CIDR Notation Explained: What /24 and /16 Mean and How to Size a Subnet

What the slash number means

An IPv4 address has 32 bits. In CIDR notation such as 192.168.1.0/24, the number after the slash says how many leading bits identify the network. The remaining bits identify hosts inside it.

A /24 therefore has 24 network bits and 8 host bits, which gives 2 to the power 8, or 256 addresses. The same idea works for every prefix: addresses = 2 to the power (32 minus prefix).

Common sizes

• /32: one address, used for a single host.
• /30: 4 addresses, 2 usable, used for point-to-point links.
• /24: 256 addresses, 254 usable, with mask 255.255.255.0.
• /16: 65,536 addresses, with mask 255.255.0.0.
• /8: 16,777,216 addresses, with mask 255.0.0.0.

In a normal subnet the first address is the network address and the last is the broadcast address, which is why two fewer addresses are usable. A /31 is the exception, allowed on point-to-point links under RFC 3021.

Worked example: finding the range of 192.168.10.77/26

Take the address 192.168.10.77/26 and find its network range step by step.

Step 1: a /26 has 26 network bits and 6 host bits, so each subnet holds 2 to the power 6, which is 64 addresses.

Step 2: the mask has 26 ones, so it is 255.255.255.192. The last octet is 192 because the top two bits of that octet are network bits (128 + 64).

Step 3: subnets in the last octet start at multiples of 64, which are 0, 64, 128 and 192. The value 77 falls between 64 and 127, so the network address is 192.168.10.64.

Step 4: the broadcast address is the last address of that block, 192.168.10.127. The usable host range is 192.168.10.65 to 192.168.10.126, which is 62 addresses.

Prefix reference table

Every step up in prefix length halves the block, and every step down doubles it. Two adjacent /24 blocks can be summarized as one /23.

Private ranges

Three blocks are reserved for private networks and are not routed on the public internet:

• 10.0.0.0/8
• 172.16.0.0/12, which covers 172.16.0.0 to 172.31.255.255
• 192.168.0.0/16

Home routers usually use 192.168.0.0/24 or 192.168.1.0/24. Cloud networks commonly use a block from 10.0.0.0/8.

Sizing a subnet

Count the hosts you need today, add room for growth, then pick the smallest prefix that fits. Needing 100 hosts means a /25, which has 128 addresses and 126 usable. Needing 300 means a /23.

Cloud providers reserve a few addresses in every subnet, so allow for that. In AWS, for example, five addresses per subnet are reserved.

Avoiding overlap

Two networks that you want to connect, through a VPN or peering, must not use overlapping ranges. Plan the ranges for every environment before you create them, because changing a network range later usually means rebuilding it.

The CIDR and Subnet Calculator shows the network address, broadcast address, mask and usable range for any prefix you enter.

Worked example: splitting a /16 into subnets

Suppose you own 10.0.0.0/16 and want separate subnets for web servers, application servers and databases in each of two zones. That is six subnets, so you need at least six blocks.

Splitting into /24 blocks gives 256 subnets of 256 addresses each, which is far more than needed. Splitting into /19 blocks gives 2 to the power 3, which is 8 subnets, each with 8,192 addresses. The first three are 10.0.0.0/19, 10.0.32.0/19 and 10.0.64.0/19, because each block is 32 wide in the third octet.

A middle choice is /20, which gives 16 blocks of 4,096 addresses, starting 10.0.0.0/20, 10.0.16.0/20, 10.0.32.0/20 and so on. Using the first six and leaving ten free keeps room to add zones later without renumbering. The rule is to pick the prefix first, then step through the address space in blocks of that size.

Checking whether two ranges overlap

Two CIDR blocks overlap whenever one contains the other, or they share any address. Blocks of different sizes either nest completely or do not touch at all, so you only need to check whether the smaller block's start falls inside the larger one.

For example, 10.0.0.0/16 covers 10.0.0.0 to 10.0.255.255. The block 10.0.5.0/24 sits inside it, so they overlap. The block 10.1.0.0/16 starts at 10.1.0.0, which is outside, so it does not overlap. In the same way, 172.16.0.0/12 reaches up to 172.31.255.255, so 172.20.0.0/16 is inside it.

Frequently asked questions

• What does /24 mean? It means the first 24 bits of the address are the network part. That leaves 8 bits for hosts, so the block has 256 addresses.
• Why are two addresses unusable in a subnet? The first address names the network itself and the last is the broadcast address. Neither can be assigned to a normal host.
• What is the difference between a subnet mask and a prefix length? They carry the same information. 255.255.255.0 and /24 both describe 24 network bits, and the slash form is shorter.
• How many /24 subnets fit in a /16? There are 256, because the difference between the prefixes is 8 bits and 2 to the power 8 is 256.
• Is 172.32.0.0 a private address? No. The private block 172.16.0.0/12 ends at 172.31.255.255, so 172.32.0.0 is public.