Subnet Mask and CIDR Explained

A subnet mask tells a device which part of an IPv4 address identifies the network and which part identifies the host. CIDR notation writes the same information as a slash and a number, for example /24, which means the first 24 bits are the network part. The mask 255.255.255.0 and the prefix /24 are two ways to write the same thing.

A mask in binary

An IPv4 address has 32 bits. A subnet mask is a row of 1 bits followed by a row of 0 bits. The 1 bits mark the network part and the 0 bits mark the host part. The prefix length is the number of 1 bits.

/24  11111111.11111111.11111111.00000000  = 255.255.255.0
/26  11111111.11111111.11111111.11000000  = 255.255.255.192
/20  11111111.11111111.11110000.00000000  = 255.255.240.0

Each octet of the mask has one of nine values: 0, 128, 192, 224, 240, 248, 252, 254 or 255. They are the sums of the bits from the left: 128, 128+64=192, 192+32=224, and so on.

The number of host bits is 32 - prefix. A subnet has 2^(host bits) addresses in total. Normally two are not usable: the first is the network address and the last is the broadcast address. So the usable count is 2^(host bits) - 2.

Worked example: 192.168.10.37/26

Find the network, broadcast and host range of 192.168.10.37/26.

1. The mask is 255.255.255.192. Only the last octet is partly used.
2. The block size is 256 - 192 = 64. Subnets in the last octet start at 0, 64, 128 and 192.
3. The value 37 lies between 0 and 63, so the subnet starts at 0.

Item	Value
Network address	192.168.10.0
First usable host	192.168.10.1
Last usable host	192.168.10.62
Broadcast address	192.168.10.63
Total addresses	64 (26)
Usable hosts	62

You can check the result with a bitwise AND: the network address is the address AND the mask. In the last octet, 37 is 00100101 and 192 is 11000000; the AND is 00000000, which is 0. You can verify any example with the subnet calculator.

CIDR cheat sheet from /8 to /32

CIDR	Subnet mask	Total addresses	Usable hosts
/8	255.0.0.0	16,777,216	16,777,214
/9	255.128.0.0	8,388,608	8,388,606
/10	255.192.0.0	4,194,304	4,194,302
/11	255.224.0.0	2,097,152	2,097,150
/12	255.240.0.0	1,048,576	1,048,574
/13	255.248.0.0	524,288	524,286
/14	255.252.0.0	262,144	262,142
/15	255.254.0.0	131,072	131,070
/16	255.255.0.0	65,536	65,534
/17	255.255.128.0	32,768	32,766
/18	255.255.192.0	16,384	16,382
/19	255.255.224.0	8,192	8,190
/20	255.255.240.0	4,096	4,094
/21	255.255.248.0	2,048	2,046
/22	255.255.252.0	1,024	1,022
/23	255.255.254.0	512	510
/24	255.255.255.0	256	254
/25	255.255.255.128	128	126
/26	255.255.255.192	64	62
/27	255.255.255.224	32	30
/28	255.255.255.240	16	14
/29	255.255.255.248	8	6
/30	255.255.255.252	4	2
/31	255.255.255.254	2	2 (point-to-point links, RFC 3021)
/32	255.255.255.255	1	1 (a single host)

Wildcard masks

A wildcard mask is the inverse of a subnet mask: every bit is flipped. Where the subnet mask has a 1, the wildcard has a 0, and the other way round. Routers and firewalls (for example Cisco access lists and OSPF network statements) use wildcard masks, where a 0 bit means "must match" and a 1 bit means "any value".

• /24, mask 255.255.255.0 gives wildcard 0.0.0.255
• /26, mask 255.255.255.192 gives wildcard 0.0.0.63
• /20, mask 255.255.240.0 gives wildcard 0.0.15.255

A quick way to compute it: subtract each octet of the mask from 255.

Splitting a /24 into four /26 subnets

Take the documentation network 198.51.100.0/24. Adding two bits to the prefix gives 2² = 4 subnets of 64 addresses each.

Subnet	Network	Usable range	Broadcast
1	198.51.100.0/26	198.51.100.1 – 198.51.100.62	198.51.100.63
2	198.51.100.64/26	198.51.100.65 – 198.51.100.126	198.51.100.127
3	198.51.100.128/26	198.51.100.129 – 198.51.100.190	198.51.100.191
4	198.51.100.192/26	198.51.100.193 – 198.51.100.254	198.51.100.255

The four subnets together hold 4 × 62 = 248 usable hosts, compared with 254 in the single /24. The difference of six addresses is the extra network and broadcast addresses. Subnetting is useful to separate departments, servers and guest Wi-Fi, and to limit broadcast traffic.

IPv6 prefix conventions

IPv6 uses the same slash notation, but the planning rules are different. Because the address space is huge, you do not count hosts. Common conventions are:

• /64 for every normal local network (LAN). Features such as SLAAC (automatic address configuration) need a 64-bit host part. Do not use a longer prefix on a normal LAN.
• /56 or /48 for a customer or a site. A /48 contains 65,536 networks of /64, and a /56 contains 256.
• /32 is a typical allocation for an internet provider, and 2001:db8::/32 is the documentation range.
• /128 is a single address, like /32 in IPv4.

For example, a site with 2001:db8:abcd::/48 can use 2001:db8:abcd:1::/64 for one VLAN and 2001:db8:abcd:2::/64 for the next one.

Related reading

For the basics of addresses, read what an IP address is. To calculate any network quickly, use the subnet calculator.