything". When designing cloud networks, pick ranges that will not overlap with offices or other VPCs you may connect later.