In this article
Every device on a network has an address, and every address has two parts: which network it belongs to and which device it is on that network. CIDR notation is a compact way to say where the line between the two parts falls. Once that clicks, subnet masks stop looking like magic.
An address is 32 bits
An IPv4 address such as 192.168.1.10 is four numbers from 0 to 255. Each number is 8 bits, so the whole thing is 32 bits. The slash number says how many of those 32 bits, counted from the left, are fixed for the network.
- Network bits (fixed)24 bits
- Host bits (free to change)8 bits
With 8 host bits there are 2⁸ = 256 different host values, from 0 to 255. Those 256 addresses are the whole /24 subnet.
How big is each prefix?
Each step up in the prefix halves the subnet. Each step down doubles it. Here are the common sizes, with the subnet mask that goes with each:
| Prefix | Subnet mask | Addresses | Usable hosts |
|---|---|---|---|
| /16 | 255.255.0.0 | 65,536 | 65,534 |
| /20 | 255.255.240.0 | 4,096 | 4,094 |
| /24 | 255.255.255.0 | 256 | 254 |
| /25 | 255.255.255.128 | 128 | 126 |
| /26 | 255.255.255.192 | 64 | 62 |
| /27 | 255.255.255.224 | 32 | 30 |
| /28 | 255.255.255.240 | 16 | 14 |
| /29 | 255.255.255.248 | 8 | 6 |
| /30 | 255.255.255.252 | 4 | 2 |
A /31 has 2 addresses and is used for point-to-point links. A /32 is a single host.
Each step to the right doubles the hosts (minus the two reserved addresses). The columns grow quickly, which is why the choice of prefix matters.
Reading one subnet in full
Take 192.168.1.0/26. The host part is the last 6 bits, so there are 64 addresses.
The subnet mask 255.255.255.192 is the same idea written in decimal: 26 ones followed by 6 zeros. The last number is 192 because the first two bits of the last byte are ones (128 + 64 = 192).
Splitting a /24 into four /26 subnets
Say you have 192.168.1.0/24 and want four separate groups, such as staff, guests, cameras and servers. Borrow two bits from the host side and you get four /26 blocks of 64 addresses.
Each block has its own network and broadcast address, for example 192.168.1.64 and 192.168.1.127 for the second one.
- 1Count the devicesInclude servers, phones, printers and room to grow.
- 2Add 2The network and broadcast addresses are not usable.
- 3Round up to a power of 2Subnet sizes are 4, 8, 16, 32, 64 and so on.
- 4Find the prefixPrefix = 32 minus the number of host bits. For 64 addresses, 6 host bits, so /26.
Private ranges you will see everywhere
Three blocks are reserved for private use inside homes and companies. They are not routed on the public internet.
| Block | Range | Addresses | Often used for |
|---|---|---|---|
| 10.0.0.0/8 | 10.0.0.0 – 10.255.255.255 | 16,777,216 | Large companies and cloud networks |
| 172.16.0.0/12 | 172.16.0.0 – 172.31.255.255 | 1,048,576 | Medium networks and containers |
| 192.168.0.0/16 | 192.168.0.0 – 192.168.255.255 | 65,536 | Home routers and small offices |
Common mistakes
- Forgetting the two reserved addresses. A /30 has 4 addresses but only 2 usable hosts, which is why it is used for links between two routers.
- Choosing a subnet that is too tight. A /27 holds 30 hosts. If you have 28 devices today, you have no room for growth.
- Overlapping subnets. 10.0.0.0/16 and 10.0.5.0/24 overlap, because the second sits inside the first. Overlaps cause routing trouble, especially when joining two networks by VPN.
- Reading the mask as a number to add. The mask is a pattern of ones and zeros. 255.255.255.192 is 26 ones, not a number you subtract.
- Mixing it up with IPv6. IPv6 uses 128 bits and prefix lengths like /64, but the idea of network bits and host bits is the same.
Questions people ask
What does /24 mean in an IP address?
It means the first 24 bits are the network part and the last 8 bits are for hosts. That gives 256 addresses, of which 254 are usable.
How many hosts are in a /26?
A /26 has 64 addresses and 62 usable hosts, because the first and last addresses are reserved.
What is the subnet mask for /20?
255.255.240.0. It has 20 ones followed by 12 zeros and covers 4,096 addresses.
What is a broadcast address?
It is the last address in a subnet. A message sent to it is delivered to every device in that subnet.
Is a bigger prefix number a bigger network?
No, the opposite. A bigger prefix means more network bits and fewer host bits, so the subnet is smaller.
Which IP ranges are private?
10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. They are for use inside private networks and are not routed on the public internet.