What Is CIDR Notation? A Plain-English Guide for IP Networks

You have seen IP addresses written as 192.168.1.0/24 and wondered what the /24 meant. That is CIDR notation, and it is the standard way the entire internet writes IP address ranges. Once you understand the rule, the format is obvious: the slash and the number after it are the prefix length, which says how many bits of the address are fixed and how many are available for hosts in that range.

This guide is the practical version: what CIDR means, how to read it, and how to compute the address range, broadcast, mask, and host count for any IPv4 or IPv6 block. The Uttir CIDR Subnet Calculator does the math for you in your browser — paste any CIDR, get the full breakdown.

The 30-second explanation

Every IP address is 32 bits (for IPv4) or 128 bits (for IPv6). When you write 192.168.1.0/24, the /24 means "the first 24 bits are the network part, the last 8 bits are the host part".

For IPv4, that gives 8 bits for hosts, which is 2 to the 8th power, which is 256 addresses. The block runs from 192.168.1.0 to 192.168.1.255.

For 10.0.0.0/8, the first 8 bits are fixed, leaving 24 bits for hosts — 2 to the 24th power, which is about 16 million addresses. The block runs from 10.0.0.0 to 10.255.255.255.

That is the entire concept. Everything else is arithmetic.

The slash number is the prefix length

The number after the slash is the prefix length: the count of fixed bits from the left. The rest of the bits are available for hosts.

For IPv4 (32 bits total):

• /0 — the whole internet. 2^32 = 4.29 billion addresses.
• /8 — a "class A" network. 2^24 = 16.7 million addresses.
• /16 — a "class B" network. 2^16 = 65,536 addresses.
• /24 — a "class C" network. 2^8 = 256 addresses. The most common small-network block.
• /30 — 4 addresses, used for point-to-point links.
• /32 — exactly one address (a single host).

For IPv6 (128 bits total):

• /0 — the whole IPv6 space (basically infinite).
• /64 — the standard allocation for a single network. 2^64 = 18.4 quintillion addresses.
• /128 — exactly one address (a single host).

You will almost always see /64 in IPv6 (the standard network size) and /32 in IPv6 allocations (a typical ISP gets a /32 and splits it into /64s for customers).

How to read any CIDR block

For IPv4, given a CIDR like A.B.C.D/N, the address range is computed as follows:

1. Convert each octet of A.B.C.D to 8-bit binary.
2. The first N bits are the network part. The remaining (32-N) bits are the host part.
3. The network address is the IP with all host bits set to 0.
4. The broadcast address is the IP with all host bits set to 1 (for prefixes < 31).

Example: 10.20.30.0/24

• N = 24, so the first 24 bits are the network: 10.20.30.
• Last 8 bits are the host part. They run from 0 to 255.
• Network: 10.20.30.0. Broadcast: 10.20.30.255. Usable: 10.20.30.1 to 10.20.30.254 (254 hosts, because the network and broadcast addresses are reserved).

Example: 172.16.5.128/25

• N = 25, so the first 25 bits are the network: 172.16.5.1 followed by a 0 in the 26th position.
• Last 7 bits are the host part. They run from 0 to 127.
• Network: 172.16.5.128. Broadcast: 172.16.5.255. Usable: 172.16.5.129 to 172.16.5.254 (126 hosts).

The Uttir CIDR Subnet Calculator does this for you, including the trickier cases.

The subnet mask

For any prefix length N, the subnet mask is an IP where the first N bits are 1 and the rest are 0. The mask is written as a normal IPv4 address.

Examples:

• /8 → mask 255.0.0.0
• /16 → mask 255.255.0.0
• /24 → mask 255.255.255.0
• /25 → mask 255.255.255.128
• /30 → mask 255.255.255.252

You will often see the mask and the prefix used interchangeably: 255.255.255.0 means the same thing as /24. The prefix notation is more compact, which is why it won.

The wildcard mask (the inverse)

Some systems (mostly Cisco networking gear) use a wildcard mask, which is the inverse of the subnet mask: 0 becomes 1 and 1 becomes 0. The wildcard for /24 is 0.0.0.255; for /30 it is 0.0.0.3.

If you are writing access control lists on a router, you will need the wildcard. For everything else, ignore it.

The two special cases: /31 and /32

Two prefixes behave differently from the rest:

• /31 — only 2 addresses. RFC 3021 allows this for point-to-point links (the link between two routers, for example). With only 2 addresses, there is no network or broadcast address; both are usable.
• /32 — exactly 1 address. A single host route. The "this IP only" case.

The general rule "subtract 2 for network and broadcast" does not apply to /31 or /32. The CIDR Subnet Calculator handles these correctly.

CIDR and IPv6

IPv6 uses the same idea, with the same slash notation. The most common prefixes:

• /128 — a single address (the equivalent of IPv4's /32)
• /64 — a single network (the standard allocation for a LAN or a customer's connection)
• /48 — a site allocation (typical for a small organization or a residential ISP customer)

IPv6 was designed so that every site can have a /48 (65,536 subnets, each with 2^64 addresses) and never run out. The address space is so large that subnetting is not the optimization problem it is in IPv4.

How to read an IPv6 CIDR

The rules are the same: the number is the prefix length, and the rest of the bits are the host part. Example: 2001:db8:1234::/48 means the first 48 bits are fixed, leaving 80 bits for the host part. The full address range covers 2001:db8:1234:0000:: to 2001:db8:1234:ffff:ffff:ffff:ffff:ffff.

The math is identical to IPv4, just with more bits. The CIDR Subnet Calculator handles IPv6 the same way it handles IPv4.

How to figure out if an IP is in a CIDR block

Given an IP and a CIDR block, "is this IP in this block?" is a two-step check:

1. Convert the IP to binary.
2. Convert the network address (the IP in the CIDR with all host bits zeroed) to binary.
3. Compare the first N bits. If they match, the IP is in the block.

For example, is 192.168.1.42 in 192.168.1.0/24? The first 24 bits of 192.168.1.42 are 11000000.10101000.00000001 — same as the first 24 bits of 192.168.1.0. So yes, it is in the block.

Most languages have a function for this:

• Python: ipaddress.ip_network('192.168.1.0/24').overlaps(ipaddress.ip_address('192.168.1.42'))
• JavaScript: // No built-in, but the calculation is two lines

The most common practical use: checking if a request came from a trusted network, or if an IP belongs to a known cloud provider's range.

CIDR in practice: where you see it

You will see CIDR notation in a lot of places:

• AWS security groups — the source IP for an inbound rule is a CIDR (e.g. 0.0.0.0/0 for "anywhere")
• Cloudflare / nginx IP allowlists — list of trusted networks as CIDR blocks
• Routing tables — every route is a CIDR with a next-hop
• WHOIS records — the IP block assigned to an organization is a CIDR (use the WHOIS tool to look one up)
• Firewall rules — most modern firewalls use CIDR notation for the source and destination

Whenever you need to talk about "this IP or any IP in this range", CIDR is the notation. There is no alternative.

Common questions

What is the largest IPv4 block?

/0 — the entire IPv4 space, 4.29 billion addresses. You will almost never see this in real-world rules. The practical maximum allocation is /8 (about 16 million addresses), and the typical end-user allocation is /24 to /30.

What is the smallest block that is usable for hosts?

/30 (4 addresses, 2 usable) is the smallest block for point-to-point links. /31 (2 addresses, 2 usable) is allowed by RFC 3021 for the same purpose. /32 is for a single host route, not a network.

Why is /24 the most common block?

Historical and practical reasons. The "class C" network in the pre-CIDR world was 256 addresses. The default subnet mask for a small business or a small office was 255.255.255.0. That became the de facto smallest block, and even though CIDR allowed finer granularity, /24 remained the default for years. Today, /24 is still the most common block for VPN ranges, internal networks, and small cloud deployments.

How many addresses are in a /16?

2^16 = 65,536. With network and broadcast, 65,534 usable. The CIDR Subnet Calculator shows the full breakdown for any prefix.

Is there a CIDR for "any IPv4 address"?

Yes: 0.0.0.0/0. This is the standard "any" block. You will see it in firewall rules as "allow from any" and in routing tables as the default route.

Bottom line

CIDR notation is the standard way to write IP address ranges. The number after the slash is the prefix length — how many bits of the address are fixed. The math for any CIDR (network address, broadcast, mask, host range, host count) is the same every time, and the Uttir CIDR Subnet Calculator does it for you. Paste any IPv4 or IPv6 CIDR, get the full breakdown in your browser.