CIDR and subnetting explained

CIDR notation, such as 192.168.1.0/24, appears in router configs, cloud VPC settings, firewall rules, Kubernetes manifests, and allow-lists for APIs. It packs a whole range of addresses into one short string. Once you can read it, subnet planning and access rules become arithmetic rather than guesswork.

Addresses are 32-bit numbers

An IPv4 address is a 32-bit number written as four decimal octets. 192.168.1.1 is the bytes 192, 168, 1, 1, the integer 3,232,235,777, or the hexadecimal 0xc0a80101. The IPv4 number converter shows all these forms and lets you toggle individual bits, which is the easiest way to see what a prefix does.

Reading a prefix

The number after the slash is the prefix length: how many leading bits identify the network. The remaining bits identify hosts within it. For 192.168.1.42/24, the IPv4 subnet calculator shows:

• Network: 192.168.1.0/24, with subnet mask 255.255.255.0.
• Addresses: 192.168.1.0 to 192.168.1.255, 256 in total.
• Usable hosts: 192.168.1.1 to 192.168.1.254 (254). The first address names the network, and the last is the broadcast address.

Each prefix bit halves the block. A /24 has 2⁸ = 256 addresses, a /25 has 128, a /26 has 64, and so on. Going the other way, a /16 has 65,536 addresses and a /8 has 16.7 million. The subnet mask is just the prefix written as an address: 24 one-bits give 255.255.255.0, and 26 give 255.255.255.192.

Cloud providers reserve extra addresses in each subnet. AWS reserves five, for example. Check your provider’s documentation for the number of hosts you can actually use.

Private ranges

RFC 1918 sets aside three blocks for private networks, which are never routed on the public internet: 10.0.0.0/8, 172.16.0.0/12 (172.16.0.0 to 172.31.255.255), and 192.168.0.0/16. When connecting networks with a VPN or peering two cloud VPCs, choose ranges that do not overlap. Two offices that both use 192.168.1.0/24 cannot be routed to each other without address translation. Use CIDR contains IP to check which range an address falls in.

Splitting a network

Planning usually starts with one block that you divide. The CIDR splitter turns 192.168.1.0/24 into four /26 subnets: .0–.63, .64–.127, .128–.191, and .192–.255. That could be one each for staff, guests, servers, and a reserve. Each additional prefix bit doubles the number of subnets and halves their size. Leave room to grow, because renumbering a live network is far harder than reserving space up front.

For a cloud VPC, a common pattern is a /16 for the VPC, split into /20 or /24 subnets per availability zone and tier (public, private, and database). That leaves plenty of unallocated space for later.

Alignment: why some ranges need several blocks

A CIDR block always starts at a multiple of its own size. A /26 can start at .0, .64, .128, or .192, but never at .10. So an arbitrary range like 192.168.1.10 to 192.168.1.130 cannot be one block. The IPv4 range to CIDR tool expresses it exactly with seven blocks: a /31, /30, /28, /27, /26, /31, and /32. Firewalls and security groups need CIDR notation, so this conversion comes up whenever a provider publishes ranges as start and end addresses.

In the other direction, the CIDR aggregator merges adjacent, aligned, and overlapping blocks into the shortest exact list. 192.168.0.0/25 and 192.168.0.128/25 become 192.168.0.0/24. But 192.168.1.0/24 and 192.168.2.0/24, although adjacent, do not combine, because a /23 must start at an even third octet. Aggregation never adds addresses you did not list.

IPv6 in brief

IPv6 addresses are 128 bits, written as eight groups of four hex digits, with runs of zeros compressed as ::. The same prefix idea applies: an ISP typically assigns a /48 or /56 to a site, and individual networks are almost always /64. There is no broadcast address, and address scarcity is not an issue, so planning is about structure rather than squeezing. The IPv6 address converter expands and compresses addresses to their canonical form.