CIDR notation and subnetting explained, with the math worked out
/24 shows up constantly in networking — router configs, firewall rules, cloud security
group definitions — but it's easy to use it correctly by pattern-matching without actually
understanding what the math behind it is doing. Here's the actual arithmetic, worked
through by hand once so the shorthand stops feeling like magic.
What the number after the slash actually means
CIDR (Classless Inter-Domain Routing, defined in RFC 4632)
notation writes an IP address's subnet as address/prefix-length, where the prefix length
is how many bits — counting from the left — are fixed as the "network" portion. The
remaining bits belong to individual hosts on that network.
An IPv4 address is 32 bits total, so /24 means the first 24 bits are the network and the
last 8 bits are free for hosts — exactly one byte, which is why /24 networks are so
common and intuitive: the first three numbers in the dotted-decimal address stay fixed, and
the last one varies (0-255).
Working the math for 192.168.1.0/24
Take the prefix length and build a 32-bit mask: that many 1 bits from the left, then 0
bits filling the rest.
/24 → 11111111.11111111.11111111.00000000 = 255.255.255.0
That's the subnet mask. From there:
- Network address: the IP with all host bits set to 0 →
192.168.1.0 - Broadcast address: the IP with all host bits set to 1 →
192.168.1.255 - Usable host range: everything between those two →
192.168.1.1through192.168.1.254 - Total addresses: 2^(32 − prefix) = 2^8 = 256
- Usable hosts: total minus 2 (network and broadcast are reserved) = 254
That last subtraction is the part people forget — a /24 has 256 addresses but only 254
you can actually assign to a device.
A smaller prefix means a bigger network
This trips people up at first: a smaller number after the slash means a larger network, because it fixes fewer bits, leaving more for hosts.
| CIDR | Subnet mask | Total addresses | Usable hosts | |---|---|---|---| | /30 | 255.255.255.252 | 4 | 2 | | /29 | 255.255.255.248 | 8 | 6 | | /28 | 255.255.255.240 | 16 | 14 | | /24 | 255.255.255.0 | 256 | 254 | | /16 | 255.255.0.0 | 65,536 | 65,534 | | /8 | 255.0.0.0 | 16,777,216 | 16,777,214 |
/8 networks like 10.0.0.0/8 (one of the RFC 1918
private ranges) are enormous — over 16 million addresses — which is why they show up as the
default for large private networks rather than public allocations.
The two exceptions: /31 and /32
The "subtract 2 for network and broadcast" rule breaks down at the extremes on purpose:
/31has only 2 addresses total, leaving none spare for network/broadcast. RFC 3021 specifically carves out an exception allowing both addresses to be used, intended for point-to-point links (a cable directly connecting two routers) where a broadcast address serves no purpose anyway./32is a single address with no network/host split at all — used for host routes, where you're routing to one specific device rather than a range.
Normalizing a host address to its network
If you take a host address like 192.168.1.100 and apply a /24 mask, you get back to the
network address, not the original host — this is the bitwise AND operation that subnet
math is actually built on: 192.168.1.100 AND 255.255.255.0 = 192.168.1.0. Any CIDR
calculator that doesn't do this — silently treating whatever address you typed as if it
were already the network address — is skipping a step that matters for correctness.
Sources: RFC 4632 (CIDR); RFC 1918 (private address ranges); RFC 3021 (/31 point-to-point links).