A guide to subnet masks and CIDR notation for network engineers
Subnetting is the practice of dividing an IP network into smaller, more manageable address ranges. It helps engineers control broadcast traffic, organize departments, conserve IPv4 addresses, and apply security policies with greater precision. Two concepts sit at the center of this work: the subnet mask and Classless Inter-Domain Routing, usually abbreviated as CIDR.
Although network equipment can calculate many values automatically, understanding the underlying binary structure remains essential. A correct prefix length affects routing, firewall rules, DHCP scopes, cloud network design, and troubleshooting. A single incorrect bit can make a host unreachable or expose a segment to unintended traffic.
How subnet masks divide an address
An IPv4 address contains 32 bits, commonly written as four decimal octets. A subnet mask also contains 32 bits. Its consecutive ones identify the network portion, while its trailing zeros identify the host portion. For example, the mask 255.255.255.0 has 24 network bits and 8 host bits.
The address 192.168.10.25 with this mask belongs to the 192.168.10.0 network. The first three octets describe the network, while the final octet identifies an individual interface. The first and last addresses in a conventional subnet are reserved for the network identifier and broadcast address, leaving 254 usable host addresses in a /24 network.
Binary notation makes the boundary clearer. The decimal mask 255.255.255.0 converts to 11111111.11111111.11111111.00000000. Network bits must appear before host bits; a mask with alternating ones and zeros is invalid for standard IPv4 subnetting.
Reading CIDR prefix lengths
CIDR notation expresses the number of network bits after a slash. Therefore, 192.168.10.0/24 means that 24 of the 32 IPv4 bits describe the network, leaving 8 host bits. A /16 leaves 16 host bits, and a /30 leaves only 2 host bits.
The number of addresses in a subnet is calculated as 2 raised to the number of host bits. For ordinary subnets, subtract two to account for the network and broadcast addresses. This formula changes in special cases: a /31 can support a point-to-point link under RFC 3021, while a /32 identifies one host route.
| CIDR prefix | Subnet mask | Total IPv4 addresses | Conventional usable hosts | Common use |
|---|---|---|---|---|
| /8 | 255.0.0.0 | 16,777,216 | 16,777,214 | Very large private or provider allocation |
| /16 | 255.255.0.0 | 65,536 | 65,534 | Large enterprise network |
| /24 | 255.255.255.0 | 256 | 254 | Typical LAN or VLAN |
| /26 | 255.255.255.192 | 64 | 62 | Small department or service segment |
| /28 | 255.255.255.240 | 16 | 14 | Compact server or management range |
| /30 | 255.255.255.252 | 4 | 2 | Traditional router-to-router link |
| /32 | 255.255.255.255 | 1 | 1 route target | Host route or loopback address |
Calculating network and broadcast addresses
To find a network address, perform a bitwise AND between the IP address and subnet mask. In decimal practice, engineers often use the block size. The block size is 256 minus the relevant mask octet. A /26 mask is 255.255.255.192, so its block size is 64.
The resulting ranges in the final octet are 0–63, 64–127, 128–191, and 192–255. An address such as 10.20.5.77 therefore belongs to the 10.20.5.64/26 subnet. The network address is 10.20.5.64, the broadcast address is 10.20.5.127, and the usual host range is 10.20.5.65 through 10.20.5.126.
For a reliable calculation, identify the octet where the mask stops being 255, determine the block size, and locate the IP address within that block. This approach is useful during incident response because it quickly reveals whether two devices share a local subnet or require routing.
Designing efficient subnet allocations
Good subnet design starts with requirements rather than arbitrary boundaries. Estimate current devices, expected growth, network appliances, servers, and reserved addresses. A branch office with 40 clients may fit in a /26, but selecting a /27 would provide only 30 conventional host addresses and leave no room for expansion.
Variable Length Subnet Masking allows different parts of an address plan to use different prefix lengths. A data-center transit link may use /31, a point-to-point legacy link may use /30, and a user VLAN may use /24. This conserves address space while keeping routes and operational boundaries clear.
Summarization is the reverse planning skill. If several contiguous networks can be represented by a shorter prefix, routers can advertise one aggregate route instead of many specific routes. For example, four aligned /24 networks can often be summarized as a /22. The networks must be contiguous and correctly aligned; otherwise, the summary may include unintended addresses.
Applying subnetting to routing and security
CIDR affects every routing decision. Routers compare the destination address against available prefixes and select the longest matching prefix. A /25 route is more specific than a /24 route, so traffic matching both normally follows the /25 path. This principle supports route aggregation, policy routing, and controlled exceptions.
Subnet boundaries also influence access control lists, firewall objects, and segmentation strategies. A rule allowing 192.168.50.0/24 is broader than one allowing 192.168.50.0/27. Engineers should verify whether a rule covers only intended hosts, especially when public services, administrative interfaces, or cloud security groups are involved.
IP geolocation can provide useful context during investigations, but it should not be confused with subnet ownership or exact device location. Public address databases may be incomplete or misleading, and techniques discussed in geolocation spoofing risks show why location signals should be treated as evidence rather than proof.
Working with IPv6 prefixes
IPv6 uses CIDR notation extensively, but its address space changes the design priorities. A common LAN allocation is /64, which provides enough interface identifiers for normal host-autoconfiguration methods. Organizations may receive a /48 site allocation and divide it into many /64 networks for departments, sites, or VLANs.
IPv6 generally does not use broadcast addresses. Neighbor Discovery replaces several IPv4 broadcast functions, and multicast handles group communication. As a result, IPv6 subnet planning focuses on prefix hierarchy, routing aggregation, privacy, and policy rather than calculating a small pool of usable host addresses.
Engineers should document IPv4 and IPv6 plans together. A firewall policy that is carefully restricted in IPv4 can still leave an unintended IPv6 path if equivalent prefixes, services, and monitoring rules are missing. Certificate configuration matters across both protocols as well; this overview of SSL security and SEO explains why encrypted web access is also an operational concern.
Practical checks for daily network work
Use a consistent method whenever you assign or troubleshoot a prefix:
- Confirm the required host count, growth margin, and reserved addresses before choosing a prefix.
- Calculate the network, first host, last host, and broadcast address for every new IPv4 subnet.
- Check that summarized routes are contiguous, correctly aligned, and not broader than intended.
- Compare firewall, ACL, DHCP, DNS, and monitoring scopes with the actual subnet boundaries.
- Validate the design with a subnet calculator, routing table, ping test, and DNS lookup before deployment.
A browser-based utility can reduce arithmetic errors, but the result should still be checked against the addressing plan and device configuration. Tools are especially helpful for unusual masks such as /19, /21, or /27, where decimal intuition is less reliable.
Build subnetting fluency by practicing with real address blocks, documenting every allocation, and testing both normal and edge-case routes. CoderVortex utilities can support quick network checks while you turn CIDR calculations into a dependable part of your engineering workflow.