Networking

CIDR Notation Explained: How to Calculate a Subnet Range

CIDR notation packs a network address and subnet size into one string. Here's how to read it, calculate ranges by hand, and where people get it wrong.

Nikhil Sai··4 min read
All posts

192.168.1.0/24 means a network starting at 192.168.1.0 with a 24-bit subnet mask — the first 24 bits are fixed (the network portion), the remaining 8 bits are host addresses, giving 256 total addresses (254 usable). The /24 is CIDR notation: it replaces a separate subnet mask (255.255.255.0) with a single number representing how many bits are fixed.

Why CIDR exists

Before CIDR (Classless Inter-Domain Routing, 1993), IP allocation was locked into rigid classes — Class A, B, C — which wasted enormous blocks of address space. CIDR decoupled the network/host split from those fixed class boundaries, letting the split happen at any bit position. That's what the /24 represents: not a class, just a bit count.

Reading the notation

An IPv4 address is 32 bits. The number after the slash is how many of those bits are the fixed network prefix — everything remaining is available for host addresses.

| CIDR | Subnet mask | Host bits | Total addresses | Usable hosts | |---|---|---|---|---| | /8 | 255.0.0.0 | 24 | 16,777,216 | 16,777,214 | | /16 | 255.255.0.0 | 16 | 65,536 | 65,534 | | /24 | 255.255.255.0 | 8 | 256 | 254 | | /28 | 255.255.255.240 | 4 | 16 | 14 | | /30 | 255.255.255.252 | 2 | 4 | 2 | | /32 | 255.255.255.255 | 0 | 1 | 1 (host route) |

Total addresses = 2^(host bits). Usable hosts is that minus 2, because the first address in the range is reserved as the network address and the last is reserved as the broadcast address — neither can be assigned to a host. (/31 and /32 are special-cased in modern usage — point-to-point links commonly use /31 with both addresses usable, per RFC 3021.)

Calculating a range by hand

Take 10.0.4.0/22 as an example.

Step 1 — find the host bits: 32 - 22 = 10 host bits, so 2^10 = 1024 total addresses.

Step 2 — find the block size in the varying octet: A /22 falls within the third octet (/24 boundaries are octet-aligned; /22 is 2 bits short of that, so the block size in the third octet is 2^2 = 4). That means networks fall on multiples of 4 in the third octet: .0, .4, .8, .12, etc.

Step 3 — find the network and broadcast addresses: 10.0.4.0/22 starts at 10.0.4.0 and spans 1024 addresses, ending at 10.0.7.255 — the network address is 10.0.4.0, the broadcast address is 10.0.7.255, and usable hosts run from 10.0.4.1 to 10.0.7.254.

This is straightforward for round numbers but gets error-prone fast with odd prefixes like /27 or /29 split across non-obvious octet boundaries — which is exactly where a mistake causes a misconfigured firewall rule or an overlapping subnet in production.

Common real-world gotchas

Off-by-one on usable hosts. It's easy to forget the network and broadcast addresses aren't assignable — a /24 has 256 total addresses but only 254 you can actually put on a host.

Subnet overlap. When splitting a larger block into smaller subnets (e.g., dividing a /24 into four /26s for different VLANs), it's easy to miscalculate a boundary and end up with two subnets that overlap by a few addresses — which causes intermittent, hard-to-diagnose routing issues rather than an obvious failure.

Confusing CIDR with a VPC/security-group range. Cloud platforms (AWS VPCs, GCP subnets) use CIDR for network definitions, but "0.0.0.0/0" in a security group context means "any IPv4 address" — a common and dangerous misconfiguration when someone means to scope a rule narrowly but leaves the prefix at /0.

IPv6 CIDR is not the same math. IPv6 addresses are 128 bits, and typical allocations are much larger — a /64 is standard for a single subnet regardless of expected host count, because IPv6 was designed with enormous address space headroom rather than the scarcity mindset IPv4 subnetting requires.

When to just use a calculator

Hand-calculating is worth understanding conceptually, but for anything beyond a /24 or /16, it's easy to make an off-by-one error that doesn't surface until a routing rule behaves unexpectedly. A CIDR / Subnet Calculator takes a CIDR block and instantly returns the network address, broadcast address, usable host range, and total host count — useful for double-checking VPC configs, firewall rules, or subnet splits before they go live.

Quick reference checklist

  • Total addresses = 2^(32 - prefix); usable hosts = total minus 2 (except /31, /32)
  • Network and broadcast addresses are never assignable to a host
  • When splitting a block into subnets, verify boundaries don't overlap — don't eyeball it
  • /0 means "everything" — double-check security group and firewall rules that use it
  • IPv6 subnetting uses different conventions (/64 is the typical subnet size) — don't apply IPv4 intuition directly

Related posts