Subnetting & CIDR

An IPv4 address is 32 bits, written as four 8-bit octets (192.168.1.130). CIDR notation adds a prefix - /26 - that says how many of those leading bits identify the network. The rest identify the host inside that network.

The prefix splits the bits

The /n prefix draws a line through the 32 bits. Everything left of the line is fixed for every address in the network; everything right of it is free to number individual hosts. A larger prefix means more network bits, fewer hosts.

Drag the slider below and watch the line move:

network bitshost bits

...

Prefix: /26

11000000

10101000

00000001

10000010

Network address	192.168.1.128/26
Broadcast address	192.168.1.191
First usable host	192.168.1.129
Last usable host	192.168.1.190
Usable hosts	62

Reading the results

• Network address - all host bits set to 0. The name of the network itself.
• Broadcast address - all host bits set to 1. Reaches every host at once.
• Usable hosts - everything between network and broadcast. For a /n that is 2^(32-n) - 2 (the -2 drops the network and broadcast addresses).

Why -2, and the special cases

Normal subnets reserve the network and broadcast addresses, so a /24 gives 256 - 2 = 254 usable hosts. Two prefixes break the rule:

• /31 - point-to-point links use both addresses (RFC 3021), so 2 usable.
• /32 - a single host, 0 usable range. Common for a route to one machine.

Worked example: carving a /24 into four /26 blocks

Take 172.16.5.0/24 and split it into four equal /26 subnets. A /26 has 32 - 26 = 6 host bits, so each block spans 2^6 = 64 addresses. The extra two bits borrowed from the host range (/24 -> /26) live in the last octet, so each block is a run of 64 consecutive values in that octet:

Block	Network address	Usable range	Broadcast address
1	172.16.5.0/26	172.16.5.1 - 172.16.5.62	172.16.5.63
2	172.16.5.64/26	172.16.5.65 - 172.16.5.126	172.16.5.127
3	172.16.5.128/26	172.16.5.129 - 172.16.5.190	172.16.5.191
4	172.16.5.192/26	172.16.5.193 - 172.16.5.254	172.16.5.255

Each block has 64 - 2 = 62 usable hosts, and the four blocks partition the original 256 addresses exactly (4 × 64 = 256) with no overlap and no gaps - the defining property of a clean CIDR split.

⚠Mismatched masks make two hosts silently unreachable

Subnet membership is defined by the mask, not just the address, so two hosts with addresses that look "close" can be on different subnets if their masks disagree. 172.16.5.100/26 and 172.16.5.140/26 look like neighbors, but .100 falls in block 2 (172.16.5.64/26) while .140 falls in block 3 (172.16.5.128/26) - they are on different subnets and can only reach each other through a router, not directly. A common real-world variant: someone manually configures a host with /24 while the rest of the subnet uses /26. That host believes it can reach all 254 addresses in 172.16.5.0/24 directly at Layer 2 and never sends an ARP-then-router path for the ones outside its actual /26 block - traffic to those addresses silently blackholes instead of routing correctly, and the fix (correcting the mask) is easy to miss because the host's own connectivity looks fine.

Try these

• 10.0.0.0/8 - a huge private network (over 16 million hosts).
• 172.16.5.130/26 - carve a /24 into four /26 blocks of 62 hosts each.
• 192.168.1.1/32 - a single-host route.