#1CIDR subnetting: the math you actually need

What we tested: We validated environment files, Docker configurations, and CI pipeline syntax using the browser-based tools on this site. All parsing and validation runs locally.

CIDR only looks intimidating until you map the prefix length to host counts.

The part that matters in practice is how to read a subnet, size one for a VPC or LAN, and remember the reserved addresses that people usually forget.

#2What CIDR Notation Actually Says

192.168.1.0/24 has two parts. The IP (192.168.1.0) and the prefix length (/24). The prefix length is the count of leading bits that identify the network; everything after belongs to the host.

An IPv4 address is 32 bits. So:

• /24 → 24 network bits, 8 host bits → 2⁸ = 256 addresses
• /16 → 16 network bits, 16 host bits → 2¹⁶ = 65,536 addresses
• /28 → 28 network bits, 4 host bits → 2⁴ = 16 addresses

The subnet mask is the same information in dotted-decimal form: a /24 is 255.255.255.0, 24 ones followed by 8 zeros. They're two notations for one idea. CIDR (/24) is the modern, compact form; the mask (255.255.255.0) is what older tooling and OS config still show.

The pattern to internalize: each step down in prefix length doubles the block. A /23 is two /24s; a /22 is four. Smaller number = bigger network.

#2The Two Reserved Addresses (Where People Slip)

In any subnet, two addresses are not usable by hosts:

• The network address, all host bits zero, names the subnet itself (e.g., 10.0.1.0 in 10.0.1.0/24).
• The broadcast address, all host bits one, addresses every host at once (e.g., 10.0.1.255).

That's why "usable hosts" is always 2^host_bits − 2. A /24 has 256 addresses but 254 usable. Forgetting the −2 is the classic off-by-two that leaves a deployment one IP short.

Two edge cases worth knowing: a /31 (2 addresses, 0 usable by the old formula) is special-cased by RFC 3021 to give both addresses to point-to-point links. And a /32 is a single host, one exact address, used constantly in security-group and firewall rules to mean "just this one machine."

#2Splitting a Block Into Subnets

The core operation in real network design: take one block and carve it into smaller ones. Say you have 10.0.0.0/24 (256 addresses) and want four equal subnets. Four = 2², so you borrow 2 host bits for the network, turning /24 into /26:

Each /26 holds 64 addresses / 62 usable hosts. Notice the subnets start at multiples of 64, the block size. That's the trick to doing this in your head: the block size is 2^host_bits, and every subnet boundary is a multiple of it. Subnets don't have to be equal, either, VLSM (Variable Length Subnet Masking) lets you mix /26 and /28 blocks inside the same parent to fit differently-sized tiers. The subnet calculator does this splitting instantly, including unequal VLSM layouts, so you can validate a plan before committing it to infrastructure-as-code.

#2Where It Actually Bites: Cloud Infrastructure

Subnetting stopped being a router-config chore and became an everyday cloud-design task. The mistakes are expensive:

VPC sizing. When you create an AWS VPC or GCP network you pick a CIDR, say 10.0.0.0/16, and it's painful to change later. Too small and you can't add subnets; too large and you may collide with a peered VPC or on-prem range. The private ranges you have to work within are RFC 1918: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16.

Subnet-per-AZ math. Split your VPC across availability zones and each subnet consumes a chunk of the range. Cloud providers also reserve a few addresses per subnet (AWS reserves 5, not 2), so a /28 subnet gives you 11 usable IPs, not 14, enough to break a deploy if you sized it to the textbook number.

Security-group and firewall rules. Every allow/deny rule is a CIDR. 0.0.0.0/0 means "the entire internet", the classic accidental exposure. 10.0.0.0/8 means "our whole private network." 203.0.113.7/32 means "exactly this one host." Fat-finger the prefix length and you either lock out legitimate traffic or open a door far wider than intended.

Route tables and peering. Routes match on CIDR prefix, the most specific match wins. Two peered VPCs with overlapping CIDRs simply cannot route to each other, which is why VPC ranges must be planned to never overlap.

For inspecting actual addresses, whether a given IP falls inside a range, what a public IP's allocation is, pair the subnet calculator with the IP info lookup, and resolve hostnames to the addresses your rules must cover with the DNS lookup.

#3Quick calculation you can run anywhere

Here's a Python one-liner that answers the most common subnetting question, "how many usable hosts in this CIDR?", accounting for the cloud-provider reserved addresses:

from ipaddress import ip_network

net = ip_network("10.0.1.0/24")
textbook_usable = net.num_addresses - 2       # 254 (subtract network + broadcast)
aws_usable      = net.num_addresses - 5       # 251 (AWS reserves 5 per subnet)
print(f"{net}: textbook={textbook_usable}, AWS={aws_usable}")
# 10.0.1.0/24: textbook=254, AWS=251

That 3-address gap between textbook and AWS reality is the kind of thing that breaks a deployment when you sized a /28 to hold exactly 14 hosts (textbook) but the cloud only gives you 11.

#2Frequently Asked Questions

#3What does the /24 in an IP address mean?

The /24 is the prefix length, the number of leading bits in the 32-bit IPv4 address that identify the network rather than an individual host. A /24 reserves 24 bits for the network and leaves 8 bits for hosts, which gives 2⁸ = 256 total addresses (254 usable after subtracting the network and broadcast addresses). It's equivalent to the subnet mask 255.255.255.0. The smaller the number after the slash, the more host bits remain and the larger the network: a /16 has 65,536 addresses, a /28 has just 16. Think of the prefix length as a dividing line in the 32 bits, everything left of it is fixed for the network, everything right of it varies per host.

#3How many usable hosts are in a subnet?

Take the number of host bits (32 minus the prefix length for IPv4) and compute 2^host_bits − 2. The −2 removes the two addresses that can't be assigned to a host: the network address (all host bits zero) and the broadcast address (all host bits one). So a /24 has 8 host bits → 256 − 2 = 254 usable; a /26 has 6 host bits → 64 − 2 = 62 usable; a /30 has 2 host bits → 4 − 2 = 2 usable. Two exceptions: a /31 is special-cased to provide both addresses for point-to-point links, and cloud providers reserve extra addresses per subnet (AWS reserves 5, so an AWS /28 yields 11 usable, not 14). The subnet calculator shows the exact usable range for any prefix.

#3What is the difference between CIDR notation and a subnet mask?

They express the same information in two formats. CIDR notation (/24) is a single number counting the network bits; a subnet mask (255.255.255.0) is the dotted-decimal form of those same bits written out, 24 ones followed by 8 zeros. /24 and 255.255.255.0 are identical, as are /16 and 255.255.0.0, or /26 and 255.255.255.192. CIDR is the compact modern notation used in cloud consoles, routing tables, and firewall rules; the dotted-decimal mask is what many operating-system network configs and older tools display. Being fluent in converting between them matters because you'll meet both, sometimes in the same system.

#3How do I split a network into smaller subnets?

Decide how many subnets you need, round up to the next power of two, and borrow that many bits from the host portion. For four subnets you need 2 borrowed bits (2² = 4), so a /24 becomes four /26 blocks; for eight subnets you'd borrow 3 bits and get /27s. Each resulting subnet has a block size of 2^remaining_host_bits, and the subnet boundaries fall on multiples of that block size, so four /26s inside a /24 start at .0, .64, .128, and .192. If your subnets need to be different sizes, VLSM lets you mix prefix lengths (say a /26 and two /28s) within the same parent block as long as none overlap. Validate the layout with the subnet calculator before applying it.

#3What does 0.0.0.0/0 mean in a firewall or security group rule?

0.0.0.0/0 is a prefix length of zero, it fixes no network bits, so it matches every possible IPv4 address: the entire internet. In an inbound security-group or firewall rule it means "allow this traffic from anywhere," which is appropriate for a public web server on port 443 but a serious exposure if applied to SSH, a database port, or an admin interface. Its opposite in specificity is a /32, which matches exactly one address, the form you use to allow a single known host. Because routing and rule evaluation prefer the most specific (longest) prefix, 0.0.0.0/0 is also the natural "default route" or catch-all. Always double-check any rule using it against what you actually intend to expose.

Subnetting feels like arcane bit-twiddling until you see it's two questions repeated: how many bits are network versus host, and which addresses are reserved. Everything else, VPC sizing, security-group CIDRs, route tables, is those two questions applied to a real design, where an off-by-one on the prefix length is the difference between a clean deploy and an outage.

Let the math be automatic: split blocks, count usable hosts, and check whether an address falls in a range with the subnet calculator. Look up real-world IP allocations with the IP info tool and resolve the hostnames your rules must cover with the DNS lookup.

Written by Rahul Jalavadiya, founder of AllDevToolsHub. All tools run locally in your browser.

#2Sources / Further reading

• IETF - RFC 4632: CIDR (Classless Inter-domain Routing)
• IETF - RFC 1918: Private Address Spaces
• IETF - RFC 4291: IPv6 Addressing Architecture