Subnetting and CIDR Notation Explained (with Examples)

IPAddress-Lookup.com · June 26, 2025

If you have ever stared at an address like 192.168.1.0/24 and wondered what that slash and number actually mean, you are in exactly the right place. Subnetting and CIDR notation sit at the heart of how modern networks are designed, secured, and routed, yet the topic has a reputation for being intimidating. It does not have to be. Once you understand that an IP address is really just a string of bits, and that a subnet mask simply tells you where the "network" part ends and the "host" part begins, everything else falls into place. In this guide we will build the concept up from first principles, work through several real examples in full, and give you a cheat sheet you can keep next to your keyboard. Along the way you can check every calculation yourself with our Subnet Calculator tool.

What is a subnet, and why do we subnet at all?

A subnet, short for subnetwork, is a logical subdivision of a larger IP network. Instead of putting every device on one enormous flat network, engineers carve that address space into smaller, self-contained blocks. Each block is a subnet with its own range of addresses, its own network address, and its own broadcast address. Routers move traffic between subnets, while devices inside a single subnet can talk to each other directly without a router getting involved.

Subnetting is not busywork. There are several concrete reasons networks are divided this way:

• Efficiency and address conservation. Handing an organisation one giant block wastes addresses. Subnetting lets you allocate exactly as many addresses as a department, floor, or branch office actually needs, rather than rounding up to the nearest enormous class.
• Smaller broadcast domains. Certain traffic, such as ARP requests, is broadcast to every host on a subnet. On a flat network of thousands of devices, that chatter becomes crippling. Splitting into subnets keeps each broadcast domain small and the network fast.
• Security segmentation. By placing servers, guest Wi-Fi, and internal workstations on separate subnets, you can apply firewall rules and access-control lists between them. A compromised guest device cannot reach a database server if the two live on isolated subnets.
• Simpler, faster routing. Routers make decisions based on network prefixes. Well-designed subnets can be summarised into a single route, shrinking routing tables and speeding up forwarding decisions across the internet.

A quick binary refresher: bits, octets, and masks

An IPv4 address is 32 bits long. We write it as four decimal numbers separated by dots, such as 192.168.1.10, but each of those numbers is really an 8-bit binary group called an octet. Eight bits per octet, four octets, equals 32 bits total. Each octet can hold a value from 0 to 255, because eight bits can represent 2^8 = 256 distinct values.

The bit positions in an octet carry the place values 128, 64, 32, 16, 8, 4, 2, and 1. To convert, add up the positions that hold a 1. For example, the octet 11000000 is 128 + 64 = 192, and 10101000 is 128 + 32 + 8 = 168. So 192.168.1.10 in binary is:

• 192 = 11000000
• 168 = 10101000
• 1 = 00000001
• 10 = 00001010

The subnet mask is another 32-bit value, but it is special: it is always a run of 1s followed by a run of 0s. The 1s mark the network portion of the address and the 0s mark the host portion. A mask of 255.255.255.0 is 11111111.11111111.11111111.00000000 in binary, which is 24 ones followed by 8 zeros. To find the network that an address belongs to, you perform a bitwise AND between the address and the mask: wherever the mask has a 1, the address bit is kept; wherever the mask has a 0, the bit becomes 0. That AND operation is the single most important calculation in all of subnetting.

Classful addressing: a short history lesson

In the early days of the internet, addresses were handed out in fixed "classes" based on the value of the first octet. This is called classful addressing, and while it is obsolete, understanding it explains why CIDR was such an improvement.

• Class A covered first octets 1 to 126, used an 8-bit network portion (mask 255.0.0.0, a /8), and gave each network roughly 16.7 million hosts.
• Class B covered 128 to 191, used a 16-bit network portion (mask 255.255.0.0, a /16), and offered about 65,000 hosts per network.
• Class C covered 192 to 223, used a 24-bit network portion (mask 255.255.255.0, a /24), and provided just 254 usable hosts.

The problem was rigidity. An organisation that needed 2,000 addresses was too big for a Class C (254 hosts) but had to be given a Class B (65,000 hosts), wasting over 60,000 addresses. With the internet growing exponentially, this waste threatened to exhaust the IPv4 space entirely. Something more flexible was needed.

Enter CIDR: notation explained bit by bit

CIDR, or Classless Inter-Domain Routing, was introduced in 1993 to replace the rigid class system. Instead of tying the network size to the first octet, CIDR lets the boundary between network and host fall anywhere in the 32 bits. We express this with the now-familiar slash notation, called the CIDR prefix.

The number after the slash is simply the count of 1-bits in the subnet mask, in other words how many bits belong to the network. So:

• /8 means 8 network bits, mask 255.0.0.0 (the old Class A size).
• /16 means 16 network bits, mask 255.255.0.0 (the old Class B size).
• /24 means 24 network bits, mask 255.255.255.0 (the old Class C size).
• /26 means 26 network bits, mask 255.255.255.192, leaving only 6 host bits.

The magic formula for how many addresses a prefix contains is 2^(32 − n), where n is the prefix length. Because the whole IPv4 space is 32 bits, subtracting the network bits leaves the host bits, and 2 raised to that power gives the total number of addresses in the block. For a /24 that is 2^(32−24) = 2^8 = 256 total addresses. For a /26 it is 2^(32−26) = 2^6 = 64 addresses. The larger the prefix number, the smaller the subnet.

Calculating the key values of a subnet

Every subnet has a handful of special addresses you will need to identify. Here is what each one means and how to find it.

1. Network address. The very first address in the block. All host bits are 0. This identifies the subnet itself and cannot be assigned to a device.
2. Broadcast address. The very last address in the block. All host bits are 1. Traffic sent here reaches every host on the subnet, so it is also unusable as a host address.
3. First usable host. One address above the network address (network + 1).
4. Last usable host. One address below the broadcast address (broadcast − 1).
5. Total addresses. 2^(32 − n).
6. Usable hosts. Total minus 2, because the network and broadcast addresses are reserved. The formula is 2^(32 − n) − 2.

There is one more value worth knowing: the wildcard mask. It is the inverse of the subnet mask, obtained by flipping every bit (subtract each octet from 255). Where a subnet mask of 255.255.255.0 selects the network, its wildcard 0.0.0.255 selects the host range. Wildcard masks show up constantly in Cisco access-control lists and OSPF configuration, so it pays to recognise them.

Worked example 1: 192.168.1.0/24

Let us start with the friendliest possible case. A /24 ends cleanly on an octet boundary, so no binary gymnastics are required. With 24 network bits, the host portion is the entire last octet.

This is the classic home and small-office network. Everything from .1 to .254 is available for devices, .0 names the network, and .255 is the broadcast.

Worked example 2: 10.0.0.0/26

Now for a prefix that does not land on an octet boundary. A /26 means 26 network bits, so the last octet is split: its first two bits belong to the network and the remaining six bits are host bits. Six host bits give 2^6 = 64 total addresses per subnet. That means /26 subnets step in increments of 64 in the final octet: 0, 64, 128, 192.

Focusing on the first block 10.0.0.0/26, the network mask is 255.255.255.192 because 11000000 in the last octet equals 192.

The next subnet in the sequence would be 10.0.0.64/26 (hosts .65 to .126, broadcast .127), then 10.0.0.128/26, and finally 10.0.0.192/26. Notice how the block size, 64, is exactly the "magic number" that determines where each subnet starts.

Worked example 3: 172.16.5.0/28

Our last example squeezes the subnet even smaller. A /28 has 28 network bits and only 4 host bits, giving 2^4 = 16 total addresses and just 14 usable hosts. The final octet uses 11110000 for the network portion, which equals 240, so the mask is 255.255.255.240. Subnets step in increments of 16.

A /28 is a popular size for small point-to-point networks and for tightly controlled server segments where you want just a handful of addresses. If you needed only two hosts, say for a link between two routers, you would go all the way down to a /30, which offers exactly 2 usable addresses.

The subnetting cheat sheet

Rather than recompute the powers of two every time, memorise or bookmark the table below. It covers the most common prefixes from /24 down to /30, showing the mask, the wildcard, the block size (total addresses), and the usable host count.

Notice the elegant pattern: every step of one bit in the prefix halves the number of hosts, and every mask value in the last octet is one of 128, 192, 224, 240, 248, 252. Those are the only valid values a final mask octet can take.

VLSM: subnets of different sizes

Traditional subnetting split a network into equal-sized pieces, which is wasteful when your departments have very different needs. Variable Length Subnet Masking (VLSM) solves this by letting you apply different prefix lengths within the same overall network. In effect, you subnet a subnet.

Suppose you own 192.168.10.0/24 and need to serve one department of 100 hosts, one of 50 hosts, and two router links of 2 hosts each. With VLSM you would allocate:

• A /25 (126 hosts) for the large department: 192.168.10.0/25.
• A /26 (62 hosts) for the medium department: 192.168.10.128/26.
• Two /30 blocks (2 hosts each) for the router links, carved from the remaining space.

The golden rule of VLSM is to allocate the largest subnets first and work downward, so the blocks nest cleanly without overlapping. This is how real-world address plans avoid waste while still leaving room to grow.

A note on IPv6 prefixes

Everything above concerns IPv4, but CIDR notation carries straight over to IPv6, just with much bigger numbers. An IPv6 address is 128 bits rather than 32, so prefixes run all the way up to /128. The most important one to know is the /64: by long-standing convention, a single IPv6 subnet is a /64, which sets aside the first 64 bits for the network prefix and the last 64 bits for the host, or "interface identifier." That leaves 2^64 addresses per subnet, an almost unimaginable number, which is why IPv6 rarely bothers with the address-conservation gymnastics that dominate IPv4 subnetting. If you want a deeper comparison of the two protocols, see our guide on IPv4 vs IPv6.

Putting it all together

Subnetting boils down to three ideas: an IP address is 32 bits, the mask decides where the network ends, and the formula 2^(32 − n) tells you how big each block is. Master those and the rest is arithmetic. Start by identifying the prefix, convert it to a block size, find the network and broadcast addresses, and the usable range appears between them. Practise on a handful of examples and the process becomes second nature. When you want to verify your work instantly, drop any address and prefix into our Subnet Calculator tool and compare the results with your own.

Frequently asked questions

Why do we subtract 2 from the total addresses to get usable hosts?

Two addresses in every IPv4 subnet are reserved and cannot be assigned to devices: the network address (all host bits set to 0), which names the subnet, and the broadcast address (all host bits set to 1), which is used to reach every host at once. Subtracting these two leaves the count of addresses you can actually give to hosts, hence 2^(32 − n) − 2.

What is the difference between a subnet mask and a CIDR prefix?

They express exactly the same information in two formats. A subnet mask such as 255.255.255.0 is a 32-bit dotted-decimal value, while the CIDR prefix /24 is simply the count of 1-bits in that mask. Any mask can be written as a prefix and vice versa; CIDR notation is just shorter and less error-prone.

What does the /24 in an IP address actually mean?

The number after the slash is the prefix length, meaning how many of the address's 32 bits define the network. A /24 reserves the first 24 bits for the network and leaves 8 bits for hosts, producing 256 total addresses (2^8) and 254 usable ones. It is equivalent to the subnet mask 255.255.255.0.

Why did CIDR replace classful addressing?

Classful addressing forced network sizes to jump in huge steps: 254 hosts, then 65,000, then 16 million, with nothing in between. Organisations were routinely given far more addresses than they needed, wasting the limited IPv4 space. CIDR lets the network boundary fall on any bit, so blocks can be sized to fit, and it also allows routes to be summarised, shrinking routing tables.

What is a wildcard mask used for?

A wildcard mask is the bitwise inverse of a subnet mask, found by subtracting each octet from 255. Whereas a subnet mask matches the network portion, a wildcard mask specifies which bits are allowed to vary. It appears mainly in Cisco access-control lists and routing protocols like OSPF to describe ranges of addresses concisely.

Do the same subnetting rules apply to IPv6?

The CIDR concept is identical: a prefix length after a slash marks the network boundary. The difference is scale. IPv6 addresses are 128 bits instead of 32, and the standard subnet size is a /64, which provides 2^64 host addresses per subnet. Because the space is so vast, IPv6 subnetting focuses on structure and hierarchy rather than squeezing out every last address.