What CIDR notation actually means
CIDR notation writes an IP network as an address followed by a slash and a number — like 10.0.0.0/24 — where the number is the prefix length: how many of the address's 32 bits are locked as the network portion, leaving the rest free for host addresses. In 10.0.0.0/24, the /24 fixes the first 24 bits (10.0.0) and leaves the last 8 bits for hosts, which produces 256 total addresses and 254 usable ones. The rule that governs everything else is simple: each time the prefix number gets smaller by one, the network doubles in size; each time it gets larger by one, the network halves. That is the entire mechanic — no address classes, no lookup tables.
That's the summary an AI Overview will hand you. What it can't show you is the bit-level picture that makes the slash number click, a size table you can read at a glance, and a calculator that does the math on your own address. CIDR ("Classless Inter-Domain Routing," defined in RFC 4632) replaced the old Class A/B/C system in 1993 precisely because those fixed classes wasted enormous ranges — CIDR lets a network be any power-of-two size. Below is how to read it without memorizing anything.
The slash number is a boundary, not a count
The most common mistake is reading /24 as "24 somethings." It isn't a count of addresses or octets — it is the position of the boundary between network bits and host bits on a 32-bit ruler. Everything to the left of the boundary is shared by every device on the network; everything to the right is free to number individual hosts.
Move that red boundary one bit to the right and you have a /25 — the network now owns 25 bits, hosts get 7, and the block shrinks to 128 addresses. Move it left to /23 and hosts get 9 bits, so the block grows to 512. The slash number is just where the line sits.
CIDR block size at a glance
Because every prefix is a power of two, you don't need to calculate — you need to recognize. Here are the blocks you will actually meet in firewall rules, cloud VPCs, and DHCP scopes.
| CIDR | Subnet mask | Total addresses | Usable hosts | Typical use |
|---|---|---|---|---|
/32 | 255.255.255.255 | 1 | 1 | A single host in a firewall/ACL rule |
/31 | 255.255.255.254 | 2 | 2 (RFC 3021) | Point-to-point router links |
/30 | 255.255.255.252 | 4 | 2 | Legacy point-to-point / tiny links |
/29 | 255.255.255.248 | 8 | 6 | A handful of servers or an ISP hand-off |
/28 | 255.255.255.240 | 16 | 14 | Small DMZ or appliance segment |
/27 | 255.255.255.224 | 32 | 30 | Small office subnet |
/26 | 255.255.255.192 | 64 | 62 | Mid-size VLAN |
/24 | 255.255.255.0 | 256 | 254 | The classic single LAN / VLAN |
/23 | 255.255.254.0 | 512 | 510 | Large flat LAN |
/16 | 255.255.0.0 | 65,536 | 65,534 | An entire site or large cloud VPC |
/8 | 255.0.0.0 | 16,777,216 | 16,777,214 | A whole private 10.x range |
Which one should I pick? Size to the hosts you actually have plus realistic growth, then round up to the next prefix. Need room for 40 devices? A /27 (30 usable) is too small, so use a /26 (62 usable). Over-allocating a /24 to a 5-device management segment isn't wrong, but it wastes address space you'll want back when you subnet later. When in doubt, /24 per VLAN is the sane default that keeps the math trivial.
Two addresses are always subtracted for a normal subnet: the network address (all host bits 0) and the broadcast address (all host bits 1). That's why usable is total minus two — except
/31(RFC 3021 point-to-point, both usable) and/32(a single host, no network/broadcast split).
Reading any CIDR in your head: the doubling ladder
You can convert prefix to size without arithmetic if you anchor on /24 = 256 and remember that down one prefix doubles, up one halves.
<rect x="170" y="90" width="120" height="70" rx="8" fill="#ffffff" stroke="#e2e8f0"/>
<text x="230" y="122" text-anchor="middle" fill="#2813e8">/23</text>
<text x="230" y="145" text-anchor="middle" fill="#334155" font-weight="400">512</text>
<rect x="310" y="90" width="120" height="70" rx="8" fill="#ffffff" stroke="#2813e8" stroke-width="2.5"/>
<text x="370" y="122" text-anchor="middle" fill="#2813e8">/24</text>
<text x="370" y="145" text-anchor="middle" fill="#0f172a" font-weight="700">256</text>
<rect x="450" y="90" width="120" height="70" rx="8" fill="#ffffff" stroke="#e2e8f0"/>
<text x="510" y="122" text-anchor="middle" fill="#2813e8">/25</text>
<text x="510" y="145" text-anchor="middle" fill="#334155" font-weight="400">128</text>
<rect x="590" y="90" width="120" height="70" rx="8" fill="#ffffff" stroke="#e2e8f0"/>
<text x="650" y="122" text-anchor="middle" fill="#2813e8">/26</text>
<text x="650" y="145" text-anchor="middle" fill="#334155" font-weight="400">64</text>
So /22 is "two doublings below /24" = 256 × 2 × 2 = 1024, and /27 is "three halvings below /24" = 256 ÷ 8 = 32. Once the ladder is muscle memory you can size any block on a whiteboard.
Convert a prefix to a subnet mask (and back)
The subnet mask is the same boundary expressed in dotted-decimal instead of a slash. Lay 32 bits out, fill the leftmost prefix count with 1s, fill the rest with 0s, then read each octet as a decimal number.
/24→11111111.11111111.11111111.00000000→ 255.255.255.0/26→11111111.11111111.11111111.11000000→ 255.255.255.192/20→11111111.11111111.11110000.00000000→ 255.255.240.0
Only nine values ever appear in a single octet as you fill it from the left: 0, 128, 192, 224, 240, 248, 252, 254, 255. Seeing 192 in a mask means "two host bits used in this octet," which is the /26 case above. Going the other way, count the 1s: 255.255.255.128 has 25 ones, so it's a /25.
Do the math on your own address
The recognition tricks above cover the common blocks. For an arbitrary address — finding the network address, the broadcast, the exact usable range, or splitting a block into smaller subnets — let the calculator handle the bit masking so you don't fat-finger an octet. Enter any address and prefix and it returns the network, broadcast, mask, and host range instantly.
Where CIDR shows up in real work
- Firewall and security-group rules.
0.0.0.0/0means "any address" (the whole internet);203.0.113.7/32means exactly one host. Getting the prefix wrong here is a security incident, not a typo —/24where you meant/32opens 254 extra hosts. - Cloud VPCs. AWS, Azure, and GCP all define VPCs and subnets in CIDR. A common pattern is a
/16VPC carved into/24subnets per tier or availability zone. - Routing tables. Routers match the longest prefix first, so a
/32route wins over a/24that also contains the address. This "longest-prefix match" is how specific overrides coexist with broad default routes. - Private ranges. RFC 1918 reserves
10.0.0.0/8,172.16.0.0/12, and192.168.0.0/16for private use — the blocks behind almost every home and office NAT.
The bottom line
CIDR notation is one idea applied consistently: the slash number marks the boundary between network bits and host bits on a 32-bit address, and moving that boundary by one bit doubles or halves the block. Memorize /24 = 256 = 254 usable, learn the doubling ladder in both directions, and you can read any IPv4 CIDR on sight. For anything that needs exact network and broadcast addresses, subnet the block with the subnet calculator rather than doing binary by hand — and when you're ready to carve a range into VLANs, read what subnetting is and why to use it next.