CIDR notation and subnetting explained

What the slash means#

CIDR notation writes an address, a slash and a number: 192.168.10.0/26. The number is the prefix length: how many of the address's bits, counting from the left, identify the network. The rest identify a host inside it. An IPv4 address has 32 bits, so a /26 leaves 32 − 26 = 6 bits for hosts, and 2^6 = 64 addresses in the block.

A prefix length is just another way to write a subnet mask. A /26 means 26 one-bits followed by 6 zero-bits, which in dotted decimal is 255.255.255.192. The two notations carry the same information. CIDR is shorter, and it is what routers, cloud consoles and firewall rules use. The idea replaced the old address classes in 1993 (RFC 4632).

Common prefix lengths#

Two examples worked by hand#

Example 1: how big is 192.168.10.0/26?

1. Host bits: 32 − 26 = 6.
2. Addresses: 2^6 = 64.
3. The network address is the first, 192.168.10.0. The broadcast address is the last, 192.168.10.63.
4. Usable hosts: .1 to .62, which is 62.

Example 2: which /26 does 192.168.10.77 belong to?

A /26 divides the last octet into blocks of 64, the size worked out above: 0–63, 64–127, 128–191 and 192–255. The address ends in 77, so it is in the second block.

Splitting a network into subnets#

Each bit you add to the prefix halves the block. A /24 becomes two /25s, or four /26s, or eight /27s. To split 192.168.10.0/24 into four equal subnets you borrow two host bits and get /26:

Subnets do not have to be the same size. Splitting with variable length subnet masks (VLSM) lets a /24 hold one /25 for a busy segment, one /26 for a department and two /27s for small ones, as long as each block starts on a boundary that is a multiple of its own size. The subnet calculator can split a block into equal parts and checks the arithmetic.

Going the other way

Contiguous, aligned blocks can be summarised into one route. Four consecutive /24s starting at a multiple of four, 192.168.0.0/24 to 192.168.3.0/24, are exactly 192.168.0.0/22. Routers do this constantly, and it is why the internet's routing table has hundreds of thousands of entries rather than billions.

Why subnet at all#

• Smaller broadcast domains. Broadcast traffic reaches every device in the subnet. Fewer devices, less noise.
• Separation. Guests, IoT devices, servers and staff can live on different subnets, with the router or firewall deciding what may cross between them.
• Planning. Subnets that map to floors, teams or roles make addresses easy to reason about, and easy to summarise.
• Containing faults. A misconfigured device or a broadcast storm stays in its own subnet.

Prefix lengths in IPv6#

The notation is the same and the numbers are bigger. Because IPv6 addresses are 128 bits, the sizes that matter are:

Common questions#