← Networking

Subnetting & CIDR

Verified Sep 7, 2026

TL;DR

An IP address like 192.168.1.10/24 is really two numbers glued into one: a network part and a hostpart. The /24 says exactly where that split happens — the first 24 bits are "network," the remaining 8 are "host." Once you know that single split point, everything else — how many devices fit, what the valid address range is, where one network ends and the next begins — is just arithmetic on those two numbers, not something to memorize per prefix length.

ELI5

A street address is really two pieces of information stacked together: "123 Main Street" finds the building, "Apartment 4B" finds you inside it. You need both, but they answer completely different questions — which building, and which unit. An IP address works the same way:
  • the network part is the building — shared by every device on the same network
  • the host part is the apartment number — it picks out one specific device inside that network
  • the /24 is just the line that says "the street name ends here, the apartment number starts here"
Move that line — change the /number — and you change how many "apartments" fit in the "building." A shorter street name (like/8) leaves more digits for apartment numbers, meaning way more devices fit.

WHY IT MATTERS

  • Every cloud console (AWS, GCP, Azure) asks you to pick a CIDR block before it'll create a network for you.
  • "Why can't these two devices talk to each other" is very often a subnet mismatch, not a cable or a firewall.
  • Firewall rules, VPNs, and VLANs are all written in terms of CIDR ranges — this is the alphabet the rest of networking is written in.

HOW IT WORKS

Everything below comes from three steps, done in binary:

  1. Turn the IP into 32 bits.
  2. The /n says the first n bits are the network — apply that as a mask (AND) to get the network address.
  3. Flip the mask and OR it with the network address to get the broadcast address — the top of the range.

Everything else — usable range, total addresses, host count — is arithmetic on those two numbers.

Try it yourself

Runs entirely in your browser. Nothing is sent anywhere.

FAILURE MODES

  • "/24 means 24 hosts." It means 24 network bits — that leaves 8 host bits, which is 254 usable addresses, not 24.
  • "A smaller number means a smaller network." Backwards. /8 is enormous (16 million+ addresses); /30 is tiny (4 addresses).
  • "Every subnet loses 2 addresses to network/broadcast." Only when the prefix is 30 or smaller. /31 and /32 reserve nothing — see the point-to-point example above.

DEEP DIVE

  • VLSM (Variable Length Subnet Masking). Real networks aren't cut into equal-size blocks. A site might carve one /24 into a /26 for one department and two /27s for two others — sized to actual need, not a fixed grid.
  • Route summarization. ISPs don't advertise every individual customer's tiny subnet to the rest of the internet — they combine adjacent CIDR blocks that share a common prefix into one larger announcement, which is the entire reason CIDR replaced the older class-based addressing system in the first place.
  • This calculator is address-space-agnostic. It does the same bit math whether the input is a private range (10.0.0.0/8, 192.168.0.0/16) or a public one — privacy of the range is a routing-policy decision, not a property of the arithmetic.

WHAT I LEARNED

CIDR notation always answers one question: how many bits are "the building" versus "the apartment." Once you know that split, every other number — network, broadcast, range, host count — is just arithmetic you (or a calculator) can derive, not something to memorize per prefix length.

Go deeper