CIDR Notation Explained: Prefix Lengths, Subnet Masks & IP Ranges

CIDR REFERENCE

CIDR notation is not a different kind of subnet mask. It is a shorter way to state the same boundary: how many bits are fixed for the network, and how many remain available inside the block.

Read 192.168.10.0/24 as “the first 24 bits are fixed.” This guide stays narrow on purpose — the broader IPv4 Subnetting Guide covers VLSM, overlap checks, and production planning in depth. Here the job is to make CIDR notation something you can read accurately at a glance — including the edge cases and boundary mistakes that cause real configuration errors.

CIDR prefix length counts fixed bits from the left. It does not count hosts or subnets.

The slash number is a bit count

An IPv4 address is 32 bits long. The number after the slash states how many of those bits are fixed as the network portion; the rest are host bits, free to vary inside the block. A /24 fixes 24 bits and leaves 8 bits free; a /26 fixes 26 and leaves 6; a /32 fixes all 32 and therefore identifies one address.

host bits = 32 - prefix
total addresses = 2^(host bits)

A /24 has 8 host bits, so it contains 256 addresses. A /26 has 6 host bits, so it contains 64. Moving the prefix one bit to the right halves the block; moving it one bit to the left doubles it.

Operational distinction: for conventional IPv4 subnets through /30, “usable hosts” is usually total addresses minus the network and broadcast endpoints. /31 and /32 do not follow that old subtraction rule. CIDR itself describes the block; host usability depends on how the block is being used.

Rule: total addresses = 2^{(32 − prefix)}. /31 and /32 are operational exceptions to the classic “minus two” host rule, not arithmetic exceptions — the block-size formula still applies to both.

CIDR and subnet masks describe the same boundary

A dotted-decimal subnet mask is simply the prefix written as four octets. The mask contains a run of 1-bits from the left followed by 0-bits. The count of 1-bits is the CIDR prefix length.

For example, /26 means 26 one-bits: 24 of them fill the first three octets, and two more appear in the fourth, making that octet 11000000 in binary, which is 192 in decimal. The mask is therefore 255.255.255.192.

The partial-octet values worth memorizing follow a fixed pattern: 1 bit → 128, 2 bits → 192, 3 bits → 224, 4 bits → 240, 5 bits → 248, 6 bits → 252, 7 bits → 254, 8 bits → 255. Their corresponding block sizes are 128, 64, 32, 16, 8, 4, 2, and 1.

Finding the actual network from an address/prefix

A host address followed by a prefix does not necessarily name the network. 192.168.10.77/26 is a valid interface address with a prefix attached, but the network it belongs to is 192.168.10.64/26.

/26 mask = 255.255.255.192
block size = 256 - 192 = 64
valid boundaries = 0, 64, 128, 192
77 falls in 64-127
network = 192.168.10.64/26

For 10.34.77.201/20, the mask is 255.255.240.0, so the third-octet block size is 16. The valid third-octet boundaries are 0, 16, 32, 48, 64, 80, and so on. Seventy-seven sits in the 64–79 block, which makes the network 10.34.64.0/20.

A CIDR network must start on a valid boundary. An address with a prefix attached is often a host/prefix pair, not the network itself:

Why this matters: routers can normalize a host/prefix to the real network, but ACLs, IPAM imports, cloud forms, and automation pipelines often expect a canonical network address.

From CIDR to first and last address

For 192.168.10.64/26, the block contains 64 addresses, so the range runs from .64 through .127. In conventional subnet semantics, .64 is the network address and .127 is the broadcast address, leaving .65 through .126 as the traditional host range.

/31 and /32 need their own interpretation. A /31 has no traditional network/broadcast pair — RFC 3021 makes both addresses usable on a point-to-point link. A /32 is a single address; there is no range to compute.

Do not force the old formula: applying the network/broadcast subtraction to a /31 or /32 produces a wrong or meaningless result. Check the prefix length before reaching for “minus two.”

A start/end range is not always one CIDR block

An exact CIDR block has two properties: its size is a power of two, and its starting address is aligned to that size. 192.168.10.64 – 192.168.10.127 contains 64 addresses and starts on a 64-address boundary, so it is exactly 192.168.10.64/26.

By contrast, 192.168.10.70 – 192.168.10.120 is not a single CIDR block. It contains 51 addresses — not a power of two — so no single aligned prefix can represent it exactly. You can represent that exact range with several CIDRs, or choose a larger covering prefix such as 192.168.10.64/26 and accept that the cover includes addresses outside the requested range.

No smaller single prefix covers both endpoints: a /27 beginning at .64 ends at .95, and the next /27 beginning at .96 starts after .70. 192.168.10.64/26 is therefore the smallest single prefix that covers the full .70–.120 range — and it is a covering prefix, not an exact conversion of that range.

Splitting and aggregating: CIDR in both directions

CIDR is used in both directions: a longer prefix splits a block into smaller pieces, and a shorter prefix aggregates several blocks into one covering route.

24 - 22 = 2 and 22 = 4, so a /22 splits into exactly four /24s. Going the other way, those same four contiguous /24s can collapse into one /22 only when they occupy the complete /22 range and the first /24 begins on a /22 boundary:

If your job is to divide a parent network evenly, use the Subnet Splitter. If your job is to combine routes, the Route Summarization Calculator distinguishes exact aggregation from a broader covering route.

CIDR replaced classful assumptions, not subnet masks

Before CIDR, address ranges were divided into fixed classes — Class A used a /8, Class B a /16, Class C a /24 — and the prefix was inferred from the address itself rather than stated explicitly. CIDR replaced that classful assumption with explicit, arbitrary-length prefixes. It did not replace the subnet mask; it gave the mask a shorter, unambiguous name.

Standards context: RFC 4632 describes CIDR as explicit prefix notation for the 32-bit IPv4 address space. The prefix length can range from /0 through /32.

CIDR in IPv6

IPv6 uses the same slash notation, but the arithmetic is 128-bit instead of 32-bit. A /64 is the conventional size for a single IPv6 LAN segment — not chosen because someone needs 18 quintillion host addresses, but because stateless address autoconfiguration and several IPv6 mechanisms are built around a 64-bit interface identifier. Planning which /64s, /56s, or /48s to allocate is a different exercise from IPv4 host-counting; the IPv6 Subnetting Tools guide covers those planning rules separately.

CIDR mistakes that are easy to miss in production

• Treating a host/prefix as a network ID. 192.168.10.77/26 belongs to 192.168.10.64/26, not itself.
• Assuming /24 means 24 hosts. It does not — /24 leaves 8 host bits and therefore contains 256 addresses.
• Using a block with the right size but the wrong start. A /26 is 64 addresses, but it cannot begin at .20 or .100.
• Reading a private range as a default mask. 10.0.0.0 is not automatically /8; CIDR does not infer a mask from the address.
• Subtracting two from /31 and /32, where the traditional network/broadcast reservation does not apply.
• Using a covering prefix as though it were an exact range, instead of acknowledging the extra addresses it includes.
• Ignoring platform-specific reservations. Cloud platforms can reserve additional addresses inside an otherwise valid CIDR block.
• Forgetting that overlap is range math. Two prefixes can overlap even when their printed network addresses look different.

CIDR cheat sheet for IPv4

Which IPRevealed tool should you use?

FAQ

What does /24 mean in CIDR notation?

It means the first 24 bits of the 32-bit IPv4 address are fixed as the network prefix. Eight bits remain variable, so the block contains 256 addresses.

Is 255.255.255.0 the same as /24?

Yes. They are two ways of writing the same 24-bit boundary.

Why does a /26 have 64 addresses?

A /26 leaves 6 host bits. 2⁶ equals 64 total addresses. In a conventional subnet, 62 are traditionally usable host addresses.

Can any address be written with a CIDR prefix?

Yes, but the address and the network are not always the same thing. 192.168.10.77/26 is valid as an address/prefix pair; the network is 192.168.10.64/26.

What is the difference between a CIDR block and an IP range?

A CIDR block is a power-of-two-sized, correctly aligned range. An arbitrary start/end range may require several CIDR blocks — or a larger covering prefix — to represent it.

Does a smaller CIDR number mean a smaller network?

No. A smaller prefix number fixes fewer bits and therefore describes a larger block. A /16 is much larger than a /24.

Does CIDR work the same way in IPv6?

The slash notation is the same concept, but the arithmetic is 128-bit. /64 is the standard LAN-sized prefix in most IPv6 designs.

The practical test: can you see the boundary?

If you can move from /26 to 64 addresses, from 255.255.255.192 to a block size of 64, and from an arbitrary host address to the correct 64-address boundary without hesitation, the notation has stopped being shorthand and become a working tool.

RFC 4632 defines CIDR itself; RFC 3021 defines the /31 point-to-point exception. Both are worth knowing by number, not just by behavior, the next time a prefix needs defending in a design review.