Subnetting and CIDR Notation, Explained From Zero

CIDR notation is an IPv4 address followed by a slash and a number from 0 to 32: 192.168.10.0/26. The number after the slash is the prefix length, and it counts how many of the address's 32 bits are fixed as the network portion. The bits left over belong to hosts, and every combination of those leftover bits is one address inside the block. A /26 fixes 26 bits and leaves 32 − 26 = 6 free, so it names a block of 2^6 = 64 addresses; a /24 leaves 8 free bits and names a block of 2^8 = 256. That is the entire notation; everything else in subnetting — masks, network and broadcast addresses, host counts — follows from counting fixed bits.

The letters stand for Classless Inter-Domain Routing, specified in RFC 4632, and classless is the load-bearing word. Until 1993, routers inferred the network/host split from an address's first octet — the Class A/B/C system. CIDR deprecated that scheme in favour of explicit prefixes: the split sits wherever the slash says it does, and nowhere else. People still say "a Class C" for a /24, which is harmless as slang and wrong as engineering — no modern router, firewall or cloud VPC guesses a mask from the first octet.

The dots are a disguise

Underneath the notation sits one plain fact from RFC 791, the original Internet Protocol specification: "Addresses are fixed length of four octets (32 bits)." An IPv4 address is a single 32-bit number; the dots are a reading aid — four groups of eight bits, each printed in decimal — and nothing in the protocol knows they exist.

Take 192.168.10.37. Octet by octet in binary: 192 = 11000000, 168 = 10101000, 10 = 00001010, and 37 = 32 + 4 + 1 = 00100101. Strung together that is 11000000.10101000.00001010.00100101, and as one integer it is 192 × 16,777,216 + 168 × 65,536 + 10 × 256 + 37 = 3,221,225,472 + 11,010,048 + 2,560 + 37 = 3,232,238,117. The IP address converter performs this in both directions — paste the integer and get the dotted form back, along with hex, binary and the reverse-DNS name. For subnetting, the binary view is the one that earns its keep: a prefix boundary is invisible in dotted decimal and obvious in a row of bits.

A subnet mask is the prefix, spelled out

Subnet mask basics come down to a single sentence: the mask is the prefix length written as 32 bits — prefix-many ones, then zeros — and printed in dotted decimal. For a /26 that is 11111111.11111111.11111111.11000000. The first three octets are all ones, which prints as 255, and the last octet is 11000000 = 128 + 64 = 192, so the mask is 255.255.255.192. The mixed octet has a shortcut: 256 minus the block size, so for /26 it is 256 − 64 = 192. A /24's mask is the tidy 255.255.255.0, because its boundary lands exactly on a dot.

The mask and the prefix carry identical information, and the mask's real job is arithmetic:

network = ⌊address ÷ 2^(32 − p)⌋ × 2^(32 − p), where p is the prefix length and 2^(32 − p) is the block size. The mask as an integer is 2^32 − 2^(32 − p).

In words: round the address down to the nearest multiple of the block size and you have the network address. Every row below follows from that rounding.

Usable is total minus two everywhere from /24 down to /30 — the reason, and the two exceptions at the bottom, are next.

The /24, worked from nothing

A /24 leaves 8 host bits, so 2^8 = 256 addresses. Two of them are reserved in any ordinary subnet. The address with every host bit set to zero is the network address — it names the subnet in routing tables and cannot be assigned to a machine. The address with every host bit set to one is the broadcast address, which reaches every host on the link at once. So 192.168.10.0/24 spans .0 through .255, but the assignable range is .1 through .254: 256 − 2 = 254 usable hosts.

Splitting the /24: where the blocks fall

Each extra bit of prefix halves the block and doubles the count. One /24 becomes two /25s of 128 addresses, four /26s of 64, eight /27s of 32, sixteen /28s of 16, or thirty-two /29s of 8. And blocks may only begin on multiples of their own size — a consequence of the rounding formula above — so the four /26 children of 192.168.10.0/24 start at .0, .64, .128 and .192, and nowhere else:

Now the question subnetting exists to answer. A switch reports a server at 192.168.10.37/26 — which subnet is that? Round the last octet down to the nearest multiple of 64: ⌊37 ÷ 64⌋ = 0, and 0 × 64 = 0, so the server lives in the first row: network 192.168.10.0/26, broadcast .63, neighbours from .1 to .62. Change nothing but the prefix and the answer moves. At /27 the blocks are 32 wide, ⌊37 ÷ 32⌋ = 1, and 1 × 32 = 32 — the same address now sits in 192.168.10.32/27, with an assignable range of .33 through .62 and 30 usable hosts. Same cable, same address, different subnet: the prefix decides.

The IP subnet calculator does this rounding for any prefix from /0 to /32 — you paste whatever address you can see, because the network address is usually the thing you are trying to find. It also locates the input in the IANA special-purpose registry from RFC 6890: 192.168.10.37 comes back Private-Use under RFC 1918, worth checking before assuming anything about reachability.

Four traps, in the order you will meet them

A bigger slash number is a smaller network. The prefix counts fixed bits, so /8 is enormous and /30 is tiny. The limit case: 0.0.0.0/0 fixes nothing and matches all 2^32 = 4,294,967,296 IPv4 addresses — the default route.

Minus-two stops at /30. RFC 3021 defines the /31 for point-to-point links: with only two addresses in the block there is nothing to broadcast to, so both are host addresses — 2 usable, not 0. The RFC quantifies the payoff: 500 point-to-point links save 500 × 2 = 1,000 addresses on /31s instead of /30s. A /32 is a route to a single host: 1 address, 1 usable. Tools applying minus-two blindly report 0 and −1 usable hosts here — that is how you spot them.

Not every address can follow a slash and mean a network. 192.168.10.50/26 describes a host inside the 192.168.10.0/26 block, because 50 is not a multiple of 64. Writing it in a route or a firewall object as though it named a network is either an error your platform rejects or, worse, one it silently rounds for you.

Leading zeros change the address. 192.168.010.1 is not reliably 192.168.10.1: the classic C parser reads a zero-prefixed octet as octal, making 010 into 8, while most modern runtimes read it as decimal 10. Both tools linked here refuse the input outright rather than pick a side — a disagreement between a validator and a network stack about which host a string names is a genuine security bug class.

Do one by hand, then delegate

Subnetting rewards exactly one round of manual work: convert an address to binary, mask off the host bits, and watch the network address appear. Do it once with 192.168.10.37 and the tables above stop being tables — they become the visible consequence of rounding down to a multiple of a power of two. After that the arithmetic can go back to being a machine's job. The two calculators in this article sit in Quanta's collection alongside a few hundred neighbours, and each prints the formula it runs directly on the page, which means a result you doubt is a result you can re-derive. Anything this walkthrough left unresolved — an address that will not parse, a prefix your router treats strangely — belongs on the contact page, where the odd question has a way of becoming the next section of documentation.

Sources

• IETF RFC 4632 — Classless Inter-domain Routing (CIDR)
• IETF RFC 1918 — address allocation for private internets
• IETF RFC 3021 — 31-bit prefixes on point-to-point links
• IETF RFC 1878 — variable-length subnet table for IPv4