Understanding IP Addresses, Subnets, and CIDR Notation for Networking

An IP address identifies a device within a network, while a subnet represents a logical division of that network. CIDR notation describes the length of the network prefix by adding a slash and a number, such as 192.168.1.0/24. Knowing how IP addresses, subnets, and CIDR work together is essential when configuring servers, network infrastructure, cloud environments, and security policies. The relevant specifications include RFC 4632 for Classless Inter-Domain Routing and RFC 1918 for private IPv4 address space.

Before working with these topics, it is useful to understand basic networking terminology, interfaces, and protocols.

This guide explains IP-layer network addressing, including the structure of IPv4 addresses, address classifications, subnet masks, CIDR prefixes, Variable Length Subnet Masking (VLSM), and the way IPv6 applies slash-based prefixes to its 128-bit address space. Each section builds on the concepts introduced before it.

Key Takeaways

• An IPv4 address contains 32 bits and is commonly displayed as four decimal octets, such as 192.168.0.5. An IPv6 address contains 128 bits and is normally written as eight groups of four hexadecimal characters.
• A subnet mask separates the network portion of an IP address from its host portion. A mask of 255.255.255.0, equivalent to /24, means that the first 24 bits identify the network.
• For most IPv4 networks using prefixes from /0 through /30, the first address is the network address and the final address is the broadcast address. These two addresses cannot normally be assigned to hosts. Point-to-point networks using /31 are an exception under RFC 3021.
• CIDR notation combines an IP address with a prefix length, such as 10.0.0.0/8, without requiring the prefix to follow historical class boundaries.
• RFC 1918 specifies three private IPv4 ranges: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. These address ranges are not routed across the public internet.
• VLSM makes it possible to use different prefix lengths inside the same address space so that each subnet can be sized according to its requirements.
• IPv6 uses the same slash-based prefix notation as IPv4. A standard IPv6 subnet normally uses a /64 prefix, leaving 64 bits for addressing hosts.

What Is an IP Address?

An IP address is a numeric identifier assigned to a device connected to a network that uses the Internet Protocol. It identifies the host and indicates where that host is located within the network topology.

IPv4 Address Structure and Dot-Decimal Notation

An IPv4 address consists of 32 bits divided into four 8-bit sections. These sections are separated by periods and displayed as decimal values ranging from 0 through 255. Devices require addresses so that other systems can communicate with them, and at the network layer of the TCP/IP model this identifier is the IP address. Each 8-bit section is known as an octet.

A typical IPv4 address can be written as follows:

192.168.0.5

Each octet can have a minimum value of 0 and a maximum value of 255.

The same address can also be represented in binary. In this example, spaces separate groups of four bits and dashes separate the octets:

1100 0000 – 1010 1000 – 0000 0000 – 0000 0101

Understanding that the decimal and binary versions describe the same address is important when working with subnet masks and CIDR prefixes.

IP addresses allow resources to communicate through network interfaces. When one computer needs to exchange data with another, it sends that information toward the destination IP address. If both devices are part of the same network, or suitable intermediate networking devices can route or translate the traffic between networks, communication can take place.

Network Address Translation (NAT) can modify addressing information as packets travel across network boundaries. This allows identical private IP addresses to exist inside separate isolated networks while still allowing those networks to communicate externally when the necessary routing and translation are configured.

IPv4 Address Classes: A, B, C, D, and E

An IP address contains both a network portion and a host portion. The location of the boundary between these portions depends on the network configuration.

Historically, IPv4 addresses were separated into five classes called A, B, C, D, and E. The classes were determined by the leading address bits. The following table summarizes their boundaries, default masks, and traditional purposes.

Two sections of the historical Class A space are reserved and are not intended for normal host assignment. The range 0.0.0.0/8 represents the “this network” address space and can be used as a source before a host receives an address. The range 127.0.0.0/8 is reserved for loopback communication, allowing a host to communicate with and test its own networking stack. The address 127.0.0.1 is commonly used for this purpose.

Class D addresses are reserved for multicast communication, which allows packets to be delivered to a defined group of systems. Class E addresses are reserved for experimental purposes and remain largely unused.

Modern routing no longer relies on classful addressing. RFC 1519, introduced in 1993 and later updated by RFC 4632 in 2006, established CIDR as its replacement. CIDR allows prefix boundaries to appear at any bit position instead of requiring them to follow address classes. The class system remains useful mainly for historical understanding and traditional default-mask terminology.

Public and Private IP Addresses

IP addresses can be divided into public and private categories. Public addresses can be routed globally through the internet. Private IPv4 addresses are specified by RFC 1918 and are intended for use inside private networks.

Private address ranges do not appear as normal destination routes in the public internet routing system. As a result, packets addressed to private destinations cannot simply continue across the public internet after leaving their local environment. Systems using private addresses therefore rely on technologies such as NAT when they need outbound access to publicly routed networks.

The range 127.0.0.0/8 is dedicated to loopback communication so that a host can communicate with its own networking stack. Although 127.0.0.1 is the address most frequently used, the entire 127.0.0.0/8 range is reserved for this purpose.

For a complete overview of reserved IPv4 blocks, refer to the IANA IPv4 Special-Purpose Address Registry.

What Is a Subnet?

A subnet, short for subnetwork, is a logical section of a larger IP network. Subnetting divides a larger address block into multiple smaller blocks, each functioning as its own network segment.

Why Networks Use Subnets

Subnetting can reduce broadcast traffic, separate network areas for security purposes, and make it possible to allocate address capacity according to the number of hosts a segment actually requires rather than relying on fixed class sizes.

Broadcast domains provide a clear example of why subnetting is useful. In one large flat network, broadcasts such as ARP requests and DHCP discovery messages can reach every connected host. A flat /16 containing around 60,000 systems requires each system to process broadcasts generated throughout that network. If one device begins sending excessive broadcasts, performance across the entire segment can be affected. Dividing that /16 into /24 networks restricts each broadcast domain to roughly 254 hosts, preventing a broadcast problem in one segment from automatically affecting the others.

Subnets can also act as boundaries for network policy. Firewall rules, routing policies, and access restrictions can target address ranges. For example, a database segment using 10.10.2.0/24 can be configured to accept traffic only from a web segment using 10.10.1.0/24. Without distinct network ranges, those rules would not have a subnet boundary to target.

Subnetting also makes address allocation more efficient. A point-to-point connection may require only a /30 with two usable host addresses, while a larger user segment might use a /24 with 254 usable addresses. Different segments therefore do not need to consume equal-sized blocks. This principle forms the basis of VLSM.

Network Address and Host Address Explained

Every IP address contains two logical elements: a network portion and a host portion. The network portion identifies the subnet, while the host portion identifies a particular device inside that subnet.

Consider 192.168.0.15 on a /24 network. The network portion is 192.168.0, while the host portion is 15. The binary representation is:

1100 0000 – 1010 1000 – 0000 0000 – 0000 1111

The first 24 bits, corresponding to the first three octets, identify the network. The remaining 8 bits identify the host.

A bitwise AND operation between an IP address and its subnet mask removes the host bits and produces the network address:

1100 0000 – 1010 1000 – 0000 0000 – 0000 1111 (192.168.0.15)

AND

1111 1111 – 1111 1111 – 1111 1111 – 0000 0000 (255.255.255.0)

=

1100 0000 – 1010 1000 – 0000 0000 – 0000 0000 (192.168.0.0)

The resulting network address is 192.168.0.0. The host identifier is represented by 0000 1111, which corresponds to decimal value 15.

Broadcast Addresses and Their Purpose

The first address of a subnet is its network address, where every host bit is 0. The final address is its broadcast address, where every host bit is 1. Traffic sent to the broadcast address is delivered to all hosts in the subnet. Normally, neither the network address nor the broadcast address can be assigned to an individual host.

This rule applies to the first and final addresses of the actual subnet rather than simply to addresses ending in 0 or 255. For example, within 10.0.1.0/24, the network address is 10.0.1.0 and the broadcast address is 10.0.1.255. For 10.0.2.128/25, the network address is 10.0.2.128 and the broadcast address is 10.0.2.255.

What Is a Subnet Mask?

A subnet mask is a 32-bit value that determines which bits of an IPv4 address represent the network and which represent the host. Bits containing 1 in the mask identify network bits, while bits containing 0 identify host bits.

How Subnet Masks Work in Binary

The subnet mask associated with a /24 network is 255.255.255.0. Expressed in binary using four-bit groups, it appears as follows:

1111 1111 – 1111 1111 – 1111 1111 – 0000 0000

The first 24 bits are set to 1 and therefore identify the network. The final 8 bits are set to 0 and remain available for host addressing.

The following reference compares common prefix lengths with their binary and dotted-decimal subnet masks:

/8 → 11111111.00000000.00000000.00000000 → 255.0.0.0

/16 → 11111111.11111111.00000000.00000000 → 255.255.0.0

/24 → 11111111.11111111.11111111.00000000 → 255.255.255.0

/25 → 11111111.11111111.11111111.10000000 → 255.255.255.128

/26 → 11111111.11111111.11111111.11000000 → 255.255.255.192

/27 → 11111111.11111111.11111111.11100000 → 255.255.255.224

/28 → 11111111.11111111.11111111.11110000 → 255.255.255.240

/29 → 11111111.11111111.11111111.11111000 → 255.255.255.248

/30 → 11111111.11111111.11111111.11111100 → 255.255.255.252

To divide a /24 into two equally sized subnets, one additional host bit is converted into a network bit. The resulting prefix therefore contains 25 network bits:

1111 1111 – 1111 1111 – 1111 1111 – 1000 0000

This binary value equals the subnet mask 255.255.255.128 and corresponds to the prefix /25. It represents a mask rather than a network address. When applied to 192.168.0.0/24, the result is two separate subnets:

• Subnet 1: Network address 192.168.0.0, broadcast address 192.168.0.127, usable addresses 192.168.0.1 through 192.168.0.126, providing 126 usable hosts.
• Subnet 2: Network address 192.168.0.128, broadcast address 192.168.0.255, usable addresses 192.168.0.129 through 192.168.0.254, also providing 126 usable hosts.

Additional subnet bits can be borrowed from the host portion when more networks are required. Each additional bit doubles the number of available subnets while reducing the number of host addresses in each subnet by half.

Default Subnet Masks for Historical IP Classes

Under the older classful addressing model, each address class used a predefined subnet mask aligned with the class boundary:

With CIDR, these traditional defaults are informational rather than mandatory. Prefixes ranging from /0 through /32 can be used regardless of the historical class associated with the address.

Calculating Usable Hosts from a Subnet Mask

For a given IPv4 prefix, the total number of addresses in the subnet can be calculated as 2^(32 – prefix). For ordinary prefixes from /0 through /30, the usable host count is the total minus two because one address is used for the network and another for the broadcast.

For a /24, the calculation is 2^(32 – 24) = 2^8 = 256 total addresses. Subtracting the network and broadcast addresses leaves 254 usable host addresses.

For a /26, 2^(32 – 26) = 2^6 = 64 total addresses. Removing the two reserved addresses leaves 62 usable hosts.

A /31 is a special case defined by RFC 3021 for point-to-point links. Both addresses can be used because the normal network and broadcast designations are unnecessary. A /32 represents an individual host route.

When starting with a host requirement instead of a prefix, choose the smallest address block whose usable capacity is large enough:

For example, a network segment requiring 30 hosts needs a /27. A /28 offers only 14 usable addresses, while a /27 provides exactly 30.

What Is CIDR Notation?

CIDR, or Classless Inter-Domain Routing, represents a network address and its prefix length together. The prefix appears after the address and a forward slash. For example, 192.168.0.15/24 indicates that the first 24 bits belong to the network portion.

How CIDR Replaced Classful Addressing

CIDR replaced traditional classful addressing because fixed address classes wasted address space and contributed to rapidly expanding routing tables. Before CIDR, allocations had to follow predefined class sizes. A Class B network offered 65,534 usable host addresses even when an organization needed far fewer, while a Class C network provided only 254. This made it difficult to allocate appropriately sized blocks and encouraged the assignment of many individual Class C networks.

RFC 1519 introduced CIDR in 1993, and the concept was later updated and consolidated in RFC 4632 in 2006. CIDR permits allocations to use arbitrary prefix lengths so that address blocks can more closely match actual requirements. It also supports route aggregation, allowing multiple contiguous blocks to be summarized by a single broader prefix and thereby reducing routing-table size.

Reading a CIDR Block: Network Prefix and Host Bits

A CIDR block contains a network prefix and a host portion. The prefix length indicates the number of leading bits that remain fixed and identify the network. All remaining bits can vary to identify addresses inside that network.

For 192.168.0.0/24:

• Network prefix: the first 24 bits, represented by 192.168.0.
• Host portion: the final 8 bits, which can have values from 0 through 255 and therefore represent 256 total addresses.

For 10.0.0.0/8:

• Network prefix: the first 8 bits, represented by 10.
• Host portion: the remaining 24 bits, ranging from 0 through 16,777,215 and providing 16,777,216 total addresses.

CIDR Examples for /8, /16, /24, /26, and /30

Common CIDR blocks provide very different capacities. For example, 192.168.1.0/24 supports 254 usable hosts, 192.168.1.0/26 supports 62, and 10.0.0.112/30 supports 2. CIDR can also represent supernets, which combine adjacent address blocks into a broader routing prefix. For example, 192.168.0.0 and 192.168.1.0 are neighboring historical Class C networks. Instead of maintaining two routing entries, CIDR can summarize them as 192.168.0.0/23.

The first network, 192.168.0.0, can be written in binary as:

1100 0000 – 1010 1000 – 0000 0000 – 0000 0000

The second network, 192.168.1.0, is:

1100 0000 – 1010 1000 – 0000 0001 – 0000 0000

The /23 mask is:

1111 1111 – 1111 1111 – 1111 1110 – 0000 0000

Because 23 bits remain fixed, the 24th bit can contain either 0 or 1 while both networks still match the same prefix. The equivalent subnet mask is 255.255.254.0. CIDR therefore gives administrators more flexibility when representing contiguous ranges than traditional classful subnetting.

Additional examples include:

CIDR Reference Table: Prefix Lengths, Subnet Masks, and Host Counts

The table below contains every IPv4 prefix from /0 through /32, along with its subnet mask, total number of IP addresses, and usable host count. For prefixes from /0 through /30, the normal usable-host calculation is 2^(32 – prefix) – 2. The /31 exception specified by RFC 3021 allows both addresses to be used on point-to-point links, while /32 identifies a single host route.

How to Calculate Subnets and Host Ranges

Subnet calculations follow the same basic binary procedure: determine the prefix, apply the subnet mask to obtain the network address, set all host bits to 1 to determine the broadcast address, and identify the usable host addresses between these two boundaries.

Step-by-Step Example: Subnetting a /24 Network

Consider the network 192.168.1.0/24:

• Prefix length: 24 bits
• Subnet mask: 255.255.255.0
• Total addresses: 2^8 = 256
• Usable hosts: 254

The subnet mask in binary is:

1111 1111 – 1111 1111 – 1111 1111 – 0000 0000

Apply a bitwise AND operation to an address inside the network, such as 192.168.1.75, and the subnet mask:

1100 0000 – 1010 1000 – 0000 0001 – 0100 1011 (192.168.1.75)

AND

1111 1111 – 1111 1111 – 1111 1111 – 0000 0000 (255.255.255.0)

=

1100 0000 – 1010 1000 – 0000 0001 – 0000 0000 (192.168.1.0)

• Network address: 192.168.1.0, with every host bit set to 0.
• Broadcast address: 192.168.1.255, with every host bit set to 1.
• Usable range: 192.168.1.1 through 192.168.1.254.

Step-by-Step Example: Dividing a /24 into /26 Networks

A /26 prefix reserves 26 bits for the network and leaves 6 bits for hosts. Each /26 contains 2^6 = 64 total addresses, of which 62 are normally usable. Dividing 192.168.1.0/24 into /26 blocks produces four subnets:

The subnet boundaries appear at intervals of 64 addresses because 2^6 equals 64. The resulting network addresses therefore end in .0, .64, .128, and .192.

Using Binary to Identify Network and Host Portions

On a /26 network, the network-to-host boundary appears after bit 26. The final octet of the 255.255.255.192 subnet mask is 1100 0000. The first two bits of that octet belong to the network, while the final six belong to the host portion.

For the address 192.168.1.130 inside the third /26 subnet:

1100 0000 – 1010 1000 – 0000 0001 – 1000 0010 (192.168.1.130)

AND

1111 1111 – 1111 1111 – 1111 1111 – 1100 0000 (255.255.255.192)

=

1100 0000 – 1010 1000 – 0000 0001 – 1000 0000 (192.168.1.128)

The resulting network address is 192.168.1.128. The host portion of the final octet is 00 0010, representing host number 2 inside that subnet.

Verifying Subnet Calculations with ipcalc

ipcalc is a command-line subnet calculator that can perform subnet calculations and show the binary representation of an address. On Ubuntu and Debian systems, it can be installed with:

sudo apt install ipcalc

To check the /24 network used in the previous example, run:

ipcalc 192.168.1.0/24

Output:

Address: 192.168.1.0 11000000.10101000.00000001. 00000000

Netmask: 255.255.255.0 = 24 11111111.11111111.11111111. 00000000

Wildcard: 0.0.0.255 00000000.00000000.00000000. 11111111

=>

Network: 192.168.1.0/24 11000000.10101000.00000001. 00000000

HostMin: 192.168.1.1 11000000.10101000.00000001. 00000001

HostMax: 192.168.1.254 11000000.10101000.00000001. 11111110

Broadcast: 192.168.1.255 11000000.10101000.00000001. 11111111

Hosts/Net: 254 Class C, Private Internet

The spacing inside the binary columns marks the boundary between the network and host portions. HostMin identifies the first usable address, HostMax identifies the last usable address, and Broadcast confirms the subnet’s upper boundary.

To check the /26 subnet, run:

ipcalc 192.168.1.0/26

Output:

Address: 192.168.1.0 11000000.10101000.00000001.00 000000

Netmask: 255.255.255.192 = 26 11111111.11111111.11111111.11 000000

Wildcard: 0.0.0.63 00000000.00000000.00000000.00 111111

=>

Network: 192.168.1.0/26 11000000.10101000.00000001.00 000000

HostMin: 192.168.1.1 11000000.10101000.00000001.00 000001

HostMax: 192.168.1.62 11000000.10101000.00000001.00 111110

Broadcast: 192.168.1.63 11000000.10101000.00000001.00 111111

Hosts/Net: 62 Class C, Private Internet

The command ipcalc 192.168.1.0/24 --split 62 62 62 62 divides the parent /24 into sequential networks large enough for the specified host requirements. It outputs a complete calculation for each resulting subnet. The resulting four /26 networks are:

This makes the --split option useful when planning VLSM allocations based on the number of hosts required by each segment.

Viewing an Interface CIDR Assignment on Linux

The address and prefix calculated for a subnet are the same values that a Linux system displays for its network interface. Use ip addr show to inspect the CIDR assignment directly:

ip addr show eth0

Output:

2: eth0: <broadcast,multicast,up,lower_up> mtu 1500 qdisc fq_codel state UP group default qlen 1000

link/ether 9a:1c:3e:7b:0a:11 brd ff:ff:ff:ff:ff:ff

inet 10.10.1.5/24 brd 10.10.1.255 scope global eth0

valid_lft forever preferred_lft forever

The line inet 10.10.1.5/24 contains the host address together with its /24 prefix. The value brd 10.10.1.255 identifies the broadcast address and matches the boundaries that can be calculated manually. To inspect the routes created by the Linux kernel from those prefixes, use:

ip route

Output:

default via 10.10.1.1 dev eth0 proto static

10.10.1.0/24 dev eth0 proto kernel scope link src 10.10.1.5

The 10.10.1.0/24 entry represents the local subnet route created from the interface’s CIDR assignment. The default via route sends destinations outside that local network toward the configured gateway.

Private IP Address Ranges and RFC 1918

Private IPv4 addresses are non-public address blocks defined by RFC 1918. Internet routers do not normally forward traffic using these private address ranges as publicly routed destinations. Systems using private addresses therefore require NAT when they need to communicate externally.

10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16

RFC 1918 defines three private IPv4 address ranges:

Historically, these ranges corresponded broadly to Class A, B, and C address boundaries. With CIDR, they are normally described using the CIDR blocks defined by RFC 1918. The class-based interpretation remains relevant only as historical context.

When to Use Private and Routable Addresses

Private addressing is suitable for internal systems such as application servers, database servers, internal APIs, and other endpoints that do not need to be directly reachable from the public internet. Publicly routable addresses are normally reserved for internet-facing components such as load balancers, gateways, and edge proxies.

Systems using private addresses require NAT when initiating connections toward the public internet. A NAT gateway replaces the private source address with a public address while forwarding outbound packets and performs the reverse translation when the response traffic returns.

Cloud private networks commonly allocate internal address space from RFC 1918 ranges. If a private network is created with 10.10.0.0/16, resources placed within that network can receive private addresses from the selected address block.

Variable Length Subnet Masking (VLSM)

Variable Length Subnet Masking is the practice of assigning different prefix lengths to different subnets within the same overall address space. Because CIDR removes fixed class boundaries, VLSM allows each subnet to be sized according to its actual requirements instead of forcing every segment to use the same block size.

What VLSM Is and Why It Matters

VLSM allows multiple subnets inside one address space to use different prefixes. A network requiring 50 hosts can therefore receive a larger block than a point-to-point link requiring only two hosts. Without variable-length subnetting, both segments would have been forced to consume address blocks of the same size.

VLSM is closely related to the /23 supernet example described earlier. Supernetting combines contiguous blocks upward into a broader prefix for route aggregation. VLSM works in the opposite direction by dividing a larger address block into smaller prefixes suited to individual requirements. Both approaches depend on CIDR’s removal of traditional class boundaries.

VLSM Practical Example

Consider dividing 10.0.0.0/24 into networks for four different segments:

The Engineering allocation can be checked using:

ipcalc 10.0.0.0/26

Output:

Address: 10.0.0.0 00001010.00000000.00000000.00 000000

Netmask: 255.255.255.192 = 26 11111111.11111111.11111111.11 000000

Wildcard: 0.0.0.63 00000000.00000000.00000000.00 111111

=>

Network: 10.0.0.0/26 00001010.00000000.00000000.00 000000

HostMin: 10.0.0.1 00001010.00000000.00000000.00 000001

HostMax: 10.0.0.62 00001010.00000000.00000000.00 111110

Broadcast: 10.0.0.63 00001010.00000000.00000000.00 111111

Hosts/Net: 62 Class A, Private Internet

The same calculation can be performed for each subnet in the VLSM allocation table to verify the usable address range and broadcast boundary before the configuration is applied.

After allocating these four networks, addresses from 10.0.0.116 through 10.0.0.255 remain unallocated and can be reserved for future network segments.

When selecting a prefix according to a host requirement, use the host-capacity relationships described earlier in the subnet-mask calculation table.

IPv6 and CIDR Notation

IPv6 applies the same slash-based prefix notation used by IPv4 CIDR to addresses containing 128 bits. The ideas of a network prefix, host portion, and subnet boundary therefore continue to apply.

How IPv6 Addresses Are Structured

An IPv6 address is 128 bits long and is written as eight groups containing four hexadecimal characters separated by colons. Hexadecimal notation uses the digits 0 through 9 and the letters a through f to represent values from 0 through 15. A typical IPv6 address looks like this:

1203:8fe0:fe80:b897:8990:8a7c:99bf:323d

IPv6 was developed to succeed IPv4 after the limits of the 32-bit IPv4 address space became a major constraint. Its 128-bit address space contains approximately 3.4 × 10^38 addresses, more than 7.9 × 10^28 times the total IPv4 address space.

IPv6 supports abbreviated notation. Leading zeros inside a group can be removed. For example:

…:00bc:…

can be shortened to:

…:bc:…

A continuous sequence of groups containing only zeros may also be replaced once by a double colon, ::. For example:

…:18bc:0000:0000:0000:00ff:…

can be shortened to:

…:18bc::ff:…

The :: abbreviation can appear only once in a single IPv6 address. Using it more than once would make it impossible to determine exactly how many zero groups were removed from each location.

The subnet calculations in this guide primarily use IPv4 because its smaller address space makes binary examples easier to follow. The underlying principles also apply to IPv6.

CIDR Notation in IPv6 Networks

IPv6 uses the same slash notation as IPv4. The number following the slash specifies how many of the leading 128 bits form the fixed network prefix.

Common IPv6 CIDR examples include:

• 2001:db8::/32 is the documentation prefix defined by RFC 3849. It is intended for documentation and examples rather than public internet routing.
• 2001:db8:1::/48 represents a typical site-level allocation. A network provider might allocate a /48 to a site, leaving 16 bits available for that site to create as many as 65,536 separate /64 subnets.
• 2001:db8:1:1::/64 represents a standard individual IPv6 subnet.

The standard IPv6 prefix for an individual subnet is /64. This reserves 64 bits for host addressing and provides 2^64 addresses within the subnet. Stateless Address Autoconfiguration (SLAAC) and many DHCPv6 configurations depend on a /64 prefix.

Dividing an IPv6 allocation into subnets works according to the same principle as IPv4: bits are taken from the host portion and used as subnet bits. The difference is the much larger scale. If a site receives 2001:db8:1::/48, the first 48 bits remain fixed. Using the normal /64 subnet size leaves bits 49 through 64, or 16 bits, for subnet numbering. This allows 2^16 = 65,536 possible /64 networks:

2001:db8:1:0000::/64 first subnet

2001:db8:1:0001::/64 second subnet

2001:db8:1:0002::/64 third subnet

…

2001:db8:1:ffff::/64 last subnet (65,536th)

The fourth hextet, ranging from 0000 through ffff, acts as the subnet identifier. Each resulting /64 still contains 2^64 host addresses. Unlike IPv4, IPv6 LANs are therefore not normally subdivided below /64 simply to conserve host addresses. Networks generally stop at /64 because SLAAC and many DHCPv6 deployments depend on this size, although point-to-point connections are often addressed with prefixes such as /127.

Key Differences Between IPv4 and IPv6 Subnetting

IPv6 Unique Local Addresses, or ULA, are defined within fc00::/7 by RFC 4193. They serve a role comparable to private IPv4 addressing because they are intended for internal communication within a site or organization rather than global routing.

Practical Applications of Subnetting and CIDR

Subnetting and CIDR are used directly when configuring practical infrastructure, including private cloud networks, office environments, and large-scale internet routing.

Subnetting a Cloud Private Network

A cloud Virtual Private Cloud, or VPC, can be defined using a private CIDR address block selected when the network is created. For example, a production VPC could use the address range 10.10.0.0/16.

Virtual machines, load balancers, managed databases, and other resources connected to this private network can receive private addresses from the 10.10.0.0/16 block.

Cloud platforms can differ in how they expose subnet objects. In an environment where a VPC is represented primarily by one larger CIDR block rather than separately provisioned subnet objects, ranges inside the block can still be treated as logical network tiers. Firewall policies, resource labels, tags, and other access controls can then enforce those logical boundaries.

CIDR ranges can then be used to define firewall scope. For example, a rule for the data tier can allow PostgreSQL traffic on port 5432 only from the web network 10.10.1.0/24 while traffic from unrelated ranges remains blocked.

This type of rule allows inbound traffic on 5432 only from 10.10.1.0/24, excluding other ranges such as the monitoring network. The exact firewall configuration syntax depends on the networking platform and command-line tooling being used.

Another important requirement is that connected networks must not use overlapping CIDR blocks. If one private network uses 10.10.0.0/16 and another connected network also uses 10.10.0.0/16, routing becomes ambiguous because identical destination addresses exist in both environments. Networks that will communicate through peering, VPN connections, or other routing mechanisms should therefore receive separate non-overlapping RFC 1918 blocks, such as 10.10.0.0/16 for one network and 10.20.0.0/16 for another.

Subnetting a Home or Office Network

Many home networks use address ranges such as 192.168.1.0/24 or 192.168.0.0/24, each of which provides 254 usable IPv4 host addresses. This capacity is generally sufficient for a typical household.

A small office that needs separate segments for employee devices, guest Wi-Fi, and IoT equipment can divide one /24 into several /26 networks:

• Staff: 192.168.1.0/26, providing 62 usable hosts.
• Guest Wi-Fi: 192.168.1.64/26, providing 62 usable hosts.
• IoT devices: 192.168.1.128/26, providing 62 usable hosts.

The remaining 192.168.1.192/26 block can be kept available for future expansion or management interfaces.

How Routers Use CIDR for Route Aggregation

Routers use CIDR to advertise one covering prefix for a contiguous collection of networks instead of advertising every smaller network independently. This reduces the total number of routing entries required. Without aggregation, a network operator responsible for 256 individual /24 networks could require 256 separate routing entries. If those networks form one contiguous range, CIDR allows them to be represented by a single broader block.

The earlier /23 example demonstrates this principle. The prefix 192.168.0.0/23 covers both 192.168.0.0 and 192.168.1.0, allowing them to appear as a single routing entry.

This process is known as route summarization and plays an important role in keeping global internet routing scalable. The Border Gateway Protocol (BGP) uses CIDR and longest-prefix matching when selecting the most specific available route for a destination.

Frequently Asked Questions

What Is the Difference Between a Subnet Mask and a CIDR Prefix?

A subnet mask and a CIDR prefix describe the same network boundary using different notation. The subnet mask 255.255.255.0 and the prefix /24 both indicate that the first 24 bits of the IP address identify the network. A CIDR prefix is simply the number of consecutive 1-bits in the binary representation of a subnet mask. To convert a mask into a prefix, count those leading 1-bits. To convert a prefix into a mask, represent the prefix as that number of 1-bits followed by enough 0-bits to reach 32 bits.

How Many Usable Hosts Does a /24 Subnet Have?

A /24 contains 256 total IPv4 addresses because eight bits remain available for host addressing. Under normal subnetting rules, two addresses are reserved: the first address is the network address and the final address is the broadcast address. This leaves 254 usable host addresses, normally ranging from .1 through .254 in the final octet.

What Is the Difference Between a Public and a Private IP Address?

Public IP addresses can be routed globally across the internet. Private IPv4 addresses are reserved by RFC 1918 for use inside private networks. The three private ranges are 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. A host using a private address normally communicates with the public internet through a NAT gateway, which substitutes a public source address when forwarding outbound traffic.

Why Was CIDR Introduced?

CIDR was introduced in 1993 through RFC 1519 and was later updated by RFC 4632. It addressed two major limitations of classful IP addressing. One problem was the rapid consumption of Class B networks, which were much larger than most organizations needed but were the only traditional option between relatively small Class C blocks and very large Class A networks. The other problem was the rapid growth of internet routing tables as large numbers of individual Class C networks were advertised separately. CIDR made arbitrary prefix lengths possible and enabled route aggregation to reduce the number of routing entries.

What Is VLSM and How Does It Relate to CIDR?

Variable Length Subnet Masking (VLSM) means applying different subnet prefix lengths to different subnets within the same overall address space. CIDR makes this possible by removing fixed class boundaries. Administrators can therefore allocate address space according to the actual host requirements of each subnet rather than assigning every subnet an identical block size. VLSM is a network-design method rather than a separate networking protocol.

How Does IPv6 Use CIDR Notation?

IPv6 uses the same forward-slash prefix format as IPv4. For example, 2001:db8::/32 indicates that the first 32 bits form the network prefix. Because IPv6 addresses contain 128 bits, a standard /64 subnet leaves another 64 bits for host addressing, providing 2^64 addresses. IPv6 also defines Unique Local Addresses in the fc00::/7 range under RFC 4193 for internal addressing.

What Is the Difference Between a Network Address and a Broadcast Address?

The network address is the first IP address in an IPv4 subnet and has every host bit set to 0. It identifies the subnet itself and is not normally assignable to an individual host. The broadcast address is the final address in the subnet and has every host bit set to 1. Traffic directed to the broadcast address is delivered to all hosts in that subnet, so this address also cannot normally be assigned to a host. These rules apply to the first and final addresses within the specific subnet rather than to every address whose final octet happens to be 0 or 255.

How Do I Calculate Which Subnet an IP Address Belongs To?

Perform a bitwise AND operation between the IP address and its subnet mask. The result is the network address for the subnet containing that IP. For example, applying the mask 255.255.255.0 to 192.168.10.75 produces 192.168.10.0, meaning that the address belongs to 192.168.10.0/24. With a narrower mask such as 255.255.255.192, equivalent to /26, the same operation determines which of the four /26 networks inside the parent /24 contains the address.

Conclusion

This guide covered IP addressing from its basic structure through subnetting and CIDR. IPv4 addresses contain 32 bits and use dot-decimal notation. Historically, they were grouped into five address classes, while subnet masks established the boundary between the network and host portions through binary operations such as bitwise AND. CIDR, standardized in RFC 4632, replaced rigid class boundaries with arbitrary prefix lengths and made efficient address allocation and route aggregation possible. VLSM extends this flexibility by allowing different subnet sizes inside one address space, while IPv6 applies the same prefix concept to 128-bit addresses and commonly uses a /64 prefix for each subnet.

With these concepts, subnet allocations can be designed for networks of different sizes, host and broadcast ranges can be derived using binary calculations, CIDR prefixes can be interpreted in routing and firewall configurations, and the purpose of RFC 1918 private address space and NAT can be understood more clearly.

For interactive subnet calculations, CIDR.xyz can convert between decimal IP addresses and binary octets while visualizing CIDR netmasks. Networking terminology, interfaces, and protocols provide additional background for these concepts, while the documentation for the networking platform being used can provide details about CIDR block selection, private network configuration, and firewall rules.