CIDR Notation Explained: What /24, /16 and /32 Mean

CIDR notation writes an IP block as an address plus a slash and a number, such as 192.168.1.0/24, where the number says how many leading bits are the network part. A /24 fixes the first 24 of 32 bits, leaving 8 bits for hosts, so it contains 2⁸ = 256 addresses (192.168.1.0 to 192.168.1.255).

The quick rule for IPv4: addresses in a block = 2^{(32 − prefix)}. Every step of one in the prefix halves or doubles the block.

How to read CIDR notation

CIDR stands for Classless Inter-domain Routing. RFC 4632 defines the prefix as an address "followed by a decimal value between 0 and 32 that describes the number of significant bits." Those significant bits are the network; the rest identify hosts inside it.

Take 192.168.10.64/26. Written in binary, the last octet 64 is 01000000. The /26 keeps the first 24 bits (192.168.10) plus the first two bits of the last octet (01). The remaining 6 bits can be anything, so the block runs from 01000000 (64) to 01111111 (127):

• Network address: 192.168.10.64
• Last address (broadcast on a normal LAN): 192.168.10.127
• Size: 2⁶ = 64 addresses

So 192.168.10.100 is inside this block and 192.168.10.130 is not.

CIDR cheat sheet: /8 to /32

Masks and sizes below were generated with Python's ipaddress module (the code is further down, so you can regenerate them). "Usable hosts" assumes an ordinary LAN where the first and last address are reserved.

/31 is the exception to "subtract two". RFC 3021 says that on a point-to-point link with a 31-bit mask, both addresses "MUST be interpreted as host addresses", because a link with exactly two ends has no need for a network or broadcast address.

CIDR to subnet mask conversion

The prefix length is the number of 1 bits in the mask, counted from the left. Fill whole octets with 255 first, then convert the leftover bits:

Example: /21 = 8 + 8 + 5 bits, so the mask is 255.255.248.0. Going the other way, 255.255.255.224 has 8 + 8 + 8 + 3 one-bits, so it is /27.

Common CIDR blocks you will see

• 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16: the three private ranges from RFC 1918 (written there as 10/8, 172.16/12 and 192.168/16). Note that 172.16.0.0/12 runs up to 172.31.255.255, not 172.16.255.255.
• 0.0.0.0/0: every IPv4 address. It is the default route and the "anywhere" source in firewall and cloud security-group rules.
• 127.0.0.0/8: loopback. 203.0.113.5/32 in a firewall rule means exactly that one address.

Why CIDR replaced Class A, B and C

Before CIDR, IPv4 networks came in three fixed sizes: Class A (/8), Class B (/16) and Class C (/24). An organisation that needed 2,000 addresses had to take a whole Class B of 65,536 or juggle several Class Cs. RFC 4632 describes how the Internet community chose to "deprecate the Class A/B/C network address assignment system" in favour of prefixes of any length.

The second gain is aggregation. A provider holding a large block can advertise one route for all of it instead of one per customer. RFC 4632's worked example has a provider holding 10.24.0.0/13 and advertising only that aggregate upstream, while its customers use smaller pieces such as 10.24.0.0/21 and 10.24.16.0/20.

How to split a network into subnets

Adding one bit to the prefix splits a block in two. A /22 split into /24s gives 2^{(24 − 22)} = 4 subnets:

10.0.0.0/22  →  10.0.0.0/24, 10.0.1.0/24, 10.0.2.0/24, 10.0.3.0/24

The reverse also works when blocks are adjacent and aligned: 203.0.113.0/25 and 203.0.113.128/25 combine into 203.0.113.0/24. Two /25s that don't line up on a /24 boundary cannot be summarised that way.

Check CIDR math with Python

Python's standard library does all of this, so you never need to trust mental arithmetic for a firewall rule. Example session:

>>> import ipaddress
>>> net = ipaddress.ip_network("192.168.10.64/26")
>>> net.netmask, net.num_addresses, net.broadcast_address
(IPv4Address('255.255.255.192'), 64, IPv4Address('192.168.10.127'))
>>> ipaddress.ip_address("192.168.10.100") in net
True
>>> list(ipaddress.ip_network("10.0.0.0/22").subnets(new_prefix=24))
[IPv4Network('10.0.0.0/24'), IPv4Network('10.0.1.0/24'), IPv4Network('10.0.2.0/24'), IPv4Network('10.0.3.0/24')]
>>> list(ipaddress.collapse_addresses([ipaddress.ip_network("203.0.113.0/25"), ipaddress.ip_network("203.0.113.128/25")]))
[IPv4Network('203.0.113.0/24')]

One error you will meet: writing a host address with a prefix. ipaddress.ip_network("192.168.1.10/24") raises ValueError: 192.168.1.10/24 has host bits set, because 192.168.1.10 is not the start of a /24. Pass strict=False to get 192.168.1.0/24, or use ip_interface() if you mean "this host, on that network".

CIDR in IPv6

IPv6 uses the same slash notation over 128 bits. RFC 4291 defines it as "ipv6-address/prefix-length", where the prefix length is "how many of the leftmost contiguous bits of the address comprise the prefix". Most LAN subnets are /64, because the same RFC requires 64-bit interface IDs for most unicast addresses. A /48 therefore holds 2¹⁶ = 65,536 separate /64 subnets.

The host count stops being useful at that scale (a /64 has 2⁶⁴ addresses), so with IPv6 you plan by number of subnets, not number of hosts.

If your numbers don't add up

Most CIDR mistakes are one of three things: forgetting that the network address must be aligned to the block size (a /26 can only start at .0, .64, .128 or .192), confusing 172.16.0.0/12 with a /16, or counting usable hosts on a /31 or /32 the LAN way. Paste the block into the Python snippet above and compare. For how these ranges relate to the address your router hands out, see public vs private IP addresses and what DHCP does.

Frequently asked questions

How many usable hosts are in a /24?

A /24 has 256 addresses. On an ordinary IPv4 LAN the first (network address) and last (broadcast address) are not assigned to devices, which leaves 254 usable host addresses, for example 192.168.1.1 to 192.168.1.254 in 192.168.1.0/24.

What does /32 mean?

A /32 is a single IPv4 address: all 32 bits are fixed, so the block contains exactly one address. It is used for host routes, firewall rules that match one machine, and loopback addresses on routers. The IPv6 equivalent is /128.

Is a subnet mask the same as a CIDR prefix?

They carry the same information in two formats. The prefix length counts the 1 bits in the mask, so /24 equals 255.255.255.0, /16 equals 255.255.0.0 and /26 equals 255.255.255.192. CIDR notation is shorter and also works for IPv6, which does not use dotted masks.

Why does 0.0.0.0/0 match everything?

A prefix length of 0 fixes no bits at all, so every IPv4 address falls inside it. That is why 0.0.0.0/0 means 'any address' in firewall rules and is the destination of the default route. In IPv6 the same idea is written ::/0.

Sources

• RFC 4632: Classless Inter-domain Routing (CIDR)
• RFC 1918: Address Allocation for Private Internets
• RFC 3021: Using 31-Bit Prefixes on IPv4 Point-to-Point Links
• RFC 4291: IP Version 6 Addressing Architecture
• Python documentation: ipaddress module