CIDR notation explained

An IPv4 address is 32 bits, usually written as four numbers from 0 to 255. CIDR notation adds a slash and a count: how many of those bits, starting from the left, are fixed for everything in the block. The rest are free to vary, and each combination of the free bits is one address.

So 203.0.113.0/24 means: the first 24 bits (203.0.113) are fixed, the last 8 bits vary, and the block runs from 203.0.113.0 to 203.0.113.255. The first address of any block is its network address and the last is its broadcast address, so on an ordinary LAN two of the 256 are not usable by hosts, leaving 254.

The address before the slash is normally the start of the block, with all host bits zero. When it is not, as in 203.0.113.42/24, the notation describes a host and the block it sits in: host 42 of the 203.0.113.0/24 network. Both forms are common. Configuration files use the host form (192.168.1.23/24 on an interface); routing tables and firewall rules use the block form.

Three rules make the arithmetic quick:

• Every bit you add to the prefix halves the block; every bit you remove doubles it. A /25 is half a /24; a /23 is two /24s.
• The number of addresses is 2 to the power of (32 minus the prefix). A /26 has 2⁶ = 64.
• Blocks start on multiples of their own size. A /26 can start at .0, .64, .128 or .192, never at .100, which is why 203.0.113.100/26 describes a host inside 203.0.113.64/26, not a block starting at .100.

The slash number and the subnet mask are the same information in two spellings. A mask is the prefix written out as 32 bits: /24 is twenty-four ones followed by eight zeros, which in dotted form is 255.255.255.0. What is a subnet mask? goes through the conversion; the subnet calculator does it for you and also prints the network, broadcast and usable range.

CIDR stands for Classless Inter-Domain Routing. It replaced the original scheme of fixed Class A, B and C sizes in 1993 for two reasons: blocks could be sized to need instead of being wasted, and a provider could announce one summary route for all its customers instead of hundreds. The IP address classes guide covers what it replaced and where the old vocabulary still turns up.

Usable hosts assumes an ordinary subnet with a network and a broadcast address. Two special cases: a /31 is used on point-to-point links with both addresses usable, and a /32 is a single host.

Prefixes shorter than /8 exist but describe aggregates rather than networks: 0.0.0.0/0 is "every address", which is how a default route is written, and regional registries hold blocks such as /8s to carve up for providers. The CIDR to IP range converter turns any block into its first and last address, and back.

A home network. The router says its LAN is 192.168.1.0/24. Hosts can use 192.168.1.1 through 192.168.1.254; the router usually takes .1, and 192.168.1.255 is the broadcast address. The local IP tool shows which of those your device holds.

Splitting a block. A company with 198.51.100.0/24 wants four separate networks. Four is 2², so it borrows 2 host bits and gets four /26s: 198.51.100.0/26, .64/26, .128/26 and .192/26, each with 62 usable addresses.

Joining blocks. An office uses 192.168.0.0/24 and 192.168.1.0/24 and wants them to be one network. They are adjacent and the first starts on an even boundary, so together they are 192.168.0.0/23: 512 addresses, one subnet. Providers do the same at a larger scale, announcing one summary route for all their customers' blocks; that is the aggregation CIDR was designed for.

A firewall rule. "Allow SSH from 203.0.113.42/32" permits exactly one address. "Allow from 203.0.113.0/24" permits all 256. Writing /32 rather than the bare address is a habit worth keeping, because some tools treat a bare address with a missing prefix as a /0 and allow everyone.

A lookup result. When the IP lookup or WHOIS shows that an address belongs to the block 203.0.113.0/25, every address from 203.0.113.0 to 203.0.113.127 has the same owner, which is what tells you that two different-looking addresses came from one network.

IPv6 uses the same slash notation on 128-bit addresses, so the numbers are bigger and the habits are different. Nobody counts usable hosts in IPv6; a single subnet is a /64 with 2⁶⁴ addresses, and address autoconfiguration requires that size. Prefixes describe how many subnets you have, not how many hosts.

The number itself is the only thing that carries over cleanly: a shorter prefix is still a bigger block, each bit still halves or doubles it, and the subnet calculator handles both families. What changes is scale. A home that got a single /24 in IPv4, 254 addresses, typically gets a /56 in IPv6, which is 256 networks each larger than the entire IPv4 internet. The IPv6 test shows whether your connection has one, and IPv4 vs IPv6 explains the rest of the differences.