← All articles  ·  IP & Tech  ·  11 min read  ·  Updated 2026-05-18

Subnet Calculator & CIDR Notation: How to Read /24, /16 and /32 in Plain English

Network engineers throw around phrases like "just give me a /29" or "route the whole /22 to that VLAN" as if everyone learned binary in primary school. They did not. CIDR notation is short, dense, and unforgiving 🧮. A subnet calculator hides the math but it does not hide the logic, and the logic is what matters when a firewall rule blocks half a building.

This article unpacks the slash. It covers what the prefix length actually does to the address space, how to count usable hosts, why /32 is useful even though it points at a single machine, and how to read any block at a glance. Examples use IPv4 throughout because that is where most people meet CIDR first, though the same idea extends to IPv6 with longer prefixes.

What CIDR notation replaced

Before 1993, IPv4 addresses were carved into rigid classes. Class A covered 1.0.0.0 to 126.255.255.255 with a fixed /8 mask. Class B used /16, Class C used /24. A small business that needed 300 addresses had to take a full /16 with 65 534 usable hosts and waste 65 000 of them. The IETF buried that scheme with RFC 1519 and finalised the modern version in RFC 4632. The new approach is Classless Inter-Domain Routing, abbreviated CIDR and pronounced like the apple drink.

The change was simple. Instead of fixed boundaries at 8, 16 and 24 bits, any number from 0 to 32 became a valid prefix length. Now that business gets a /23, which is exactly 512 addresses, and the rest stays in the pool. ARIN, RIPE and the other regional registries hand out blocks in CIDR form by default. If you ever pulled a WHOIS record and saw NetRange: 203.0.113.0 - 203.0.113.255 next to CIDR: 203.0.113.0/24, that is the new world meeting the old.

Reading the slash, one bit at a time

An IPv4 address is 32 bits long. The number after the slash is how many of those bits are locked as the network identifier. The bits left over identify hosts inside that network. The rule is mechanical:

• Host bits = 32 minus prefix length
• Total addresses in the block = 2 raised to the host bits
• Usable hosts on a normal subnet = total minus 2 (network address and broadcast)

That last subtraction does not apply to /31 point-to-point links per RFC 3021, nor to /32 host routes, but it holds everywhere else. A /24 has 8 host bits, so 256 addresses, 254 usable. A /16 has 16 host bits, so 65 536 addresses. A /28 has 4 host bits, so 16 addresses and 14 usable hosts which is a popular size for a small DMZ.

The prefix table that lives on every engineer's whiteboard

Most people memorise the slash-to-mask conversion eventually. Until then, this table answers ninety percent of subnetting questions in production:

Why /32 even exists

A /32 has zero host bits, which sounds useless until you realise it is the most precise way to point at a single machine. Routing tables, firewall ACLs and BGP communities use /32 entries constantly. When a cloud security group says "allow 203.0.113.42/32 on port 22", it is locking access to one address. The same trick works in reverse. A blackhole route to 198.51.100.7/32 drops traffic for one bad actor without touching the rest of the prefix. If you have ever read about a targeted IP block during a DDoS, the operator almost certainly used /32 entries.

IPv6 takes the idea further. A /128 in IPv6 is the same concept and shows up in things like ::1/128, the loopback. The IPv4 equivalent is the entire 127.0.0.0/8 block reserved by RFC 1122, of which only 127.0.0.1 ever gets used in practice. For a deeper dive on address sizes and why IPv6 even matters, the comparison in IPv4 vs IPv6 walks through the bit-length jump from 32 to 128.

Working an example without a calculator

Take 10.20.30.0/26. The prefix is 26, so host bits = 6, total addresses = 64, usable = 62. The subnet mask is 255.255.255.192 because the last octet has 2 network bits set (128 + 64 = 192). The network address is 10.20.30.0 and the broadcast is 10.20.30.63. Host range runs from 10.20.30.1 to 10.20.30.62. The next /26 starts at 10.20.30.64. That is the entire arithmetic, no tool needed.

The trick is recognising the "magic number". For prefixes between /25 and /30, the magic number is 256 minus the last mask octet. /26 has mask 192, so 256 minus 192 equals 64. Subnets start every 64 addresses: .0, .64, .128, .192. Once you see the rhythm, slashes stop feeling arbitrary.

Private ranges and the slash that defines them

The famous RFC 1918 blocks are written in CIDR for a reason. 10.0.0.0/8 covers everything from 10.0.0.0 to 10.255.255.255. 172.16.0.0/12 stretches from 172.16.0.0 to 172.31.255.255, which surprises people who expect a tidy /16 there. The 192.168.0.0/16 block hides the well-known home subnets like 192.168.1.0/24 inside it. The private IP ranges article takes that apart in more detail, including the link-local 169.254.0.0/16 and the IPv6 ULA fc00::/7 equivalent.

One reason CIDR matters for privacy work is that WHOIS allocations show the boundary of who owns what. A residential customer might sit inside a /22 assigned to an ISP, but the ISP itself holds a /16 or larger from the regional registry. The geographic location of an IP often resolves only as accurately as the smallest CIDR block the geolocation provider has data for. If MaxMind only knows the /20, every address in that block reports the same city.

Subnet calculators worth bookmarking

Real calculators do the boring parts in milliseconds. The classics are subnet-calculator.com, the legacy Wikipedia CIDR table for reference, and the built-in ipcalc command on Linux:

1. ipcalc 192.168.1.0/26 prints network, broadcast, host range, mask and wildcard.
2. sipcalc 10.0.0.0/8 -s 16 splits a big block into /16 pieces.
3. Python users can write import ipaddress; list(ipaddress.ip_network('203.0.113.0/29').hosts()) and get a clean list.

Common mistakes that look fine on paper

Three errors come up repeatedly during network reviews. The first is treating /24 as a hard rule when allocating LANs. There is no reason a guest WiFi needs 254 addresses if only fifteen devices ever join. A /27 with thirty hosts saves space and reduces broadcast traffic. The second mistake is forgetting that /23 and larger blocks cross the third-octet boundary. A /23 starting at 10.0.0.0 covers 10.0.0.0 through 10.0.1.255, not just 10.0.0.x. The third is using overlapping subnets in VPN concentrators, which guarantees routing failures the moment a remote office tries to reach an internal /24 that matches its own LAN.

None of these show up on a subnet calculator. They show up at three in the morning when a deployment breaks. The fix is to draw the address plan before touching any device and to keep a record of every allocation. Spreadsheets work. IPAM tools work better. Either way, CIDR is the unit, not random ranges.

The IPv6 footnote

IPv6 uses the same slash but the numbers feel weird. A /64 is the standard subnet size and contains 18 quintillion addresses, more than the entire IPv4 internet squared. Service providers usually hand out /48 or /56 to customers, leaving room for thousands of /64 subnets inside one allocation. Reading IPv6 CIDR is identical in logic, only longer in digits. The transition mechanics, and why the slash sizes feel so generous, are unpacked in the IPv4 vs IPv6 deep dive linked earlier.

CIDR is forty years old at this point and shows no sign of retiring. Every routing table on the public internet uses it. Every cloud VPC asks for it. Reading a slash and knowing what comes next is one of those small, durable skills that pays back forever. If you also need to know how an outside observer maps that prefix back to a country or ISP, the piece on how accurate IP geolocation really is covers the limits of that translation.