CIDR notation explained: what /24, /26 and the rest actually mean

CIDR is short for Classless Inter-Domain Routing, which is an unhelpful name for something quite simple. The thing to hold onto is that a prefix is a boundary: it says where the network part of an address stops and the host part begins. Move the boundary left and you get fewer, larger networks. Move it right and you get more, smaller ones.

Where the boundary sits

An IPv4 address is 32 bits, written as four 8-bit octets in decimal because humans are bad at reading 32 binary digits. The prefix simply marks a cut point in that bit string.

Doing it in your head

In an exam, and in a change window at eleven at night, you will not have a calculator. Three steps get you everything:

1. Host bits = 32 − prefix. A /27 leaves 5.
2. Block size = 2^{host bits}. 2⁵ = 32. This is also how far apart consecutive subnets sit, which is the number you actually use most.
3. Usable hosts = block size − 2. 32 − 2 = 30.

The block size is the one worth internalising. For a /27, subnets start at .0, .32, .64, .96 and so on. Asked which subnet 192.168.1.100/27 belongs to, you count up in 32s — 0, 32, 64, 96 — stop before passing 100, and the answer is 192.168.1.96/27, broadcast .127. No binary conversion required.

The mask octet is 256 minus the block size. Block size 32 gives 224, so a /27 is 255.255.255.224. That subtraction saves you from memorising the mask column entirely.

The prefixes you will actually meet

That is the working set. For every prefix from /1 to /32 with wildcard masks alongside, use the subnet mask cheat sheet.

Two entries surprise people. A /31 gives two usable addresses rather than zero — RFC 3021 dispensed with network and broadcast addresses on point-to-point links, where nobody needs them, so a serial or routed link can use a /31 instead of wasting half a /30. And a /32 is a single address: that is what a loopback interface carries, and what an ACL means when it matches one host.

Why classes had to go

Before 1993, the boundary could only sit at /8, /16 or /24 — Class A, B or C — decided by the address's leading bits. An organisation needing 300 addresses did not fit a Class C's 254, so it was allocated a Class B: 65,534 addresses, of which roughly 65,200 sat unused forever. Multiply that across every mid-sized company on the internet and you can see why IPv4 exhaustion arrived decades early.

CIDR let the boundary land anywhere, so that organisation now gets a /23 — 510 addresses, roughly what it asked for. Just as importantly it enabled aggregation: a provider holding sixteen consecutive /24s can advertise them upstream as one /20, so the global routing table carries one entry instead of sixteen. Without that, internet routers would have run out of memory long ago.

Where you will type it

Cisco IOS is inconsistent about this, which trips up newcomers. Interface addressing wants a dotted-decimal mask; most other commands want a prefix:

R1(config)# interface GigabitEthernet0/1
R1(config-if)# ip address 192.168.1.1 255.255.255.192      ← dotted-decimal here

R1(config)# ip route 10.20.0.0 255.255.0.0 192.168.1.2     ← and here

R1# show ip route
      192.168.1.0/24 is variably subnetted, 2 subnets, 2 masks
C        192.168.1.0/26 is directly connected, GigabitEthernet0/1   ← prefix here

Cloud consoles, firewall rules and ACL summarisation all use prefix notation, so in practice you convert between the two constantly. Hence the 256-minus-block-size trick.