Subnet Calculator: How to Read CIDR Notation

CIDR (Classless Inter-Domain Routing) notation is how networks are defined in the modern internet. If you configure firewalls, security groups, VPCs, VPNs, or any network infrastructure, you need to read CIDR fluently. Yet many developers treat subnet math as a black art, reaching for a calculator without understanding what the numbers mean.

This guide teaches you to read CIDR notation by sight and understand what the numbers represent.

What is CIDR Notation?

CIDR notation appends a prefix length to an IP address:

192.168.1.0/24

The /24 means the first 24 bits (out of 32) identify the network. The remaining 8 bits identify hosts within that network.

192.168.1.0/24

IP:        11000000.10101000.00000001.00000000
Mask:      11111111.11111111.11111111.00000000
           ├── network (24 bits) ──┤├ host (8)┤

The Subnet Mask

The prefix length /n creates a subnet mask — a 32-bit value where the first n bits are 1 and the rest are 0:

Prefix	Subnet mask	Total addresses	Usable hosts
/32	255.255.255.255	1	0 (single host)
/30	255.255.255.252	4	2 (point-to-point)
/28	255.255.255.240	16	14
/24	255.255.255.0	256	254
/20	255.255.240.0	4,096	4,094
/16	255.255.0.0	65,536	65,534
/8	255.0.0.0	16,777,216	16,777,214

The pattern: each bit you add to the prefix halves the network. Each bit you remove doubles it.

Network and Broadcast Addresses

Every subnet has two reserved addresses:

Network address — all host bits set to 0 (first address)
Broadcast address — all host bits set to 1 (last address)

For 192.168.1.0/24:

Network: 192.168.1.0
First usable host: 192.168.1.1
Last usable host: 192.168.1.254
Broadcast: 192.168.1.255

This is why a /24 has 256 addresses but only 254 usable hosts.

Reading CIDR by Sight

With practice, you can read common prefixes instantly:

/24 = 256 addresses, last octet varies (192.168.1.0 - 192.168.1.255)
/16 = 65,536 addresses, last two octets vary (10.0.0.0 - 10.0.255.255)
/8 = 16M addresses, last three octets vary (10.0.0.0 - 10.255.255.255)
/32 = single IP address (host route)
/0 = all IP addresses (default route)

For anything between, remember: each step from /24 toward /16 doubles the network.

/24 = 256
/23 = 512
/22 = 1,024
/21 = 2,048
/20 = 4,096

Splitting Subnets

Splitting (subnetting) divides a network into smaller pieces. Split a /24 into four /26 networks:

192.168.1.0/24 splits into:
  192.168.1.0/26    (hosts .1 - .62)
  192.168.1.64/26   (hosts .65 - .126)
  192.168.1.128/26  (hosts .129 - .190)
  192.168.1.192/26  (hosts .193 - .254)

Each /26 has 64 addresses (62 usable). This is the standard approach for creating VLANs, cloud subnets, or isolated network segments.

Private IP Ranges (RFC 1918)

These ranges are reserved for private networks and are not routable on the public internet:

Range	CIDR	Typical use
10.0.0.0 - 10.255.255.255	10.0.0.0/8	Large enterprise, cloud VPCs
172.16.0.0 - 172.31.255.255	172.16.0.0/12	Mid-size networks
192.168.0.0 - 192.168.255.255	192.168.0.0/16	Home and small office

Other reserved ranges:

127.0.0.0/8 — loopback (localhost)
169.254.0.0/16 — link-local (auto-assigned when DHCP fails)
100.64.0.0/10 — carrier-grade NAT (RFC 6598)

Cloud VPC Sizing

When creating a VPC in AWS, Azure, or GCP, choose the CIDR block carefully — it cannot be changed later:

VPC size	CIDR	Addresses	Subnets you can create
Small	/24	256	4 x /26 or 8 x /28
Medium	/20	4,096	16 x /24
Large	/16	65,536	256 x /24

AWS reserves 5 addresses per subnet (network, broadcast, and three for internal services). So an AWS /24 subnet has 251 usable IPs, not 254.

The Wildcard Mask

The wildcard mask is the bitwise inverse of the subnet mask. It is used in Cisco ACLs and OSPF configuration:

Subnet mask	Wildcard mask
255.255.255.0 (/24)	0.0.0.255
255.255.240.0 (/20)	0.0.15.255
255.255.255.252 (/30)	0.0.0.3

The wildcard mask marks which bits can vary. In a /24, the last 8 bits (0.0.0.255) can be any value.

Calculate Subnets

StackCache IP Calculator derives network address, broadcast address, subnet mask, wildcard mask, host range, and CIDR splits — all locally in your browser with no account needed.