CIDR Notation Explained: How to Read /24, /16, and /30

What is CIDR notation?

CIDR notation pairs an IP address with a slash and a prefix length, written as 192.168.1.0/24. The prefix length counts the bits locked to the network. Every remaining bit addresses an individual host inside that block.

CIDR stands for Classless Inter-Domain Routing. It replaced the Class A, B, and C system during the 1990s.

Before CIDR, address blocks came in three rigid sizes. That wasted enormous ranges and drained IPv4 quickly.

CIDR lets a network use any prefix length instead. The result is finer control and far less waste. RFC 4632 defines the current standard.

How to read a CIDR block

Read a CIDR block in two parts. The address sits before the slash and marks where the block starts. The number after the slash counts the leading bits that identify the network, leaving the rest for hosts.

The address part

The address looks like any ordinary IPv4 address. In 10.0.0.0/8, the address is 10.0.0.0.

It marks the start of the block, called the network address. All host bits are set to zero there.

The slash and prefix length

The prefix length is a number between 0 and 32. It counts the bits belonging to the network.

A /24 locks the first 24 bits. The final 8 bits stay free for hosts. Our IP to binary converter shows that split directly.

Turning a prefix into a subnet mask

Every prefix maps to exactly one subnet mask. A /24 equals 255.255.255.0.

The mask is the same prefix written as four decimal numbers. Ones cover network bits and zeros cover host bits. Our subnet mask cheat sheet lists every pairing.

What /24, /16, and every other prefix means

Each prefix length describes one fixed block size. A /24 holds 256 addresses, a /16 holds 65,536, and a /8 holds over 16 million. A smaller prefix number always means a larger block.

The table below covers every prefix from /0 through /32. Most guides stop at the common dozen, which is where the awkward lookups begin.

The private ranges in RFC 1918 use these blocks too. The common three are 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. Our guide to public vs. private IP addresses explains why they exist.

How to calculate the IP range and host count

Total addresses equal 2 raised to the power of 32 minus the prefix length. Usable hosts equal that total minus two. One address becomes the network address and one becomes the broadcast address.

Take 192.168.1.0/24 as the worked example. The math is 2 to the power of 8.

That gives 256 total addresses. Subtracting two leaves 254 usable hosts.

The first address, 192.168.1.0, is the network address. The last, 192.168.1.255, is the broadcast address.

Neither is ever assigned to a device. That is why a /24 gives 254 hosts rather than 256. Our CIDR to IP range converter does this expansion instantly.

The /31 and /32 exceptions

Two prefixes break the minus-two rule. A /32 describes a single host address, common in routing tables and firewall rules.

A /31 holds only two addresses and has none to spare. RFC 3021 permits both on point-to-point links.

Why cloud subnets give you fewer hosts than the math predicts

Cloud providers reserve more addresses than traditional networks do. AWS holds back five addresses in every subnet rather than two. A /24 therefore yields 251 usable addresses inside a VPC, not the 254 a calculator reports.

AWS reserves the first four addresses and the last address of every subnet. They cover the network address, the VPC router, DNS, a future use slot, and broadcast.

The formula shifts accordingly. Available addresses equal 2 to the power of (32 minus the prefix), minus five.

AWS also caps subnet size at a /28 floor and a /16 ceiling. A /30 point-to-point link is not valid inside a VPC.

Google Cloud sets its own floor at /29, or eight addresses. Sizing a subnet from a generic calculator can therefore fail on the first deployment.

Where you actually meet CIDR notation

CIDR notation appears anywhere a system needs to describe a range of addresses in one field. Firewall rules, VPN configurations, cloud security groups, and routing tables all use it as their native format.

• Firewall rules. A source of 0.0.0.0/0 means every address on the internet. Our guide on what a firewall does covers rule structure.
• WireGuard configs. The AllowedIPs field takes CIDR blocks. Setting 0.0.0.0/0 routes all traffic through the tunnel.
• Cloud security groups. AWS and Azure both express allowed sources as CIDR blocks rather than address lists.
• DHCP scopes. The scope is defined by a network address and prefix. See how DHCP works for the lease process.
• Routing tables. Every route entry is a destination prefix paired with a next hop.

Recognising 0.0.0.0/0 as “everything” is the single most useful reading skill here. It is the default route and the wide-open firewall rule at once.

CIDR notation in IPv6

IPv6 uses identical slash notation. The address is longer but the rule does not change. A prefix such as 2001:db8::/32 locks the first 32 bits, and prefixes run from /0 through /128.

IPv6 addresses are 128 bits rather than 32. The math still holds, since a prefix counts network bits and hosts fill the remainder.

Most networks assign a /64 to each subnet. That single subnet holds more addresses than the entire IPv4 internet.

Our IPv6 subnet calculator plans these ranges. For the wider comparison, see IPv4 vs. IPv6.

Common CIDR mistakes to avoid

Four errors account for most CIDR mistakes. Confusing total addresses with usable hosts is the most frequent. Inverting the size rule, ignoring block boundaries, and applying the minus-two rule in the cloud follow close behind.

• Inverting the size rule. A /16 is far larger than a /24, not smaller.
• Forgetting the reserved addresses. Subtract two on normal subnets and five inside AWS.
• Ignoring block boundaries. A /25 starts at .0 or .128 and never between them.
• Misreading a host address as a network address. Writing 192.168.1.5/24 is accepted input, but the network is 192.168.1.0.

When a block matters, confirm it with a tool. Our subnet calculator resolves boundaries and host ranges in one step.

For aggregation and variable-length design, read VLSM and supernetting.

Frequently asked questions

What does CIDR notation mean?

CIDR notation writes an IP address with a slash and a prefix length, like 192.168.1.0/24. The prefix length counts the network bits. The remaining bits define the host range. It replaced the old class-based system to reduce address waste.

What does /24 mean in an IP address?

A /24 means the first 24 bits are the network portion. That leaves 8 bits for hosts. The block holds 256 total addresses and 254 usable ones. Its subnet mask is 255.255.255.0.

How do I calculate the number of hosts in a CIDR block?

Take 2 to the power of 32 minus the prefix length. That gives the total addresses. Subtract two for the network and broadcast addresses. A /26, for example, gives 64 total and 62 usable hosts.

Is a smaller CIDR number a bigger network?

Yes. A smaller prefix number means a larger block of addresses. A /16 holds 65,536 addresses, while a /24 holds only 256. The smaller the number after the slash, the more hosts the block contains.

Why does AWS give me fewer usable IPs than my subnet calculator?

AWS reserves five addresses in every subnet, not two. The first four addresses and the last one are unavailable. A /24 therefore yields 251 usable addresses inside a VPC instead of 254.

What is the difference between CIDR and a subnet mask?

They carry the same information in different formats. A prefix like /24 equals the subnet mask 255.255.255.0. CIDR notation is shorter, while the mask is the older dotted-decimal form. Both define where the network ends and hosts begin.

Does CIDR notation work for IPv6?

Yes. IPv6 uses the same slash notation as IPv4. A prefix such as 2001:db8::/32 locks the first 32 bits. Most subnets use a /64 prefix, leaving 64 bits for host addresses.

Can a CIDR block start at any address?

No. A block must start on a boundary that matches its size. A /25 starts at .0 or .128 only. Writing 192.168.1.5/24 is valid input, but 192.168.1.0 is the actual network address.

Related tools and guides

• CIDR to IP Range Converter — expand any block to its full range.
• Subnet Calculator — split a block into smaller subnets.
• IPv6 Subnet Calculator — plan IPv6 prefixes and address space.
• Subnet Mask Cheat Sheet — every prefix and mask pairing.
• IP to Binary Converter — see the bits behind the mask.
• Subnetting for Beginners — learn subnetting from scratch.
• VLSM and Supernetting — variable-length and aggregation techniques.
• Networking Glossary — plain-language definitions.

References

• IETF — RFC 4632: Classless Inter-domain Routing (CIDR)
• IETF — RFC 1918: Address Allocation for Private Internets
• IETF — RFC 3021: Using 31-Bit Prefixes on IPv4 Point-to-Point Links
• Amazon Web Services — Subnet CIDR blocks (Amazon VPC User Guide)
• Google Cloud — Subnets (Virtual Private Cloud documentation)