Subnetting and CIDR explained without the headache
CIDR notation looks cryptic until you separate the two things it is actually encoding: an address, and how many of its bits are fixed.
What the slash means
192.168.1.0/24 means the first 24 bits of the 32-bit IPv4 address are the fixed network portion, and the remaining 8 bits identify hosts within that network. More bits after the slash means a smaller network; fewer bits means a bigger one.
/32— a single host, no room for anything else./24— 256 addresses, the classic "Class C"-sized network./16— 65,536 addresses./8— 16.7 million addresses.
Converting the prefix to a subnet mask
Each bit in the prefix becomes a 1 in the subnet mask, grouped into four octets:
| Prefix | Mask |
|---|---|
| /24 | 255.255.255.0 |
| /25 | 255.255.255.128 |
| /26 | 255.255.255.192 |
| /28 | 255.255.255.240 |
The pattern within an octet follows powers of two counted from the left: 128, 192, 224, 240, 248, 252, 254, 255 for one through eight bits set.
Counting usable hosts
Total addresses in a subnet = 2^(32 - prefix). Two of those are reserved — the network address (all host bits zero) and the broadcast address (all host bits one) — so usable hosts = 2^(32 - prefix) - 2.
A /26 gives 2^6 = 64 total addresses, so 62 usable hosts. A /30 gives 4 total, 2 usable — exactly enough for a point-to-point link between two routers, which is why /30 (and /31, using a special rule that allows both addresses) shows up constantly in WAN configuration.
Finding the network and broadcast address
Given 10.20.30.77/27, a /27 has 5 host bits (32-27), meaning subnets are 32 addresses apart (2^5). 30 falls in the range starting at 0, 32, 64... — the third octet stays 30, and within the last octet the block boundaries are every 32: 64-95 covers 77. So:
- Network address:
10.20.30.64 - Broadcast address:
10.20.30.95 - Usable range:
10.20.30.65–10.20.30.94
Why subnetting exists at all
Splitting a large allocation into smaller subnets lets you route traffic between segments, apply different firewall rules per segment, and avoid wasting an entire /24 on a network that only needs a dozen hosts. A cloud VPC is almost always subdivided this way — a /16 VPC split into /24 subnets per availability zone is a common pattern.
Private ranges worth memorizing
10.0.0.0/8— large private networks.172.16.0.0/12— medium private networks, often used by Docker.192.168.0.0/16— small/home networks.127.0.0.0/8— loopback.169.254.0.0/16— link-local, assigned automatically when DHCP fails.
Reading CIDR in firewall rules and security groups
0.0.0.0/0 means "any IPv4 address" — a prefix of zero fixes no bits at all. Seeing this in an inbound security group rule for anything other than a public web server (ports 80/443) is almost always a misconfiguration worth double-checking.
The mental shortcut
You rarely need to compute this by hand under pressure — the useful skill is reading a /24 and immediately knowing "256 addresses, last octet is the host part" without reaching for a calculator, and reaching for one anyway when the prefix does not land on an octet boundary.