Subnets and CIDR explained: what /24 and /28 mean

The short answer: The number after the slash, as in 192.168.1.0/24, says how many bits at the start of the address are fixed for the network. The rest are for devices. A /24 has 256 addresses, and each step up the slash halves the block: a /25 has 128, a /26 64 and a /28 just 16. In a normal IPv4 network, the first address names the network and the last is the broadcast address, so a /24 has 254 usable addresses and a /28 has 14.

This guide explains how CIDR notation works, how to read a subnet mask, how to split a range into smaller subnets, and how IPv6 differs.

What a subnet is

An IP address has two parts: the network it belongs to, and the device on that network. A subnet is a block of addresses that share the same network part. Devices in the same subnet can talk to each other directly; traffic to anywhere else goes through a router.

An IPv4 address is 32 bits long, written as four numbers from 0 to 255, such as 192.168.1.10. CIDR (Classless Inter-Domain Routing), defined in RFC 4632, writes a block as an address followed by a slash and the prefix length. 192.168.1.0/24 means "the first 24 bits are the network": every address from 192.168.1.0 to 192.168.1.255.

Before CIDR, networks came in fixed "classes" of 256, 65,536 or 16 million addresses. CIDR lets a block be any power-of-two size, which is why you see /28 and /22 rather than only /8, /16 and /24.

Prefix lengths and sizes

Each step down the slash (a smaller number) doubles the size, and each step up halves it. The common IPv4 sizes:

Where you usually see each size:

• /8: a large private network, such as 10.0.0.0/8.
• /16: a campus or a cloud network.
• /22: a large office or Wi-Fi network.
• /24: a home or small office network.
• /26: a department or VLAN.
• /28: a small block of public addresses.
• /29: a business broadband block.
• /30: a link between two routers.
• /31: a point-to-point link (RFC 3021).
• /32: a single address.

To work out the size yourself, subtract the prefix from 32 and raise 2 to that power. A /27 leaves 5 bits for hosts, so it has 2 × 2 × 2 × 2 × 2 = 32 addresses.

Network, broadcast and usable addresses

In a normal IPv4 subnet, two addresses are set aside:

• The network address is the first address, with all host bits set to 0. It names the subnet and isn't given to a device.
• The broadcast address is the last, with all host bits set to 1. A message sent to it reaches every device on the subnet.

Everything in between is usable. For 192.168.1.0/28, the network address is .0, the broadcast address is .15, and devices can use .1 to .14. The router usually takes the first or last usable address.

There are two exceptions. RFC 3021 allows a /31 on a point-to-point link, with no network or broadcast address, so both addresses are usable. A /32 is a single address, often used for one server or in firewall rules.

Subnet masks and wildcard masks

A subnet mask is the prefix written as an address: 1 bits for the network part, 0 bits for the host part. A /24 is 255.255.255.0; a /26 is 255.255.255.192, because the last number in binary is 11000000. Older equipment, Windows network settings and many routers ask for the mask rather than the prefix.

A wildcard mask is the opposite: 0 bits for the network part and 1 bits for the host part. A /24 has the wildcard 0.0.0.255. Cisco access lists and some firewalls use it.

Which subnet is an address in?

Take 192.168.1.77/26. A /26 block holds 64 addresses, so the blocks start at .0, .64, .128 and .192. 77 falls in the block starting at 64. The network address is 192.168.1.64, the broadcast address is 192.168.1.127, and the usable range is .65 to .126. Our Subnet Calculator works this out for any address, including masks that don't fall on a whole number.

Splitting a range into smaller subnets

To divide a block, add bits to the prefix. Each extra bit doubles the number of subnets and halves their size. A /24 splits into:

• two /25 subnets of 128 addresses (126 usable);
• four /26 subnets of 64 (62 usable);
• eight /27 subnets of 32 (30 usable);
• sixteen /28 subnets of 16 (14 usable).

You can mix sizes, as long as each subnet starts on a boundary of its own size. From 192.168.1.0/24 you could take 192.168.1.0/25 for staff devices, 192.168.1.128/26 for printers and phones, and 192.168.1.192/26 for guest Wi-Fi. But 192.168.1.32/26 isn't a valid subnet: a /26 must start at a multiple of 64.

In the Subnet Calculator, enter the range and a longer prefix in "Split into", such as /26, to list the smaller subnets inside it.

Private and special ranges

Some ranges are set aside and never appear on the public internet:

• 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16 are private (RFC 1918). Homes and offices use them behind a router that shares one public address.
• 100.64.0.0/10 is shared address space (RFC 6598), used by internet providers for carrier-grade NAT. If your router's internet address starts with 100.64 to 100.127, your provider shares a public address between customers.
• 192.0.2.0/24, 198.51.100.0/24 and 203.0.113.0/24 are for documentation and examples only (RFC 5737), like the examples in this guide.
• 127.0.0.0/8 is loopback: the device talking to itself.

How IPv6 is different

IPv6 addresses are 128 bits long, so the numbers are much larger, but the slash means the same thing. A few practical differences:

• A single network, such as one office LAN, is almost always a /64. Automatic address setup (SLAAC) expects it, as described in RFC 4291.
• Sites are usually given a /48 or /56, which holds 65,536 or 256 /64 networks.
• There's no broadcast address, because IPv6 uses multicast, so every address in a range can in principle be used.
• 2001:db8::/32 is for documentation, the IPv6 equivalent of the example ranges above.

Don't try to save addresses by using a longer prefix than /64 on a LAN. IPv6 has room to spare, and many devices won't configure themselves on a smaller network.

Common questions

Is /24 the same as 255.255.255.0?

Yes. They're two ways of writing the same thing: 24 network bits, shown as a prefix length or as a mask.

Why does my provider's address start with 100.64?

That's shared address space for carrier-grade NAT. Your router doesn't have its own public address; the provider shares one between several customers. Websites see the shared public address, not the 100.64 one. That can matter for port forwarding and remote access, which usually need a public address of your own.

How big should each subnet be?

Count the devices that need an address today, add room for growth, and add the router. Then choose the smallest size that fits. A small office with 40 devices fits in a /26, with 62 usable addresses, but a /24 gives more room and is easier to remember. Phones, laptops, printers and smart devices add up quickly, and guest Wi-Fi can be busy, so leave more space than you think you need. Changing a subnet later means changing every device with a fixed address, firewall rules and sometimes the VPN as well.

Can I use 10.0.0.0/8 for a small network?

You can use any part of it. Most people take one /24 from it, such as 10.20.30.0/24, rather than the whole block.

Checklist

• You know how many devices each subnet needs, with room to grow.
• Each subnet is the smallest size that fits and starts on a boundary of its own size.
• Two addresses per IPv4 subnet are kept for network and broadcast, except /31 and /32.
• Private ranges don't clash with the home networks staff connect from.
• IPv6 LANs use /64.
• Ranges and masks checked in a subnet calculator before you configure equipment.